The Code You Reviewed is Not the Code You Built
summary
Describes the BoltDB typosquat where attackers publish a malicious v1.3.1 to the Go module proxy then retag the GitHub repo to a clean commit so code review would miss the backdoor; the malicious version persists on the mirror for over three years and only one downstream ever used it. Covers TJ Actions and event-stream tactics that exploit mutable git tags and npm semver. Introduces capability analysis with capsoc (SSA/call‑graph/VTA) and notes only 3% of Go updates add a new capability, so pin by commit.
AI-written summary · about
chapters (10)
- 0:00Code review vs build gaps
- 1:06Bolt DB Go malicious package
- 5:20Event stream npm supply chain
- 7:48TJ Actions GitHub tag attack
- 11:17XZ Utils long-con supply chain
- 12:43Build artifacts security source
- 14:10Capability analysis with capsock
- 18:24Detecting new capabilities
- 20:30Go module proxy malicious tags
- 22:15Conclusion
related talks
25mWhen the supply chain hits a sour note
29mTrust, but Verify: Proactive Security in Open Source
35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
43mHow to hack and defend (your) open source
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain
27mStrangerDanger: Finding Security Vulnerabilities Before They Find You
41mThe CVE Blind Spot: Defeating "Hidden EOLs" and Repo Jacking with Engineering Triage & Code Diet
30mHow to hack an Angular app?