Name: The Compromised Maintainer Problem: Detecting Malicious Code in Legitimate Dependencies
Start: 2026-11-05T14:15:00-0800
End: 2026-11-05T15:00:00-0800

The Compromised Maintainer Problem: Detecting Malicious Code in Legitimate Dependencies

Thursday November 5, 2026 2:15pm - 3:00pm PST

Room: Grand Ballroom A (Street Level)

Supply chain attacks have changed. A few years ago the story was typosquatting and obviously sketchy packages with five downloads. Today it is the opposite. Attackers are going after the packages you already trust, the ones with millions of weekly installs and maintainers you have heard of. XZ Utils, the wave of npm maintainer account takeovers, self-replicating worms like Shai-Hulud, leaked PyPI tokens in public CI logs. The pattern is consistent and it is getting worse.

The hard part is that traditional tooling does not catch any of this. SCA scanners look for known CVEs, but there is no advisory yet. The package name is legitimate. The signature checks out. By the time the ecosystem catches up, the malicious version has already shipped to production for thousands of teams.

In this session we will share what we have learned building detection for these attacks across npm, PyPI, NuGet, and Go. We will walk through a few recent real incidents, the behavioral signals that gave them away (suspicious postinstall scripts, network callbacks, obfuscated payloads, anomalous maintainer activity), and why waiting for a CVE will always leave you exposed. From there we will get practical: pre install scanning, sandboxing build steps, lockfile pinning with provenance verification, and monitoring for dependency drift over time.

Attendees will leave with a clear mental model of how modern package attacks unfold, detection patterns they can apply to their own pipelines, and an honest read on where current tooling falls short. Aimed at AppSec engineers, platform teams, and developers who own anything in CI/CD or dependency policy.

Speakers

Polina Moshenets

Security Engineer and Founder, SichGate

Polina Moshenets is a Security Engineer and Founder of SichGate, an AI model integrity testing company focused on safety and security evaluation of language models in highly regulated industries. Her background spans application security, supply chain risk in AI/ML pipelines, and... Read More →

Amro Haddadah

Founder, CyberXYZ

Amro is the founder of CyberXYZ and a veteran of Microsoft’s DFIR team, where he spent five years investigating advanced cyber threats. He later led enterprise security as Principal Architect at Roche. Today, he’s building AI-native defenses to detect and stop zero-day attacks... Read More →

Thursday November 5, 2026 2:15pm - 3:00pm PST
Room: Grand Ballroom A (Street Level)

Deployment and Maintenance

Audience Advanced

OWASP Global AppSec USA 2026

Polina Moshenets

Amro Haddadah

Get help with the event

OWASP Global AppSec USA 2026

Polina Moshenets

Amro Haddadah

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event