OpenSourceMalware

The OpenSourceMalware Show

About the show

When you think about malware, you probably envision phishing emails or sketchy websites. But malicious open source - targeting software developers and their build systems - is becoming a top way that threat actors deliver malware. Just one 'npm install' can trigger payloads that steal information and credentials. Software supply chain attacks by state actors, ransomware groups, and freelancers are happening every day. Hosted by Jenn Gile and Paul McCarty (co-founders of OpenSourceMalware), this podcast explores the latest trends and attacks, and helps defenders understand the tactics needed to prevent their orgs from being the next target. OpenSourceMalware provides community-driven threat intelligence on malicious open source assets including packages, domains, IP addresses, crypto wallets, and more. https://opensourcemalware.com/

Newest episodes

Keyv and Cachable maintainer talks about ChainDrop attack

Nov 13, 2026 1 hr 8 min

This week we had a special guest on the show: Jared Wray, who is the maintainer of several popular open source projects, including Keyv and Cacheable. In August 2026, he was the victim of an account takeover. A threat actor used a GitHub token he thought he'd retired to push malware into his Kevy and Cachable, and his own release pipeline shipped it to npm with valid provenance. It contained a worm that propagated the malware into 400+ npm packages. The campaign became known as ChainDrop, and the worm code was based on TeamPCP's open-sourced Mini Shai-Hulud worm. We talked about: How the attack happenedGetting his accounts backRebuilding his setupSecurity controls that are harder than they soundVetting new dependenciesStaying on GitHub ActionsEpisode resources: (webpage) Jared Wray on GitHub(blog) New npm Worm Hits 400+ Packages Including Keyv, Cachable(blog) Keyv and Cacheable - Chaindrop Worm(blog) Coding Securely in the Age of AI

Trojanized Claude Code extension, Binance and Polymarket thefts, PolinRider dated to 2025

Nov 6, 2026 47 min

This week we talked about: Trojanized Claude Code extension: On October 29, a trojanized Claude Code extension was shipped from Cursor's own mirror of the Open VSX registry. Cursor's mirror can carry different versions than Open VSX itself, so the only people who got it pulled Claude Code through Cursor, and most of them appear to have had auto-update turned on. The extension included the official binary plus code that gives attackers persistent remote access. Binance robbed by North Korea: The $6.3 billion Binance crypto theft started in June, when an engineer downloaded a malicious version of Homebrew. Binance cleaned it up, but the attackers had already learned enough about that engineer and his colleagues to pick their next target. In September a second engineer was compromised through a fake job interview's take-home assignment on a work laptop.. That access led to two more developer machines, and a container deployment token on one of them was used to deploy the container that launched the attack on October 29.Polymarket compromised through DebugBear: Polymarket was compromised through malicious JavaScript from DebugBear, a third-party vendor whose DNS records were hijacked at its domain registrar. Beyond DebugBear's first incident post on X, there's no public information about the attack yet. Injected JavaScript isn't new: it has been a common WordPress incident for years, through sites with an upload function and path traversal.PolinRider backdated to 2025: A set of legitimate npm packages compromised in May 2025 carried an obfuscated payload that turns out to be the earliest known PolinRider infection. The same maintainer was hit again multiple times this year, indicating they were likely compromised the entire time and could be one of the earliest victims.Resources (blog) Trojanized Claude Code Extension Plants an SSH Backdoor(blog) Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension...

Brotli vulnerability, LiteLLM breached via unrevoked key, poisoned prompt downloads malware

Oct 28, 2026 31 min

This week we talked about: Brotli vulnerability: The Brotli decoder bug behind Node2Shell reaches far beyond Node, and it's been overshadowed by the hype around PHP2Shell. Google's Brotli C code is usually vendored into projects like Python, Rust and PHP instead of pulled in as a dependency, so it won't show up in your package manifests. You have to hunt for copies yourself, and finding them all could take as long as Log4j did. We cover how to check for vulnerable copies. LiteLLM postmortem: LiteLLM's second compromise this year started with an admin key that was committed to a public repo in May and never revoked. In October, attackers used it to push malicious version 1.107.0, helped by a release control the team had relaxed so they could ship faster. It's a clear case for threat modeling any time you trade security for speed. MALFEX campaign: A malicious AGENTS.md file in a developer's Downloads folder tried to get their AI coding agent to install a package from MALFEX, an npm campaign that's been running since 2023. MALFEX packages are tiny, have no install script, and hide their payload in a file with a PNG header. Resources (blog) Blog - Dear Open Source Developers: It's OK not to embargo(blog) Python Packages Vulnerable to Node2Shell Brotli CVE(blog) CVE-2026-111497 Brotli Bug Reaches Far Beyond Node.js(blog) Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline(blog) The attack chain behind the v1.107.0 LiteLLM release(webpage) The Ultimate Beginner's Guide to Threat Modeling(blog) Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer(blog) Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware(feed) OpenSourceMalware threat reports tagged #malfex

