Possessed by Packages: Is Your JavaScript Haunted? by Chris DeMars

A conference talk covering JavaScript supply chain security threats and mitigations. Topics include typosquatting (malicious packages with near-identical names), dependency confusion attacks (public packages overriding private registry packages via higher version numbers), backdoors, and transitive dependency risks. Practical defenses covered: pinning dependency versions, committing lock files, scoping private packages, configuring .npmrc and CI/CD pipelines, ignoring pre/post install scripts, and using SCA tools like npm audit, Dependabot, and Snyk. The SLSA framework is introduced as a security maturity checklist. The talk frames security alongside accessibility and performance as core developer responsibilities.