Training the world's developers on application security

Node.js Secure Coding

Focus on command injection and path traversal vulnerabilities. Participants will get acquainted with real-world, vulnerable code of open source npm packages that were identified via CVEs. They will learn how to recognize patterns of vulnerable code, and best practices to mitigate these sets of vulnerabilities. We can focus on one of command injection or path traversal, or encompass both in order to provide a broader spectrum of patterns and cases. The session includes an intro for AppSec fundamentals and an outro for continued education and other resources at their disposal.

The Mechanics of Malicious Packages

A deepdive into supply chain security incidents with a focus on malicious packages - analyzing real incidents and stories behind them in the JavaScript / npm packages, analyzing vulnerable code, understanding the threat landscape from developer's to SCM, to CI, to public registries such as npmjs and pypi. Participants will have an increased awareness and secure mindset when working in the open source ecosystems (dependencies, docker container images, github actions) and will be presented with best practices and tools to help them combat against these threats.

Open Source and JavaScript Security Controls

Software supply chain security risks are ever-increasing, and if this wasn’t worrying enough, attacks have been sharpened to target developers and their ecosystems. From dependency confusion attacks, spearheaded malicious code backdoors in open source packages, and compromising your build pipelines infrastructure. The security risks prevalent in open source libraries and ecosystems pose an imminent threat to developers. What are some software security controls we can apply for a better security posture? Participants will have a broader understanding of the risks of open source software, from malicious packages to other security risks involved with open source software.