Supply chain attack
16
MENTIONS
9
EPISODES
9
PODCASTS
Search complete. 16 mentions across 9 episodes found for "Supply chain attack".
Oct 27, 2026
Mike ShemaHOST
I'm going to kind of jump onto some other use cases here because you mentioned like, why is my payments API launching a shell? That's probably not what any API you want to be doing.
Mike ShemaHOST
And so supply chain, there has to be a story here too, because a lot of supply chain attacks can also be predicated on download a malicious package, launch a shell.
Mike ShemaHOST
So how have you applied this? Has it been just observability? Has it also been just blocking? What's the story there that you've encountered?
Rashid FerozeGUEST
So when it comes to monitoring for such scenarios, what has worked for us is To add more context here, when we talk about runtime security and supply chain, right? I'll talk about what has happened in the recent, last week.
6 MINS LATER
Mike ShemaHOST
Got it.
Rashid FerozeGUEST
I think I can walk you through one of the cases that I have seen.
Rashid FerozeGUEST
We saw a couple of supply chain attacks, for example, in and then 2.0 came, a lot of node NPM packages were compromised.
Rashid FerozeGUEST
When we say upstream package got compromised, we essentially mean is the attacker injected some malicious code in it.
Mike ShemaHOST
I'm gonna kind of jump onto some other use cases here because you mentioned like, why is my payments API launching a shell? That's probably not what any API you want to be doing.
Mike ShemaHOST
And so supply chain, there has to be a story here too, because a lot of supply chain attacks can also be predicated on download a malicious package, launch a shell.
Mike ShemaHOST
So how have you applied this? Has it been just observability? Has it also been just blocking? What's the story there that you've encountered?
Rashid FerozeGUEST
So when it comes to monitoring for such scenarios, what has worked for us is To add more context here, when we talk about runtime security and supply chain, right, I'll talk about what has happened in the recent, last week.
6 MINS LATER
Mike ShemaHOST
Got it.
Mike ShemaHOST
Got it.
Rashid FerozeGUEST
I think I can walk you through one of the cases that I have seen, right? We saw a couple of supply chain attacks, for example, in and then 2.0 came.
Rashid FerozeGUEST
A lot of node NPM packages were compromised, right? So when we say a package, upstream package got compromised, we essentially mean is the attacker injected some malicious code in it.
OpeHOST
Let's go with Lite again first.
OpeHOST
They posted that they had this supply chain attack.
OpeHOST
So what a supply chain attack is, is normally as a company, you have where you want to release new builds.
OpeHOST
You control that whole process, right? You know what goes out.
OpeHOST
A couple of months ago, and they have a root cause document as 3B.
James AzarHOST
All right, log4j on steroids.
James AzarHOST
All right, from the web stack to the AI stack, LiteLLM, the popular Python package that sits between applications and model providers, was compromised in a supply chain attack.
James AzarHOST
Versions 1.107.0 distributed through PyPi wheels and Docker images carried a credential stealer and a backdoor.
James AzarHOST
PyPi has quarantined the package and the malicious Docker images are all gone.
Dave JonesHOST
I've been dealing with, uh, supply chain.
Dave JonesHOST
I've been doing a video on supply chain attacks.
Chris GammellHOST
Oh, yes.
Chris GammellHOST
Right.
Dave JonesHOST
It's also called a man in the middle attack-
Chris GammellHOST
Yeah, yeah, yeah
Dave JonesHOST
... which usually refers to comms, but it also can refer to supply chain attacks as well.
Chris GammellHOST
Yeah.
Francois ProulxGUEST
It's really production that matters.
Francois ProulxGUEST
So I think that's why people think it were it works it's good enough we don't need to modify the yaml anymore don't touch it you know it's not broken uh don't fix it kind of mentality uh and that leads to also people like just not caring enough about following the best practice they may have heard about like uh some some hypothetical scenario that supply chain attacks like are using this technique they're like well that only applies to public repos we don't have any open source project like we only have like private repos they rationalize it away
Cameron WaltersHOST
rationalize
Francois ProulxGUEST
it away okay yeah and then i in my way in my in my mind in just private repos setting it's even worse like because everyone has has right access to push like push new branches open prs
Network ChuckHOST
Now this cybersecurity threat, I hate it so much because there's really not much we can do about it.
Network ChuckHOST
It's called supply chain attacks.
Network ChuckHOST
And my good old buddy Starbucks is gonna help me explain this in December of 2024.
Network ChuckHOST
So recently Starbucks got hacked, but they also themselves did not get hacked.
Network ChuckHOST
That has happened.
Network ChuckHOST
In fact, it happened with three CX just last year.
Network ChuckHOST
Now I'm scrolling through this article, just remembering how many of these supply chain attacks happened in 2024.
Network ChuckHOST
I think it was dubbed the year of supply chain attacks and it's just crazy.
speaker_2HOST
Right.
speaker_2HOST
In a sophisticated supply chain attack, the initial access happens quietly through a trusted dependency.
speaker_2HOST
The malicious activity is designed to blend right in with normal system operations.
speaker_1HOST
So the attacker blends in.