Software Supply Chain Security is a hands-on course for software engineers who want to understand how attackers compromise the tools, dependencies, build systems, and delivery pipelines used to create modern software.
The course explains the full attack lifecycle, from malicious package publication and dependency confusion to maintainer compromise, poisoned updates, CI/CD attacks, and compromised build tooling. It combines attacker and defender perspectives with practical examples for Python, JavaScript, GitHub Actions, package registries, containers, SBOMs, SLSA, and Sigstore.

Learning outcomes

After completing the course, participants will be able to:

• Distinguish a vulnerable dependency from a malicious dependency.
• Identify software supply chain attack surfaces across the SDLC.
• Recognize typosquatting, slopsquatting, dependency confusion, maintainer compromise, and poisoned updates.
• Analyze major incidents including event-stream, SolarWinds, Codecov, 3CX, Polyfill.io, and XZ Utils.
• Apply practical controls for developers, package registries, CI/CD pipelines, containers, and build artifacts.
• Build a realistic detection, response, and supply chain security maturity plan.
   

Course details

• Audience: Front-end, back-end, platform, and DevOps engineers
• Level: Intermediate to advanced
• Format: Practical lecture and seminar
• Instructor: Richard A. Dubniczky
• Organization: ELTE, Faculty of Informatics
• Last updated: 2026