Who Controls the Dependencies, Controls the Universe

The Shai-hulud - the great sandworm of Arrakis - was neither the first nor the last supply-chain attack in a vast desert of dependencies. The attackers named it themselves. In 2025 came the first. Then two more mutations followed. And we felt the teeth in our company too.

One poisoned install, and compromised developers and CI pipelines become worm-riders themselves — automatically spreading the infection to every package they maintain. The spice of credentials must flow, apparently.

In this talk, we'll map the desert: how Shai-Hulud worked, why npm's trust model is basically a sandpit without stillsuits, and why this will not be the last. Then we'll gear up — you'll leave with a practical stillsuit of your own: linter rules and package manager configurations you can drop into your project today.

The Fremen survived Arrakis by respecting the desert, not fearing it. Fear is the mind-killer. Healthy paranoia about your dependencies, however, is just good engineering