Keynote: The State of JavaScript Supply Chain Security in 2022
summary
Walks through the October 2021 compromise of ua-parser.js (54 releases, ~7M weekly downloads, used by ~3M GitHub repos) where attacker uses install scripts to run platform-specific payloads: a Linux shell script that fetches a Monero miner and skips CIS countries, and a Windows batch/DLL combo that installs a miner and a DLL password stealer. Covers typo-squats, dependency confusion, DNS-based environment-variable exfiltration, 94% of malicious packages using install scripts, and averages of months-long exposure.
AI-written summary · about
chapters (13)
- 0:00Introduction and agenda
- 1:26Real supply chain attack story
- 7:23Why attacks are increasing now
- 11:55Six supply chain attack techniques
- 17:33Why vulnerability scanning fails
- 19:19Supporting open source maintainers
- 20:01Mindset shift on dependencies
- 21:02Dependency update cadence
- 22:03Auditing dependencies before use
- 23:45New dependency checklist
- 26:33Monitoring pull requests for risks
- 28:16JavaScript security wish list
- 30:44Closing and Q&A
related talks
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
32mIt's a Jungle Out There! – Open Source Supply Chain Attacks
20mKeynote: Securing JavaScript
13mKeynote: Hacking the OSS Supply Chain
30mBroken Links: Emergence and Future of Software-Supply Chain Compromises
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain