Protect Yourself Against Supply Chain Attacks
summary
Pipeline attacks include typo squatting, namespace squatting and injected build-time malware and happen in practice — an npm incident squatted 218 packages and averaged 50 downloads per package (~4,000 installs) in two days. Examples show malicious postinstall scripts and CI runners abused via GitHub Actions or manipulated registry lines; defenses are SCA (Snyk, Dependabot), private proxies (Nexus/Artifactory), MFA and package signing, and producing signed SBOMs (CycloneDX/SPDX) to prove provenance.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 1:41Agenda
- 2:25The Supply Chain
- 4:02Devils Pipeline
- 6:40Supply Chain Confusion
- 7:12Package Squad
- 8:07Namespaces
- 9:23namespace confusion
- 10:06Timelines
- 14:59NPM Audit
- 15:51NPM Autofix
- 16:40MPQ Autofix
- 20:30Attack Examples
- 23:23SCVs
- 25:14Gitbook
- 26:37Inventory
- 35:39Software Composition Analysis
- 39:18Software Package Data Exchange
- 45:57Verification Standard 3
- 48:29Traceability
- 51:00Package Management
- 54:00Component Analysis
- 56:26Provenance Pedigree
related talks
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
35mSupply Chain Attacks: The New Reality
37mSupply Chain Attacks and the Future of Software Delivery
58mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
23mProtecting Your npm Dependencies
21mSupply Chain Attacks on Open Source: What's Happening, What...
15mSoftware Supply Chain Security for those in a rush
15mSupply chain security for dummies