Exploiting Vulnerabilities and Flaws to Attack Supply Chain
summary
Demonstrates concrete exploits and fixes across IDE, SCM, registry, CI/CD and artifact stages: an impersonating VSCode extension (Prettier typo) nets >1,000 installs in 48 hours; Semgrep and Backstabber patterns find extensions that fetch and eval remote code; repojacking analysis of 1.25M GitHub names finds ~37,000 vulnerable repos (~3%); Travis CI logs expose ~770M public logs (1% sample yields 73,000 secrets, ~50% still valid); NPM had package-planting fixed by invite confirmation and a timing attack leaks private-package existence (600ms vs <100ms).
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:21The Development Flow
- 2:46Code Editors & IDE
- 3:55Malicious npm Packages
- 4:54The Comparison
- 8:07Verified on the Marketplace
- 11:44Secret Scanning
- 12:32Mitigations and Recommendations
- 14:13What is Repojacking
- 15:12Restrictions and Bypasses
- 15:51Exploitation Scenarios
- 16:39Example - Installation Guide
- 17:38Example - Link in the Code
- 20:39What is Package Planting?
- 22:01The Patch: Confirmation Mechanism
- 28:04Executing a Timing Attack on npm
- 31:09Summary
related talks
35mBreaking the Chain: An Attacker's Perspective on Supply Chain Vulnerabilities and Flaws
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain
43mHow to hack and defend (your) open source
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
34mStranger Danger: Finding Security Vulnerabilities Before They Find You!
32mHacking the OSS Supply Chain
13mKeynote: Hacking the OSS Supply Chain
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack