Keynote: Securing JavaScript
summary
npm suffers account takeovers of popular modules: ua-parser-js (7.5M weekly downloads, 1,200 dependents) took 9 hours to remove, later rc (13M) and koa (9M) were removed in 15 and 30 minutes after rolling out malware scanning and an on-call alert for high-impact packages. Measures include login verification via email OTP, phased 2FA enforcement with limbo mode, WebAuthn, improved account recovery, reuse of package signatures (re-signed with ECDSA) after an AWS exfiltration, and a CLI verifier coming soon; adoption is ~90% top-100, ~83% top-500, ~70% high-impact.
AI-written summary · about
chapters (11)
- 0:00Introduction and welcome
- 1:04npm and supply chain threats
- 3:10Account takeover attacks timeline
- 5:55npm security road map goals
- 8:00Login verification rollout
- 9:23Two-factor authentication enforcement
- 12:50Improved 2FA experience
- 14:59Account recovery improvements
- 16:44OAuth token breach incident
- 18:31Package integrity validation
- 19:15Future security investments
related talks
20mKeynote: Securing JavaScript
41mMalicious Modules on npm - a series of unfortunate events
47mBlack Clouds and Silver Linings in Node.js Security
23mSecuring the npm Ecosystem
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
28mnpm Security: Key Threats & Real Cases | Anastasiya Egorova #JSConfAM25
31mWhat's Going on Inside the Node_Modules Folder
23mProtecting Your npm Dependencies