What You’re Really Trusting When You Run npm install - Karen Li - GitHub - dotJS 2026

Why watch

Karen Li explains the hidden trust model behind npm install, showing how JavaScript developers implicitly trust thousands of package maintainers when installing dependencies. The talk covers dependency resolution mechanics, how trust failures propagate through dependency graphs, and ecosystem-wide risks from compromised packages. It also explores publishing-side concerns including credential security and emerging solutions like identity-based publishing and provenance verification. Ideal for JavaScript developers wanting to understand and mitigate supply chain risks.