Watch Me Run Malware From NPM

The speaker is Zebe, a JavaScript and Node enthusiast with a focus on security, working on Labemote and running a Meetup and conference group called MeetJS.

The presentation focuses on security concerns related to running malware directly from NPM, exploring malicious packages, and defending applications against them.

NPM packages are compared to unsanitized input from random people online, which are consumed and run in production without reading.

The main concern is the potential for malicious packages to be included in applications, leading to security vulnerabilities.

The speaker created NPM Audit Resolver to address vulnerable dependencies by providing a structured way to manage them.

Malicious NPM packages can be explored on Socket Dev, where old versions are not removed, allowing users to view and download package contents.

Hardin JavaScript is a security tool that controls the scope and import mechanisms in JavaScript, providing scope isolation and preventing prototype pollution.

LavaLab is used to run and evaluate malware samples in a controlled environment, allowing the speaker to demonstrate how malware operates.

Lafamote improves security by placing each package in its own compartment, controlling dependency structure, and allowing selective access to globals and imports.

Using security tools like Lafamote is important to protect applications from malicious packages that could compromise security if they run in production.