What's in your dependencies? Supply chain attacks on Python projects

TALK: What's in your dependencies? Supply chain attacks on Python projects by Mateusz Bełczowski

Your Django project doesn't just depend on Django - it depends on dozens, sometimes hundreds, of packages. Each one is code that runs with your privileges. What happens when one of them gets compromised? This isn't theoretical. Attackers have phished maintainers to publish malicious versions of trusted packages. They've exploited CI/CD pipelines to inject crypto miners into popular libraries. They've registered typosquatted package names and waited for developers to mistype. This talk examines how these attacks work and what you can do about them. We'll look at real incidents to understand the attack patterns - how attackers get in, what payloads they deploy, and how compromises get detected.

More information: https://2026.djangocon.eu/speakers/FLBRLU/

Follow DjangoCon Europe on social media:
*X - https://x.com/DjangoConEurope/
*LinkedIn - https://www.linkedin.com/company/djangocon-europe/
*Mastodon - https://fosstodon.org/@djangoconeurope

#django #djangocon #djangoconeurope #djangoconeurope2026