WeAreDevelopers LIVE • Sep 15, 2021

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

Could an obscure NPM dependency be silently stealing credentials during your build phase? Discover how to neutralize rogue lifecycle scripts and secure your JavaScript supply chain.

Pause

Mute

Enter Fullscreen

#1 about 2 min

Introduction to supply chain security principles

An introduction to the foundational concepts of securing modern application supply chains.

#2 about 2 min

Understanding modern software supply chains in web development

Modern applications natively rely on numerous external NPM packages created by third parties.

#3 about 5 min

Challenges with automating vulnerability audits in development pipelines

Strictly blocking builds on new package vulnerabilities causes unnecessary friction and alert fatigue during continuous integration.

#4 about 5 min

Managing security alerts with NPM audit resolver

Wrapping standard audit tools allows developers to intentionally ignore, postpone, or address security alerts without breaking CI pipelines.

#5 about 6 min

How malicious packages exploit installation lifecycle scripts

Attackers can define malicious postinstall scripts within dependencies to execute arbitrary code during the installation phase.

#6 about 4 min

Demonstration of malicious compiler output modification

A postinstall script can subtly alter local tooling like the TypeScript compiler to inject environment variable exfiltration capabilities into applications.

#7 about 3 min

Defending against malicious package scripts during installation

Passing the ignore scripts flag blocks unauthorized execution while companion tooling selectively re-enables necessary legitimate scripts.

#8 about 4 min

Identifying safe exceptions for dependency lifecycle scripts

Dedicated command-line tools can analyze node modules to verify which packages genuinely require their lifecycle scripts to function properly.

#9 about 2 min

Recommended workflow for continuous integration dependency installation

A secure pipeline strategy combines disposable containers, version lock files, and selective script allowances to install application dependencies.

#10 about 15 min

Audience questions on tool configurations and package locks

A closing discussion covers the purpose of lock files, defenses like content security policies, and maintenance intervals for dependency updates.

Matching moments

1:50 min

Supply chain security risks in NPM dependency code

martinakraus

martinakraus · World Congress 2024

2:32 min

Dependency risks in widespread NPM supply chain attacks

Chris Heilmann +2 · LIVE

1:03 min

Highlighting supply chain vulnerabilities from obfuscated package manager backdoors

Daniel Cranney +1 · LIVE

3:06 min

Mitigating dependency confusion in NPM packages

Jakub Andrzejewski · World Congress 2023

3:39 min

Mitigating logging failures and supply chain vulnerabilities

Jose Manuel Ortega

Jose Manuel Ortega · Europe 2026 Virtual

1:16 min

Avoiding supply chain risks within standard software dependencies

Bozidar Spirovski

Bozidar Spirovski +1 · Coffee With Developers

More from WeAreDevelopers LIVE

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers - Of Agents and Robots thumbnail

WeAreDevelopers - Of Agents and Robots

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers LIVE - How DevRel Makes Tech More Human thumbnail

WeAreDevelopers LIVE - How DevRel Makes Tech More Human

Chris Heilmann, Daniel Cranney

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres thumbnail

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres

Chris Heilmann, Daniel Cranney

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Node and Package Security thumbnail

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

Upcoming sessions on this topic

World Congress 2026 North America

How Docker caught a supply chain attack in 83 minutes

Khushboo Verma

Systems Engineer at Cloudflare

Khushboo Verma

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp

World Congress 2026 North America

rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)

Rishab Kumar

Staff Developer Evangelist @ Twilio

Rishab Kumar

World Congress 2026 North America

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois

World Congress 2026 North America

AI vs. AI: Defending the open source supply chain with agentic workflows

Manfred Moser

Senior Principal DevRel Engineer at Chainguard

Manfred Moser

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy

Related videos

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor thumbnail

Coffee With Developers • over 2 years ago

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail

LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

WeAreDevelopers LIVE - Node and Package Security thumbnail

LIVE • 24 days ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

Supply Chain Security and the Real World: Lessons From Incidents thumbnail

World Congress 2025 • about 1 year ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Walking into the era of Supply Chain Risks thumbnail

LIVE • over 4 years ago

Walking into the era of Supply Chain Risks

Vandana Verma

Beyond SBOMs: The Future of Container Supply Chain Security thumbnail

World Congress 2026 Europe • about 2 months ago

Beyond SBOMs: The Future of Container Supply Chain Security

Mohammad-Ali A'râbi

Related articles

BB

Benedikt Bischof

Walking Into The Era of Supply Chain Risks

Welcome to this issue of the WeAreDevelopers Live Talk series. This article recaps an interesting talk by Vandana Verma who introduced the audience interesting topic of supply chain risks.About the...

about 4 years ago

Walking Into The Era of Supply Chain Risks

CH

Chris Heilmann

Dev Digest 138 - Are you secure about this?

Hello there! This is the 2nd "out of the can" edition of 3 as I am on vacation in Greece eating lovely things on the beach. So, fewer news, but lots of great resources. Many around the topic of sec...

almost 2 years ago

Dev Digest 138 - Are you secure about this?

DC

Daniel Cranney

Dev Digest 188: CfP time, the risks of NPM and IKEA algorithms

Inside last week’s Dev Digest 188 . 🤖 GitHub Copilot CLI is now in public review 💻 Microsoft is bringing ‘vibe working’ to office apps 🎣 Attackers abuse AI tools to generate captchas in fishing at...

11 months ago

IKEA-style no-text diagrams explaining algorithms

DC

Daniel Cranney

The Overflow: Security and Privacy

Every week we dig through hundreds of links from all over the web, and it’s often hard for developers keep up. So, we thought we’d put together some links we couldn’t fit in the Dev Digest in what ...

6 months ago

From learning to earning

Jobs that call for the skills explored in this talk.

Staff Engineering Manager, Cloud Security

San Francisco, CA, United States

Experienced Github Code Review Google Cloud

5 days ago • Verified

Founding Developer Advocate

San Francisco, United States

Experienced €150k–190k Remote GIT Bash Linux

about 2 months ago

Staff Engineer - Offensive Security

San Francisco, CA, United States

Expert $155k–194k Remote Nmap Twilio Scripting

Application Security Engineer

Greater London, UK

Remote Alwayson Data Logging Secure Coding

Endpoint Security Engineer - OT

München, Germany

Runbook Malware Scripting

Senior Site Reliability Engineer - IT

San Francisco, CA, United States

Expert $273k Git DevOps Github