Slaying the Dragons: A Security Professional’s Guide to...
summary
Open source dependencies supply 70–90% of an app and attackers exploit that scale with typosquatting, author impersonation, obfuscated multi‑stage payloads and automation. Specific cases show a Go module mirror cache poisoned by a cloned BoldDB repo, npm campaigns that mass‑publish about 280 packages and use Ethereum smart contracts as decentralized C2, PyPI packages dropping client.exe and exfiltrating to Discord or Gmail, and widespread abuse of postinstall scripts. Defenses require automated vetting, allowlists and registry cooperation.
AI-written summary · about
chapters (11)
- 0:00Introduction to talk
- 1:24Open source dependency risks
- 9:28Code repository abuse in Go
- 15:00Typosquatting in npm
- 22:37Multi-stage malware in npm
- 26:35Legitimate services as exfiltration
- 31:49AI-generated malicious code in Java
- 33:35Malware in Python packages
- 35:02Ruby gems reconnaissance abuse
- 37:09Defense strategies for malicious packages
- 38:56Q&A on malicious package research
related talks
27mStrangerDanger: Finding Security Vulnerabilities Before They Find You
43mHow to hack and defend (your) open source
37mAI-Powered Slopsquatting: Is Your Software Supply Chain Compromised?
13mKeynote: Hacking the OSS Supply Chain
35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
42mHacking the OSS Supply Chain
52mBest Practices for Developers to Master Security
25mTrusting Your Open-Source Software Supplier