🚀 Submit a Challenge — SecDim AppSec Village CTF at DEF CON 34 and Win a ROG Xbox Ally

Sign InContact sales
Sign InContact sales

Supply Chain Security

6h 20mBeginnerDevSecOpsFeatured

Software supply chains are among the most targeted and least understood attack surfaces in modern development. This course teaches developers to see their software the way an attacker does — not just the code they write, but every dependency, build tool, CI/CD pipeline, registry, and AI assistant that touches it. You will learn how landmark attacks like SolarWinds, XZ Utils, and event-stream unfolded, how to map and harden your own supply chain, and how to apply practical controls including lockfile pinning, artifact signing, SBOM generation, and policy-as-code gates. The course closes with the emerging threat of AI supply chain attacks — hallucinated packages, insecure code suggestions, prompt injection, and backdoored models — equipping you to ship software you can actually trust.

Begin course

Topics

  1. Introduction

    Lesson5m

    Software supply chain attacks are among the fastest-growing threats in modern development. This course is designed for developers who want to understand, identify, and mitigate supply chain risks without leaving their natural workflow.

  2. What is Supply Chain Attack

    Lesson15m

    Mental model: you're not just shipping your code. Anatomy of a supply chain attack (SolarWinds, XZ Utils, event-stream).

  3. Mapping Your Attack Surface

    Lesson15m

    Dependencies, build tools, CI/CD, registries, contributors. How to think like an attacker across the full pipeline.

  4. Depd Confusion & Typosquatting

    Lesson15m

    How attackers hijack package resolution. Scoped packages, private registries, namespace squatting.

  5. Typosquatting Lab

    Challenge30m

    Complete this hands-on lab to transform your learning into a new skill.

  6. Dependency Confusion Lab

    Challenge30m

    Complete this hands-on lab to transform your learning into a new skill.

  7. Transitive Dependencies

    Lesson15m

    The real risk is what your deps pull in. SBOM basics, dependency trees, lockfile hygiene.

  8. Malicious Packages

    Lesson15m

    Real case studies (PyPI, npm). Red flags to spot in package code, install hooks, unusual network calls.

  9. Malicious Packages Lab

    Challenge30m

    Complete this hands-on lab to transform your learning into a new skill.

  10. Securing Your CI/CD Pipeline

    Lesson15m

    Poisoned pipeline execution (PPE), secret sprawl, third-party Actions/Orbs. Principle of least privilege for pipelines.

  11. CI/CD Hardening Lab

    Challenge30m

    Complete this hands-on lab to transform your learning into a new skill.

  12. Secret in CI Lab

    Challenge30m

    Complete this hands-on lab to transform your learning into a new skill.

  13. Artifact Integrity & Signing

    Lesson15m

    Checksums, Sigstore/cosign, provenance attestation, SLSA framework intro.

  14. Dependency Pinning

    Lesson15m

    Hash pinning vs version ranges, lockfiles, automated update policies (Dependabot/Renovate tradeoffs).

  15. Secrets in the Supply Chain

    Lesson15m

    Hardcoded secrets, leaked tokens in public repos, compromised signing keys. Detection and rotation.

  16. Secret Leak Lab

    Challenge30m

    Complete this hands-on lab to transform your learning into a new skill.

  17. SBOMs & Policy as Code

    Lesson15m

    Generating and consuming SBOMs, open source license risk, integrating supply chain checks into PRs as policy gates.

  18. AI Supply Chain

    Lesson15m

    Hallucinated package names, insecure code suggestions, prompt injection in agents, malicious/pickle-exploited models, and AI framework supply chain risk.

  19. AI Supply Chain Security Lab

    Challenge30m

    Complete this hands-on lab to transform your learning into a new skill.