WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
Coffee With Developers • Apr 10, 2024

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Feross Aboukhadijeh warns that rigorous code reviews are useless if you blindly import massive dependency trees. Discover how to automate defense against targeted open-source supply chain attacks.

Pause
Mute Enter Fullscreen
#1 about 3 min

Overview of the xz backdoor incident

How a malicious contributor socially engineered their way into adding a backdoor to a fundamental Linux utility.

#2 about 3 min

Open source maintainer burnout and project handoffs

The transition of abandoned package ownership to unknown contributors creates a significant shift in risk profile.

#3 about 3 min

Anatomy of the Node.js event-stream supply chain attack

How an attacker gained access to a popular package and deployed targeted malware that was discovered by accident.

#4 about 4 min

The lingering risk of trivial NPM packages

Why outdated utility modules like is-number and is-buffer remain heavily downloaded and bloat modern dependency trees.

#5 about 3 min

How modern package managers redefined dependency hell

NPM and Rust solved version conflicts by allowing deep nested installations, leading to applications with tens of thousands of dependencies.

#6 about 4 min

The persistence of polyfills and legacy frameworks

Forging ahead with polyfills like jQuery instead of waiting for platform support creates long-lasting attack vectors.

#7 about 4 min

The local impact of automated hacktivism and protestware

Executing local package installs with elevated privileges exposes machines to data loss and targeted protest code.

#8 about 6 min

Automated tooling to detect malicious dependencies

Developers can use static analysis to track unexpected network requests, file reads, or code obfuscation in package updates.

#9 about 6 min

The security trade-offs of auto-updating software dependencies

Distributing untethered updates through CDNs or automated package managers can rapidly propagate supply chain attacks to end users.

#10 about 5 min

Practical safeguards and evaluating open source package health

Using lock files and automated vetting tools reveals package metadata risks and maintainer behavior before installation.

#11 about 6 min

Shifting the developer mindset on dependency code responsibility

Treating third-party open source modules with the same rigorous review processes applied to internal team code.

Matching moments

2:32 min

Dependency risks in widespread NPM supply chain attacks

Chris Heilmann +2 · LIVE

1:03 min

Highlighting supply chain vulnerabilities from obfuscated package manager backdoors

Daniel Cranney +1 · LIVE

2:49 min

Managing dependency vulnerabilities and transitive software risks

Niels Tanis Niels Tanis · WWC 2024

2:36 min

Combatting rogue maintainers and backdoors in open source

Niels Tanis Niels Tanis · WWC 2024

2:12 min

Analyzing real-world structural vulnerabilities in popular npm dependency packages

Liran Tal Liran Tal · WWC 2025

2:08 min

Malware distribution through open source event stream libraries

Vandana Verma Sehgal · LIVE

More from Coffee With Developers

What to Do About Hackathons in the Time of Agents - Mike Swift thumbnail
46:03
9 days ago

What to Do About Hackathons in the Time of Agents - Mike Swift

Mike Swift

Moving from Playing with AI to Implementing AI - Lee Stott thumbnail
18:43
13 days ago

Moving from Playing with AI to Implementing AI - Lee Stott

Lee Stott

Evals vs. Evil - AI and Package Security - Laurie Voss thumbnail
16:57
22 days ago

Evals vs. Evil - AI and Package Security - Laurie Voss

Laurie Voss

Burning Satellites, Talking Plants and Agents Hiring Each Other - Fake or News with Matt Zeunert thumbnail
4:57
27 days ago

Burning Satellites, Talking Plants and Agents Hiring Each Other - Fake or News with Matt Zeunert

Matt Zeunert

Web Scraping, AI Agents, and the Future of Open Source - Kevin Lewis (Apify) thumbnail
40:29
about 2 months ago

Web Scraping, AI Agents, and the Future of Open Source - Kevin Lewis (Apify)

Making Teaching Code Less Academic and More Market-Ready - Peter Ruppel thumbnail
32:22
about 2 months ago

Making Teaching Code Less Academic and More Market-Ready - Peter Ruppel

Upcoming sessions on this topic

Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)

Rishab Kumar

Staff Developer Evangelist @ Twilio

Rishab Kumar
Open session

World Congress 2026 North America

GitHub’s Team X-Ray: Your Repository Knows More About Your Team Than Your Team Does

Andrea Griffiths

Senior Developer Advocate

Andrea Griffiths
Open session

World Congress 2026 North America

Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026

Farshad Abasi

CEO/Founder, Eureka DevSecOps + Forward Security

Farshad Abasi

Related videos

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Oops! Stories of supply chain shenanigans thumbnail
43:57
LIVE • almost 5 years ago

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

WeAreDevelopers LIVE - Node and Package Security thumbnail
1:08:30
LIVE • 5 days ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

Answering the Million Dollar Question: Why did I Break Production? thumbnail
29:38
WWC 2024 • almost 2 years ago

Answering the Million Dollar Question: Why did I Break Production?

Luís Ventura

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most thumbnail
24:33
WWC Europe 2026 • about 1 month ago

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most

Marcus Wermuth

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks thumbnail
27:10
WWC 2023 • almost 3 years ago

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks

Sonya Moisset

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.