Anatomy Of A Supply Chain Worm Building Detection Systems That Work On Zero Days

This talk, presented by Sudhanshu Dasgupta and Sahil Bansal from SafeDep, delves into the Shai-Hulud supply chain worm, which compromised over 500 npm packages and executed credential theft, repository hijacking, and self-replication within seconds. The session highlights the limitations of traditional static analysis in detecting zero-day supply chain attacks and discusses the importance of dynamic runtime monitoring in sandboxed containers. The speakers also explain how Falco and eBPF-based behavioral detection rules can identify malicious package behavior during installation, allowing for proactive classification before any damage occurs.