Aaron Davis — LavaMoat — solving JavaScript software supply chain

Aaron Davis is a founder, dev, and a lead security researcher at MetaMask, a popular Ethereum wallet. He introduces us to LavaMoat, an approach to solving javascript software supply chain security for node and the browser. The LavaMoat runtime prevents modifying JavaScript's primordials, limits access to the platform API, and prevents packages from corrupting other packages. We hope you enjoy this conversation with... Aaron Davis.Connect with Aaron “kumavis” Davis:→ Aaron “kumavis” Davis on GitHub→ LavaMoatMentioned in this episode:→ LavaMoat→ MetaMask→ npm event-stream incident→ Snyk→ Node.jsFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Meet Aaron “kumavis” Davis02:10 Aaron’s security origin story03:29 Security lessons from building MetaMask05:20 Why tackle the JavaScript supply chain?09:06 The problem reaches beyond JavaScript10:40 Malicious updates and compromised maintainers12:47 The hidden scale of transitive dependencies14:52 Open source economics and critical packages18:42 Is LavaMoat a firewall for JavaScript?20:22 Could browsers make LavaMoat obsolete?22:35 Runtime performance costs25:11 Threat modeling LavaMoat itself28:36 Static analysis and policy generation30:07 Understanding LavaMoat policy files33:01 Using LavaMoat in complex applications37:36 How to get involved