doc: add 2022-10-13 meeting minutes

meetings/2022-10-13.md

@@ -0,0 +1,63 @@
+# Node.js  Security WorkGroup Meeting 2022-10-13
+
+## Links
+
+* **Recording**:  https://www.youtube.com/watch?v=pMv6cyLyVIw&ab_channel=node.js
+* **GitHub Issue**: https://github.com/nodejs/security-wg/issues/837
+* **Minutes Google Doc**: https://docs.google.com/document/d/1vmjLrcVG-bgBg3Iu-U9mEQ8pV0jJjGCFKbORGaval6E/edit
+
+## Present
+
+* Security wg team: @nodejs/security-wg
+* Rafael Gonzaga: @rafaelgss
+* Yagiz Nizipli: @anonrig
+* Ulises Gascon: @ulisesgascon
+* Facundo Tuesca: @facutuesca
+* Zbyszek Tenerowicz: @naugtur
+
+## Agenda
+
+## Announcements
+
+Rafael gave a presentation on Node.js Collab Summit. The presentation consists of an overview of the Security WG and our current initiatives. The slides are available on: Node.js Security WG - Collab Summit
+
+*Extracted from **security-wg-agenda** labelled issues and pull requests from the **nodejs org** prior to the meeting.
+
+- [X] Vulnerability Review - https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues
+
+There is only one issue about a CVE disclosed by zlib. However, this vulnerability has been assessed and does not affect Node.js
+
+### nodejs/TSC
+
+* Re-charter the Ecosystem Security WG [#1081](https://github.com/nodejs/TSC/issues/1081)
+  * Waiting for Michael input
+
+### nodejs/security-wg
+
+* Best Practices Document [#819](https://github.com/nodejs/security-wg/issues/819)
+  * Document permission adjusted. Feel free to ask for permissions in the #nodejs-security-wg slack channel
+  * Final roundtrip to the document
+    * Merged Supply Chain Attacks with Malicious Third-party modules
+    * Zb will include a content about "Why disabling npm postinstall"
+    * Yagiz suggested two new threats to the list
+      * Time based attacks
+      * Memory Heap violation (secure-heap mitigation)
+    * Included two mitigations for DNS Rebinding on inspect protocol
+    * Included Monkey-Patching mitigation (--frozen-intrinsics)
+
+* Automatic check for dependencies' vulnerabilities in Node.js CI [#802](https://github.com/nodejs/security-wg/issues/802)
+
+* Threat Model [#799](https://github.com/nodejs/security-wg/issues/799)
+
+* Permission Model [#791](https://github.com/nodejs/security-wg/issues/791)
+
+* feature request for `require.pure(id)` or `pkg.pure:true` [#467](https://github.com/nodejs/security-wg/issues/467)
+
+## Q&A, Other
+
+## Upcoming Meetings
+
+* **Node.js Project Calendar**: <https://nodejs.org/calendar>
+
+Click `+GoogleCalendar` at the bottom right to add to your own Google calendar.
+