Supply Chain Attacks: Focused on NPM attacks
summary
Automated scans of 2.1 million npm packages extract 6.7 million emails (600k unique), resolve 132k domains and find 675 expired domains that allow account takeover; follow‑up attribution yields 2,843 vulnerable packages that together have ~250k dependent repos, ~93k dependent packages, ~400k forks and ~50k contributors. A Python/npm‑API pipeline and a CI cron job detect at‑risk maintainers, a GemScanner identifies dependency‑confusion in Ruby, and mitigation priorities are MFA on registry accounts, disable automatic updates for risky packages, npm audit and pipeline checks.
AI-written summary · about
chapters (25)
- 0:00intro
- 1:43preamble
- 1:55about danish
- 2:37disclaimer
- 2:54supply chain
- 3:50software supply chain
- 4:39supply chain attacks
- 6:11npm (node package manager)
- 9:18maintainer email address takeover
- 9:54significance of maintainer email - recently
- 10:53process - attacker's perspective
- 11:32defensive strategy for projects or companies
- 13:49research - wordl-wide-how
- 14:53hassan intro
- 15:58research - npm packages (domains)
- 22:37impact!!!
- 24:48gap that could be filled
- 26:04ruby gems research approach
- 26:56vulnerable ruby gem
- 27:24hardest part!
- 27:43some fun stuff!
- 28:22another tool: script to detect dependency confusion
- 29:11solutions
- 31:58any questions?
- 32:22thank you!
related talks
20mBuilding a Threat Model & How npm Fits Into It
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
23mProtecting Your npm Dependencies
41mMalicious Modules on npm - a series of unfortunate events
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
47mBlack Clouds and Silver Linings in Node.js Security
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack