Open Source Malware or a Vulnerability? The Philosophical Debate and How To Mitigate
Talkat KubeCon + CloudNativeCon Europe 2025 · on Thursday, 2025-04-03· at 16:00· Level 1 | Hall Entrance S10 | Room C·
summary
Claims that the ecosystem already hosts 828,000 malicious components and that attackers publish about 18,000 new packages per week (mostly npm, then Python) explain why traditional SCA and AV fail. Concrete incidents include attempted backdoors in XZ utils, a TensorFlow model supply-chain compromise, and an Eclipse “octopus” worm proof‑of‑concept. SBOMs miss a lot — up to 50% files missing from SBOM — so Sonatype-style behavioral detectors and a repository firewall approach are the practical mitigations discussed.
AI-written summary · about
chapters (11)
- 0:00Panelist introduction
- 2:10Software supply chain attacks
- 5:21Supply chain vs vulnerabilities
- 9:14Open source threats today
- 11:21Malicious components rise
- 16:38Why tools fail on open source
- 20:31Fake components dominate
- 22:19Detection tool limitations
- 24:47Behavior-based detection
- 27:14Collaborating with developers
- 28:16Need for info sharing
related talks
33mYour Silent Software Saboteur: Open Source Malware
46mThe Rise of Malware Within the Software Supply Chain
42mHacking the OSS Supply Chain
31mOpen Source Supply Chain Threat Landscape - A Moving Target
41mSponsored Session: Software Supply Chain Threat Landscapes: A Moving Target
18mIT Security – Don’t let Open Source Software become the next menace
32mIs the Internet on Fire? Strategies for Mitigating Open Source...
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy