Syntax - Tasty Web Development Treats 705: Is Running Random Code From npm Safe? With Feross Aboukhadijeh
8 snips
Dec 15, 2023 
Feross Aboukhadijeh, a software developer known for Socket, Wormhole, and WebTorrent, discusses vital security improvements for npm code installations. He unveils Socket's role in ensuring open-source safety and transparency while introducing AI-driven package summaries. Feross shares insights into the risks of malicious code and the ethical responsibilities for developers. He also explores the innovative functionality of WebTorrent and challenges faced in decentralized file sharing, all while emphasizing the importance of community vigilance in a secure coding environment.
AI Snips
Chapters
Transcript
Episode notes
Event-Stream Compromise
- Dominic Tarr, a prolific open-source maintainer, had a package, event-stream, compromised.
- An attacker gained access and inserted malicious code, targeting a specific company and stealing cryptocurrency.
Proactive Security
- Be proactive about open-source security, don't wait for issues to arise.
- Use automated tools and LLMs like ChatGPT to scan for and interpret potentially malicious code.
Protestware Incidents
- During the Russia-Ukraine war, some maintainers injected protestware into their packages.
- One extreme example involved wiping hard drives of users with Russian IPs, replacing files with flower emojis.