Thomas Chauchefoin

Conf42: DevSecOps 2022

Oops, there's somebody in my package manager!

What is your worst supply chain nightmare, and why is it somebody breaking into the backend of a popular package manager? Let's explore how we got our hands on the servers behind the PHP package managers Composer and PEAR, and how we should rethink our approach to supply chain security.