The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
summary
Shows concrete attacker methods and real incidents: account takeovers on npm that push crypto miners from a 10M-weekly-download ua‑parser release, a March 7 2022 node‑ipc update that conditionally wipes systems in Russia/Belarus, and a RedLy factory that publishes 1,500 malicious packages in one month. Demonstrates a private star‑jacking tool that forges GitHub/npm/pyPI metadata, notes detection averages of 200 days, and points out easy wins like compromised accounts with no 2FA, disposable domains, and subdependency payloads.
AI-written summary · about
chapters (7)
- 0:00Introduction to supply chain attacks
- 3:54Dependencies as the real threat
- 7:01When good packages go bad
- 13:49Attackers building malicious factories
- 20:58Why supply chain attacks are so easy
- 25:34Malicious vs vulnerable packages
- 28:25Call to action and Q&A
related talks
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain
32mHacking the OSS Supply Chain
31mKeynote: The State of JavaScript Supply Chain Security in 2022
30mBroken Links: Emergence and Future of Software-Supply Chain Compromises
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
35mSupply Chain Attacks: Focused on NPM attacks