WeAreDevelopers LIVE • Sep 15, 2021

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

Could an obscure NPM dependency be silently stealing credentials during your build phase? Discover how to neutralize rogue lifecycle scripts and secure your JavaScript supply chain.

Oops! Stories of supply chain shenanigans thumbnail

Checking access…

Playback and chapters load privately for Free videos.

Matching moments

2:56 min

Managing risks in CI/CD pipelines and supply chains

Christian Heilmann

Christian Heilmann +1 · World Congress 2026 North America

1:50 min

Supply chain security risks in NPM dependency code

martinakraus

martinakraus · World Congress 2024

2:32 min

Dependency risks in widespread NPM supply chain attacks

Chris Heilmann

Chris Heilmann +2 · LIVE

2:12 min

Exploiting npm lifecycle scripts during software installation

Chris DeMars

Chris DeMars · World Congress 2026 North America

1:03 min

Highlighting supply chain vulnerabilities from obfuscated package manager backdoors

Daniel Cranney

Daniel Cranney +1 · LIVE

3:06 min

Mitigating dependency confusion in NPM packages

Jakub Andrzejewski · World Congress 2023

More from WeAreDevelopers LIVE

Like Peas in a Pod - What Happens When People Clone Your App? thumbnail

Like Peas in a Pod - What Happens When People Clone Your App?

Ivan Kutskir, Christian Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Read more, Prompt Less thumbnail

WeAreDevelopers LIVE - Read more, Prompt Less

Christian Heilmann, Daniel Cranney, Luise Freese

WeAreDevelopers LIVE - Tech Education in Two Languages thumbnail

WeAreDevelopers LIVE - Tech Education in Two Languages

Daniel Cranney, Roxy Rodriguez-Becker

WeAreDevelopers LIVE - Playing in Production thumbnail

WeAreDevelopers LIVE - Playing in Production

Andrew MacLean, Daniel Cranney, Christian Heilmann

WeAreDevelopers LIVE - Is CSS Catching Up to Flash? thumbnail

about 1 month ago

WeAreDevelopers LIVE - Is CSS Catching Up to Flash?

Chris Heilmann, Daniel Cranney, Bramus Van Damme

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail

about 1 month ago

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof Cieślak

Upcoming sessions on this topic

Supply Chain Security for the Everyday Engineer

Pradumna Saraf

Kestra Technologies

Quality Assurance Engineer

What I Got Wrong Shipping an MCP Server for Live Infrastructure

Pritesh Kiri

Harness

Developer Relations Engineer

Beware of Strangers Bearing Code: Open Source Trust in the Agent Era

Vikram Vaswani

Consultant

How We Cut Our API's p99 Latency from Minutes to Under a Second

Deepak Agrawal

Atlassian

Principal Software Engineer

Autopsy of an Autonomous Incident: When the Agent Made It Worse

Navin Pai

StackGen

Director of Engineering

Shipping MCP to Real Users: Scaling, Auth, and the PII Leak You Didn't See Coming

Hadar Geva

Myop

CTO & Co-founder

Related videos

Silent Execution: Defending Against Install-Time Supply Chain Attacks thumbnail

World Congress 2026 North America • 28 days ago

Silent Execution: Defending Against Install-Time Supply Chain Attacks

Chris DeMars

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor thumbnail

Coffee With Developers • over 2 years ago

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail

LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

WeAreDevelopers LIVE - Node and Package Security thumbnail

LIVE • 3 months ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

Supply Chain Security and the Real World: Lessons From Incidents thumbnail

World Congress 2025 • about 1 year ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Walking into the era of Supply Chain Risks thumbnail

LIVE • over 4 years ago

Walking into the era of Supply Chain Risks

Vandana Verma

Related articles

BB

Benedikt Bischof

Walking Into The Era of Supply Chain Risks

Welcome to this issue of the WeAreDevelopers Live Talk series. This article recaps an interesting talk by Vandana Verma who introduced the audience interesting topic of supply chain risks.About the...

over 4 years ago

Walking Into The Era of Supply Chain Risks

CH

Chris Heilmann

Dev Digest 138 - Are you secure about this?

Hello there! This is the 2nd "out of the can" edition of 3 as I am on vacation in Greece eating lovely things on the beach. So, fewer news, but lots of great resources. Many around the topic of sec...

about 2 years ago

Dev Digest 138 - Are you secure about this?

DC

Daniel Cranney

Dev Digest 188: CfP time, the risks of NPM and IKEA algorithms

Inside last week’s Dev Digest 188 . 🤖 GitHub Copilot CLI is now in public review 💻 Microsoft is bringing ‘vibe working’ to office apps 🎣 Attackers abuse AI tools to generate captchas in fishing at...

about 1 year ago

IKEA-style no-text diagrams explaining algorithms

DC

Daniel Cranney

Do You Trust Your Agents? Five Quick Ways to Contain Them

Do you trust your agents? Most of us use coding agents every day now. Give one a vague request, walk away, and come back to a pile of mostly working software. It’s brilliant, right up until you rem...

2 days ago

An image of a cube-shaped container with a ball of light inside of it

From learning to earning

Jobs that call for the skills explored in this talk.

about 2 months ago • Verified

Senior Supply Chain Security Engineer

Expert Remote Linux Kubernetes

about 2 months ago • Verified

Senior Principal Software Engineer, Docker and Ecosystem

Seattle, United States

Expert Remote Cloud (AWS/Google/Azure)

about 2 months ago • Verified

Principal Software Engineer, Docker Hardened Images

Expert Remote Kubernetes

Senior Software Engineer, Vulnerability Management

Expert $329k Remote Ruby Golang Docker

about 2 months ago • Verified

Manager, Engineering, Secure Build and SCS Services

Expert Remote Team Leadership

Staff Developer Advocate, GitHub Security Lab

Experienced $121k–323k Remote Git Github Databases