The Risks of Blind Trust in Code from Strangers
summary
Team analyzes close to two million unique open source packages per month with an automated pipeline of over 30 engines plus a package sandbox and human review, and finds concrete supply‑chain attacks: UAParser.js and coa/rc hijacks that add password stealers and miners, node-ipc updates that wipe machines by geolocation, typosquatting and a 900‑package campaign by “LofyGang,” 22 user accounts created on Nov 1 2022, and a StarJacking demo that creates a fake package with 9,000 stars in seconds; they ship an Overlay browser extension to surface risk indicators.
AI-written summary · about
chapters (14)
- 0:00Introduction and background
- 3:21Dependency threats in open source
- 5:55Popular doesn’t mean safe
- 9:28Why you shouldn’t trust what you see
- 14:06Evolving attacker techniques
- 20:30Targeted malicious campaigns
- 24:25Browser extension malware attacks
- 28:59LofyGang attack group exposed
- 30:21Advanced persistent threats explained
- 31:48Malicious vs vulnerable packages
- 32:32Collaboration against supply chain attacks
- 34:40Tools to vet open source packages
- 35:42Overlay browser extension demo
- 36:26Three key takeaways
related talks
34mStranger Danger: Finding Security Vulnerabilities Before They Find You!
25mTrusting Your Open-Source Software Supplier
32mIt's a Jungle Out There! – Open Source Supply Chain Attacks
42mHacking the OSS Supply Chain
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
16mNation-State Threats in the Open-Source Software Supply Chain
13mKeynote: Hacking the OSS Supply Chain