When the supply chain hits a sour note
summary
Chronicles an npm compromise that led to malicious releases downloaded 2.5 million downloads with only ~$500 stolen, then a Singularity GitHub Actions credential harvest and a Shy Holude self‑replicating worm that backdoored ~800 packages and affected 500+ GitHub users. Describes concrete mitigations: org‑wide repo protections that stopped malicious PRs at Datadog, fine‑grained tokens, MFA, and the new minimum package age / dependabot cooldowns in yarn/pnpm. Emphasizes SBOMs, assigned incident roles, templates, SOPs, and post‑mortem fixes.
AI-written summary · about
chapters (17)
- 0:00Introduction to talk
- 1:04Supply chain attacks overview
- 3:38Chain of fools dependencies
- 4:41Organizing incident response
- 6:49Assigning clear responsibilities
- 8:11Leadership communication
- 9:13Proactive defenses
- 10:40Minimum package age
- 11:02Recovery and monitoring
- 12:07Post-incident retrospective
- 13:12Documenting the incident
- 14:34Writing SOPs
- 15:40Team support and self-care
- 16:25Mandatory fun after incidents
- 18:53Prepare for next attack
- 20:18Resources and playlist
- 22:47Q&A session
related talks
21mSupply Chain Attacks on Open Source: What's Happening, What...
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain
42mProtecting Your GitHub from Supply Chain Attacks
52mGitHub Actions Security: From CI Nightmare to Supply Chain Sentinel
23mProtecting Your npm Dependencies