OWASP Vancouver Chapter

The Secret Life of Malicious Packages with Megg Sage

Supply chain security has been all the rage recently—we keep hearing story after story about malicious packages popping up across various package repositories. This talk dives into the secret life of malicious packages: what they are, where they lurk, how they operate, and the many creative ways they can wreak havoc. From innocent-seeming typosquats to the compromise of trusted, widely-used packages, we’ll explore the full spectrum of threats and real-world examples that show just how sneaky (and dangerous) these packages can be.

So how can we protect ourselves from these threats? There are various options such as checking package health, source code reviews/scans, or use of tooling such as SCA tools. SCA scans, while very useful for vulnerability scanning, cannot be relied upon to protect against malicious packages. This talk will discuss their blind spots and other options for adding further protection. It will further reinforce that security should always take a multi-layered approach.

About our speaker
I'm an application security engineer who started out as a web developer. Security drew me in with the endless puzzles and challenges put forth by the field. I love sharing knowledge, particularly when I can both educate and horrify my audience at the same time. After all, what can happen when security goes wrong is pretty scary. I also enjoy working closely with software engineering teams to try to make security work within existing development practices, or at least try to minimize how painful "doing security" can be. When not behind a computer, I can usually be found making some sort of costume piece or shiny object.

============

Not So Secret: The Hidden Risks of GitHub Actions Secrets with Amiran Alavidze

If your CI/CD pipelines are built on GitHub Actions, you might be using GitHub Actions secrets to securely store credentials for connecting to your cloud environments. The security model for GitHub Actions secrets is not very intuitive. Many organizations assume that repository and organization-level secrets offer sufficient protection, but in reality these secrets lack granular access controls, exposing organizations to hidden security risks. This talk is full of demos and explores the hidden dangers of GitHub Actions Secrets.

Amiran is OWASP Vancouver board member and is a passionate product security professional with over 20 years of experience spanning systems engineering, security operations, GRC, and product and application security. As a security engineering leader, he champions a pragmatic, scalable approach to security - where collaboration between security, developer, and platform teams turns security into a business enabler rather than a bottleneck.