WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2024 • Aug 20, 2024 • Session details

How your .NET software supply chain is open to attack : and how to fix it

Andrei Epure

Are malicious NuGet packages secretly compromising your .NET builds? Minor dependency oversights often lead to catastrophic network breaches. Learn to lock down your supply chain using strict configurations.

Pause
Mute Enter Fullscreen
#1 about 4 min

Understanding software supply chain threats and security risks

The software supply chain encompasses all build tools and dependencies, which are increasingly targeted by data exfiltration attacks.

#2 about 4 min

How attackers exploit developers using typosquatting campaigns

Malicious packages rely on common typo variations to execute remote code when developers inadvertently download lookalike libraries.

#3 about 5 min

How a typosquatting attack triggers remote code execution

Mistyping a package name triggers remote code execution when manipulated build targets run directly from the local cache.

#4 about 4 min

Defending against typosquatting through nuget signature validation

Build environments can be protected by requiring signature validation mode and declaring trusted signers directly in configuration files.

#5 about 4 min

Explaining dependency confusion vulnerabilities in package resolution

Attackers exploit non-deterministic package resolution by publishing public repositories carrying private names to override internal dependencies.

#6 about 4 min

How wildcard versions trigger dependency confusion in nuget

Wildcard versioning and hybrid configuration sources can be manipulated to force the unintended installation of a public malicious package.

#7 about 2 min

Mitigating dependency confusion by using package source mapping

Administrators can restrict specific package namespaces strictly to intended public or private feeds by configuring package source mapping.

#8 about 6 min

Essential best practices for securing nuget package configurations

Engineering teams prevent supply chain attacks by reserving package prefixes, signing binaries, clearing system defaults, and inspecting new targets.

Matching moments

1:16 min

Avoiding supply chain risks within standard software dependencies

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

1:03 min

Highlighting supply chain vulnerabilities from obfuscated package manager backdoors

Daniel Cranney +1 · LIVE

5:13 min

Identifying sophisticated supply chain attacks and simulated software vulnerabilities

Mohamed Shiralizadeh · Coffee With Developers

2:22 min

Addressing supply chain attacks in package managers

Laurie Voss · Coffee With Developers

3:39 min

Exploring the mechanics of software supply chain attacks

Chris Heilmann +2 · LIVE

3:06 min

Mitigating dependency confusion in NPM packages

Jakub Andrzejewski · WWC 2023

More from World Congress 2024

Beyond the Hype: Real-World AI Strategies Panel thumbnail
24:07
10 months ago

Beyond the Hype: Real-World AI Strategies Panel

Mike Butcher, Jürgen Müller, Katrin Lehmann, Tobias Regenfuss

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation thumbnail
21:17
almost 2 years ago

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation

Carl Lapierre

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI! thumbnail
31:50
almost 2 years ago

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI!

Zaid Zaim

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging thumbnail
29:43
almost 2 years ago

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging

Sue Quackenbush

Dapr in Practice thumbnail
24:08
almost 2 years ago

Dapr in Practice

marcklefter

Minimising the Carbon Footprint of Workloads thumbnail
27:46
almost 2 years ago

Minimising the Carbon Footprint of Workloads

Michael Mueller

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026

Farshad Abasi

CEO/Founder, Eureka DevSecOps + Forward Security

Farshad Abasi
Open session

World Congress 2026 North America

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed
Open session

World Congress 2026 North America

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

Don’t kill my Vibes - Simple Steps to Stay Secure when Vibe Coding

Isaac Evans

Co-founder & CEO of Semgrep

Isaac Evans

Related videos

Walking into the era of Supply Chain Risks thumbnail
37:36
LIVE • over 4 years ago

Walking into the era of Supply Chain Risks

Vandana Verma

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Securing your application software supply-chain thumbnail
28:27
WWC 2022 • about 4 years ago

Securing your application software supply-chain

Niels Tanis

Oops! Stories of supply chain shenanigans thumbnail
43:57
LIVE • almost 5 years ago

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

Supply Chain Security and the Real World: Lessons From Incidents thumbnail
24:47
WWC 2025 • 12 months ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor thumbnail
42:55
Coffee With Developers • over 2 years ago

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.