Blue Team Con 2026

12:00pm CDT

When the Package Is the Weapon: Detecting and Responding to npm Supply Chain Intrusions

Sunday September 13, 2026 12:00pm - 12:25pm CDT

Your developers trust npm. Attackers figured that out before your detection stack did.
This talk is a ground-up forensic reconstruction of two real npm supply chain campaigns — the NX package compromise in late 2025 and the axios RAT campaign in March 2026 — told entirely from the defender's perspective. Not a theoretical exercise. This is what the logs actually looked like, what the tooling missed, and what finally surfaced the activity.
We walk through how a malicious git hook silently drops a RAT onto a developer endpoint the moment they run a routine yarn dlx command, why this technique is specifically engineered to stay quiet in standard endpoint telemetry, and what the attacker does next. The target isn't your servers. It's the MetaMask wallet sitting in your developer's browser profile and the seed phrases cached in their dotfiles. Cloud credentials are secondary — harvested and staged for resale while the crypto moves on-chain.
The second half of the talk is pure blue team. We'll share the Humio/LogScale query patterns that actually worked, the CrowdStrike telemetry fields that matter for this attack class, the detection gaps these campaigns deliberately exploit, and a hardening checklist your security team can hand directly to engineering.
Real IOCs and detection artifacts from live incident forensics will be released during the session.
You will leave with something you can use the same week.

Speakers

Mohit Bansal

Senior Engineering Manager, Security Engineering, Webflow

Mohit Bansal leads a security engineering team spanning SecOps, Vulnerability Management, Enterprise Security, Incident Response and security tooling. He brings 10+ years of security experience across application security engineering and leadership roles at multiple high-scale technology... Read More →

Sunday September 13, 2026 12:00pm - 12:25pm CDT
Swissôtel Chicago 323 E Wacker Dr, Chicago, IL 60601, USA

Talk, Talk Track 2

Company Webflow
Audience Intermediate
Subject Application Security / DevSecOps
global Y

Blue Team Con 2026

From $0.00

Tickets

Success you have shared X tickets.

Blue Team Con 2026

12:00pm CDT

Mohit Bansal

Get help with the event

Choose your checkout method

Success you have shared X tickets.

Blue Team Con 2026

12:00pm CDT

Mohit Bansal

Get help with the event