Loading…
The past year saw an explosion of highly effective malicious‑package attacks. Well‑known libraries were compromised, new versions shipped with additions for crypto theft or data exfiltration. Attackers launched different attacks with each building upon the last becoming more effective with each iteration. We bore witness to the first appearance of the great sandworm, followed by a far worse second coming. A simple bit of JavaScript that started with a mere 37 packages, swiftly spread like a worm from one victim to the next. In the end, it compromised an estimated 700 packages and GitHub accounts across more than a thousand organizations. Many recognizable companies had source code and other sensitive artifacts stolen. This talk digs into how these campaigns worked, why they were so effective, with real-world examples of how they slipped into even established security vendors or became pivot points for deeper compromise. We’ll also look at what has actually changed to counter this class of threat, what still hasn’t, and what is effective at protecting against these attacks.


Speakers
avatar for Megg Sage

Megg Sage

Senior Security Engineer, PagerDuty
Megg is an application security engineer who started out as a web developer. Security drew her in with the endless puzzles and challenges put forth by the field. She loves sharing knowledge, particularly when she can both educate and frighten her audience at the same time. After all... Read More →
Monday June 1, 2026 10:40am - 11:30am PDT
Track 3 - AppSec Track - Room 1420/1430 - Sponsored by Google Cloud Security - Hosted by OWASP 515 W Hastings St, Vancouver, BC V6B 5K3, Canada
Share Modal

Share this link via

Or copy link