Seminar: Malicious npm Packages — Anatomy, Detection Gaps, and AI’s Role (Boston)

This seminar examines the modern software supply chain threat landscape through the lens of the JavaScript ecosystem, drawing on analysis of real 2025 compromises including the NX Singularity, Chalk/Debug, and Shai-Hulud campaigns. It explores how attackers infiltrate npm through typosquatting, dependency confusion, and maintainer account takeovers, and how payloads are delivered using install-time hooks, obfuscated JavaScript, bundled binaries, and worm-style propagation. A central focus is the window-of-exposure problem: the gap between a malicious publish and a public advisory is the true attack surface. The session also evaluates the role of AI-assisted analysis across varying obfuscation tiers such as readable, minified, and fully obfuscated code, bundled binaries and concludes with concrete, actionable defenses practitioners can apply immediately.

Presenter: Diptendu Kar

Diptendu Kar is a security researcher focused on supply chain and dependency risk. He works on triaging open-source vulnerabilities, writing detection rules, and exploring how AI can automate tedious parts of security research. He is a Northeastern University alumnus and previously served as a part-time instructor at Khoury College, teaching CY6120: Software Security Practices. He is especially interested in patch diffing, vulnerable function detection, and the use of LLMs in AppSec. He is a frequent speaker at security conferences such as OWASP and BSides.