Supply chain security conversation is booming these days after attacks like log4j came to the scene.
In this in-house research, we have conducted research on publicly available open-source assets like (JS packages), WordPress Plugins, and Ruby Gems to find out the presence of mistakenly or deliberately publicly exposed secrets (including private API keys and so on) i.e. AWS, Google, etc. (33 different types!)
This could pose a risk to anyone using those packages as dependencies or plugins so that this chain of not re-inventing the wheel could become a disaster that stops the wheel once and for all.
We would be presenting our research done on a large scale after in-house scanning on:
- Around 2 Million+ NPM Packages. (almost all publicly available at the time of research)
- About 60,000 WordPress Plugins. (almost all publicly available at the time of research)
- Ruby Gems (almost all publicly available at the time of research)
We would be demonstrating the numbers and impact to an audience in this talk and we would also be providing ways to prevent this and automation to integrate in your own ci/cd pipelines to prevent such disasters from happening
