Worms in our software supply chain - Where do we go from here?
summary
Open-source registries see fast-moving worms that compromise accounts via command-injection in GitHub Actions, pull NPM tokens and seed systems with an LLM or trufflehog-based scanner to harvest secrets, then exfiltrate by creating public repos. Incidents include about 1,400 public repos with 1,100 still-valid tokens, 180+ then ~1,000 packages wormed, ~33,000 exposed secrets (300k reachable, ~3,700 validated) and a separate extension theft of $8.5M from Trust Wallet. PNPM 24‑hour delays and registry moderation are practical mitigations.
AI-written summary · about
chapters (12)
- 0:00Introduction and trust disclaimers
- 3:33Defining software dependencies and trust
- 9:55Supply chain attacks timeline and their impact
- 21:25NX supply chain attack and its technical details
- 27:53The Shai-Hulud worm and its spread
- 35:22Shai-Hulud’s second wave and GitHub token exfiltration
- 42:07GitHub’s impossible choice and the human cost
- 46:48Trust Wallet crypto theft and ecosystem flaws
- 48:54Why the current ecosystem enables these attacks
- 51:05The role of LLMs and open source trust
- 57:29The need for moderation and collective defense
- 1:00:15Where do we go from here and Q&A
related talks
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
25mWhen the supply chain hits a sour note
32mIt's a Jungle Out There! – Open Source Supply Chain Attacks
17mIs My (Open Source) Project Safe?
29mWorms, Tokens, and Trust The Industrialization of Supply Chain Attacks
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
21mSupply Chain Attacks on Open Source: What's Happening, What...
30mBroken Links: Emergence and Future of Software-Supply Chain Compromises