TuxCare developer advocate to speak on install-time supply chain attacks at WeAreDevelopers North America

TuxCare said Senior Developer Advocate Chris DeMars will speak at WeAreDevelopers World Congress North America in San Jose from Sept. 23-25, 2026. His session will focus on install-time supply chain attacks, including malicious npm lifecycle scripts and the 2026 Glassworm campaign.

Why it matters: - Install-time supply chain attacks can compromise a developer environment before a project ever reaches the build stage. - The topic is relevant for teams trying to secure local development workflows and CI/CD pipelines. - The session is aimed at helping developers spot threats that standard audit tools may miss.

What happened: - TuxCare announced that Chris DeMars, Senior Developer Advocate, is scheduled to speak at WeAreDevelopers World Congress North America. - The conference runs Sept. 23-25, 2026, at the McEnery Convention Center in San Jose, California. - DeMars is scheduled to speak from 4:15-4:25 p.m. on Friday, Sept. 25. - His talk is titled “Silent Execution: Defending Against Install-Time Supply Chain Attacks.”

The details: - The session will examine how malicious npm lifecycle scripts can run during routine package installation. - DeMars will explain how install-time malware works, including techniques used in the 2026 “Glassworm” attacks. - The talk will cover why standard audit tools can miss these exploits. - Attendees will hear practical approaches for hardening local development environments and CI/CD pipelines. - Those approaches include script-blocking techniques and behavioral monitoring to detect and prevent malicious activity. - DeMars focuses on secure JavaScript development and software supply chain education. - He has more than 20 years of experience in web development and developer relations. - DeMars is a recognized Progress Champion and former Google Developer Expert and Microsoft MVP. - His background includes web accessibility, secure frontend practices and community building. - DeMars is based in Detroit. - More information on the session is available here. - More information on the conference is available here.

Between the lines: - TuxCare is using the appearance to reinforce its position around software supply chain security. - The focus on install-time threats reflects a broader shift toward defending the earliest stages of the development process. - The talk’s emphasis on practical controls suggests interest in defenses developers can use without waiting for downstream security review.

What's next: - DeMars is set to deliver the session during the conference on Sept. 25. - Attendees will be able to use the session to evaluate controls for script execution and pipeline monitoring. - TuxCare continues to promote its security work across open source and enterprise environments.

The bottom line: - The session spotlights a growing security gap in the software supply chain: threats that can strike during installation, before code is built or shipped.