Securing Your Node.js Supply Chain: Dependencies, Vulnerabilities and Real-World Fixes
Key Speaker
Technical Lead, Ksolves India Limited
He is a technical lead with hands-on experience in Node.js application security, dependency management, DevSecOps practices, and AI-assisted application modernization for production environments.
In this session, Adnan Mirza, Technical Lead at Ksolves India Limited, addresses a security challenge that most Node.js engineering teams underestimate: your application rarely depends only on the packages listed in your package.json. Every direct dependency brings along its own set of dependencies, creating a software supply chain that is difficult to audit, harder to secure, and easy to overlook until something goes wrong.
Most teams discover dependency vulnerabilities too late, either after a security audit flags them, or after a CVE has already been in production for weeks. The problem is not a lack of tools. npm audit exists. The problem is understanding what those tools are actually telling you, knowing when to apply a fix and when not to, and having a practical strategy for managing dependency risk across a living, evolving codebase.
This webinar walks through real-world examples from Ksolves production environments, including a specific axios CVE that impacted one of our projects and the decisions made to resolve it. Adnan covers the critical difference between npm audit fix and npm audit fix –force, explains how transitive dependencies introduce risk that most developers do not see, and demonstrates how AI can be used to modernize legacy Node.js applications, including a migration from Restify to Express.
If you are building or maintaining Node.js applications, this session gives you practical, experience-backed strategies for improving security without disrupting delivery.
Key Takeaways
- How transitive dependencies work and where vulnerabilities actually come from in Node.js projects.
- A real-world walkthrough of an axios CVE that impacted a production application.
- The difference between npm audit fix and npm audit fix –force, and when to use each.
- Best practices for managing Node.js dependencies securely across production environments.
- How AI can assist with large-scale application modernization, including a Restify to Express migration.
- Practical lessons from securing real Node.js applications in production.
