Supply Chain Attacks on Open Source: What's Happening, What...
summary
Explains how the Shy Halud campaign used phishing and poisoned GitHub Actions caches to add malware to hundreds of popular NPM packages within hours, then used package install scripts to exfiltrate build and dev credentials and multiply across maintainers. Describes concrete mitigations that were built and deployed: cache defaults to read-only, GitHub Actions context-aware checkouts, trusted publishing (workload identity), npm’s approve-scripts and a 3‑day cooldown/staging queue. Focus is operational detail, measured impact, and what actually changed.
AI-written summary · about
chapters (8)
- 0:00Supply chain attacks on open source
- 1:20Shai Hulud attacks on NPM
- 5:30Three-step attack process
- 8:26Credentials exfiltration in attacks
- 10:31Defenses for NPM supply chain
- 13:40Mitigating credential exfiltration
- 15:26Layered security changes
- 17:55Future of open source security
related talks
25mWhen the supply chain hits a sour note
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain
01h 02mProtect Yourself Against Supply Chain Attacks
42mProtecting Your GitHub from Supply Chain Attacks
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack