How Worms Exposed the Real Attack Surface of Open Source - Charlie Eriksen - NDC Oslo 2026

How Worms Exposed the Real Attack Surface of Open Source - Charlie Eriksen - NDC Oslo 2026

Title history
  • How Worms Exposed the Real Attack Surface of Open Source - Charlie Eriksen - NDC Oslo 2026 — observed on 20261028-1453 UTC (YouTube)

by Charlie Eriksen · View the channel on PSI

Humanities, Social Sciences & Thought Computing & Cybersecurity URComputer securityURJComputer viruses, Trojans and worms
🎙 Charlie Eriksen 👥 230K 📅 October 28, 2026 ⏱ 57 min 👁 10 📄 expert opinion 🧭 2026-10-28
Available in: English (current) Français

Keywords

supply chainopen sourcewormnpmsecurity

Summary

The talk by Charlie Eriksen, a security researcher at Iikido Security, examines the evolution of supply-chain attacks in open-source ecosystems, culminating in self-propagating worms. He identifies three enabling conditions: speed of distribution, automation (e.g., npm lifecycle scripts), and scale of dependency trees. The talk recounts major incidents: the Singularity attack on NX, the compromise of debug and chalk packages, and the Shy Hulude worm, which used credentials to spread and exfiltration mechanisms. It highlights the rising role of AI agents in attacks and the vulnerability of developer workstations and CI/CD systems. The speaker discusses attacks on security tools like Trivy and the canister worm that targeted Kubernetes during the Iran conflict. He concludes that security in open source has shifted from a prevention-first mindset to a design problem, emphasizing trust and the need for better credential management and faster containment.

140 words

Critical Evaluation

Value of the Information & Strength of the Argument

The talk provides a comprehensive, narrative-driven analysis of recent supply-chain attacks, drawing on concrete examples to illustrate systemic vulnerabilities. Eriksen effectively argues that speed, automation, and scale have fundamentally changed the security landscape, making worms inevitable without breaking any technical mechanisms. The escalation from isolated incidents to self-replicating campaigns is well-documented, and the discussion of trust, dependency, and social engineering adds depth. The argument is persuasive, blending technical details with strategic insights, and the call to shift from prevention to design thinking is compelling.

Scientific Rigor, Source Quality, Title Accuracy

The talk is based on real-world incidents and the speaker’s direct research, lending credibility. However, it lacks explicit citations beyond general references, and some claims (e.g., specific statistics) are not sourced within the talk. The title accurately reflects the content: it centers on how worms revealed the true nature of the open-source attack surface. The format is a conference presentation, not a rigorous academic paper, but it synthesizes known information clearly and reasonably.

172 words

Quality & Reliability

8/10

The speaker is a security researcher actively involved in analyzing the discussed attacks, and the talk references well-documented incidents. However, it is a conference talk providing personal interpretations rather than a formal, peer-reviewed publication.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

Contribution & Novelties

This talk stands out for its chronological synthesis of major supply-chain attacks, connecting them to a broader argument about systemic vulnerabilities. It introduces the concept of worms as a natural consequence of speed, automation, and scale in open-source ecosystems, and highlights the shift toward credential-based propagation and exfiltration mechanisms. The discussion of team PCP’s evolution and the implications for security tools like Trivy provides novel context.

Pour aller plus loin :

  • Supply chain attack — Overview of supply-chain security in software.
  • npm — Package manager and the attack surface it introduces.
  • GitHub Actions — CI/CD platform exploited in several attacks.

100 words

Radar Profile

The profile shows high information quantity and quality, with moderate technical depth and good reliability, indicating a well-informed expert talk that is accessible yet substantive. The high information scores reflect the dense coverage of incidents and concepts, while the reliability score aligns with the speaker's direct involvement and the practical nature of the talk.

Reliability 8/10