npm packages are awesome, but also introduce risk. This presentation explains how packages may introduce known vulnerabilities into your application, explains their impact, and most importantly, shows how to protect yourself. The few slides were complemented by running several vulnerability exploits against the vulnerable demo app Goof from here: https://github.com/Snyk/goof

1. snyk.io
Stranger Danger
Guy Podjarny, Snyk
@guypod

2. snyk.io
About Me
• Guy Podjarny, @guypod on Twitter
• CEO & Co-founder at Snyk
• History:
• Cyber part of Israel Defense Forces
• First Web App Firewall, Dynamic/static App Sec Tester
• Security: Worked in Sanctum -> Watchfire -> IBM
• Performance: Founded Blaze -> CTO @Akamai
• O’Reilly author, speaker

3. snyk.io
npm
Is AWESOME

4. snyk.io
>363,000 packages
>5.5B downloads/month
>65,000 publishers
npm usage
Has Exploded

5. snyk.io
JavaScript has Won

6. snyk.io
A typical Node.js app has
100s or 1,000s of dependencies
Some direct, most indirect

7. snyk.io
Your App

8. snyk.io
Your Code
Your App

9. snyk.io
Each Dependency Is A
Security Risk

10. snyk.io
Do You Know
Which Dependencies
You Have?

11. snyk.io
Do you know, for
EVERY SINGLE DEPENDENCY
if its developers have any
Security Expertise?

12. snyk.io
Do you know, for
EVERY SINGLE DEPENDENCY
if it underwent any
Security Testing?

13. snyk.io
Do you know, for
EVERY SINGLE DEPENDENCY
if it has any
Known Vulnerabilities?

14. snyk.io
Open Source is written by
People

15. snyk.io
Open Source is written by
People
Strangers

16. snyk.io

17. snyk.io

18. snyk.io
Do you know, for
EVERY SINGLE CONTRIBUTOR
if they are
Malicious?

19. snyk.io
Do you know, for
EVERY SINGLE CONTRIBUTOR
if they’ve been
Compromised?

20. snyk.io
It’s a BIG Problem
First step: Known Vulnerabilities

21. snyk.io
~14%
of npm Packages Carry
Known Vulnerabilities
~76% of Snyk users found vulns in their apps
Source: Snyk data, June 2016

22. snyk.io
1. How do I protect myself?

23. snyk.io
1. How do I protect myself?
2. Can I learn from these vulns?

24. snyk.io
Live Hacking Begins…

25. snyk.io
Don’t start hacking sites…
It’s illegal. And impolite.

26. snyk.io
JavaScript Takeaways
• Consider all encodings
• Notably HTML & URL Encoding
• Better yet: Whitelist instead of Blacklist
• Prevent long algorithm runs
• Control Regexp input lengths
• Don’t initialize Buffer with integers
• Beware JSON type manipulations

27. snyk.io
npm packages takeaway
• Find vulnerabilities
• Be sure to test ALL your applications
• Fix vulnerabilities
• Upgrade when possible, patch when needed
• Prevent adding vulnerable module
• Break the build, test in pull requests
• Respond quickly to new vulns
• Track vuln DBs, or use Snyk! </shameless plug>

28. snyk.io
npm Is Awesome

29. snyk.io
npm Is Awesome
Please Enjoy Responsibly
Questions?
Guy Podjarny, Snyk
@guypod