Responsible Use of Node.js & Open Source Software Utilizing Best Practices at an...
summary
Capital One enforces concrete controls: production systems use only LTS Node.js, minor releases lag two weeks and accept security releases same day, and end‑of‑life versions are deprecated on Node’s schedule. Builds derive from centrally maintained golden images (minimal Docker runtimes kept vulnerability‑free), dependencies are locked and scoped, and an internal npm registry plus CVE thresholds block releases until remediation. Automated scanners and auto‑remediation PRs reduce developer toil and feed dashboards for time‑to‑fix reporting.
AI-written summary · about
chapters (6)
- 0:00Start
- 7:06Example of a Supply Chain Attack Substitution Attack
- 11:53Be Intentional on Node.js Version Usage The life cycle stages of version acceptance
- 24:47Track Package Usage A Software Bill of Materials (SBOM) helps audit usage
- 28:35Evaluate packages before use Tools and processes can assist in detecting issues early
- 32:40Npm Package Developer Best Practices Developers can protect themselves to a degree
related talks
47mImproving the Security of a Large Open Source Project One Step at a Time
48mImproving the Security of a Large Open Source Project One Step at a Time- 48mImproving the Security of a Large Open Source Project One Step...
33mNode.js Versions - How Do They Work?
27mState of Node.js Security
30mThe Life and Times of a Node.js Release
19mConsuming Open-source: A maintainer's perspective
29mNode.js: The New and the Experimental