WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 North America • Sep 26, 2026 • Session details

Silent Execution: Defending Against Install-Time Supply Chain Attacks

Chris DeMars

Are your npm install scripts silently stealing your GitHub tokens? Discover how malware like Glassworm exploits standard package managers and learn to harden your pipelines against install-time attacks.

Silent Execution: Defending Against Install-Time Supply Chain Attacks thumbnail

Checking access…

Playback and chapters load privately for Free videos.

Matching moments

2:56 min

Managing risks in CI/CD pipelines and supply chains

Christian Heilmann Christian Heilmann +1 · World Congress 2026 North America

3:50 min

Mitigating supply chain attacks via automated post-install hooks

Chris Heilmann Chris Heilmann +2 · LIVE

2:32 min

Dependency risks in widespread NPM supply chain attacks

Chris Heilmann Chris Heilmann +2 · LIVE

1:55 min

Evolving attacks from npm scripts to prompt injection

Marcus Wermuth Marcus Wermuth · World Congress 2026 Europe

1:50 min

Supply chain security risks in NPM dependency code

martinakraus martinakraus · World Congress 2024

1:03 min

Highlighting supply chain vulnerabilities from obfuscated package manager backdoors

Daniel Cranney Daniel Cranney +1 · LIVE

More from World Congress 2026 North America

2026 in LLMs (so far) thumbnail
31:31
10 days ago

2026 in LLMs (so far)

Simon Willison

Running Operations Without Humans in the Loop thumbnail
32:31
10 days ago

Running Operations Without Humans in the Loop

Edward Aryee, Ryan Ries, Yaron Schneider, Chris Hallenbeck, Floriane Gramlich

Beyond the Code: Human-AI Synergies in Product Development thumbnail
17:43
10 days ago

Beyond the Code: Human-AI Synergies in Product Development

Ajita Kanchivakam Ananth

Honey, look! I vibe-coded an OS! thumbnail
30:40
10 days ago

Honey, look! I vibe-coded an OS!

Ian Smith

The Productivity Illusion: What AI Really Changed for Developers thumbnail
24:28
10 days ago

The Productivity Illusion: What AI Really Changed for Developers

Fatih Kadir Akın

Your Evals Passed. Your Agent Just Emptied a Database. thumbnail
21:37
10 days ago

Your Evals Passed. Your Agent Just Emptied a Database.

Tejas Pravinbhai Patel

Related videos

Oops! Stories of supply chain shenanigans thumbnail
43:57
LIVE • about 5 years ago

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most thumbnail
24:33
World Congress 2026 Europe • 3 months ago

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most

Marcus Wermuth

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

WeAreDevelopers LIVE - Node and Package Security thumbnail
1:08:30
LIVE • 2 months ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor thumbnail
42:55
Coffee With Developers • over 2 years ago

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Supply Chain Security and the Real World: Lessons From Incidents thumbnail
24:47
World Congress 2025 • about 1 year ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.