Similar podcasts

Machine Gods NPR

Hard Fork The New York Times

Lex Fridman Podcast Lex Fridman

Teknisk sett Teknisk Ukeblad

Search Engine PJ Vogt

The Vergecast The Verge

Acquired Ben Gilbert and David Rosenthal

Better Offline Cool Zone Media and iHeartPodcasts

All episodes

Keyv and Cachable maintainer talks about ChainDrop attack

Nov 13, 2026 1 hr 8 min

Trojanized Claude Code extension, Binance and Polymarket thefts, PolinRider dated to 2025

Nov 6, 2026 47 min

Brotli vulnerability, LiteLLM breached via unrevoked key, poisoned prompt downloads malware

Oct 28, 2026 31 min

OVH CLI compromised by Glassworm, compound payloads hide malware, GhostAction copycats PolinRider

Oct 21, 2026 41 min

This week we talked about: OVH CLI compromised by GlassWorm: GlassWorm is back. The Russian threat actor went quiet after its infrastructure was taken down earlier this year, and it resurfaced with malicious versions of OVH’s official CLI tool. It got in through a contributor account it had held for seven months, a reminder that compromised credentials can be used long after they’re stolen. The malicious builds came from a laptop rather than OVH’s normal pipeline, which helped a user spot them quickly.Compound payloads: Threat actors are splitting malware into pieces, often spread across several packages. They only do damage when they run together, and the purpose is to evade detection because each piece looks harmless on its own. DPRK is using a similar approach in Contagious Interview, in which a private repo’s .npmrc points to a different registry, so the malicious package only resolves for the target.GhostAction copycats PolinRider: GhostAction has moved from attacking CI to going after developers directly. It used its malicious workflows to plant PolinRider’s fake font trick repos already compromised with the malicious workflows. Anyone who opens one of those repos in VS Code runs a credential stealer and gets a cron job that checks in with the attacker every five minutes. Removing the malicious workflows doesn’t remove it, and at least one maintainer who did exactly that missed the new malware. Luckily, the code is sloppy and only partly works, but that doesn’t make it harmless.Resources (blog) Glassworm Hacks OVH Clouds CLI tool(threat report) webrunc(blog) GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File

GitHub security improvements, GhostAction phishes OSS maintainers, and DoJ shuts down DPRK laptop farms

Oct 15, 2026 27 min

This week we talked about: GitHub push attribution: GitHub now shows when the account that pushed a commit is different from the one listed as the committer, which makes faked Git history easier to spot. That could help flag PolinRider-style changes and pushes made with stolen credentials. The catch is that it’s in public preview for GitHub Enterprise only. The related push rules may also not work on public repos, which leaves out the open source maintainers who are targeted most.GitHub Actions workflow lockfiles: Workflow lockfiles keep a GitHub Actions workflow pointed at the version you chose, even if an attacker moves the tag. That should help against attacks like tj-actions and Trivy, though it wouldn’t stop GhostAction, and setup requires installing a GitHub CLI extension. GhostAction expands to phishing: GitGuardian first discovered GhostAction in 2025. It’s a malicious GitHub Actions workflow that sweeps a repo’s full Git history for credentials. The operators have now registered a GitHub lookalike domain and are phishing open source maintainers with fake sign-in alerts. Their kit proxies the real GitHub login and got past the MFA methods it was tested against. The same IP has also been mass scanning the internet for about a year.North Korean IT worker laptop farms: The US Department of Justice announced Operation Lonestar Roundup, with law enforcement actions in Ohio and Texas and approximately 187 computers seized. We explain how the IT worker scheme works and why operatives need US-based laptop farms to hide where they are. We also cover how they find people to host the laptops.Resources (blog) Push attribution for commits in limited public preview(blog) GitHub Actions workflow lockfiles in public preview(blog) GhostAction Attack Escalates By Targeting GitHub Users(blog) GhostAction Is Now Phishing Open Source Maintainers(webpage) Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S....

