Anatomy of a Software Supply Chain Incident
Software supply chain attacks have fundamentally redefined the modern threat landscape. The Shai-Hulud worm campaigns (September and November 2025) and the eamPCP cascading multi-ecosystem compromise (March 2026) represent the most operationally complex and broadly impactful supply chain incidents ever recorded. Together, they compromised hundreds of thousands of machines, exfiltrated over 300 GB of credentials, and demonstrated for the first time how a single poisoned dependency can cascade across npm, PyPI, GitHub Actions, Docker Hub, and container registries simultaneously.
Traditional incident response frameworks – built for perimeter breaches and ransomware events – are structurally inadequate for supply chain incidents of this nature. Security leaders are now facing attacks that:
- Execute before security tooling even initialises (npm preinstall hooks)
- Use the organisation’s own CI/CD infrastructure as the propagation engine
- Weaponise the security tools deployed to defend pipelines (Trivy, Checkmarx KICS)
- Operate across ecosystems that no single team owns
- Pivot from credential exfiltration to ransomware within weeks
This working session addresses the widening gap between how organisations plan to respond and how they must actually respond. Delegates will leave with a tested CISO-level decision framework, updated playbook structures anchored in real incident timelines, and a shared understanding of the governance, legal, and communications obligations triggered by supply chain compromise at scale.
This proposal references two major confirmed incidents: the Shai-Hulud npm worm (CISA Advisory, September 2025 and November 2025 wave) and the TeamPCP cascading supply chain campaign (CVE-2026- 33634, CISA KEV listed April 2026). All technical claims are traceable to public disclosures by Unit 42, SANS, Snyk, Wiz, JFrog, AWS, Microsoft, CISA, and Elastic.
Vinothkumar R – Freshworks
Professional Summary:
Cybersecurity leader with over a decade of experience specializing in Incident Response, Threat Detection, Enterprise Security and Security Operations.
- Currently part of Freshworks as an Incident Response and Enterprise IT Security Manager, with prior impactful roles across Microsoft, EY, and Deloitte.
- Holds multiple industry certifications, including CISSP, SANS GCIL, Microsoft DevOps Engineer Expert, Splunk, and EC-Council credentials.
- Strong technical foundation complemented by leadership, innovation, and a commitment to continuous learning through global hackathons and security programs.
- Speaker (BSides Chennai, c0c0n, Black Hat), Mentor, and Trainer.
LinkedIn Profile: https://www.linkedin.com/in/vinothkumar-incidentresponse
Aravind Baskaran – LinkedIn
Professional Summary:
Senior Information Security Engineer at LinkedIn with 7+ years of experience across incident response threat hunting, digital forensics, and security engineering.
- Previously held security roles at Microsoft, Imperva, and Deloitte, contributing to large-scale cyber defence and resilience programs.
- Strong expertise in Azure Cloud Security, DevOps, and forensic analysis, backed by multiple Microsoft and Google cloud/security certifications.
- Recognised for outstanding performance and leadership across multiple organisations, including several Deloitte Excellence Awards.
- Passionate about strengthening organisational security posture and staying ahead of emerging cyber threats.
- Prior speaking experience at comparable venues (FIRST Technical Conference – 2026, Bangalore)
LinkedIn Profile: https://www.linkedin.com/in/aravind-baskaran-6779b6b6