CI Pulled It, Prod Ran It: The Real Risk in Dependency, by GraphsIlkka Turunen
summary
Data from Sonatype-backed Maven Central shows extreme scale and risk: registries serve 9.8 trillion requests in 2025, Maven Central adds ~3 million gavs, and 5% of consumers cause 90% of bandwidth. Typical Java projects have 180 dependencies (300 with npm), creating ~1,800 update decisions yearly. The report finds ~1.2 million malicious packages cataloged by end‑2025 and AI assistants hallucinate dependencies ~30% of the time. EU rules require SBOMs, five years of patches and zero known exploitable vulnerabilities.
AI-written summary · about
chapters (12)
- 0:00Software supply chain risks
- 4:29Open source value
- 10:57Dependency debt
- 13:27Secure component adoption
- 20:32Open source tragedy
- 27:53Build tools and caching
- 33:08Malware in packages
- 38:25Cybercrime behind attacks
- 42:17Developers as malware targets
- 46:52AI dependency hallucinations
- 49:18EU Cyber Resilience Act compliance requirements
- 52:28Q&A
related talks
35mMachines Making Software
21mWhy Building Your Ship (Application) with Raw Materials is a Bad Idea!
32mAdapting DevOps in a World of Growing Software Supply Chain Attacks
37mThe Death Star and the Ultimate Vulnerability
08mAll About Dependencies
38mKnow thy neighbours: dependency management done right.
56mA New Hope for 2023? What Developers Must Learn Next
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance