AI
SBOMs Report What the Package Manager Believes
An SBOM is a snapshot of a source composition analysis scan. It tells customers the component name, version, and source URL. Customers can check the NVD themselves. What it does not capture is whether the repo those coordinates point to has been poisoned, repo-jacked, or replaced with a version containing malware. Marion works in healthcare and faces FDA regulations on top of SBOM mandates. His observation: supply chain attacks keep increasing even as SBOM adoption grows.
When Compliance Becomes a Checkbox
Regulated industries treat compliance as an accountability framework. A paper Marion cites argues that mandatory controls in many regulations may actually drive negative security behaviors. The pattern he sees across multiple industries: teams run SAST scans without examining results. Vendors deliver SBOMs as Word or Excel documents. Recipients store them in a file and never open them. Run them through Dependency-Track and they often fail to parse. Compliance turns into a checkbox exercise, replacing genuine security work.
Dependency Confusion and the Transitive Gap
A single top-level dependency pulls in roughly 34 transitive dependencies on average in Python or npm. The package manager shows requests; it won’t list urllib or the 20 libraries under it. That gap is the attack surface. Dependency confusion exploits version precedence: a researcher uploaded a package with a higher version number than an identically named private internal component, then watched package managers at Apple and other companies automatically pull his version, which contained a test payload.
Practical Supply Chain Defenses
Pin exact version numbers (no version ranges) in every package manifest. Reserve your package name in the registry before someone else registers a higher version. Validate checksums after download. In Artifactory, disable virtual repo fallback so external lookups cannot override private components. Use scoped npm packages to block typo squatting. Enable 2FA on every repo account. Run OpenSSF Scorecard on GitHub dependencies to measure maintenance quality. North Korean threat actor Moonstone Sleet pushed malicious npm packages to the JavaScript registry targeting Windows systems.
XZ Utils: Social Engineering an Unpaid Maintainer
XZ is a compression library distributed with almost every Linux version. It was maintained by a single unpaid volunteer. A threat actor badgered that maintainer over months: pull requests are late, the work is poor, step down. The maintainer became despondent and eventually accepted the attacker as a co-maintainer. The backdoor made it into pre-release builds before Andres Freund, a Microsoft engineer investigating SSH slowdowns, traced anomalous memory usage to XZ with Valgrind and pulled the alarm.
OmniBOR and Runtime Dependency Mapping
OmniBOR is an open source project that captures what actually loads at runtime. Marion contributes the Python tooling. The tool runs against a Python target, records every import, notes where each module loaded from, and computes a hash. The resulting manifest can be embedded in the build artifact. A subsequent build that cannot reproduce that manifest has been tampered with. Deep Factor, acquired by Cisco, took a similar runtime analysis approach. Runtime data produces no false positives because it only reports code that actually executed.
Notable Quotes
the danger isn’t in the things you know Robert Marion · ▶ Watch (22:12)
many times apparently trust but verify Robert Marion · ▶ Watch (19:36)
security is all about the gaps the gaps are the problems Robert Marion · ▶ Watch (43:49)
Key Takeaways
- SBOMs list declared components but cannot detect repo jacking or poisoned transitive packages before download.
- Dependency confusion exploits version precedence in package managers; pin exact versions and reserve your package name in the registry.
- Runtime analysis via OmniBOR hashes every actual import at execution, producing a reproducible manifest that flags tampering.
About the Speaker(s)
Robert Marion is the Product Security Architect at Baxter Healthcare. He has a background in software engineering and has worked on robots and machine communication. Marion designs and builds processes for making software products more secure. He is a member of the OmniBOR open source project.