Supply Chain Shenanigans
Todor Todorov
Senior Software Engineer, Payhawk
I am a software engineer with more than 15 years of experience. I have worked with different technologies and tech stacks. I have helped teams through their DevOps transformation journey.
I have also been a public speaker for 6 years and have given talks at conferences and meetups in Bulgaria and abroad.
My passions are clean code, cyber security, and DevOps.
In today’s interconnected digital world, the security of software supply chains has never been more critical. This session delves into the dark corners of software package ecosystems, using npm and NuGet as examples. We’ll explore real-world incidents of supply chain attacks, illustrating how attackers have successfully infiltrated various platforms to distribute malicious packages.
Key topics include:
1. Types of Supply Chain Attacks: Understanding the various attack vectors such as dependency confusion, typosquatting, and malicious package insertion.
2. Case Studies: Mention of recent attacks on npm and NuGet, providing a broad idea of how some of these attacks were carried out.
3. Attack Mechanisms: Step-by-step breakdown of how attackers create and distribute seemingly harmless packages with malicious payloads, open pull requests to popular repositories, and ultimately exploit these to harvest sensitive data.
4. Mitigation Strategies: Best practices for developers and organizations to protect their projects, including dependency management, using private package repositories, and educating developers on the risks and detection of supply chain attacks.
Join me to learn how to safeguard your projects against these insidious threats and ensure the integrity of your software supply chain.