🛡️ Notes

🕘 9:15 AM — Opening Remarks

Duration: 15 min

Short welcome and introduction.

🕤 9:30 AM — Keynote: Breaking the Chain

Speaker: Roni “Lupin” Carta

Duration: 45 min

Theme

Supply chain security and the rise of attacks across npm, nx, and ghost.

Key Topics

🔹 SLSA Standards

Baseline framework for securing the software supply chain.

🔹 Offensive Supply Chain Techniques

Source Layer

• Dependency Confusion:

  When a package manager installs a public package instead of a private one.

  • Examples: Fortune 500, HashiCorp Consul.
  • Attackers upload malicious packages that get executed internally.

• npx Confusion:

  Package name ≠ binary name.

  If the binary isn’t found, npx may temporarily install and execute a malicious package.

• Maintainer Account Takeover:

  • Buying expired domains → reclaiming MX records.
  • Triggering GitHub password resets to hijack maintainer accounts.