The Phantom Vulnerability: A Node.js Ghost Story [BSides Bangalore]

How AI Helped Solve the Mystery in Hours, Not Weeks

Transcript

1. The Phantom Vulnerability: A Node.js Ghost Story How AI helped solve the mystery in hours, not weeks SHIVAM SARASWAT WWW.BSIDESBANGALORE.IN Powered By
2. ABOUT THE SPEAKER Shivam Saraswat Senior Cybersecurity Engineer, PayPal 4+ years leading DevSecOps and cybersecurity at PayPal, IKEA, Tekion, and BreachLock. Container Security Supply Chain Security SAST SCA CI/CD Security #ACSC2026 WWW.BSIDESBANGALORE.IN
3. AGENDA Today’s Journey 01 The initial alarm A critical vulnerability surfaces in our Node.js app 02 Unravelling the puzzle Go binaries in a pure JavaScript codebase 03 AI as a catalyst Claude navigates 1,247 packages in minutes 04 The key insight The root cause that stumped traditional tools 05 Multi-stage Docker builds Isolating build tools from the production image 06 Dramatic results 2–3 weeks of work compressed into 3 hours 07 Trust but verify Human validation of every AI finding 08 Your AI workflow A 4-step framework for AI-assisted security #ACSC2026 WWW.BSIDESBANGALORE.IN
4. MONDAY, 9:00 AM The Monday Morning Alert CRITICAL ALERT 12 high-severity vulnerabilities package: @esbuild/linux-x64 language: Golang CVSS: 7.2 — HIGH OUR TECH STACK Next.js 15.4.7 React 18.3.1 TypeScript 100% JavaScript / TypeScript Where is the Go coming from? #ACSC2026 WWW.BSIDESBANGALORE.IN
5. THE HAYSTACK The Investigation Challenge THE MANUAL WAY Ctrl+F through 26,172 lines of package-lock.json Google each of 1,247 packages Read documentation, one repo at a time Build the dependency tree by hand 2–3 weeks THE AI-ASSISTED WAY Upload package.json + package-lock.json Ask specific, targeted questions Get full dependency traces instantly 3 hours — 30× faster #ACSC2026 WWW.BSIDESBANGALORE.IN
6. MONDAY, 9:30 AM Asking AI for Help MY MESSAGE TO CLAUDE “I’ve uploaded our package.json and package-lock.json. Security scan shows Golang vulnerabilities but we only use JavaScript. Can you trace where these Go binaries are coming from ?” Then I waited — hoping for answers that would normally take weeks to uncover. #ACSC2026 WWW.BSIDESBANGALORE.IN
7. MONDAY, 9:35 AM — 5 MINUTES LATER AI’s Breakthrough: The Trace — your application ↓ @xyz/xy-react internal component library ↓ @vanilla-extract/next-plugin CSS-in-JS ↓ @vanilla-extract/integration ↓ esbuild@0.25.5 Go-based JS bundler ↓ 24 platform-specific Go binaries ↓ @esbuild/linux-x64 ← the vulnerability CLAUDE’S EXPLANATION esbuild is a Go-based JavaScript bundler used by vanilla-extract for CSS processing at build time. 5 minutes to a full root-cause trace — the breakthrough moment #ACSC2026 WWW.BSIDESBANGALORE.IN
8. THE KEY INSIGHT Build Time vs Runtime MY FOLLOW-UP “Is this actually used in our code?” CLAUDE’S ANSWER “I searched your codebase… no direct usage in your application code.” Only @xyz/xy-react uses vanilla-extract internally. esbuild runs only during npm run build × Not during production runtime × Not in your HTTP request path × Not serving user traffic Like a hammer in your closet: present, but harmless unless used. #ACSC2026 WWW.BSIDESBANGALORE.IN
9. THE SOLUTION Multi-Stage Docker Builds BEFORE — SINGLE STAGE Build tools and production code shipped together in one image. image: 1.28 GB esbuild: present alerts: 12 HIGH AFTER — MULTI-STAGE Build stage uses esbuild; production stage ships only compiled output. image: 524 MB (↓59%) esbuild: absent alerts: 3 (↓75%) #ACSC2026 WWW.BSIDESBANGALORE.IN
10. LIVE DEMO $ npm ls esbuild_ #ACSC2026 WWW.BSIDESBANGALORE.IN
11. THE RESULTS Hours, Not Weeks TRADITIONAL APPROACH Week 1 — manual dependency analysis (40 h) Week 2 — research solutions and patches (30 h) Week 3 — testing and documentation (20 h) ~90 hours AI-ASSISTED APPROACH Hour 1 — AI finds root cause, traces the chain Hour 2 — AI suggests solutions Hour 3 — we test, verify, and document 3 hours — 30× faster #ACSC2026 WWW.BSIDESBANGALORE.IN
12. WE DIDN’T BLINDLY TRUST AI Trust But Verify Ran the commands ourselves npm ls esbuild · find node_modules -name esbuild Confirmed AI’s findings exactly Checked the line numbers L10525: @vanilla-extract/integration → esbuild L14318: esbuild with 24 Go binaries All accurate Tested the solution removed @vanilla-extract/next-plugin Build still works — unused dependency Verified in Docker built the multi-stage container No esbuild in the production image AI accelerates. Humans validate. #ACSC2026 WWW.BSIDESBANGALORE.IN
