The Hidden Risks of Software re-use: OWASP Top 10 OSS Risks

The talk argues that open source security reaches well past license compliance and tracking known vulnerabilities. The speaker points out that most code in large organizations is open source, and that severity scores alone miss whether a flaw is reachable in a given application. Gaps in vulnerability data are highlighted, including a claim that roughly 80 percent of known vulnerabilities had public exploits before a CVE was published, which leaves reactive patching always behind attackers.

The middle section walks through a list of less obvious risks. Compromised legitimate packages, illustrated by the XZ Utils backdoor, and name confusion, including typosquatting and a dependency confusion case involving a PyTorch nightly build, are presented as easy and scalable attack paths. Other items cover unmaintained projects, breaking changes and weak test coverage that make upgrades hard, untracked and rebundled code, unapproved runtime behaviour such as calls to a domain that changed hands, and both undersized and oversized dependencies. Lock files and internal registries help only when every install path actually uses them.

For practitioners, the suggested steps include pinning versions and using reproducible installs in CI, reserving important package names on public registries, vetting packages before adoption and avoiding very new releases for a while, and monitoring sensitive API calls such as file, process and network activity. Copying small pieces of code can sometimes reduce exposure more than depending on them. The speaker suggests an internal platform team as a practical place to start.