Trusting Your Open-Source Software Supplier
summary
Maps open source use to NIST SSDF and SP 800-161 and walks SBOM requirements to real attacks: scans across npm PyPI Maven et al. find 18,000 packages executing code on install, 12,000 packages calling direct IPs, ~2,200 typo‑squats and ~800,000 spam packages; a campaign registers 899 typo‑squats around ccxt, uses Unicode obfuscation to hide a clipboard‑stealer that drops the WASP credential stealer, and enables dependency‑confusion; research and mitigation notes live on Phylum’s blog.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:25Defining OSS suppliers
- 3:56Supply chains versus physical
- 8:27Government mandates and risks
- 10:122023 attack trends
- 13:45SBOMs and VEX limits
- 16:17Typo squatting solutions
- 19:47Protecting developers
- 24:24Q&A
related talks
42mHacking the OSS Supply Chain
43mHow to hack and defend (your) open source
13mKeynote: Hacking the OSS Supply Chain
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
13mKeynote: Hacking the OSS Supply Chain
38mThe Risks of Blind Trust in Code from Strangers
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
32mIt's a Jungle Out There! – Open Source Supply Chain Attacks