Malicious Dependencies Aren’t an Accident
transcript
show notes
Malicious dependencies are not accidents. They are often intentionally designed to look trustworthy so developers install them without hesitation. In this episode of DevSec Station, Tanya Janca explains how attackers use typosquatting, dependency confusion, fake packages, and even AI-generated recommendations to compromise developer environments and steal credentials.
You’ll learn:
• how malicious packages trick developers
• why dependency attacks work so well
• how attackers abuse trust and speed
• why “just be careful” is not an effective defense
• practical ways to add safer guardrails to your development workflow
Tanya walks through a realistic example of a dependency stealing AWS credentials, explains why this is a workflow problem instead of a developer failure, and shares practical steps you can take immediately to reduce risk in your own projects.
One practical action from this episode:
Require new dependencies to go through pull request review, and add lightweight checks that help your team verify package names and sources before installation.
DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software.
Train with Tanya: Want to bring practical, hands-on secure coding, application security, or AI security training to your team? Learn more at SheHacksPurple.
Follow Tanya:
