WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Sep 15, 2021

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

Could an obscure NPM dependency be silently stealing credentials during your build phase? Discover how to neutralize rogue lifecycle scripts and secure your JavaScript supply chain.

Pause
Mute Enter Fullscreen
#1 about 2 min

Introduction to supply chain security principles

An introduction to the foundational concepts of securing modern application supply chains.

#2 about 2 min

Understanding modern software supply chains in web development

Modern applications natively rely on numerous external NPM packages created by third parties.

#3 about 5 min

Challenges with automating vulnerability audits in development pipelines

Strictly blocking builds on new package vulnerabilities causes unnecessary friction and alert fatigue during continuous integration.

#4 about 5 min

Managing security alerts with NPM audit resolver

Wrapping standard audit tools allows developers to intentionally ignore, postpone, or address security alerts without breaking CI pipelines.

#5 about 6 min

How malicious packages exploit installation lifecycle scripts

Attackers can define malicious postinstall scripts within dependencies to execute arbitrary code during the installation phase.

#6 about 4 min

Demonstration of malicious compiler output modification

A postinstall script can subtly alter local tooling like the TypeScript compiler to inject environment variable exfiltration capabilities into applications.

#7 about 3 min

Defending against malicious package scripts during installation

Passing the ignore scripts flag blocks unauthorized execution while companion tooling selectively re-enables necessary legitimate scripts.

#8 about 4 min

Identifying safe exceptions for dependency lifecycle scripts

Dedicated command-line tools can analyze node modules to verify which packages genuinely require their lifecycle scripts to function properly.

#9 about 2 min

Recommended workflow for continuous integration dependency installation

A secure pipeline strategy combines disposable containers, version lock files, and selective script allowances to install application dependencies.

#10 about 15 min

Audience questions on tool configurations and package locks

A closing discussion covers the purpose of lock files, defenses like content security policies, and maintenance intervals for dependency updates.

Matching moments

2:56 min

Managing risks in CI/CD pipelines and supply chains

Christian Heilmann Christian Heilmann +1 · World Congress 2026 North America

1:50 min

Supply chain security risks in NPM dependency code

martinakraus martinakraus · World Congress 2024

2:32 min

Dependency risks in widespread NPM supply chain attacks

Chris Heilmann Chris Heilmann +2 · LIVE

2:12 min

Exploiting npm lifecycle scripts during software installation

Chris DeMars Chris DeMars · World Congress 2026 North America

1:03 min

Highlighting supply chain vulnerabilities from obfuscated package manager backdoors

Daniel Cranney Daniel Cranney +1 · LIVE

3:06 min

Mitigating dependency confusion in NPM packages

Jakub Andrzejewski · World Congress 2023

More from WeAreDevelopers LIVE

WeAreDevelopers LIVE - Tech Education in Two Languages thumbnail
1:00:18
3 days ago

WeAreDevelopers LIVE - Tech Education in Two Languages

Daniel Cranney, Roxy Rodriguez-Becker

WeAreDevelopers LIVE - Playing in Production thumbnail
1:06:40
10 days ago

WeAreDevelopers LIVE - Playing in Production

Andrew MacLean, Daniel Cranney, Christian Heilmann

WeAreDevelopers LIVE - Is CSS Catching Up to Flash? thumbnail
1:03:33
24 days ago

WeAreDevelopers LIVE - Is CSS Catching Up to Flash?

Chris Heilmann, Daniel Cranney, Bramus Van Damme

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail
1:21:17
about 1 month ago

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof Cieślak

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak thumbnail
4:23
about 1 month ago

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Open Source Agent Toolkits thumbnail
1:00:38
about 1 month ago

WeAreDevelopers LIVE - Open Source Agent Toolkits

Chris Heilmann, Daniel Cranney, Eddie Jaoude

Upcoming sessions on this topic

Open session

Supply Chain Security for the Everyday Engineer

  • Pradumna Saraf

    Kestra Technologies

    Quality Assurance Engineer

Open session

What I Got Wrong Shipping an MCP Server for Live Infrastructure

  • Pritesh Kiri

    Harness

    Developer Relations Engineer

Open session

Beware of Strangers Bearing Code: Open Source Trust in the Agent Era

  • Vikram Vaswani

    Consultant

Open session

How We Cut Our API's p99 Latency from Minutes to Under a Second

  • Deepak Agrawal

    Atlassian

    Principal Software Engineer

Open session

Autopsy of an Autonomous Incident: When the Agent Made It Worse

  • Navin Pai

    StackGen

    Director of Engineering

Open session

Shipping MCP to Real Users: Scaling, Auth, and the PII Leak You Didn't See Coming

  • Hadar Geva

    Myop

    CTO & Co-founder

Related videos

Silent Execution: Defending Against Install-Time Supply Chain Attacks thumbnail
11:36
World Congress 2026 North America • 15 days ago

Silent Execution: Defending Against Install-Time Supply Chain Attacks

Chris DeMars

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor thumbnail
42:55
Coffee With Developers • over 2 years ago

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

WeAreDevelopers LIVE - Node and Package Security thumbnail
1:08:30
LIVE • 2 months ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

Supply Chain Security and the Real World: Lessons From Incidents thumbnail
24:47
World Congress 2025 • about 1 year ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Walking into the era of Supply Chain Risks thumbnail
37:36
LIVE • over 4 years ago

Walking into the era of Supply Chain Risks

Vandana Verma

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.