13. HOW YOU CAN DO THIS Your AI Investigation Workflow 01 Gather context Upload package.json and the lockfile Share scan results and error messages Provide relevant logs 02 Ask specific questions “Trace where [package] comes from” “Is [dependency] used in my code?” Avoid: “fix my security” — too vague 03 Verify everything Run the suggested commands Check line numbers, test solutions Cross-reference documentation 04 Document & share Save the AI conversations Share findings with your team Build institutional knowledge #ACSC2026 WWW.BSIDESBANGALORE.IN
14. THE BIGGER PICTURE It’s Not Just Go GO esbuild — bundler with 24+ platform packages @esbuild/linux-x64, @esbuild/darwin-arm64… Used by Vite, Parcel, vanilla-extract RUST — most dominant @swc/core — TS/JS compiler, 19M dl/wk lightningcss — CSS parser, 22M dl/wk Turbopack (Next.js 16), Rolldown (Vite 7), Biome, Oxlint C / C++ sharp — image processing on libvips @img/sharp-linux-x64, @img/sharp-darwin… node-gyp native addons By 2026, nearly every major JavaScript build tool has a Rust-based rewrite. #ACSC2026 WWW.BSIDESBANGALORE.IN
15. DELIVERY MECHANISMS How Binaries Enter Your App 1 optionalDependencies safest npm resolves the right platform package at install. No scripts, no external downloads. esbuild, SWC, lightningcss, sharp. 2 postinstall script install-time code execution Runs on npm install, fetches a binary from GitHub Releases. @sentry/cli, hookdeck-cli, older sharp. 3 node-gyp addon build-time code execution from source C/C++ compiled during installation; needs Python + gcc/MSVC. better-sqlite3, bcrypt, canvas. WHAT THE SCANNER SEES All three land binary files in node_modules Scanner reads the embedded runtime version string Flags CVEs against the Go / Rust / libvips version Alert fires in a JS app with no JS vulnerability #ACSC2026 WWW.BSIDESBANGALORE.IN
16. SAME ALERT, THREE REALITIES The Risk Spectrum FALSE POSITIVE our esbuild case Build-time tool, never runs in production. The CVE targets the Go runtime, not your app. Multi-stage Docker removes it entirely. REAL BUT MANAGEABLE postinstall download Upstream release could be compromised. Pin exact versions, verify SHA256 checksums, use pnpm onlyBuiltDependencies or npm v12 allowlists. ACTIVE THREAT supply chain attack Same postinstall pattern, malicious intent: 33 packages ran credential recon at install (May 2026); the Shai-Hulud worm self-propagated across 500+ packages. The scanner fires the same alert for all three. Context + dependency tracing = correct severity. #ACSC2026 WWW.BSIDESBANGALORE.IN
17. HARDENING IN PROGRESS The Ecosystem Response npm v12 2026 postinstall scripts blocked by default No automatic Git / remote URL resolution Explicit opt-in for all lifecycle scripts pnpm v10+ Lifecycle scripts disabled by default onlyBuiltDependencies: [esbuild, sharp] allowBuilds: per-package granular control TOOLING ITSELF Know your binary. Know your risk level. Multi-stage Docker removes it either way. #ACSC2026 WWW.BSIDESBANGALORE.IN esbuild strips Go version metadata to prevent false-positive CVEs Turbopack: falls back to WASM when no native binding Multi-stage Docker is standard practice
18. TAKEAWAYS 3 Big Lessons 1 Polyglot dependencies are normal Build tools are written in Go and Rust for speed. 30–40% of JS apps ship native binaries. Not a bug — the modern ecosystem. 2 AI makes analysis dramatically faster What took weeks now takes hours, and deeper investigations become possible. Always verify the results yourself. 3 Context changes everything Build-time is not runtime risk. Multi-stage builds solve most of these — and ask whether you need the dependency at all. #ACSC2026 WWW.BSIDESBANGALORE.IN
19. FREE TOOLS Try It Today! Claude.ai Free tier available — great for file analysis and dependency tracing ChatGPT Free tier available GitHub Copilot Great for code-focused security work #ACSC2026 WWW.BSIDESBANGALORE.IN
20. STAY IN TOUCH Let’s Connect! WEB shivamsaraswat.com X / TWITTER @thecybersapien LINKEDIN shivamsaraswat GITHUB shivamsaraswat #ACSC2026 WWW.BSIDESBANGALORE.IN
21. THANK YOU Questions? Powered By