6 AppSec CTOs Debate Open Source Supply Chain Security at Black Hat

Summary

Six AppSec CTOs debated the evolving landscape of open source supply chain security, highlighting the critical distinction between software vulnerabilities and active malware. They discussed how threat actors, including state-sponsored groups like North Korea's DPRK, exploit developer tools and CI/CD pipelines, and noted the inherent limitations of package registries in preventing malicious payloads. The consensus emphasized the need for industry-wide collaboration to harden the open source distribution trust model.

Full text

Back[Security News]6 AppSec CTOs Debate Open Source Supply Chain Security at Black HatSocket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.Sarah GoodingAug 31, 2026|1 min readSocket CTO Ahmad Nassri recently sat down with five other AppSec leaders on The Secure Disclosure podcast for an unfiltered discussion on the state of software supply chain security. Hosting six competing CTOs and security researchers in one room provided a candid look at how upstream threats are evolving, the operational limits of package registries, and why commercial threat intelligence siloing leaves engineering teams exposed. A few of the highlights:Vulnerabilities vs. Active Malicious Intent AppSec still suffers from a fundamental confusion between vulnerable software (CVEs) and active malware. Threat actors aren't waiting around to exploit a known bug in your code. They are poisoning dependency trees, hijacking maintainer credentials, and executing malicious payloads during package installation. Treating active malware like a standard patch management issue simply doesn't work.State-Sponsored Leverage and CI/CD Exploitation Groups like North Korea's DPRK have turned upstream open source compromises into a high-margin business model. Armed with AI agents to automate spear-phishing and script generation, threat actors are targeting developer laptops and GitHub Actions pipelines to pull credentials and pivot directly into production systems.Open Source Registry Limitations Package registries face structural limitations and deep legacy dependencies. Registries like npm cannot simply disable features like lifecycle scripts without breaking massive portions of the open source ecosystem. Pre-publication registry scanning offers a narrow line of defense. Effective security requires complete visibility across the full execution graph, extending from local developer workstations into CI/CD pipelines.The general consensus among the CTOs involved in the discussion was that defending open source requires an industry-wide shift in perspective. Registries, maintainers, enterprise teams, and security vendors cannot solve this crisis in silos. Until the industry works together to harden the trust model of package distribution, attackers will keep taking the path of least resistance.Catch the lively roundtable discussion below to see how the panel tackles some of the most pressing issues in supply chain security:

Indicators of Compromise

• malware — malware

Entities