NPM

“One of the threat groups actually kind of posted their, you know, open source to their kind of vibe coded toolkit for others to use to be able to do this. You know, we've seen copycat attacks happen since then.”

“I noticed the attackers seemed to pick RSA and Black Hat as the times they wanted to start these NPM worms.”

“Every move that we make to make it more secure will break a lot of people.”

“The structure of the repository is like, 500 NPM packages. It's like architecture to the access for what you would consider, I think, normal for a seven person team. But if every person is actually, like, 10 to 50. Then the, like, numbers on, like, being super…”

“I do think that what's happening with AI, this is just going to get so much worse because all of a sudden everyone dangerously skips permissions.”

“They're effectively using private registries already for NPM. They're using for PyPy and they will also do it for MCP servers. In there you have implicit trust and then you can just search.”

“And its package manager, NPM, is the largest ecosystem of open source libraries in the world.”

“And what's interesting is in, in neither of those two worlds, at least historically, like pre-crypto, has much of the value that those open source contribute been captured.”