> Markdown version of [/videos/879-coffee-with-developers-with-feross-aboukhadijeh-of-socket-about-the-xz-backdoor?t=191](https://www.wearedevelopers.com/videos/879-coffee-with-developers-with-feross-aboukhadijeh-of-socket-about-the-xz-backdoor?t=191). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh warns that rigorous code reviews are useless if you blindly import massive dependency trees. Discover how to automate defense against targeted open-source supply chain attacks.

- **Speakers:** Feross Aboukhadijeh
- **Event:** Coffee With Developers
- **Published:** April 10, 2024
- **Duration:** 42:55
- **URL:** https://www.wearedevelopers.com/videos/879-coffee-with-developers-with-feross-aboukhadijeh-of-socket-about-the-xz-backdoor
- **Thumbnail URL:** https://customer-goifxnzhrq3d0d54.cloudflarestream.com/1922a86c61083aae58ab2187291aef73/thumbnails/thumbnail.jpg?time=14455ms

## Access

Playback and chapters for this video are available with a Free account.

## Related Moments

- [Dependency risks in widespread NPM supply chain attacks](https://www.wearedevelopers.com/videos/1719-wearedevelopers-live-fun-and-games-and-all-that-comes-with-it-back-to-basic-more) (from "WeAreDevelopers LIVE - "Fun and games - and all that comes with it", Back to BASIC & more")
  - **Thumbnail URL:** https://customer-goifxnzhrq3d0d54.cloudflarestream.com/e8044956b6f8dda3b3d8cd206aaa7f4c/thumbnails/thumbnail.jpg?time=286135ms
- [Highlighting supply chain vulnerabilities from obfuscated package manager backdoors](https://www.wearedevelopers.com/videos/1284-dev-digest-end-of-year-recap) (from "Dev Digest End of Year Recap")
  - **Thumbnail URL:** https://customer-goifxnzhrq3d0d54.cloudflarestream.com/d05b3bdeaf16cf1c5594554179bfac5e/thumbnails/thumbnail.jpg?time=90635ms
- [Managing dependency vulnerabilities and transitive software risks](https://www.wearedevelopers.com/videos/1041-reviewing-3rd-party-library-security-easily-using-openssf-scorecard) (from "Reviewing 3rd party library security easily using OpenSSF Scorecard")
  - **Thumbnail URL:** https://customer-goifxnzhrq3d0d54.cloudflarestream.com/26834f89e9fa2bfe6540fe592c71adf5/thumbnails/thumbnail.jpg?time=121285ms
- [Managing risks in CI/CD pipelines and supply chains](https://www.wearedevelopers.com/videos/100592-coffee-with-developers-with-noris-buriac-forward-security) (from "Coffee with Developers with Noris Buriac (Forward Security)")
  - **Thumbnail URL:** https://customer-goifxnzhrq3d0d54.cloudflarestream.com/452af028b9f8ec87961079131316173e/thumbnails/thumbnail.jpg?time=114296ms
- [Preventing dependency confusion attacks in Node.js package managers](https://www.wearedevelopers.com/videos/100591-fake-or-news-xxl) (from "Fake or news XXL")
  - **Thumbnail URL:** https://customer-goifxnzhrq3d0d54.cloudflarestream.com/8865570cfcca86e03e7cad04a5fd7f09/thumbnails/thumbnail.jpg?time=327354ms
- [Mitigating logging failures and supply chain vulnerabilities](https://www.wearedevelopers.com/videos/1957-security-in-model-context-protocol-an-analysis-of-the-owasp-mcp-top-10) (from "Security in Model Context Protocol: An Analysis of the OWASP MCP Top 10")
  - **Thumbnail URL:** https://customer-goifxnzhrq3d0d54.cloudflarestream.com/5e8006fd139b890d3bbe3ce4ab3d1eaf/thumbnails/thumbnail.jpg?time=11160ms

## Related Articles

- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)

## Related Jobs

- [Senior Supply Chain Security Engineer](https://www.wearedevelopers.com/jobs/48462-senior-supply-chain-security-engineer) at **Docker, Inc.**
- [Senior Software Engineer, Vulnerability Management](https://www.wearedevelopers.com/jobs/ext/3814641-senior-software-engineer-vulnerability-management) at **GitHub**
- [Senior Principal Software Engineer, Docker and Ecosystem](https://www.wearedevelopers.com/jobs/48456-senior-principal-software-engineer-docker-and-ecosystem) at **Docker, Inc.**
- [Manager, Engineering, Secure Build and SCS Services](https://www.wearedevelopers.com/jobs/48447-manager-engineering-secure-build-and-scs-services) at **Docker, Inc.**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/4009852-staff-developer-advocate-github-security-lab) at **GitHub**
- [Principal Software Engineer, Docker Hardened Images](https://www.wearedevelopers.com/jobs/48453-principal-software-engineer-docker-hardened-images) at **Docker, Inc.**