The xz attack highlights how maintainer burnout creates opportunities for malicious actors to gain trust and take over critical open source projects.
The 2017 event-stream hack demonstrates a similar pattern of social engineering and highlights how lucky discoveries often expose these backdoors.
Modern package managers encourage massive dependency trees, which often include outdated or unnecessary packages that increase the attack surface.
Automated tooling is essential for detecting malicious code like protestware by analyzing package behavior for suspicious activities like file deletion or network access.
While updating dependencies protects against known vulnerabilities, updating too quickly can expose you to new, undiscovered supply chain attacks before the community finds them.
Developers must take responsibility for their dependencies by using lock files, leveraging analysis tools, and understanding that open source transparency aids discovery but doesn't guarantee immediate safety.
Sensory-Minds GmbH
Offenbach am Main, Germany
Hubert Burda Media
München, Germany
26:28Anna Oliveira
29:47Thomas Chauchefoin & Paul Gerste
44:30Milecia McGregor
43:56Mauro Verderosa
40:38Anna Bacher
27:10Sonya Moisset
43:57Zbyszek Tenerowicz
44:11Raul Onitza-Klugman & Kirill Efimov
.png?w=240&auto=compress,format)
Jobs that call for the skills explored in this talk.
Punk Security Ltd.
Core4ce LLC
Discord Inc.
Port Zero GmbH
Berlin, Germany
