Inside the NPM supply chain attacks: Lessons from a worm on the loose

Foredragsholder

Nora Tomas

Senior Security Engineer

Nora is an Application Security Engineer at Storebrand, where she focuses on helping developers build secure systems and defend against threats.

Before moving into security, Nora spent several years as a developer specializing in authentication solutions, giving her an understanding of the challenges developers face.

Today, she leverages that experience to bridge the gap between development and security, working on strategies, tools, and practices that strengthen application security across the organization.

Om sesjonen

At the end of last year, the NPM ecosystem was hit with three supply‑chain attacks in rapid succession. In this session, we will go through the technical details of each one, how they unfolded, and how they impacted Storebrand.

From a crypto interceptor to Shai‑Hulud 1.0 and 2.0, you will learn how our AppSec team worked closely with developers and detection engineering to respond quickly and create mitigations by developing new scanners, as well as by leveraging our existing tool‑stack.

Further, we will look at long‑term strategies that can help developers protect against these types of attacks. We will also explain how to scale these strategies across a large organization such as Storebrand, with 300+ developers, 17 GitHub organizations, and varied tool‑stacks.

By the end of the session, you will leave with practical ideas for short‑term defenses you can use during the next NPM supply‑chain attack, and long‑term strategies to strengthen your stack.

Samtidig i programmet

1. 15:00 No Key Required: Bypassing Application-Layer Encryption with Frida 1 · Frimurerlosjen, rom 2
2. 15:00 Trust and Democracy in the Age of AI 10 · HeartBox ,Teatersalen
3. 15:00 No More Shadow IT: Governing Linux Desktops with Intune and Chef 10 · HeartBox, Byscenen
4. 15:00 Artikkel 32 i praksis: Slik ivaretar vi den registrerte 11- Breiseth, Storlon
5. 15:00 Bridging the gap between OT and IT - Expert Panel 2 · Home hotel Hammer, moen nede
6. 15:00 Integrert sikring i sykehusprosjekter - fra idefase til drift 2 · Home hotel Hammer, moen oppe
7. 15:00 Er konsulenten din en risiko i sikkerhetsgraderte anskaffelser? 3 · Hvelvet, Gullsalen
8. 15:00 Leverandøravhengighet i et beredskapsperspektiv: EU-kravene som kan endre forholdet til Big Tech 4 · Kommunestyresalen, Lillehammer rådhus
9. 15:00 Passkeys migration in the enterprise 5 · Kulturhuset Banken, Expedisjon
10. 15:00 "Last man standing – hvordan sikre operativ evne når digitale tjenester svikter" 5 · Kulturhuset Banken, Festsalen
11. 15:00 No organization is an island: hvordan finne det som betyr noe, når alt henger sammen med alt 5 · Kulturhuset Banken, Holbøsalen
12. 15:00 A closer look at what we suspect is vibe coded ransomware 5 · Kulturhuset Banken, Kafeen
13. 15:00 Beyond Standalone Risk Assessments: Making Cyber Risk Relevant for Management 6 · Lillehammer kino, sal 2
14. 15:00 Hvordan skape suksess med digitale kurs - en ærlig fortelling fra maritim næring 6 · Lillehammer kino, sal 4
15. 15:00 Lessons Learned and laughs from Incident Response 9 · Victoria Scandic, sal 3