Sponsored: What npm 12 fixes… and what it doesn’t
Summary
Casey Ellis interviews Feroza Bukadégie from Socket about NPM v12’s new security defaults, which disable install scripts by default. They discuss how attackers rapidly adapted by moving payloads into package code or exploiting trusted GitHub Actions pipelines, as seen in recent malware campaigns. The episode also covers upcoming NPM token restrictions and advises teams to enforce hard failures for skipped scripts to prevent production errors.
Topics discussed
Introduction and NPM v12 security changes
Attacker workarounds and payload shifting
Case study: J Scrambler info stealer campaign
Case study: Async API and trusted publishing flaws
The limits of provenance and multi-layered security
Upcoming NPM token and 2FA changes
Risks of soft failures and hardening recommendations
Listen ad-free on Castria