Adam Baldwin (@adam_baldwin) Director of Security, npm     Role in the NodeJS project     Advisory? Active role? Maintain security modules?     Are there any requirements to being a dev?     Are there different roles in the NodeJS environment?     Is there any review of system sensitive packages? (or has that ship sailed…)   Discussion of timeline from NodeJS security team     When were you notified? (or were you notified at all?)     What steps were taken to fix the issue?     Lessons learned?   Official npm security policy: (good stuff!)   Event-stream (initial bug report):      Only affected bitcoin Wallets from ‘Copay’                     “Cue relief, mixed with frustration, for anyone not targeted. Developer Chris Northwood : We’ve wiped our brows as we’ve got away with it, we didn’t have malicious code running on our dev machines, our CI servers, or in prod. This time.” (   “The damage this could have caused is incredible to think about. The projects that depend on this aren’t trivial either, ! Think of the systems that either develop that tool or run that tool. Each one of those potentially had this malicious code installed.”   “The malicious code detected earlier this week was added to Event-Stream version 3.3.6, published on September 9 via NPM repository, and had since been downloaded by nearly 8 million application programmers.”     Hacker News (with comments):   Official npm blog post:   2017 package/user stats:   According to npmjs.org: over 800,000 packages (854,000 packages, 7 million+ individual versions)   Dependency hell in NodeJS:     “Roughly 76% of Node shops use vulnerable packages, some of which are extremely severe; and open source projects regularly grow sta