WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
Coffee With Developers • Apr 10, 2024

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Feross Aboukhadijeh warns that rigorous code reviews are useless if you blindly import massive dependency trees. Discover how to automate defense against targeted open-source supply chain attacks.

Pause
Mute Enter Fullscreen
#1 about 3 min

Overview of the xz backdoor incident

How a malicious contributor socially engineered their way into adding a backdoor to a fundamental Linux utility.

#2 about 3 min

Open source maintainer burnout and project handoffs

The transition of abandoned package ownership to unknown contributors creates a significant shift in risk profile.

#3 about 3 min

Anatomy of the Node.js event-stream supply chain attack

How an attacker gained access to a popular package and deployed targeted malware that was discovered by accident.

#4 about 4 min

The lingering risk of trivial NPM packages

Why outdated utility modules like is-number and is-buffer remain heavily downloaded and bloat modern dependency trees.

#5 about 3 min

How modern package managers redefined dependency hell

NPM and Rust solved version conflicts by allowing deep nested installations, leading to applications with tens of thousands of dependencies.

#6 about 4 min

The persistence of polyfills and legacy frameworks

Forging ahead with polyfills like jQuery instead of waiting for platform support creates long-lasting attack vectors.

#7 about 4 min

The local impact of automated hacktivism and protestware

Executing local package installs with elevated privileges exposes machines to data loss and targeted protest code.

#8 about 6 min

Automated tooling to detect malicious dependencies

Developers can use static analysis to track unexpected network requests, file reads, or code obfuscation in package updates.

#9 about 6 min

The security trade-offs of auto-updating software dependencies

Distributing untethered updates through CDNs or automated package managers can rapidly propagate supply chain attacks to end users.

#10 about 5 min

Practical safeguards and evaluating open source package health

Using lock files and automated vetting tools reveals package metadata risks and maintainer behavior before installation.

#11 about 6 min

Shifting the developer mindset on dependency code responsibility

Treating third-party open source modules with the same rigorous review processes applied to internal team code.

Matching moments

2:32 min

Dependency risks in widespread NPM supply chain attacks

Chris Heilmann +2 · LIVE

1:03 min

Highlighting supply chain vulnerabilities from obfuscated package manager backdoors

Daniel Cranney +1 · LIVE

2:49 min

Managing dependency vulnerabilities and transitive software risks

Niels Tanis Niels Tanis · World Congress 2024

3:39 min

Mitigating logging failures and supply chain vulnerabilities

Jose Manuel Ortega Jose Manuel Ortega · Europe 2026 Virtual

2:36 min

Combatting rogue maintainers and backdoors in open source

Niels Tanis Niels Tanis · World Congress 2024

2:12 min

Analyzing real-world structural vulnerabilities in popular npm dependency packages

Liran Tal Liran Tal · World Congress 2025

More from Coffee With Developers

Using Agents to Curate the Content You See Online - Dan Gish thumbnail
12:47
25 days ago

Using Agents to Curate the Content You See Online - Dan Gish

Dan Gish

AI Vector Search at Scale - Ewa Szyszka - Ewa Szyszka thumbnail
11:14
25 days ago

AI Vector Search at Scale - Ewa Szyszka - Ewa Szyszka

Ewa Szyszka

What is Cross-Origin Storage - Thomas Steiner thumbnail
34:51
25 days ago

What is Cross-Origin Storage - Thomas Steiner

Thomas Steiner

Women in AI - Nalini Garg thumbnail
42:19
26 days ago

Women in AI - Nalini Garg

Nalini Garg

Agents and People Dynamics in Shared Chats - Sam Liu thumbnail
37:41
about 1 month ago

Agents and People Dynamics in Shared Chats - Sam Liu

Sam Liu

Why Token Reduction Isn’t Cost Reduction - Dave Anderson & Sarel Weinberger, PhD. thumbnail
41:09
about 1 month ago

Why Token Reduction Isn’t Cost Reduction - Dave Anderson & Sarel Weinberger, PhD.

Dave Anderson, Sarel Weinberger, Phd

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 · 16:15–16:25

Outdoor Stage

Silent Execution: Defending Against Install-Time Supply Chain Attacks

Chris DeMars

Senior Developer Advocate at TuxCare

Chris DeMars
Open session

World Congress 2026 North America

September 25, 2026 · 14:50–15:20

Outdoor Stage

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

September 25, 2026 · 09:40–10:10

Stage 4

Your registry can't stop a valid login. What happens then?

Khushboo Verma

Systems Engineer at Cloudflare

Khushboo Verma
Open session

World Congress 2026 North America

September 24, 2026 · 14:10–14:40

Stage 2

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

September 24, 2026 · 11:40–12:10

Stage 3

Stop Running Mystery Meat in Production

Jeroen van Erp

Technology Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

September 24, 2026 · 12:15–12:45

Stage 6

AI vs. AI: Defending the open source supply chain with agentic workflows

Manfred Moser

Senior Principal DevRel Engineer at Chainguard

Manfred Moser

Related videos

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Oops! Stories of supply chain shenanigans thumbnail
43:57
LIVE • about 5 years ago

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

WeAreDevelopers LIVE - Node and Package Security thumbnail
1:08:30
LIVE • about 2 months ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

Answering the Million Dollar Question: Why did I Break Production? thumbnail
29:38
World Congress 2024 • about 2 years ago

Answering the Million Dollar Question: Why did I Break Production?

Luís Ventura

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most thumbnail
24:33
World Congress 2026 Europe • 3 months ago

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most

Marcus Wermuth

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks thumbnail
27:10
World Congress 2023 • almost 3 years ago

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks

Sonya Moisset

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.