Feross Aboukhadijeh

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

A malicious actor gained trust over years to inject a backdoor into a core utility. The xz attack reveals a critical, deep-rooted flaw in open source security.

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor
#1about 5 minutes

How the xz backdoor exploited maintainer burnout

The xz attack highlights how maintainer burnout creates opportunities for malicious actors to gain trust and take over critical open source projects.

#2about 4 minutes

A historical parallel with the event-stream NPM hack

The 2017 event-stream hack demonstrates a similar pattern of social engineering and highlights how lucky discoveries often expose these backdoors.

#3about 9 minutes

The growing problem of dependency bloat and rot

Modern package managers encourage massive dependency trees, which often include outdated or unnecessary packages that increase the attack surface.

#4about 10 minutes

Detecting protestware and other malicious behaviors

Automated tooling is essential for detecting malicious code like protestware by analyzing package behavior for suspicious activities like file deletion or network access.

#5about 4 minutes

The critical trade-offs of auto-updating dependencies

While updating dependencies protects against known vulnerabilities, updating too quickly can expose you to new, undiscovered supply chain attacks before the community finds them.

#6about 10 minutes

Taking responsibility for your software supply chain

Developers must take responsibility for their dependencies by using lock files, leveraging analysis tools, and understanding that open source transparency aids discovery but doesn't guarantee immediate safety.

Related jobs
Jobs that call for the skills explored in this talk.

Matching moments

How malicious actors infiltrate open source projects
02:00 MIN

How malicious actors infiltrate open source projects

Reviewing 3rd party library security easily using OpenSSF Scorecard

How developers can become malware distribution vehicles
02:39 MIN

How developers can become malware distribution vehicles

Stranger Danger: Your Java Attack Surface Just Got Bigger

Developers as an unintentional malware distribution vehicle
03:36 MIN

Developers as an unintentional malware distribution vehicle

Walking into the era of Supply Chain Risks

How attackers exploit developers and packages
05:43 MIN

How attackers exploit developers and packages

Vue3 practical development

Common attacks targeting software developers
05:49 MIN

Common attacks targeting software developers

Vulnerable VS Code extensions are now at your front door

Human factors in open source supply chain risk
06:09 MIN

Human factors in open source supply chain risk

Stranger Danger: Your Java Attack Surface Just Got Bigger

Exploring specific web vulnerabilities and filtering issues
03:17 MIN

Exploring specific web vulnerabilities and filtering issues

WeAreDevelopers LIVE - Chrome for Sale? Comet - the upcoming perplexity browser Stealing and leaking

The critical role of human observation in security
01:07 MIN

The critical role of human observation in security

Answering the Million Dollar Question: Why did I Break Production?

Featured Partners

Related Videos

See all videos
Security Blindspots and How to Learn About Them - Anna Oliveira26:28

Security Blindspots and How to Learn About Them - Anna Oliveira

Anna Oliveira

You click, you lose: a practical look at VSCode's security29:47

You click, you lose: a practical look at VSCode's security

Thomas Chauchefoin & Paul Gerste

Securing Your Web Application Pipeline From Intruders44:30

Securing Your Web Application Pipeline From Intruders

Milecia McGregor

Getting under the skin: The Social Engineering techniques43:56

Getting under the skin: The Social Engineering techniques

Mauro Verderosa

How to Cause (or Prevent) a Massive Data Breach- Secure Coding and IDOR40:38

How to Cause (or Prevent) a Massive Data Breach- Secure Coding and IDOR

Anna Bacher

The attacker's footprint2:08:06

The attacker's footprint

Antonio de Mello & Amine Abed

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks27:10

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks

Sonya Moisset

Oops! Stories of supply chain shenanigans43:57

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

Related Articles

View all articles
CH
Chris Heilmann
Dev Digest 110 - XY marks the spotty security
This time we give you a collection of links about the XZ backdoor, solve the last CODE100 puzzle, announce the next round of it, let you play with colours and explain why Lava lamps are great to keep the web secure.News and ArticlesThe big piece of n...
Dev Digest 110 - XY marks the spotty security
DC
Daniel Cranney
The Overflow: Security and Privacy
Every week we dig through hundreds of links from all over the web, and it’s often hard for developers keep up. So, we thought we’d put together some links we couldn’t fit in the Dev Digest in what we call The Overflow. This week, we’re looking at wha...
The Overflow: Security and Privacy
DC
Daniel Cranney
Dev Digest 206: X Algorithm, Super Monkey Ball, Moltbot vs. Security
Inside last week’s Dev Digest 206 . 👀 How X chooses what you see 🟨 Building a JavaScript runtime in a month and a browser API in one shot 🔲 JavaScript frameworks heading into 2026 ⚠️ AI is getting better at detecting security issues 🔓 Moltbot is a s...
Dev Digest 206: X Algorithm, Super Monkey Ball, Moltbot vs. Security

From learning to earning

Jobs that call for the skills explored in this talk.