Stop Malicious Packages Before They Hit Your Build
Stop Malicious Packages Before They Hit Your Build
Malicious packages no longer stand out—they blend in. Based on Sonatype’s analysis of 4,300+ malicious open source packages, this session reveals how attackers are moving beyond typosquatting to publish ecosystem-adjacent packages that look like legitimate plugins, SDKs, and developer tools. Learn the naming patterns and tactics behind these attacks, how to spot suspicious dependencies before they enter your build, and practical ways to keep malicious code out of developer environments and CI/CD pipelines.
Overview
Modern malicious packages no longer rely on simple typos or obvious fake names. Today’s attackers are publishing packages that look like normal parts of the development ecosystem, plugins, SDKs, configs, wrappers, and helper libraries designed to blend into everyday engineering workflows.
Based on Sonatype’s latest research into more than 4,300 malicious open source packages, this workshop-style webinar explores how naming-variant attacks are evolving beyond traditional typosquatting, and why developers are increasingly becoming the first target. We’ll break down the tactics attackers use to make malicious dependencies appear trustworthy across ecosystems like React, ESLint, and Tailwind.
Rather than focusing on theory alone, this session will help developers and engineering teams build practical instincts for evaluating dependencies before they enter the build. Attendees will learn how to spot risky naming patterns, identify suspicious ecosystem-adjacent packages, and introduce simple checks that reduce the chance of malicious code reaching developer environments and CI/CD pipelines.
Because the next generation of malicious packages is designed to look completely normal.
Featured Speakers
Andrés Pérez
Product Marketing Manager
.png?width=242&height=208&name=Andr%C3%A9s%20P%C3%A9rez%20-%20Product%20Marketing%20Manager%2c%20Sonatype%20(1).png)
Garrett Calpouzos
Principal Security Researcher