How to hack and defend (your) open source
summary
Shows concrete attacks and defenses: a fake PyPI package WM connect (200 downloads) and a malicious VS Code add-on mimicking Dracula extension fake payload demonstrate dependency confusion, typosquatting and repo hijacks (one popular npm parser had ~9M weekly downloads when compromised). Recommends automated checks like openSSF Scorecard and scorecard monitor, CI hardening, SBOM use while warning about tooling limits — a 2023 study finds 77 package versions misidentified in SBOM tools.
AI-written summary · about
chapters (10)
- 0:00Welcome and introduction
- 2:15Why open source security matters
- 8:44Open source risk assessment
- 12:45Hacking techniques overview
- 15:57Defending with secure sourcing
- 23:42Build and release security
- 32:18Software Bill of Materials
- 36:18Key takeaways and tools
- 38:28Bonus: Open source security index
- 40:16Q&A session
related talks
25mTrusting Your Open-Source Software Supplier
42mHacking the OSS Supply Chain
13mKeynote: Hacking the OSS Supply Chain
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain
13mKeynote: Hacking the OSS Supply Chain
32mHacking the OSS Supply Chain
44mSlaying the Dragons: A Security Professional’s Guide to...
54mSupply Chain Security for OpenSource Projects