Share
Software's best weekly news brief, deep technical interviews & talk show.
…
continue reading
Manage episode 510394640 series 1280399
Content provided by Changelog Media. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Changelog Media or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://staging.podcastplayer.com/legal.
Over the past two months, we’ve seen some of the most serious supply chain attacks in npm history: phishing campaigns, maintainer account takeovers, and malware published to packages with billions of weekly downloads. What is going on?! What can we do about it? Our old friend, Feross Aboukhadijeh, joins us to help make sense of it all.
Changelog++ members save 2 minutes on this episode because they made the ads disappear. Join today!
Sponsors:
- Depot – 10x faster builds? Yes please. Build faster. Waste less time. Accelerate Docker image builds, and GitHub Actions workflows. Easily integrate with your existing CI provider and dev workflows to save hours of build time.
Featuring:
- Feross Aboukhadijeh – Website, GitHub, X
- Jerod Santo – GitHub, LinkedIn, Mastodon, X
- Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X
Show Notes:
- Active supply chain attack: npm phishing campaign
- Npm phishing email targets developers with typosquat
- Nx npm packages compromised in supply chain attack
- Introducing socket firewall
- Changelog News Classifieds
Something missing or broken? PRs welcome!
Chapters
1. Let's talk! (00:00:00)
2. Sponsor: Depot (00:00:38)
3. Feross & Friends (00:02:49)
4. The big picture (00:04:04)
5. Why now? Why this? (00:05:50)
6. Phishing maintainers! (00:08:21)
7. Not for the lulz (00:11:51)
8. Maximal profit (00:15:28)
9. The most surprising hack (00:18:59)
10. exfiltrate and extrude (00:23:03)
11. Exploiting GitHub Actions (00:25:44)
12. It all happened so fast (00:29:56)
13. How Socket discloses (00:31:10)
14. Disclosing 0days vs malware (00:32:30)
15. Scanning GitHub Actions (00:34:49)
16. GH Actions footguns (00:36:18)
17. Socket's future GH Actions feature (00:40:04)
18. Evil genius move (00:41:48)
19. What devs can do (00:43:14)
20. Staying off the bleeding edge (00:47:30)
21. How many typosquats (00:50:21)
22. How we got here (00:52:58)
23. Was it worth it? (00:54:33)
24. GitHub's responsibility (00:57:09)
25. GitHub's roadmap (00:58:37)
26. Why doesn't npm do this (01:03:54)
27. A package vetting period (01:06:17)
28. Publisher opt-in (01:08:08)
29. We figured it out! (01:12:03)
30. Adam goes GH Karen (01:12:36)
31. Codegen everything instead (01:15:17)
32. More companies vendoring (01:20:08)
33. Proxies, mirrors, options (01:22:16)
34. New tool! sfw (01:23:22)
35. The next big thing? (01:27:37)
36. The criteria for free (01:28:50)
37. sfw is a great name (01:31:07)
38. Bye, friends (01:31:29)
39. Next week on the pod (01:32:34)
2330 episodes
))
