WeAreDevelopers LIVE • Sep 15, 2021

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

Could an obscure NPM dependency be silently stealing credentials during your build phase? Discover how to neutralize rogue lifecycle scripts and secure your JavaScript supply chain.

Pause

Mute

Enter Fullscreen

#1 about 2 min

Introduction to supply chain security principles

An introduction to the foundational concepts of securing modern application supply chains.

#2 about 2 min

Understanding modern software supply chains in web development

Modern applications natively rely on numerous external NPM packages created by third parties.

#3 about 5 min

Challenges with automating vulnerability audits in development pipelines

Strictly blocking builds on new package vulnerabilities causes unnecessary friction and alert fatigue during continuous integration.

#4 about 5 min

Managing security alerts with NPM audit resolver

Wrapping standard audit tools allows developers to intentionally ignore, postpone, or address security alerts without breaking CI pipelines.

#5 about 6 min

How malicious packages exploit installation lifecycle scripts

Attackers can define malicious postinstall scripts within dependencies to execute arbitrary code during the installation phase.

#6 about 4 min

Demonstration of malicious compiler output modification

A postinstall script can subtly alter local tooling like the TypeScript compiler to inject environment variable exfiltration capabilities into applications.

#7 about 3 min

Defending against malicious package scripts during installation

Passing the ignore scripts flag blocks unauthorized execution while companion tooling selectively re-enables necessary legitimate scripts.

#8 about 4 min

Identifying safe exceptions for dependency lifecycle scripts

Dedicated command-line tools can analyze node modules to verify which packages genuinely require their lifecycle scripts to function properly.

#9 about 2 min

Recommended workflow for continuous integration dependency installation

A secure pipeline strategy combines disposable containers, version lock files, and selective script allowances to install application dependencies.

#10 about 15 min

Audience questions on tool configurations and package locks

A closing discussion covers the purpose of lock files, defenses like content security policies, and maintenance intervals for dependency updates.

Matching moments

1:50 min

Supply chain security risks in NPM dependency code

martinakraus

martinakraus · World Congress 2024

2:32 min

Dependency risks in widespread NPM supply chain attacks

Chris Heilmann +2 · LIVE

1:03 min

Highlighting supply chain vulnerabilities from obfuscated package manager backdoors

Daniel Cranney +1 · LIVE

3:06 min

Mitigating dependency confusion in NPM packages

Jakub Andrzejewski · World Congress 2023

3:39 min

Mitigating logging failures and supply chain vulnerabilities

Jose Manuel Ortega

Jose Manuel Ortega · Europe 2026 Virtual

1:16 min

Avoiding supply chain risks within standard software dependencies

Bozidar Spirovski

Bozidar Spirovski +1 · Coffee With Developers

More from WeAreDevelopers LIVE

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof Cieślak

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak thumbnail

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak

Chris Heilmann, Daniel Cranney

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers - Of Agents and Robots thumbnail

WeAreDevelopers - Of Agents and Robots

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers LIVE - How DevRel Makes Tech More Human thumbnail

WeAreDevelopers LIVE - How DevRel Makes Tech More Human

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

World Congress 2026 North America

September 23, 2026 · 14:00–14:30

Stage 1

Supply Chain Security When Agents Write the Code

Ajeet Raina

Developer Advocate at Docker

Ajeet Raina

World Congress 2026 North America

September 25, 2026 · 09:40–10:10

Stage 4

Your registry can't stop a valid login. What happens then?

Khushboo Verma

Systems Engineer at Cloudflare

Khushboo Verma

World Congress 2026 North America

September 24, 2026 · 11:40–12:10

Stage 3

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp

World Congress 2026 North America

September 25, 2026 · 15:00–17:00

Stage 12

Secure development from pull request to production with GitHub

Sam Jarvinen

Senior Solutions Engineer, GitHub

Sam Jarvinen

World Congress 2026 North America

September 23, 2026 · 15:45–17:45

Stage 10

Securing the Agentic Stack: Docker Hardened Images and Supply Chain Security

Ajeet Raina

Developer Advocate at Docker

Ajeet Raina

World Congress 2026 North America

September 25, 2026 · 10:20–10:50

Stage 4

rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)

Rishab Kumar

Staff Developer Evangelist @ Twilio

Rishab Kumar

Related videos

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor thumbnail

Coffee With Developers • over 2 years ago

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail

LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

WeAreDevelopers LIVE - Node and Package Security thumbnail

LIVE • about 1 month ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

Supply Chain Security and the Real World: Lessons From Incidents thumbnail

World Congress 2025 • about 1 year ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Walking into the era of Supply Chain Risks thumbnail

LIVE • over 4 years ago

Walking into the era of Supply Chain Risks

Vandana Verma

Beyond SBOMs: The Future of Container Supply Chain Security thumbnail

World Congress 2026 Europe • 2 months ago

Beyond SBOMs: The Future of Container Supply Chain Security

Mohammad-Ali A'râbi

Related articles

BB

Benedikt Bischof

Walking Into The Era of Supply Chain Risks

Welcome to this issue of the WeAreDevelopers Live Talk series. This article recaps an interesting talk by Vandana Verma who introduced the audience interesting topic of supply chain risks.About the...

about 4 years ago

Walking Into The Era of Supply Chain Risks

CH

Chris Heilmann

Dev Digest 138 - Are you secure about this?

Hello there! This is the 2nd "out of the can" edition of 3 as I am on vacation in Greece eating lovely things on the beach. So, fewer news, but lots of great resources. Many around the topic of sec...

almost 2 years ago

Dev Digest 138 - Are you secure about this?

DC

Daniel Cranney

Dev Digest 188: CfP time, the risks of NPM and IKEA algorithms

Inside last week’s Dev Digest 188 . 🤖 GitHub Copilot CLI is now in public review 💻 Microsoft is bringing ‘vibe working’ to office apps 🎣 Attackers abuse AI tools to generate captchas in fishing at...

11 months ago

IKEA-style no-text diagrams explaining algorithms

DC

Daniel Cranney

The Overflow: Security and Privacy

Every week we dig through hundreds of links from all over the web, and it’s often hard for developers keep up. So, we thought we’d put together some links we couldn’t fit in the Dev Digest in what ...

6 months ago

From learning to earning

Jobs that call for the skills explored in this talk.

13 days ago • Verified

Senior Supply Chain Security Engineer

Expert Remote Linux Kubernetes

13 days ago • Verified

Senior Principal Software Engineer, Docker and Ecosystem

Seattle, United States

Expert Remote Cloud (AWS/Google/Azure)

13 days ago • Verified

Principal Software Engineer, Docker Hardened Images

Expert Remote Kubernetes

13 days ago • Verified

Manager, Engineering, Secure Build and SCS Services

Expert Remote Team Leadership

about 1 month ago

Staff Developer Advocate, GitHub Security Lab

Experienced $121k–323k Remote Git Github Databases

13 days ago • Verified

Senior Software Engineer, Secure Build

Expert Remote Go