Dependency attacks in 2026 with James Matchett

The podcast discusses critical issues in software supply chain security, emphasizing the gap between perceived and actual preparedness among organizations. A key finding highlights that while 73% of respondents believe their tools can stop install-time attacks, only 38% scan for vulnerabilities before ingesting dependencies. Misconceptions persist around the protective capabilities of SBOMs and package managers, which do not prevent malicious pre-install scripts from executing. The discussion also covers risks from transitive dependencies, typosquatting, and AI-generated code, which can introduce hidden or hallucinated packages into projects. Automation in policy decisions remains low despite the impracticality of manual oversight across thousands of packages.

Further topics include evolving security practices such as dependency firewalls, soak policies, and cool-down periods to delay package adoption and allow for community scrutiny. However, overly rigid policies risk driving developers to copy-paste code, creating untracked "shadow dependencies." The importance of build provenance, attestation, and cryptographic signing is stressed, though challenges remain with systems like SigStore. The conversation also addresses the vulnerabilities of open-source ecosystems, including the "bus factor" and lack of MFA among maintainers, which increase systemic risk. With the rise of AI in development, risks are accelerating, especially when AI agents pull dependencies without oversight.

Regulatory changes like the EU's Cyber Resilience Act (CRA) are highlighted as catalysts for improved security, mandating SBOMs, security scans, and rapid reporting of exploits. The podcast underscores the need for greater visibility into package usage through comprehensive logging and monitoring, enabling faster incident response. Regular fire drills are recommended to test response plans for compromised packages. Ultimately, the discussion advocates for a balanced approach that combines automated policies, developer flexibility, and proactive security measures to address the growing complexity and threats within modern software supply chains.

• What if you enforced pre-ingestion scanning for all dependencies before they enter your CI/CD pipeline?

  • Move: Implement a mandatory vulnerability scan using tools like Trivy or Snyk on every dependency - direct and transitive - before any package is ingested into your local registry or build process. Automate this as a gate in your development workflow.
  • Why Now?: With only 38% of organizations scanning before ingestion and attackers shifting to install-time exploits, waiting until deployment is too late. The Cyber Resilience Act also pushes for proactive SBOM and scan compliance by 2027.
  • Expected Upside: Reduce risk of pulling compromised or hallucinated packages; avoid downstream breaches and compliance gaps. Catch issues early when remediation cost is lowest.

• What if you simulated a "compromised dependency" fire drill across your solo development environment?

  • Move: Intentionally introduce a known malicious or flagged package (e.g., from a test repo like npm/malicious-example) into your project, then execute your detection and removal process: trace its usage, identify where it was pulled, and purge it from artifacts and logs.
  • Why Now?: Most developers lack visibility into who pulled what and when. Real incidents (e.g., log4j) show that without logs and provenance, responders default to overreacting (e.g., credential resets). Practice now avoids chaos later.
  • Expected Upside: Validate your monitoring setup, improve incident response time, and build confidence in your ability to contain supply chain breaches without over-remediating.

• What if you implemented a 7-day soak period for new or updated dependencies in production builds?

  • Move: Configure your dependency management system (e.g., via Renovate or Dependabot) to allow new versions in development immediately but block them from production pipelines for 7 days unless manually approved. Log all exceptions.
  • Why Now?: Threat intelligence shows many malicious packages are detected days after release. The industry is adopting "cool down" policies, and the CRA demands justification for software safety - this creates audit-ready rationale.
  • Expected Upside: Reduce blast radius from typosquatting, slop squatting, or AI-hallucinated packages. Gain time to observe community feedback and security advisories before exposure.

• Implement automated dependency scanning before ingesting any third-party packages to catch vulnerabilities early, especially given that only 38% of organizations currently do so.
• Set up a dependency firewall with a soak policy (e.g., 7-day delay) for new or updated packages to allow time for community scrutiny and threat detection.
• Enforce cryptographic signing of all internal and external packages using tools like SigStore, and verify signatures in CI/CD pipelines to ensure build provenance.
• Generate and maintain accurate Software Bill of Materials (SBOMs) for every build to comply with emerging regulations like the EU Cyber Resilience Act and enable rapid incident response.
• Conduct regular incident response fire drills simulating a compromised dependency to test detection, communication, and remediation processes across development teams.