Inside Today’s AI-Accelerated Software Supply Chain Attacks
summary
Aikido Security claims it first uncovers major incidents like the Shai-Hulud self‑propagating worm, the mass npm compromises of debug and chalk, and a backdoored XRP SDK; analysis finds 216 undisclosed vulnerabilities in popular projects and about 6,000 malicious packages per month. Key lessons: CVE/NVD disclosure lags ~3 months, debug’s compromise affects 2.6 billion weekly downloads with a 4.5‑hour malware window, and mitigation uses a hybrid static + LLM pipeline plus policies like minimum package age and the open‑source Aikido SafeChain.
AI-written summary · about
chapters (10)
- 0:00Supply chain attacks intro
- 1:35Modern software supply chain
- 7:51Package compromise debug
- 13:30CVE databases limitations
- 20:13Malware detection before spread
- 29:19AI in malware creation/detection
- 34:38Shahalude self-propagating worms
- 49:05Glassworm invisible attacks
- 53:42Preventing supply chain attacks
- 55:29Q&A
related talks
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
13mKeynote: Hacking the OSS Supply Chain
37mAI-Powered Slopsquatting: Is Your Software Supply Chain Compromised?
46mThe Rise of Malware Within the Software Supply Chain
41mHow to protect your software project from supply chain security threats
16mAre We Forever Doomed to Software Supply Chain Security?