Code Red: When Your Tools Turn Against You

Did you ever wonder what typosquatting, dependency confusion, malicious maintainers, or shadow libraries really mean, and how they could compromise your applications without a single line of your own code being wrong?

Welcome to the hidden war zone of modern software development: the software supply chain. In this workshop, we’ll demystify the most dangerous and fast-evolving attack vectors that are targeting developers through the tools they trust, package managers, build systems, third-party libraries, and CI/CD pipelines. Through real-world case studies and code-level examples, we’ll unpack how: Attackers exploit developer mistakes with typosquatting. Internal dependencies are hijacked via dependency confusion. Maintainers or compromised packages introduce malware into trusted ecosystems. Obscure transitive dependencies become silent backdoors.

This session is designed for developers who want to understand the risks, recognize the signs, and start building defense-in-depth strategies. If time permits, we’ll get hands-on with practical exercises where you’ll see (and maybe try) some of these attack techniques in a controlled environment—so you can learn how to defend against them in the wild. Come prepared to rethink your assumptions about open source and start building a more resilient development workflow.