Keynote: Hacking the OSS Supply Chain

on YouTube ↗13m

" summary

Chronicles major supply chain breaches and adds concrete data: Apache Struts leads to $1.4B cleanup and 143M affected, SolarWinds shows a TeamCity-built binary replacement, and Log4Shell forces mass Java updates. Demonstrates dependency confusion attack (Alex Birsan) that nets ~$130k in bounties and recommends using an artifact manager to block unintended public packages. JFrog scans ~300,000 PyPI packages, flags 6,000 potential hits and finds obfuscated malware, typo‑squatting across 218 packages, and points to persia as a blockchainish multi‑node verification approach.

AI-written summary · about

" chapters (8)

1. 0:00Introduction to OSS supply chain
2. 1:25Famous OSS supply chain hacks
3. 3:09Default behavior of package managers
4. 5:19Dependency confusion attacks
5. 7:47How PyPI works and risks
6. 9:33Malicious packages and typosquatting
7. 10:35Community efforts and solutions
8. 11:59Call to action for developers

" related talks

• 13mKeynote: Hacking the OSS Supply ChainMelissa McKay · cdCon 2022
• 32mHacking the OSS Supply ChainStephen Chin · Devnexus 2022
• 42mHacking the OSS Supply ChainStephen Chin · JNation 2022
• 11mKeynote: Securing Open SourceDavid A. Wheeler · Cloud Native Security Day Europe 2021
• 32mBreaking the Chain: Advanced Offensive Strategies in Software Supply ChainLupin · HackAICon 2025
• 41mSponsored Session: Software Supply Chain Threat Landscapes: A Moving TargetBrian Fox · SupplyChainSecurityCon at Open Source Summit North America 2022
• 10mHacking the OSS Supply ChainStephen Chin · Continuous Delivery Summit 2022
• 58mAttacking through the Software Supply ChainFelix Leder · NDC Security 2023