Building Community-Driven Security Analysis for Your .NET Software Supply Chain
summary
Explains concrete tools and results: an open-source CLI called Fennec Labs that runs OSS Scorecards on solution dependencies, flags transitive CVEs (now surfaced by .NET 10 CLI), instruments NuGet packages to dump API calls, and compares IL to verify reproducible builds between locally built and NuGet artifacts. Demonstrates detecting homoglyph/malicious packages, spotting unmanaged DLLs inside packages, and outlines automatable fuzzing + Roslyn analyzer hooks that mark risky API flows for actionable, developer-friendly alerts.
AI-written summary · about
chapters (13)
- 0:00Community-driven security analysis
- 3:32Challenges in .NET packages
- 8:25Vulnerabilities in transitive deps
- 11:13Malicious packages and risks
- 15:03Best practices for supply chain
- 18:09Microsoft's SCC Framework
- 21:35OpenSSF Scorecards for deps
- 26:37Fenic Labs dependency auditing
- 31:10Reproducible builds and IL
- 36:12Static analysis of .NET DLLs
- 40:25Future automated security ideas
- 44:55Dashboards and community insights
- 47:44Conclusion
related talks
59mReviewing NuGet Packages security easily using OpenSSF Scorecard
57mReviewing NuGet Packages security easily using OpenSSF Scorecard
57mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
56m.NET supply chain: Protecting against hidden threats
58mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
58mSecuring your .NET application software supply chain
54mAssessing NuGet Packages more easily with Security Scorecards
46m.NET supply chain: Protecting against hidden threats