Open Source Summit India 2026

Every npm install or pip install pulls in dozens of packages which includes transitive dependencies no one has reviewed. This is the most unguarded moment in the software supply chain: malicious code enters a developer's machine before any CI/CD check or SBOM scan even runs.

Attackers know this. Typosquatting, dependency confusion, and pre/post-install script exploitation all target the install step specifically, because that's where defences are weakest.

In this talk, I'll discuss a different approach: guarding the package manager itself. Instead of scanning after installation, what if we could analyse packages in real-time and block threats before they execute? I'll walk through real attack patterns, explain how combining malware analysis with OS-native sandboxing makes this practical, and share what we've learned building open source tooling in this space.

You'll get to know about:
- Why install-time is the critical gap in dependency security
- How real supply chain attacks bypass pipeline-stage scanning
- Practical ways to add real-time package protection using open source tools