WeAreDevelopers LIVE • Sep 15, 2021

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

Could an obscure NPM dependency be silently stealing credentials during your build phase? Discover how to neutralize rogue lifecycle scripts and secure your JavaScript supply chain.

Pause

Mute

Enter Fullscreen

#1 about 2 min

Introduction to supply chain security principles

An introduction to the foundational concepts of securing modern application supply chains.

#2 about 2 min

Understanding modern software supply chains in web development

Modern applications natively rely on numerous external NPM packages created by third parties.

#3 about 5 min

Challenges with automating vulnerability audits in development pipelines

Strictly blocking builds on new package vulnerabilities causes unnecessary friction and alert fatigue during continuous integration.

#4 about 5 min

Managing security alerts with NPM audit resolver

Wrapping standard audit tools allows developers to intentionally ignore, postpone, or address security alerts without breaking CI pipelines.

#5 about 6 min

How malicious packages exploit installation lifecycle scripts

Attackers can define malicious postinstall scripts within dependencies to execute arbitrary code during the installation phase.

#6 about 4 min

Demonstration of malicious compiler output modification

A postinstall script can subtly alter local tooling like the TypeScript compiler to inject environment variable exfiltration capabilities into applications.

#7 about 3 min

Defending against malicious package scripts during installation

Passing the ignore scripts flag blocks unauthorized execution while companion tooling selectively re-enables necessary legitimate scripts.

#8 about 4 min

Identifying safe exceptions for dependency lifecycle scripts

Dedicated command-line tools can analyze node modules to verify which packages genuinely require their lifecycle scripts to function properly.

#9 about 2 min

Recommended workflow for continuous integration dependency installation

A secure pipeline strategy combines disposable containers, version lock files, and selective script allowances to install application dependencies.

#10 about 15 min

Audience questions on tool configurations and package locks

A closing discussion covers the purpose of lock files, defenses like content security policies, and maintenance intervals for dependency updates.

Matching moments

1:50 min

Supply chain security risks in NPM dependency code

martinakraus

martinakraus · WWC 2024

2:32 min

Dependency risks in widespread NPM supply chain attacks

Chris Heilmann +2 · LIVE

1:03 min

Highlighting supply chain vulnerabilities from obfuscated package manager backdoors

Daniel Cranney +1 · LIVE

3:06 min

Mitigating dependency confusion in NPM packages

Jakub Andrzejewski · WWC 2023

1:16 min

Avoiding supply chain risks within standard software dependencies

Bozidar Spirovski

Bozidar Spirovski +1 · Coffee With Developers

3:50 min

Mitigating supply chain attacks via automated post-install hooks

Chris Heilmann +2 · LIVE

More from WeAreDevelopers LIVE

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Node and Package Security thumbnail

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

WeAreDevelopers LIVE - Streaming HTML thumbnail

WeAreDevelopers LIVE - Streaming HTML

Chris Heilmann, Daniel Cranney, Jad Joubran

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe thumbnail

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe

Chris Heilmann, Daniel Cranney, Justin Halsall, Werner Jeschko, Nicole Jeschko, Mirco Tomić

WeAreDevelopers LIVE - Web Performance in an AI World thumbnail

WeAreDevelopers LIVE - Web Performance in an AI World

Chris Heilmann, Daniel Cranney

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko thumbnail

about 2 months ago

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp

World Congress 2026 North America

rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)

Rishab Kumar

Staff Developer Evangelist @ Twilio

Rishab Kumar

World Congress 2026 North America

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali

World Congress 2026 North America

Red Teaming Your LLM App -- A Hands-On Threat Model You Can Reuse

Saloni Garg

Senior ML Engineer at Adobe

Saloni Garg

Related videos

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor thumbnail

Coffee With Developers • over 2 years ago

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail

LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

WeAreDevelopers LIVE - Node and Package Security thumbnail

LIVE • 5 days ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

Supply Chain Security and the Real World: Lessons From Incidents thumbnail

WWC 2025 • 12 months ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Walking into the era of Supply Chain Risks thumbnail

LIVE • over 4 years ago

Walking into the era of Supply Chain Risks

Vandana Verma

Beyond SBOMs: The Future of Container Supply Chain Security thumbnail

WWC Europe 2026 • about 1 month ago

Beyond SBOMs: The Future of Container Supply Chain Security

Mohammad-Ali A'râbi

Related articles

BB

Benedikt Bischof

Walking Into The Era of Supply Chain Risks

Welcome to this issue of the WeAreDevelopers Live Talk series. This article recaps an interesting talk by Vandana Verma who introduced the audience interesting topic of supply chain risks.About the...

about 4 years ago

Walking Into The Era of Supply Chain Risks

CH

Chris Heilmann

Dev Digest 138 - Are you secure about this?

Hello there! This is the 2nd "out of the can" edition of 3 as I am on vacation in Greece eating lovely things on the beach. So, fewer news, but lots of great resources. Many around the topic of sec...

almost 2 years ago

Dev Digest 138 - Are you secure about this?

DC

Daniel Cranney

Dev Digest 188: CfP time, the risks of NPM and IKEA algorithms

Inside last week’s Dev Digest 188 . 🤖 GitHub Copilot CLI is now in public review 💻 Microsoft is bringing ‘vibe working’ to office apps 🎣 Attackers abuse AI tools to generate captchas in fishing at...

10 months ago

IKEA-style no-text diagrams explaining algorithms

DC

Daniel Cranney

The Overflow: Security and Privacy

Every week we dig through hundreds of links from all over the web, and it’s often hard for developers keep up. So, we thought we’d put together some links we couldn’t fit in the Dev Digest in what ...

5 months ago

From learning to earning

Jobs that call for the skills explored in this talk.

Engineer, Offensive Security Organization

Delhi, NY, United States

Expert Remote Nmap Twilio Ethereal

Staff Developer Advocate, GitHub Security Lab

Experienced $121k–323k Remote Git Github Databases

Senior Software Engineer

AMSTERDAM, Netherlands

Expert Remote Ruby Golang Prolog

Endpoint Security Engineer - OT

Oberkochen, Germany

Runbook Malware Scripting

about 1 month ago

Staff Engineer - Offensive Security

San Francisco, CA, United States

Expert $155k–194k Remote Nmap Twilio Scripting

Endpoint Security Engineer

München, Germany

Scripting Windows PowerShell Python (Programming Language)