Protect Yourself from Malicious Dependencies with One Cool Trick
summary
A live demo shows a toy site pulling a Rainbow HTML Go package that embeds and executes a binary, and an automated check flags the binary artifact check and blocks the PR. The actual trick is running OSSF Scorecard via a Tekton pipeline triggered from GitHub Actions to enumerate transitive deps and run heuristics. Claims include a public Scorecard dataset for >150,000 repos and a reported ~650% rise in supply‑chain attacks in 2021. Companion tools mentioned: Allstar, depth.dev, Salsa framework and Tekton Chains.
AI-written summary · about
chapters (6)
- 0:00Start
- 5:38Common Attack Types
- 8:31What's the problem?
- 22:22Operation SLSA Teaser
- 22:50Supply Chain Integrity. SLSA
- 36:23SLSA Requirements
related talks
01h 01mAutomating dependency selection with open-source tools at scale
43mHow to hack and defend (your) open source
18mLive Exploiting Your Open Source Dependencies
46mSafely through the dependency minefield using OWASP Dependency Track
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
16mFortify Your Code: Secure Your Supply Chain with Scorecard
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
40mSecuring your dependencies