The document discusses the risks associated with open-source software, particularly highlighting abandoned resources that can be exploited through dependency supply chain attacks. It provides insights into vulnerable packages, the prevalence of vulnerabilities in the latest versions, and references various git repositories for demonstration. The author acknowledges contributions from the community and offers resources for further information on the topic.

1. Attacking Open Source using
Abandoned Resources
Speakeasy JS - Feb 05, 2021

2. Hi, I’m Adam
@adam_baldwin
evilpacket

3. Discovery
Abandoned Resource Attacks
Fun Facts
Disclosure

4. “I wonder if…”
“Have you tried it yet”
Discovery

5. https:/
/blog.securityinnovation.com/repo-jacking-exploiting-the-dependency-supply-chain

6. APP
Dependency
express@4.3.1
npm Registry
Background

7. APP
Dependency
Dependency
express@4.3.1
npm Registry
https:/
/example.com/pkg-1.0.0.tgz
File
Background

8. APP
Dependency
Dependency
Dependency
express@4.3.1
npm Registry
https:/
/example.com/pkg-1.0.0.tgz
File
github:evilpacket/beep-boop#beta
GitHub
Repository
Background

9. Attack Overview
npm cli GitHub
git clone evilpacket/beep-boop
github:evilpacket/beep-boop#beta

10. Attack Overview
npm cli GitHub
git clone evilpacket/beep-boop
redirect -> joemcpwnerson/beep-boop
github:evilpacket/beep-boop#beta

11. Attack Overview
npm cli GitHub
git clone evilpacket/beep-boop
redirect -> joemcpwnerson/beep-boop
Git clone joemcpwnerson/beep-boop
github:evilpacket/beep-boop#beta

12. Attack Overview
npm cli GitHub
git clone evilpacket/beep-boop
redirect -> joemcpwnerson/beep-boop
Git clone joemcpwnerson/beep-boop
Have a repo
github:evilpacket/beep-boop#beta

13. Attack Overview
npm cli GitHub
git clone evilpacket/beep-boop
redirect -> joemcpwnerson/beep-boop
Git clone joemcpwnerson/beep-boop
Have a repo
git checkout #beta
github:evilpacket/beep-boop#beta

14. Attack Overview
npm cli GitHub
git clone evilpacket/beep-boop
redirect -> joemcpwnerson/beep-boop
Git clone joemcpwnerson/beep-boop
Have a repo
git checkout #beta
github:evilpacket/beep-boop#beta
ATTACKER

15. Fun Facts ✨
✨ it’s just numbers

16. Vulnerable
Packages
https://evilpacket.net/2021/attacking-oss-using-abandoned-resources/
754

17. Vulnerable
Packages
https://evilpacket.net/2021/attacking-oss-using-abandoned-resources/
754
Download the list

18. Vulnerable
Package
Versions
https://evilpacket.net/2021/attacking-oss-using-abandoned-resources/
6,530

19. deps
vs
devDeps
https://evilpacket.net/2021/attacking-oss-using-abandoned-resources/
> 50%
⚠

20. Latest
Version
Vulnerable
https://evilpacket.net/2021/attacking-oss-using-abandoned-resources/
~ 56%
⚠

21. Disclosure
TL;DR - I’m sorry for the emails
Special thanks to a bunch of pesky Hackers, Open Source
Maintainers, GitHub Security, and the webpack-cli maintainers…

22. T.hanks!
adam_baldwin
evilpacket
Questions?