6 AppSec CTOs Debate Open Source Supply Chain Security at Black Hat

At Black Hat, Socket CTO Ahmad Nassri joined five application-security leaders on The Secure Disclosure podcast to discuss escalating open-source software supply chain threats, including malicious dependency poisoning, maintainer account hijacking, and payloads executed during package installation. The panel distinguished active malware from ordinary software vulnerabilities, arguing that patch-management approaches alone cannot address deliberate upstream attacks. Participants also highlighted state-sponsored groups, including North Korea-linked actors, using AI-assisted phishing and attacks on developer devices and CI/CD systems to steal credentials and reach production environments. They noted that package registries such as npm face practical constraints because disabling features like lifecycle scripts could disrupt much of the ecosystem, making registry scanning insufficient without visibility across developer workstations, dependency execution paths, and CI/CD pipelines. The discussion concluded that registries, maintainers, enterprises, and security vendors must collaborate to strengthen the package-distribution trust model rather than addressing supply chain security in isolation.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.