WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Sep 15, 2021

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

Could an obscure NPM dependency be silently stealing credentials during your build phase? Discover how to neutralize rogue lifecycle scripts and secure your JavaScript supply chain.

Pause
Mute Enter Fullscreen
#1 about 2 min

Introduction to supply chain security principles

An introduction to the foundational concepts of securing modern application supply chains.

#2 about 2 min

Understanding modern software supply chains in web development

Modern applications natively rely on numerous external NPM packages created by third parties.

#3 about 5 min

Challenges with automating vulnerability audits in development pipelines

Strictly blocking builds on new package vulnerabilities causes unnecessary friction and alert fatigue during continuous integration.

#4 about 5 min

Managing security alerts with NPM audit resolver

Wrapping standard audit tools allows developers to intentionally ignore, postpone, or address security alerts without breaking CI pipelines.

#5 about 6 min

How malicious packages exploit installation lifecycle scripts

Attackers can define malicious postinstall scripts within dependencies to execute arbitrary code during the installation phase.

#6 about 4 min

Demonstration of malicious compiler output modification

A postinstall script can subtly alter local tooling like the TypeScript compiler to inject environment variable exfiltration capabilities into applications.

#7 about 3 min

Defending against malicious package scripts during installation

Passing the ignore scripts flag blocks unauthorized execution while companion tooling selectively re-enables necessary legitimate scripts.

#8 about 4 min

Identifying safe exceptions for dependency lifecycle scripts

Dedicated command-line tools can analyze node modules to verify which packages genuinely require their lifecycle scripts to function properly.

#9 about 2 min

Recommended workflow for continuous integration dependency installation

A secure pipeline strategy combines disposable containers, version lock files, and selective script allowances to install application dependencies.

#10 about 15 min

Audience questions on tool configurations and package locks

A closing discussion covers the purpose of lock files, defenses like content security policies, and maintenance intervals for dependency updates.

Matching moments

1:50 min

Supply chain security risks in NPM dependency code

martinakraus martinakraus · World Congress 2024

2:32 min

Dependency risks in widespread NPM supply chain attacks

Chris Heilmann +2 · LIVE

1:03 min

Highlighting supply chain vulnerabilities from obfuscated package manager backdoors

Daniel Cranney +1 · LIVE

3:06 min

Mitigating dependency confusion in NPM packages

Jakub Andrzejewski · World Congress 2023

3:39 min

Mitigating logging failures and supply chain vulnerabilities

Jose Manuel Ortega Jose Manuel Ortega · Europe 2026 Virtual

1:16 min

Avoiding supply chain risks within standard software dependencies

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

More from WeAreDevelopers LIVE

WeAreDevelopers LIVE - Is CSS Catching Up to Flash? thumbnail
1:03:33
8 days ago

WeAreDevelopers LIVE - Is CSS Catching Up to Flash?

Chris Heilmann, Daniel Cranney, Bramus Van Damme

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail
1:21:17
15 days ago

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof Cieślak

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak thumbnail
4:23
17 days ago

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Open Source Agent Toolkits thumbnail
1:00:38
22 days ago

WeAreDevelopers LIVE - Open Source Agent Toolkits

Chris Heilmann, Daniel Cranney, Eddie Jaoude

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail
6:16
24 days ago

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail
5:46
29 days ago

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 · 16:15–16:25

Outdoor Stage

Silent Execution: Defending Against Install-Time Supply Chain Attacks

Chris DeMars

Senior Developer Advocate at TuxCare

Chris DeMars
Open session

World Congress 2026 North America

September 23, 2026 · 14:00–14:30

Stage 1

Supply Chain Security When Agents Write the Code

Ajeet Raina

Developer Advocate at Docker

Ajeet Raina
Open session

World Congress 2026 North America

September 25, 2026 · 09:40–10:10

Stage 4

Your registry can't stop a valid login. What happens then?

Khushboo Verma

Systems Engineer at Cloudflare

Khushboo Verma
Open session

World Congress 2026 North America

September 24, 2026 · 11:40–12:10

Stage 3

Stop Running Mystery Meat in Production

Jeroen van Erp

Technology Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

September 25, 2026 · 15:00–17:00

Stage 12

Secure development from pull request to production with GitHub

Sam Jarvinen

Senior Solutions Engineer, GitHub

Sam Jarvinen
Open session

World Congress 2026 North America

September 23, 2026 · 15:45–17:45

Stage 10

Securing the Agentic Stack: Docker Hardened Images and Supply Chain Security

Ajeet Raina

Developer Advocate at Docker

Ajeet Raina

Related videos

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor thumbnail
42:55
Coffee With Developers • over 2 years ago

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

WeAreDevelopers LIVE - Node and Package Security thumbnail
1:08:30
LIVE • about 2 months ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

Supply Chain Security and the Real World: Lessons From Incidents thumbnail
24:47
World Congress 2025 • about 1 year ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Walking into the era of Supply Chain Risks thumbnail
37:36
LIVE • over 4 years ago

Walking into the era of Supply Chain Risks

Vandana Verma

Beyond SBOMs: The Future of Container Supply Chain Security thumbnail
30:38
World Congress 2026 Europe • 3 months ago

Beyond SBOMs: The Future of Container Supply Chain Security

Mohammad-Ali A'râbi

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.