Are we Forever Doomed to Software Supply Chain Security?

on YouTube ↗16m

" summary

Open source packages host real exploits: an event-stream backdoor taints a bitcoin wallet for three months, weak maintainer passwords give publish access to 14 high‑download npm modules, and a sudo bug sits undiscovered for ten years. Research finds 61% abandoned npm packages, maintainers take ~100 days to start mitigation, and npm 2FA adoption is 7.1% in 2017 (9% by 2020). CI and package registries prove exploitable in practice.

AI-written summary · about

" chapters (8)

1. 0:00Start
2. 0:21Are We Forever Doomed by Software Supply Chain Risks
3. 3:11How One Developer Perceived the Risks of Open Source Software
4. 5:03Event Stream Incident
5. 9:10How Quickly Do Maintainers Mitigate a Newly Published Security Vulnerability
6. 12:41Humans Often Represent the Weakest Link in the Chain
7. 14:26What Happens When Maintainers Remove Their Packages and Dependencies
8. 14:55Malicious Activities and Assets Can We Track Back To Open Source Software

" related talks

• 16mAre We Forever Doomed to Software Supply Chain Security?Liran Tal · Open Source Summit + Embedded Linux Conference + OSPOCon 2021
• 34mStranger Danger: Finding Security Vulnerabilities Before They Find You!Liran Tal · Voxxed Days Frontend Bucharest 2019
• 23mProtecting Your npm DependenciesChristopher Laughlin · ReactiveConf 2019
• 42mSecuring Your Software Supply ChainDarcy Clarke · OpenJS World 2023
• 47mBlack Clouds and Silver Linings in Node.js SecurityLiran Tal · Voxxed Days Zurich 2019
• 39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?Harish Shankar · FIRST Conference 2026 (FIRSTCON26)
• 42mHacking the OSS Supply ChainStephen Chin · JNation 2022
• 37mThe State of Open Source SecurityLiran Tal · Node+JS Interactive 2019