World Congress 2026 North America • Sep 26, 2026 • Session details

Silent Execution: Defending Against Install-Time Supply Chain Attacks

Are your npm install scripts silently stealing your GitHub tokens? Discover how malware like Glassworm exploits standard package managers and learn to harden your pipelines against install-time attacks.

Silent Execution: Defending Against Install-Time Supply Chain Attacks thumbnail

Checking access…

Playback and chapters load privately for Free videos.

Matching moments

2:56 min

Managing risks in CI/CD pipelines and supply chains

Christian Heilmann

Christian Heilmann +1 · World Congress 2026 North America

3:50 min

Mitigating supply chain attacks via automated post-install hooks

Chris Heilmann

Chris Heilmann +2 · LIVE

2:32 min

Dependency risks in widespread NPM supply chain attacks

Chris Heilmann

Chris Heilmann +2 · LIVE

1:55 min

Evolving attacks from npm scripts to prompt injection

Marcus Wermuth

Marcus Wermuth · World Congress 2026 Europe

1:50 min

Supply chain security risks in NPM dependency code

martinakraus

martinakraus · World Congress 2024

1:03 min

Highlighting supply chain vulnerabilities from obfuscated package manager backdoors

Daniel Cranney

Daniel Cranney +1 · LIVE

More from World Congress 2026 North America

2026 in LLMs (so far) thumbnail

2026 in LLMs (so far)

Simon Willison

Running Operations Without Humans in the Loop thumbnail

Running Operations Without Humans in the Loop

Edward Aryee, Ryan Ries, Yaron Schneider, Chris Hallenbeck, Floriane Gramlich

Beyond the Code: Human-AI Synergies in Product Development thumbnail

Beyond the Code: Human-AI Synergies in Product Development

Ajita Kanchivakam Ananth

Honey, look! I vibe-coded an OS! thumbnail

Honey, look! I vibe-coded an OS!

Ian Smith

The Productivity Illusion: What AI Really Changed for Developers thumbnail

The Productivity Illusion: What AI Really Changed for Developers

Fatih Kadir Akın

Your Evals Passed. Your Agent Just Emptied a Database. thumbnail

Your Evals Passed. Your Agent Just Emptied a Database.

Tejas Pravinbhai Patel

Upcoming sessions on this topic

Supply Chain Security for the Everyday Engineer

Pradumna Saraf

Kestra Technologies

Quality Assurance Engineer

From Profiler to Production: Measuring What Actually Matters in React & React Native

Andrei Tazetdinov

Dynatrace

React Native Developer

How We Cut Our API's p99 Latency from Minutes to Under a Second

Deepak Agrawal

Atlassian

Principal Software Engineer

Beware of Strangers Bearing Code: Open Source Trust in the Agent Era

Vikram Vaswani

Consultant

What I Got Wrong Shipping an MCP Server for Live Infrastructure

Pritesh Kiri

Harness

Developer Relations Engineer

Autopsy of an Autonomous Incident: When the Agent Made It Worse

Navin Pai

StackGen

Director of Engineering

Related videos

Oops! Stories of supply chain shenanigans thumbnail

LIVE • about 5 years ago

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most thumbnail

World Congress 2026 Europe • 3 months ago

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most

Marcus Wermuth

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail

LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

WeAreDevelopers LIVE - Node and Package Security thumbnail

LIVE • 2 months ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor thumbnail

Coffee With Developers • over 2 years ago

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Supply Chain Security and the Real World: Lessons From Incidents thumbnail

World Congress 2025 • about 1 year ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Related articles

BB

Benedikt Bischof

Walking Into The Era of Supply Chain Risks

Welcome to this issue of the WeAreDevelopers Live Talk series. This article recaps an interesting talk by Vandana Verma who introduced the audience interesting topic of supply chain risks.About the...

about 4 years ago

Walking Into The Era of Supply Chain Risks

DC

Daniel Cranney

Dev Digest 188: CfP time, the risks of NPM and IKEA algorithms

Inside last week’s Dev Digest 188 . 🤖 GitHub Copilot CLI is now in public review 💻 Microsoft is bringing ‘vibe working’ to office apps 🎣 Attackers abuse AI tools to generate captchas in fishing at...

about 1 year ago

IKEA-style no-text diagrams explaining algorithms

DC

Daniel Cranney

The Overflow: Security and Privacy

Every week we dig through hundreds of links from all over the web, and it’s often hard for developers keep up. So, we thought we’d put together some links we couldn’t fit in the Dev Digest in what ...

7 months ago

DC

Daniel Cranney

Dev Digest 179: rm -rf, Agent Style, NPM hacks & Browser Design Tools

Inside last week’s Dev Digest 179 . 🌍 AI is eating the internet 💡 Reverse engineering GitHub Spark with itself 📦 NPM under attack - ‘is’ package compromised ⚠️ AI code assistant almost wiped the c...

about 1 year ago

Files not found on a Windows machine

From learning to earning

Jobs that call for the skills explored in this talk.

about 1 month ago • Verified

Senior Supply Chain Security Engineer

Expert Remote Linux Kubernetes

about 1 month ago • Verified

Senior Principal Software Engineer, Docker and Ecosystem

Seattle, United States

Expert Remote Cloud (AWS/Google/Azure)

Staff Developer Advocate, GitHub Security Lab

Experienced $121k–323k Remote Git Github Databases

about 1 month ago • Verified

Principal Software Engineer, Docker Hardened Images

Expert Remote Kubernetes

about 2 months ago

Senior Software Engineer, Sandboxes (Eu Or East Coast Preferred)

€94k–155k Remote Docker Adobe InDesign Virtual Agents

about 1 month ago • Verified

Senior Software Engineer, Secure Build

Expert Remote Go