Javier Conejo del Cerro

Imagine buying a brand-new smartphone. You peel away the protective film. The screen lights up for the first time. The setup wizard welcomes you. Everything smells new, looks untouched and behaves exactly as expected. You believe you are the first person to control the device. But somewhere beneath the operating system, another presence is already awake. It does not appear on the home screen. It does not ask for permission. It does not need you to download anything suspicious. It was placed...

Every software ecosystem resembles a city. Developers construct applications like buildings, dependencies form their foundations, repositories supply the materials, and automated pipelines transport those materials from one construction site to another. The entire city depends on trust. A developer installs a package. A build system executes its installation scripts. A release pipeline publishes a new version. Other projects consume it, assuming the material arriving from a familiar supplier...

Every visitor knows the routine. You approach a building. A security guard stands at the entrance. He wears the right uniform, stands behind an official-looking checkpoint and asks you to complete a routine verification before entering. You comply. After all, the guard is supposed to protect the building. Now imagine the guard is not employed by the building at all. He has stolen the uniform, taken control of the checkpoint and rewritten the instructions. Instead of checking whether you...