BSidesSF 2026 - Who Watches the NPM Watchers? (Paul McCarty)

This talk explores the oversight of the NPM ecosystem regarding malicious packages and security threats. The speaker, Paul McCarty, discusses the use of innovative canary tokens, referred to as "canary packages," strategically placed in published packages to monitor the effectiveness of security vendors' detection capabilities, identify blind spots, and analyze scanning behaviors. This research sheds light on the current security landscape of the NPM ecosystem and the proactive measures that are necessary to enhance package safety.