> Markdown version of [/events/world-congress-2026-north-america/sessions/1958-silent-execution](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1958-silent-execution). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Silent Execution: Defending Against Install-Time Supply Chain Attacks


- **Date:** Friday, Sep 25, 2026
- **Time:** 16:15–16:25 (10 min)
- **Room:** Outdoor Stage
- **Event:** World Congress 2026 North America

## Description

While we often focus on securing the React Native bridge or runtime data, the most immediate threat to your project might execute before you even hit "build." In early 2026, the "Glassworm" attacks proved that a developer’s environment can be compromised in seconds through malicious npm lifecycle scripts that exfiltrate credentials during a standard installation. This 15-minute technical deep dive breaks down the mechanics of install-time malware, analyzes why standard audit tools often miss these exploits, and provides a concrete roadmap for hardening your local environment and CI/CD pipelines using script-blocking strategies and behavioral monitoring.

## Speaker

### [Chris DeMars](https://www.wearedevelopers.com/@chris-demars)

Senior Developer Advocate at TuxCare


## Related talks at this congress

- [Your registry can't stop a valid login. What happens then?](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1755-your-registry-can-t) — Khushboo Verma
- [Supply Chain Security When Agents Write the Code](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1920-supply-chain) — Ajeet Raina
- [Stop Running Mystery Meat in Production](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1726-stop-running-mystery) — Jeroen van Erp
- [Secure development from pull request to production with GitHub](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1881-secure-development) — Sam Jarvinen

## Watch remotely

Can’t make it to San José? Watch this session live with Pro. You also get:

- All full videos, bookmarks, and playlists
- World Congress livestreams

[See pricing](https://www.wearedevelopers.com/pricing)

## Links

- [Get tickets](https://www.wearedevelopers.com/world-congress-north-america/tickets)