StrangerDanger: Finding Security Vulnerabilities Before They Find You

on YouTube ↗27m

" summary

A hands-on runthrough shows a sample app Goof sample app with exploitable dependencies and demonstrates real attacks (event-stream, a get-cookies command-and-control hidden via a dependency pyramid, mailparser compromise), specific vulnerabilities in marked (XSS) and dust (server-side code injection), and concrete mitigations. Claims include NPM scale (>1M packages), 61% potentially abandoned packages, average of four levels deep of transitive deps and that 78% indirect dependency vulnerabilities hit projects; tooling and upgrade strategies that actually fix, not just report, are exercised and evaluated.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 5:18Mental Exercise
3. 10:49Markdown
4. 15:31Template Templating on the Server
5. 24:25Enabling 2fa

" related talks

• 24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · JSConf Budapest 2019
• 35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · DevDays Europe 2019
• 37mStranger Danger: Finding Security Vulnerabilities Before They Find You!Liran Tal · Node.js Global Summit 2020
• 34mStranger Danger: Finding Security Vulnerabilities Before They Find You!Liran Tal · Voxxed Days Frontend Bucharest 2019
• 14mStranger Danger: Tracking Vulnerabilities in Your Third Party CodeGuy Podjarny, Assaf Hefetzz · Velocity Conference Amsterdam 2015
• 40mSecuring your dependenciesNina Juliadotter · NDC Sydney 2018
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 44mSlaying the Dragons: A Security Professional’s Guide to...Kirill Boychenko · BSidesSF 2025