Securing Your Software Supply Chain
summary
JavaScript supply chain shows concrete risks: npm hosts ~3 million packages and 219 billion monthly downloads, projects average 683 transitive dependencies with ~75% of vulnerabilities hidden deep, and attacks rose ~742%. Package managers resolve dependencies differently—one create‑react-app install yields seven direct deps but ~1,200 transitive deps with yarn, a ~850‑dependency gap across managers—causing nondeterminism. Practical fixes include lockfiles, owning scopes, mandatory 2FA, using time‑travel features and the npm query selector for inspecting node_modules.
AI-written summary · about
chapters (4)
- 0:00Start
- 24:41Mutable Package References
- 31:48Cryptography & Artifact Signatures
- 39:02Key: Imagine a world with a... Standardized Package Resolution Algorithm & Query Selector Syntax
related talks
41mThe Future of JavaScript Package Management- 41mThe Future of JavaScript Package Management
23mProtecting Your npm Dependencies
26mHow npm is Making JavaScript Safe For Everyone
16mAre We Forever Doomed to Software Supply Chain Security?
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
29mAll your packages are belong to us - Protecting your npm dependencies
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?