Coffee With Developers • Apr 10, 2024

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Feross Aboukhadijeh warns that rigorous code reviews are useless if you blindly import massive dependency trees. Discover how to automate defense against targeted open-source supply chain attacks.

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor thumbnail

Checking access…

Playback and chapters load privately for Free videos.

Matching moments

2:32 min

Dependency risks in widespread NPM supply chain attacks

Chris Heilmann

Chris Heilmann +2 · LIVE

1:03 min

Highlighting supply chain vulnerabilities from obfuscated package manager backdoors

Daniel Cranney

Daniel Cranney +1 · LIVE

2:49 min

Managing dependency vulnerabilities and transitive software risks

Niels Tanis

Niels Tanis · World Congress 2024

2:56 min

Managing risks in CI/CD pipelines and supply chains

Christian Heilmann

Christian Heilmann +1 · World Congress 2026 North America

1:01 min

Preventing dependency confusion attacks in Node.js package managers

Christian Heilmann

Christian Heilmann · World Congress 2026 North America

3:39 min

Mitigating logging failures and supply chain vulnerabilities

Jose Manuel Ortega

Jose Manuel Ortega · Europe 2026 Virtual

More from Coffee With Developers

Agentic Software Engineering thumbnail

Agentic Software Engineering

Dr. Ralf S. Engelschall, Christian Heilmann, Daniel Cranney

Using Agents to Curate the Content You See Online - Dan Gish thumbnail

Using Agents to Curate the Content You See Online - Dan Gish

Dan Gish

AI Vector Search at Scale - Ewa Szyszka - Ewa Szyszka thumbnail

AI Vector Search at Scale - Ewa Szyszka - Ewa Szyszka

Ewa Szyszka

What is Cross-Origin Storage - Thomas Steiner thumbnail

What is Cross-Origin Storage - Thomas Steiner

Thomas Steiner

Women in AI - Nalini Garg thumbnail

Women in AI - Nalini Garg

Nalini Garg

Agents and People Dynamics in Shared Chats - Sam Liu thumbnail

Agents and People Dynamics in Shared Chats - Sam Liu

Sam Liu

Upcoming sessions on this topic

Supply Chain Security for the Everyday Engineer

Pradumna Saraf

Kestra Technologies

Quality Assurance Engineer

Beware of Strangers Bearing Code: Open Source Trust in the Agent Era

Vikram Vaswani

Consultant

How We Cut Our API's p99 Latency from Minutes to Under a Second

Deepak Agrawal

Atlassian

Principal Software Engineer

Autopsy of an Autonomous Incident: When the Agent Made It Worse

Navin Pai

StackGen

Director of Engineering

What I Got Wrong Shipping an MCP Server for Live Infrastructure

Pritesh Kiri

Harness

Developer Relations Engineer

Shipping MCP to Real Users: Scaling, Auth, and the PII Leak You Didn't See Coming

Hadar Geva

Myop

CTO & Co-founder

Related videos

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail

LIVE • almost 5 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Oops! Stories of supply chain shenanigans thumbnail

LIVE • about 5 years ago

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

WeAreDevelopers LIVE - Node and Package Security thumbnail

LIVE • 3 months ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

Answering the Million Dollar Question: Why did I Break Production? thumbnail

World Congress 2024 • about 2 years ago

Answering the Million Dollar Question: Why did I Break Production?

Luís Ventura

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most thumbnail

World Congress 2026 Europe • 4 months ago

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most

Marcus Wermuth

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks thumbnail

World Congress 2023 • about 3 years ago

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks

Sonya Moisset

Related articles

BB

Benedikt Bischof

Walking Into The Era of Supply Chain Risks

Welcome to this issue of the WeAreDevelopers Live Talk series. This article recaps an interesting talk by Vandana Verma who introduced the audience interesting topic of supply chain risks.About the...

over 4 years ago

Walking Into The Era of Supply Chain Risks

CH

Chris Heilmann

Dev Digest 138 - Are you secure about this?

Hello there! This is the 2nd "out of the can" edition of 3 as I am on vacation in Greece eating lovely things on the beach. So, fewer news, but lots of great resources. Many around the topic of sec...

about 2 years ago

Dev Digest 138 - Are you secure about this?

DC

Daniel Cranney

The Overflow: Security and Privacy

Every week we dig through hundreds of links from all over the web, and it’s often hard for developers keep up. So, we thought we’d put together some links we couldn’t fit in the Dev Digest in what ...

8 months ago

CH

Chris Heilmann

Dev Digest 134 - Where pixels sing?

News and ArticlesWeAreDevelopers LIVE Data and Security Day is on Wednesday, 25/09/2024. Learn about OPC UA Updates, Best Practices for Using GitHub Secrets, Passwordless Web 1.5, Emerging AI Secur...

about 2 years ago

Dev Digest 134 - Where pixels sing?

From learning to earning

Jobs that call for the skills explored in this talk.

2 months ago • Verified

Senior Supply Chain Security Engineer

Expert Remote Linux Kubernetes

Senior Software Engineer, Vulnerability Management

Expert $329k Remote Ruby Golang Docker

2 months ago • Verified

Senior Principal Software Engineer, Docker and Ecosystem

Seattle, United States

Expert Remote Cloud (AWS/Google/Azure)

2 months ago • Verified

Manager, Engineering, Secure Build and SCS Services

Expert Remote Team Leadership

Staff Developer Advocate, GitHub Security Lab

New York, NY, United States

Experienced $323k Remote Git Github Databases

2 months ago • Verified

Principal Software Engineer, Docker Hardened Images

Expert Remote Kubernetes