2026-10-29 –, Main Hall
I am going to talk about software supply chain security, more precisely about exploiting CI/CD pipelines in GitHub so as to publish malicious versions of popular open source packages (just for example, on npmjs), write arbitrary code in GitHub repos or steal secrets.
Vulnerabilities are not only in your source code. They can hide in the deepest dependency of your project, in a build script, in a tool one of your dev uses. Every single piece of your software supply chain could impact the artefact you distribute. Including the pipelines you trust, the very pipelines that help you develop faster and secure your codebase. Maybe you should check on those to avoid distributing malware without even knowing it...
I’m going to show you various methods I’ve used to compromise popular open-source packages by exploiting their GitHub Actions workflows, or those of their dependencies.
Garance works at Depi in the offensive security research team, and she is specialising in software supply chain security. She love understanding and learning random things in the world around her and meeting new people.