Hacking the OSS Supply Chain
summary
Enterprise code bases use roughly 80–90% open source and attackers exploit package ecosystems. Research scans 300,000 PyPI packages and flags 6,000 suspicious PyPI packages, two obfuscated malware packages total about 30,000 downloads, and npm typo‑squatting publishes 218 npm typo-squat packages that exfiltrate developer data. Dependency confusion earned researchers $130,000 bug bounties. Proposed defenses include SBOMs, reproducible multi-node build verification, and a peer-to-peer verified binary network for tamper‑resistant distribution.
AI-written summary · about
chapters (10)
- 0:00Start
- 9:25DEPENDENCY CONFUSION ATTACK
- 9:39PACKAGE MINING
- 16:57BROWSER AUTOFILL
- 17:48CREDIT CARD STEALER
- 25:14SUPPLY-CHAIN LEVELS FOR SOFTWARE ARTIFACTS
- 28:04PYRSIA BINARY DISTRIBUTION NETWORK
- 29:14MULTI-NODE VERIFICATION OF BUILDS
- 30:12IMMUTABLE TRANSPARENCY LEDGER
- 32:27DECENTRALIZED PACKAGE NETWORK
related talks
10mHacking the OSS Supply Chain
13mKeynote: Hacking the OSS Supply Chain
32mHacking the OSS Supply Chain
25mTrusting Your Open-Source Software Supplier
13mKeynote: Hacking the OSS Supply Chain
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
43mHow to hack and defend (your) open source
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks