The elephant in the room dependencies: securing your software supply chain
summary
Attackers target transitive packages by social engineering maintainers—earning trust with many benign PRs then slipping in a few malicious lines inside a large feature change; example: js-tokens transitive dependency sits under React (175k vs 272 GitHub stars). Past incidents: event-stream/flatmap-stream compromise impacted hundreds of thousands of packages; dependency confusion let attackers publish internal package names to public registries. Proposed mitigation is the salsa levels 0–4 framework with provenance, scripted builds, reproducible artifacts and a GitHub Action provenance integration plus Azure DevOps support.
AI-written summary · about
chapters (5)
- 0:00Start
- 3:45Optimize for the Path of Least Resistance
- 6:20How an Attacker Might Target a Software Supply Chain
- 9:22Maintainer Burden
- 24:19Can I Gain Unauthorized Access to Your Code
related talks
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
42mSecuring Your Software Supply Chain
25mWhen the supply chain hits a sour note
34mStranger Danger: Finding Security Vulnerabilities Before They Find You!
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
23mProtecting Your npm Dependencies
27mStrangerDanger: Finding Security Vulnerabilities Before They Find You