> Markdown version of [/events/conference-india-2026/sessions/1994-supply-chain](https://www.wearedevelopers.com/events/conference-india-2026/sessions/1994-supply-chain). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Supply Chain Security for the Everyday Engineer


- **Event:** Conference India 2026

## Description

On March 31, the Axios npm package was compromised for about 3 hours. Two bad versions shipped with a hidden dependency that pulled a remote access trojan onto Linux, macOS, and Windows. Axios does over 70 million downloads a week. If your CI ran an unpinned install in that window, you found out fast what your incident response looks like.

Three weeks later another npm worm started spreading through stolen publish tokens. Then a PyPI package. Then the Docker images for Checkmarx KICS.

Most engineers can't quickly answer the one question that matters when this happens: are we exposed, and where?
This talk covers the basics most of us never got. What's an SBOM and why should you care? How to read a CVE. What a VEX statement actually does, and how it can save your team a weekend of arguing about whether a CVE even applies.

Then what I actually do. In dev, I catch bad dependencies before they get committed. In CI, I keep the pipeline itself honest. In production, I run on hardened, signed base images. That's where Docker Hardened Images fit in, and I'll share what changed after I switched.

I'll cover the tools I kept, the ones I dropped, and a few things I got wrong the first time.

## Speaker

### [Pradumna Saraf](https://www.wearedevelopers.com/@pradumna-saraf)

Open Source Developer | Docker Captain | Microsoft MVP


## Related talks at this congress

- [What I Got Wrong Shipping an MCP Server for Live Infrastructure](https://www.wearedevelopers.com/events/conference-india-2026/sessions/1999-what-i-got-wrong) — Pritesh Kiri
- [Shipping MCP to Real Users: Scaling, Auth, and the PII Leak You Didn't See Coming](https://www.wearedevelopers.com/events/conference-india-2026/sessions/1993-shipping-mcp-to-real) — Hadar Geva
- [Beware of Strangers Bearing Code: Open Source Trust in the Agent Era](https://www.wearedevelopers.com/events/conference-india-2026/sessions/1978-beware-of-strangers) — Vikram Vaswani
- [How We Cut Our API's p99 Latency from Minutes to Under a Second](https://www.wearedevelopers.com/events/conference-india-2026/sessions/1987-how-we-cut-our-api-s) — Deepak Agrawal

## Watch remotely

Can’t make it to Bengaluru? Watch this session live with Pro. You also get:

- All full videos, bookmarks, and playlists
- World Congress livestreams

[See pricing](https://www.wearedevelopers.com/pricing)

## Links

- [Get tickets](https://www.wearedevelopers.com/conference-india/tickets)