title	conference	date
These Aren't the Tools You're Looking For: MCP Security Awakens	AI Native DevCon Fall 2025	2025-11-18
MCP ecosystem yields concrete attacks: a malicious tool description can exfiltrate credentials by baking a bearer token into a webfetch call; insecure MCP… Talk on
Backend/Fullstack Development With JavaScript	JSNation US 2025	2025-11-17
-- no description -- Talk on
Weaponizing LLMs to Hack JavaScript AI Applications	JSNation US 2025	2025-11-17
Developers have gone full-steam from traditional programming to AI code assistants and vibe coding but where does that leave application security? What are the… Talk on
Hacking AI Applications	CityJS London 2025	2025-04-23
Generative-AI code and integrations produce concrete vulnerabilities: a February 2025 study of ~733 snippets finds ~25% of JavaScript lines vulnerable and only… Talk on
Friend or Foe? TypeScript Security Fallacies	Voxxed Days Bucharest 2025	2025-03-27
TypeScript gives compile‑time safety but not runtime guarantees: an Express + TypeScript demo app shows how HTTP parameter pollution lets arrays masquerade as… Talk on
Char Wars: The Path Traversal Strikes Back	NodeTLV 2023	2023-06-28
Demonstrates real path‑traversal cases: a vulnerable npm middleware st npm (≈500k weekly downloads) where percent‑encoded “..” bypasses normalize before… Talk on
Master production: best practices to build Node.js Docker images	DevOps fwdays'23	2023-03-16
Claims that many Dockerfiles are unsafe and unreproducible get demonstrated with concrete failures: a Codecov Docker image leak exposes static GCP creds for… Talk on
Let me show you how React applications get hacked in the real-world	Nordic.js 2022	2022-10-06
Concrete exploits and demos show how React apps become XSS-prone: direct user data in attributes like href bypasses React’s default HTML encoding, control… Talk on
The Unexpected Demise of Open Source Libraries	Critical Software Summit @ Open Source Summit Europe 2022	2022-09-15
Stories of real breakage and fixes: a tiny utility left-pad (11 lines, 2.5M downloads) gets unpublished and breaks thousands of builds; a maintainer publishes… Talk on
How React Applications Get Hacked in the Real-World	React Summit 2022	2022-06-17
How to hack a RealWorld live React application in seven minutes. Tips, best practices, and pitfalls when writing React code. XSS and cross-site scripting in… Talk on
Security Controls in the JavaScript Supply Chain	JSNation Conference 2022	2022-06-16
This talk discusses the security challenges in the JavaScript ecosystem, including supply chain security, lock file tampering, and arbitrary command execution… Talk on
Stranger Danger: Your Node.js Attack Surface Just Got Bigger	Voxxed Days Zürich 2022	2022-05-17
Live hacking shows a vulnerable marked markdown parser (4 million monthly downloads) enabling XSS via an escape/regex gap, an unauthenticated NoSQL injection… Talk on
The Unexpected Demise of Open Source Libraries	Cloud Native SecurityCon Europe 2022	2022-05-16
Stories show small maintainer actions breaking huge ecosystems: left-pad removed (≈2.5M downloads) unpublishes nested deps and breaks builds; faker.php… Talk on
Let me show you how React applications get hacked in the real-world	Voxxed Days Bucharest 2022	2022-03-23
React is mostly safe by output-encoding text but fails on specific APIs and libraries: live demos turn a database Twitter link into javascript:alert(1) via an… Talk on
Are we Forever Doomed to Software Supply Chain Security?	TestJS Summit 2021	2021-11-18
Open source packages host real exploits: an event-stream backdoor taints a bitcoin wallet for three months, weak maintainer passwords give publish access to 14… Talk on
Let Me Show You How React Applications Get Hacked in the Real-World	React Advanced 2021	2021-10-22
A live demo builds a package‑profile site and uses the unmaintained npm module react-json-pretty (40k downloads) to render package.json showing that React’s… Talk on
Are We Forever Doomed to Software Supply Chain Security?	Open Source Summit + Embedded Linux Conference + OSPOCon 2021	2021-09-27
Shows concrete failures: the event-stream backdoor compromises a Bitcoin wallet via a dependency chain, 14 npm modules were writable because of weak passwords… Talk on
You thought your React application is secure? Think again	React Finland 2021	2021-08-30
React is mostly secure by default but concrete failures happen: injecting a javascript:alert payload into an href attribute bypasses React’s output encoding… Talk on
