The Open Source Dependencies Running Your Startup (Without You Knowing It)

Modern applications are built on open source. Whether it's a web application, mobile backend, AI service, or cloud platform, developers routinely install a handful of packages and move on. What often goes unnoticed is the vast dependency graph hidden underneath those direct dependencies.

A single package installation can introduce hundreds of transitive dependencies, each maintained by different individuals, governed by different release cycles, and carrying different levels of risk. Over the years, attackers have exploited this complexity through dependency confusion attacks, typosquatting, malicious package updates, and compromised maintainer accounts.

This talk explores the hidden software supply chain that powers modern applications. Through real-world incidents and practical demonstrations, attendees will learn how dependency trees evolve, how supply-chain attacks work, and why organizations increasingly treat dependency management as a critical security concern.

The session will also introduce open-source tools that help developers audit dependencies, generate Software Bills of Materials (SBOMs), identify vulnerabilities, and integrate dependency checks into CI/CD pipelines.

By the end of the talk, attendees will have a practical framework for understanding, visualizing, and securing the open-source ecosystem their applications depend upon.

Session Outline

1. The Dependency Graph Nobody Sees

   • Direct vs transitive dependencies

   • Visualizing dependency trees

   • Why dependency count grows rapidly

2. When Dependencies Become Security Risks

   • Dependency confusion

   • Typosquatting

   • Malicious package releases

   • Real-world supply chain incidents

3. Securing the Open Source Supply Chain

   • Vulnerability scanning

   • SBOM fundamentals

   • Dependency auditing

   • CI/CD integration

4. Practical Checklist for Teams

   • What to audit today

   • Recommended open-source tools

   • Secure dependency management practices

• Understand how modern applications accumulate large dependency chains.

• Learn the difference between direct and transitive dependencies and their associated risks.

• Explore real-world examples of open-source supply-chain attacks.

• Discover open-source tools for dependency auditing, SBOM generation, and vulnerability detection.

• Leave with actionable practices to improve dependency security in personal projects, startups, and production systems.