Talk Overview
The Set List
Every section is related to a song — because even supply chain disasters deserve a soundtrack. Listen to the playlist →
The Silent Threat
An npm package configured to upgrade automatically. Everything is working great. Then a new version is released. No one thinks twice about it.
This is the story of what happens when that silent assumption breaks at scale.
Four Connected Attacks
- Targeted Nx
- Exploited a vulnerable GitHub Actions workflow
- Deployed a credential-harvesting malware script
- Resulted in thousands of leaked secrets
- Targeted npm maintainer known as Qix
- Gained access via phishing email
- Malicious code functioned as a crypto stealer
- Used unrotated tokens from the s1ngularity breach
- Self-replicating worm
- Exfiltrated secrets and exposed private repos
- Backdoored 796 unique npm packages
- Leaked data from 500+ GitHub users
- Self-replicating worm
The Architecture of Dependencies
Dependencies are all interconnected, each relying on tens of transitive dependencies. A single point of failure doesn't stay contained. It propagates.
Understanding the blast radius before the incident is the only way to reason about it during one.
Responding When It's Already on Fire
What happened? New information is being released constantly. Stay up to date.
Are you affected? Does an SBOM exist? Is it current? This is the moment you find out if your inventory is real.
Stay organized.
- Create a centralized tracking sheet immediately
- Assign clear responsibilities so nothing falls between teams
Three Things Happening at Once
- Leadership wants answers
- Customers want to know their impact
- New information keeps being released
The Response Triangle
Supply chain incidents don't stay in one team's lane.
Light at the End of the Tunnel
You've made it through the initial response, but it is not over yet.
Competing Urgencies
Coming Out the Other Side
Cross-functional incidents are exhausting. But you get through them — and the teams that do it well come out stronger and better coordinated than before.
Before the Incident Happens
Guiding principles: Least Privilege and Defense in Depth. The goal is a reduced attack surface — not perfect security.
The Debrief
What went well? What didn't?
- Did you have an easy way to find vulnerable versions across your stack?
- Did you face friction from supporting teams during the response?
- Did you have a communications plan in place — or were you making it up?
What can be improved for next time? Make a concrete plan to fix anything that didn't go well. Before the next incident starts.
Making It Repeatable
- Document the response efforts — every step, every decision, every escalation
- Create templates for communications — so the next incident doesn't start from a blank page
- Write SOPs on what to do in similar situations
- Communicate results with stakeholders and customers — close the loop
Wellness Check
Take time to breathe after an incident. Response efforts can be stressfull, check on your teammates.
The Human Element
There will always be another event
We don't know when the next attack will happen. The best thing we can do is make sure we are prepared.
Datadog Security Labs publishes original security research, threat intelligence, and in-depth technical analysis.