Master Production-grade Best Practices to Build your Node.js Docker Images	OpenJS World 2021	2021-06-02
Pins base images by digest instead of FROM node:latest, uses npm ci --only=production with a lockfile to get deterministic, faster installs, and sets NODE_ENV… Talk on
Securing Node Applications with Automated Security Testing in CI/CD	Node Congress 2021	2021-02-18
This workshop on automated application security testing for Express apps covers the importance of early bug detection, the challenges of testing in production… Talk on
PACKAGES FOR MASS CONSUMPTION - AN NPM STORY UNFOLDED	jsday 2020	2020-09-10
Shows concrete incidents and fixes: a maintainer unpublishes left-pad and breaks builds for minutes, attackers gain publish access to 14 modules covering ~20%… Talk on
Stranger Danger: Finding Security Vulnerabilities Before They Find You!	Node.js Global Summit 2020	2020-05-30
Claims that many vulnerabilities hide in transitive packages: scans find 78% indirect-vulns and a demo to-do app shows a real path from dependency to app… Talk on
Node.js Q&A	Node.js Global Summit 2020	2020-05-30
Recommends turning off package lifecycle scripts when installing because both npm audit and yarn still run arbitrary install scripts; Snyk creates and offers… Talk on
Malicious Modules on npm - a series of unfortunate events	Geekle Free Online DevOps+JS Conference 2020	2020-04-07
NPM hosts ~1.2M packages and 70+ billion downloads a month; installing one package implicitly trusts ~79 transitive packages and ~39 maintainers, creating a… Talk on
The State of Open Source Security	Node+JS Interactive 2019	2019-12-11
Open source dependency risk is quantified with concrete findings: NPM tops 1M packages, 78% in transitive dependencies are where vulnerabilities surface, and… Talk on
StrangerDanger: Finding Security Vulnerabilities Before They Find You	ReactiveConf 2019	2019-10-30
A hands-on runthrough shows a sample app Goof sample app with exploitable dependencies and demonstrates real attacks (event-stream, a get-cookies… Talk on
StrangerDanger: Finding Security Vulnerabilities Before They Find You!	JSConf Budapest 2019	2019-09-26
A small demo app called Goof sample app uses real vulnerable NPM modules and shows concrete exploits: marked XSS via sanitization bypass, dust.js remote code… Talk on
Consumer-Driven Contract: A better approach for API Testing	apidays Barcelona 2019	2019-09-12
Advocates replacing brittle mocks and slow end-to-end suites with consumer-driven contracts that generate Pact files from consumer tests, publish them to a… Talk on
Stranger Danger: Finding Security Vulnerabilities Before They Find You!	Voxxed Days Frontend Bucharest 2019	2019-05-21
Open source supply chain risk is concrete: the NPM registry spans ~1,000,000 packages with 250,000 added in 2018, and 78% of found vulnerabilities live in… Talk on
StrangerDanger: Finding Security Vulnerabilities Before They Find You!	DevDays Europe 2019	2019-05-14
A runnable Goof sample app demonstrates real exploits: a marked XSS bypass where browser HTML parsing defeats library sanitization, and a ReDoS in… Talk on
Black Clouds and Silver Linings in Node.js Security	Voxxed Days Zurich 2019	2019-03-19
Survey of real incidents and demos shows npm hosts ~1M packages and 40B monthly downloads while malicious modules repeatedly appear: a rimraf-like package… Talk on
Panel: Building A Secure Ecosystem for Node.js	Node+JS Interactive 2018	2018-10-10
The Node.js Security Working Group reports running two active HackerOne programs (one for npm modules, one for Node core), triaging incoming reports, assigning… Panel on
Jest Testing Patterns	jsDay 2018	2018-05-09
Node.js and JavaScript adoption is high and application security plays a big part in shipping your products in the midst of cyber security threats. We will… Talk on
Node.js Security: Breaking The Loop	jsDay 2018	2018-05-09
Shows concrete attacks and fixes: npm packages with destructive install scripts and typosquatting, a malicious module exfiltrating environment variables, and a… Talk on
Making The Terminal Great Again	JSHeroes 2018	2018-04-10
Live demo builds a real CLI called Chucky that fetches from chucknorris.io and runs successfully with animated loaders and interactive menus. Argument parsing… Talk on
Node.js Security: Breaking The Loop	JSHeroes 2017	2017-06-08
Shows concrete exploits and concrete fixes: demonstrates the rimraf npm sabotage and the validator vs validator.js typo trap, uses NodeGoat to exploit XSS and… Talk on
nothing matches

-- 36 of 36 talks indexed --