# How Worms Exposed the Real Attack Surface of Open Source - Charlie Eriksen - NDC Oslo 2026

## Executive summary

This talk analyzes the evolution of supply-chain attacks, arguing that modern threats are less about exploiting technical flaws and more about leveraging the speed, automation, and transitive trust inherent in the open-source ecosystem. The speaker details major attacks (e.g., Singularity, Shy Hulude, Tanstack) and emphasizes that the developer workstation and CI/CD pipelines are now the primary targets. Key vulnerabilities include mutable tags, lack of credential rotation, and the rapid propagation of malicious code via dependency graphs. The rise of LLMs and AI agents has significantly lowered the barrier to entry for sophisticated attacks, making the concept of 'trust' the most critical security challenge.

## Key takeaways

- The Developer Workstation is the Primary Target: Attacks are shifting away from production systems toward developer workstations because developers tend to have highly privileged access, making it easier to compromise the initial entry point. (Time: 11:45)
- Speed and Automation Amplify Risk: The industry optimization for speed means that packages published to registries are running in the wild within minutes, allowing malware to propagate instantly. (Time: 410)
- Credential Management is Critical: Compromising a security vendor (like Aqua Security's Trivy) or a central repository (like GitHub) allows attackers to gain privileged access and compromise numerous downstream projects. Atomic rotation of credentials is essential. (Time: 14:30)
- The Role of LLMs in Attacks: Attackers are leveraging LLMs to automate and accelerate complex attacks, enabling sophisticated compromises (e.g., writing malicious JavaScript) that previously required deep expertise. (Time: 23:00)
- Due Diligence and Trust are Paramount: The speaker stresses that every dependency pull is a trust decision. Due diligence is required, and users should not be 'guinea pigs' by installing packages immediately after release. (Time: 20:20)

## Technical details

- Supply Chain Attacks & Worms: The talk traces the evolution of attacks from early, isolated incidents to self-propagating campaigns (worms) that traverse dependency graphs. (Time: 1:30)
- Vulnerabilities and Tools: Specific attacks discussed include: The Singularity attack (compromising NX via a 'pone request' vulnerability) and the subsequent Shy Hulude worm. Other tools/concepts mentioned are: `npm` lifecycle scripts (allowing code execution upon install), `Trivy` (a security tool compromised by attackers), and `GitHub Actions` (a high-value target for attacks). (Time: 705, 1430)
- Attack Vectors: Attackers exploit mutable tags (e.g., Docker Hub/GitHub) and compromised developer credentials to achieve massive, rapid compromise. The 'pone request' vulnerability allows code execution in the repository context. (Time: 14:30)
- Mitigation Techniques: The speaker advocates for implementing 'cooldowns' on automatic extension updates (e.g., in VS Code) and utilizing features like 'trusted publishing' on npm to verify package provenance. (Time: 20:20)

## Practical implications

- Implement strict credential hardening and enforce atomic rotation for all secrets, especially those used in CI/CD pipelines.
- Be wary of rapid package updates; do not install packages immediately upon release, as this increases the risk of being a 'guinea pig' for zero-day exploits.
- Prioritize security measures around developer workstations and CI/CD systems, as these are the most accessible points of failure.
- Utilize provenance verification tools (like trusted publishing on npm) to ensure the origin and integrity of open-source dependencies.

## Topics

Supply Chain Security, Open Source Vulnerabilities, CI/CD Security, Dependency Management, AI/LLM Security Risks, GitHub, npm, Trivy, Anthropic

Source: https://www.youtube.com/watch?v=9QaidOZ4zUM