Nation-State Threats in the Open-Source Software Supply Chain
summary
Phylum’s automated platform monitors seven ecosystems and 40 million packages and uncovers Lazarus Group npm campaigns that target developers with fake job offers; dozens of malicious packages appear from June–Feb 2024 and some are live for mere 90 seconds. Example: heart-hat-cookie trojanized clone of config@3.3.9 uses a pre-install hook that writes and runs package.bat which curls a hard-coded IP to drop a DLL executed via rundll32, aiming to steal crypto; UN-linked estimates put DPRK crypto theft near $3B and 82% of Phylum’s malware finds have no CVE or GitHub advisory.
AI-written summary · about
chapters (6)
- 0:00Introduction and background
- 1:46Heart Hat Cookie attack chain
- 7:26Social engineering and targets
- 9:31Prevalence and other campaigns
- 10:54Defense and detection gaps
- 12:18Q&A session
related talks
32mIt's a Jungle Out There! – Open Source Supply Chain Attacks
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
38mThe Risks of Blind Trust in Code from Strangers
25mTrusting Your Open-Source Software Supplier
42mHacking the OSS Supply Chain
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack