BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//packagingcon-2021//speaker//3HHFC7
BEGIN:VEVENT
SUMMARY:Mitigating Open-source Software Supply Chain Attacks With OSSIBOT 
 - Ashish Bijlani\, Ajinkya Rajput
DTSTART:20211109T172500Z
DTEND:20211109T174500Z
DTSTAMP:20261011T083602Z
UID:pretalx-packagingcon-2021-7L88W8@pretalx.com
DESCRIPTION:Software package managers have become a vital part of the mode
 rn software development process. They allow developers to easily adopt thi
 rd-party software and streamline the development process. However\, bad ac
 tors today reportedly leverage highly sophisticated techniques such as typ
 o-squattng and social engineering to “supply” purposefully harmful cod
 e (malware) and carry out software supply chain attacks. For example\, esl
 int-scope\, a NPM package with millions of weekly downloads\, was compromi
 sed to steal credentials from developers. \n\nWe are building a large-scal
 e automated vetting infrastructure to analyze millions of published softwa
 re packages and provide actionable insights into their composition and sec
 urity posture. In this presentation\, we will cover the technical details 
 of our system and introduce a free tool for developers to detect accidenta
 l installation of “risky” packages and mitigate software supply chain 
 attacks. We have already detected a number of abandoned\, typo-squatting\,
  and malicious packages. We will present our findings\, highlight differen
 t types of attacks and measures that developers  can take to thwart such a
 ttacks. With our work\, we hope to enhance productivity of the developer c
 ommunity by exposing undesired behavior in untrusted third-party code\, ma
 intaining developer trust and reputation\, and enforcing security of packa
 ge managers.
LOCATION:Room 3
URL:https://pretalx.com/packagingcon-2021/talk/7L88W8/
END:VEVENT
END:VCALENDAR