Coffee With Developers • Apr 10, 2024

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Feross Aboukhadijeh warns that rigorous code reviews are useless if you blindly import massive dependency trees. Discover how to automate defense against targeted open-source supply chain attacks.

Starting at 37:49 · Watch from the beginning

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor thumbnail

Checking access…

Playback and chapters load privately for Free videos.

Matching moments

2:32 min

Dependency risks in widespread NPM supply chain attacks

Johanna Pirker

Johanna Pirker +2 · LIVE

1:03 min

Highlighting supply chain vulnerabilities from obfuscated package manager backdoors

Daniel Cranney

Daniel Cranney +1 · LIVE

2:49 min

Managing dependency vulnerabilities and transitive software risks

Niels Tanis

Niels Tanis · World Congress 2024

2:56 min

Managing risks in CI/CD pipelines and supply chains

Christian Heilmann

Christian Heilmann +1 · World Congress 2026 North America

1:01 min

Preventing dependency confusion attacks in Node.js package managers

Christian Heilmann

Christian Heilmann · World Congress 2026 North America

3:39 min

Mitigating logging failures and supply chain vulnerabilities

Jose Manuel Ortega

Jose Manuel Ortega · Europe 2026 Virtual

More from Coffee With Developers

The State of Agentic AI - Adel Zaalouk thumbnail

The State of Agentic AI

Adel Zaalouk +1

4 days ago

Staying Curious in an AI World - Werner Vogels thumbnail

Staying Curious in an AI World

Werner Vogels +1

4 days ago

Transforming Tech Hiring with AI - Philipp Richter thumbnail

Transforming Tech Hiring with AI

Philipp Richter +2

Last week

Agentic Software Engineering thumbnail

Agentic Software Engineering

Dr. Ralf S. Engelschall +2

3 weeks ago

Using Agents to Curate the Content You See Online - Dan Gish thumbnail

Using Agents to Curate the Content You See Online

Dan Gish

Aug 2026

AI Vector Search at Scale - Ewa Szyszka - Ewa Szyszka thumbnail

AI Vector Search at Scale - Ewa Szyszka

Ewa Szyszka

Aug 2026

Upcoming sessions on this topic

Starts in 11 days

Conference India 2026

November 25–26, 2026

Bengaluru, India

Get tickets All 108 sessions

Supply Chain Security for the Everyday Engineer
Pradumna Saraf · Kestra Technologies

Wed 25 Nov · Stage 3 - powered by GitHub
Beware of Strangers Bearing Code: Open Source Trust in the Agent Era
Vikram Vaswani

Wed 25 Nov · Stage 3 - powered by GitHub
How We Cut Our API's p99 Latency from Minutes to Under a Second
Deepak Agrawal · Atlassian

Wed 25 Nov · Stage 2

Related videos

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

LIVE · Jan 2022

Oops! Stories of supply chain shenanigans thumbnail

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

LIVE · Sep 2021

WeAreDevelopers LIVE - Node and Package Security thumbnail

Node and Package Security

Zbyszek Tenerowicz +2

LIVE · Aug 2026

Answering the Million Dollar Question: Why did I Break Production? thumbnail

Answering the Million Dollar Question: Why did I Break Production?

Luís Ventura · Codacy

World Congress · 2024

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most thumbnail

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most

Marcus Wermuth · Safety Cybersecurity

World Congress Europe · 2026

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks thumbnail

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks

Sonya Moisset

World Congress · 2023

Related articles

BB

Benedikt Bischof

Walking Into The Era of Supply Chain Risks

Welcome to this issue of the WeAreDevelopers Live Talk series. This article recaps an interesting talk by Vandana Verma who introduced the audience interesting topic of supply chain risks.About the...

over 4 years ago

Walking Into The Era of Supply Chain Risks

CH

Chris Heilmann

Dev Digest 138 - Are you secure about this?

Hello there! This is the 2nd "out of the can" edition of 3 as I am on vacation in Greece eating lovely things on the beach. So, fewer news, but lots of great resources. Many around the topic of sec...

about 2 years ago

Dev Digest 138 - Are you secure about this?

DC

Daniel Cranney

The Overflow: Security and Privacy

Every week we dig through hundreds of links from all over the web, and it’s often hard for developers keep up. So, we thought we’d put together some links we couldn’t fit in the Dev Digest in what ...

8 months ago

CH

Chris Heilmann

Dev Digest 134 - Where pixels sing?

News and ArticlesWeAreDevelopers LIVE Data and Security Day is on Wednesday, 25/09/2024. Learn about OPC UA Updates, Best Practices for Using GitHub Secrets, Passwordless Web 1.5, Emerging AI Secur...

about 2 years ago

Dev Digest 134 - Where pixels sing?

From learning to earning

Jobs that call for the skills explored in this talk.

Senior Software Engineer, Vulnerability Management

Expert $329k Remote Ruby Golang Docker

Staff Developer Advocate, GitHub Security Lab

San Francisco, CA, United States

Experienced $323k Git Github Databases

Product Security Incident Response Analyst

Expert $329k Remote Github Code Review Data Analysis

about 1 month ago

Senior Incident Response Analyst

Expert $124k Remote Github Code Review Data Analysis

Staff Security Data Engineer

Experienced Remote Github Airflow Terraform

Support Engineer III

AMSTERDAM, Netherlands

Experienced Remote Git Docker Github