Sponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
summary
Demonstrates concrete attacks: a malicious pip/npm package exfiltrates SSH keys and environment variables after a simple install, and GitHub Actions pipelines can be hijacked via username renames and repository redirects so a marketplace action becomes attacker-controlled. Reports average 200 days mean time to detect malicious packages, shows a live npm publish CI example, and cites a late‑2021 fix for the flaw. Calls for shared samples, registry verification, and a universal ID for malicious packages.
AI-written summary · about
chapters (4)
related talks
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
01h 02mProtect Yourself Against Supply Chain Attacks
21mSupply Chain Attacks on Open Source: What's Happening, What...
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
37mSupply Chain Attacks and the Future of Software Delivery
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain
25mWhen the supply chain hits a sour note