Defense Against the Dark Arts: NPM Attack
A deep dive into the September 2025 NPM supply chain attack—one of the largest in history—and how to defend your enterprise JavaScript applications.
Talk Deliveries
June 16, 2026
Mannheim, Germany
In this special mission, the Black Forest Commandos have traveled through time, arriving in a magical realm where they are known as the Seven Hexbreakers. This elite unit is uniquely equipped to break the "hexes" cast by modern supply-chain attackers.
Meet the Seven Hexbreakers:
- ⚔️ Gord: The Swordmaster (Physical Defense)
- 🎩 Rothütle: The Tactician (Strategic Planning)
- 🦾 Jack: The Cyborg (Vulnerability Detection)
- 🎯 Evie: The Sharpshooter (Cryptographic Signing)
- 🧛 Wilhelmina (Mina): The Undead Assassin (Triage & Exemptions)
- 🛡️ The Valkyrie: Identity Specialist (Attestations)
- 🎭 Agent Null: Zero-Day Specialist (The Masked Hunter)
What you will learn:
- 🧠 Anatomy of an Attack: How 18+ libraries (including Chalk and Debug) were compromised simultaneously.
- 🛡️ Proactive Defense: Practical strategies for evaluating and selecting NPM packages with a security-first mindset.
- 🧰 Tooling & Workflows: Implementing
npm audit, SBOM generation, and automated CVE scanning in your CI/CD pipeline. - 🤝 Maintainer Best Practices: How to protect your own packages and contribute to a safer ecosystem.