The xz attack highlights how maintainer burnout creates opportunities for malicious actors to gain trust and take over critical open source projects.
The 2017 event-stream hack demonstrates a similar pattern of social engineering and highlights how lucky discoveries often expose these backdoors.
Modern package managers encourage massive dependency trees, which often include outdated or unnecessary packages that increase the attack surface.
Automated tooling is essential for detecting malicious code like protestware by analyzing package behavior for suspicious activities like file deletion or network access.
While updating dependencies protects against known vulnerabilities, updating too quickly can expose you to new, undiscovered supply chain attacks before the community finds them.
Developers must take responsibility for their dependencies by using lock files, leveraging analysis tools, and understanding that open source transparency aids discovery but doesn't guarantee immediate safety.
29:47Thomas Chauchefoin & Paul Gerste
2:08:06Antonio de Mello & Amine Abed
43:56Mauro Verderosa
40:38Anna Bacher
44:30Milecia McGregor
29:34Reto Kaeser
37:32Martin Schmiedecker
45:19Reinhard Kugler
.png?w=240&auto=compress,format)
Jobs that call for the skills explored in this talk.
Peter Park System GmbH
München, Germany
doinstruct Software GmbH
Berlin, Germany
Fraunhofer-Gesellschaft
freiheit.com freiheit.com