Today's relatively simple applications are often duct-taped together by hundreds of different libraries with external APIs and code loaded at run time. Attacks against this fragile software supply chain are becoming very common. We will show in an interactive attack/defend session how the current attacks against these applications work, and how to correctly apply the defenses against them.