Sponsored Session: Software Supply Chain Threat Landscapes: A Moving Target
summary
Open source consumption hits billions of downloads (Maven Central ~600 billion) and attackers move from exploiting old CVEs to typosquatting and attacking dev infrastructure. Sonatype builds ML/AI models plus a repository firewall that flags anomalous publishes and blocks downloads in real time, and the team reports 87,000 malicious packages detected in a year. Supply chain incidents spike (216→1,100→+650%) after disclosures and dependency confusion and about 40% still download vulnerable log4j versions.
AI-written summary · about
chapters (5)
- 0:00Start
- 4:51Chevy Cobalt
- 9:39Equifax Attacks
- 15:42Creating Opportunities
- 21:08The Dependency Confusion Attack
related talks
31mOpen Source Supply Chain Threat Landscape - A Moving Target
32mAdapting DevOps in a World of Growing Software Supply Chain Attacks
13mKeynote: Hacking the OSS Supply Chain
13mKeynote: Hacking the OSS Supply Chain
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
37mSupply Chain Attacks and the Future of Software Delivery
46mThe Rise of Malware Within the Software Supply Chain
18mSecuring Open Source in Nomura’s Software Supply Chain