WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2024 • Aug 20, 2024 • Session details

How your .NET software supply chain is open to attack : and how to fix it

Andrei Epure

Are malicious NuGet packages secretly compromising your .NET builds? Minor dependency oversights often lead to catastrophic network breaches. Learn to lock down your supply chain using strict configurations.

Pause
Mute Enter Fullscreen
#1 about 4 min

Understanding software supply chain threats and security risks

The software supply chain encompasses all build tools and dependencies, which are increasingly targeted by data exfiltration attacks.

#2 about 4 min

How attackers exploit developers using typosquatting campaigns

Malicious packages rely on common typo variations to execute remote code when developers inadvertently download lookalike libraries.

#3 about 5 min

How a typosquatting attack triggers remote code execution

Mistyping a package name triggers remote code execution when manipulated build targets run directly from the local cache.

#4 about 4 min

Defending against typosquatting through nuget signature validation

Build environments can be protected by requiring signature validation mode and declaring trusted signers directly in configuration files.

#5 about 4 min

Explaining dependency confusion vulnerabilities in package resolution

Attackers exploit non-deterministic package resolution by publishing public repositories carrying private names to override internal dependencies.

#6 about 4 min

How wildcard versions trigger dependency confusion in nuget

Wildcard versioning and hybrid configuration sources can be manipulated to force the unintended installation of a public malicious package.

#7 about 2 min

Mitigating dependency confusion by using package source mapping

Administrators can restrict specific package namespaces strictly to intended public or private feeds by configuring package source mapping.

#8 about 6 min

Essential best practices for securing nuget package configurations

Engineering teams prevent supply chain attacks by reserving package prefixes, signing binaries, clearing system defaults, and inspecting new targets.

Matching moments

1:16 min

Avoiding supply chain risks within standard software dependencies

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

1:03 min

Highlighting supply chain vulnerabilities from obfuscated package manager backdoors

Daniel Cranney +1 · LIVE

5:13 min

Identifying sophisticated supply chain attacks and simulated software vulnerabilities

Mohamed Shiralizadeh · Coffee With Developers

2:22 min

Addressing supply chain attacks in package managers

Laurie Voss Laurie Voss · Coffee With Developers

3:39 min

Exploring the mechanics of software supply chain attacks

Chris Heilmann +2 · LIVE

3:06 min

Mitigating dependency confusion in NPM packages

Jakub Andrzejewski · World Congress 2023

More from World Congress 2024

Beyond the Hype: Real-World AI Strategies Panel thumbnail
24:07
12 months ago

Beyond the Hype: Real-World AI Strategies Panel

Mike Butcher, Jürgen Müller, Katrin Lehmann, Tobias Regenfuss

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation thumbnail
21:17
almost 2 years ago

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation

Carl Lapierre

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI! thumbnail
31:50
about 2 years ago

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI!

Zaid Zaim

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging thumbnail
29:43
about 2 years ago

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging

Sue Quackenbush

Dapr in Practice thumbnail
24:08
about 2 years ago

Dapr in Practice

marcklefter

Minimising the Carbon Footprint of Workloads thumbnail
27:46
about 2 years ago

Minimising the Carbon Footprint of Workloads

Michael Mueller

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 · 16:15–16:25

Outdoor Stage

Silent Execution: Defending Against Install-Time Supply Chain Attacks

Chris DeMars

Senior Developer Advocate at TuxCare

Chris DeMars
Open session

World Congress 2026 North America

September 23, 2026 · 14:00–14:30

Stage 1

Supply Chain Security When Agents Write the Code

Ajeet Raina

Developer Advocate at Docker

Ajeet Raina
Open session

World Congress 2026 North America

September 25, 2026 · 09:40–10:10

Stage 4

Your registry can't stop a valid login. What happens then?

Khushboo Verma

Systems Engineer at Cloudflare

Khushboo Verma
Open session

World Congress 2026 North America

September 24, 2026 · 11:40–12:10

Stage 3

Stop Running Mystery Meat in Production

Jeroen van Erp

Technology Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

September 24, 2026 · 14:50–15:20

Stage 1

The Era of Machine-Driven Defense is Here: Headless Security

Loris Degioanni

Founder & CTO of Sysdig

Loris Degioanni
Open session

World Congress 2026 North America

September 24, 2026 · 12:15–12:45

Stage 6

AI vs. AI: Defending the open source supply chain with agentic workflows

Manfred Moser

Senior Principal DevRel Engineer at Chainguard

Manfred Moser

Related videos

Walking into the era of Supply Chain Risks thumbnail
37:36
LIVE • over 4 years ago

Walking into the era of Supply Chain Risks

Vandana Verma

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Securing your application software supply-chain thumbnail
28:27
World Congress 2022 • over 4 years ago

Securing your application software supply-chain

Niels Tanis

Oops! Stories of supply chain shenanigans thumbnail
43:57
LIVE • about 5 years ago

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

Supply Chain Security and the Real World: Lessons From Incidents thumbnail
24:47
World Congress 2025 • about 1 year ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor thumbnail
42:55
Coffee With Developers • over 2 years ago

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.