Tensorlake compromised with mini Shai-Hulud worm, new RubyGems attack

Oct 9, 2026 29 min

This week we talked about: Tensorlake SDK compromise: The npm SDK for Tensorlake, a tool for building and operating AI agents, was compromised with two malicious files. A setup.mjs file fires through a preinstall hook and launches the payload with Bun, and math_symbol.js carries a credential stealer and self-propagating worm. It is at least the second attack built on the open-sourced Mini Shai-Hulud worm, following the August attack on keyv and cachable. We discuss why this well-known pattern should have been caught by registry scanning, and what the lack of impact suggests about the attacker.Rogue .npmrc in a fake job interview: A new attack follows the Contagious Interview playbook but is not yet attributed. The repo a candidate clones quietly drops a custom .npmrc, so a later npm install resolves a package from a Chinese npm mirror instead of the public registry. We also look at packages with no malicious payload on their own that only become malicious when combined through dependencies, and why scanners miss them.Malicious crypto gems on RubyGems: OpenSourceMalware's automated detection flagged 42 malicious gems published by a single account calling itself Ghost Dev. They target crypto and Web3 developers through typosquats, brandjacking, and plausible utility names. Installing the gem runs a native extension build script that sleeps for 20 to 40 minutes, then either opens a reverse shell or installs a wallet theft kit posing as a tool called Wallet Guard. We also cover why a Python payload inside a Ruby package is a useful signal, and how slopsquatting gets more effective as AI tools hallucinate dependencies across ecosystems.Resources (report) tensorlake threat report(blog) New npm Worm Hits 400+ Packages Including Keyv, Cachable(blog) Malicious Crypto Shell Packages Target RubyGems

Ransomeware arrests, crypto heist, Mac and Baileys malware, DPRK's A/B testing

Oct 1, 2026 31 min

This week we talked about: ShinyHunters and KillSec arrests: Dutch police arrested Pepijn van der Stap, a long-time ShinyHunters member known as Umbreon, on September 16, less than a year after he finished a prison sentence for earlier hacking. His arrest followed a power struggle with the group's 16-year-old leader over who controls its infrastructure. Separately, police arrested three suspected members of the KillSec ransomware group. The group is linked to roughly 1,000 attacks and used AI to build its infrastructure and identify victims.Bitget crypto heist: Suspected North Korean hackers stole $351.6 million from the hot and warm wallets of crypto exchange Bitget. Customer accounts still showed full balances after the funds were drained. Incident response firm SlowMist attributes the initial access to a zero-day in an unnamed security product.Signed Mac malware posing as Claude Desktop: A lookalike Claude Desktop site is serving a signed macOS installer hosted on GitHub. It appears to be the real app with a padded payload added. Because it's signed, macOS installs it without warning, and the file is about four times the size of the real installer.Baileys campaign update: The number of malicious npm packages abusing the Baileys WhatsApp library now tops 100. Most only inflate follower counts for WhatsApp channels, so the direct risk is low. Some have also served as a base for other attacks, including WhatsApp-based C2.PolinRider A/B testing: DPRK's PolinRider campaign is changing its fake font trick to slip past detections that rely on a single file name. The fa-solid-400.woff2 payload has been renamed to 500, 900, and 300 and moved deep into legitimate folders. Most recently it was given a .llf extension that has nothing to do with fonts.We're hiring: OpenSourceMalware is looking for a part-time malware researcher with software supply chain experience.Resources (blog) Dutch Police Arrest 'Reformed' Hacker in Shiny Hunters Investigation(blog) Police Arrest 16-Ye...

ShinyHunters attacks FBI, new WeaselBiscuit malware, Contagious Interview research, and dev FAQs

Sep 24, 2026 47 min

This week we discussed: ShinyHunters vs. the FBI and Cl0p: ShinyHunters claims it stole data from an FBI jobs website through a PeopleSoft zero-day, and it is threatening to leak that data unless the FBI retracts a May FLASH tied to the Instructure Canvas breach. We cover why aging enterprise monoliths like PeopleSoft and WebLogic are such attractive targets. We also get into the group's escalating public feud with ransomware crew Cl0p.A correction on WhatsApp Baileys attacks: Malicious Baileys typosquats aren't targeting WhatsApp payments, as we said last week. We explain what these packages actually do and how threat actors make money from them.WeaselBiscuit: A new, stripped-down, self-contained malware family derived from BeaverTail and OtterCookie has turned up in 16 npm packages so far. We share the latest on attribution, what the malware is designed to steal, and why its minimal design helps it slip past detection.FBI joint advisory on Contagious Interview: The FBI and international partners issued a joint warning about the DPRK IT workers scam and Contagious Interview (under the name WaterPlum), with figures on infected devices and stolen cryptocurrency. We discuss what the advisory leaves out. We also explain why its finding of shared infrastructure with the IT workers scam matters for researchers and defenders.Atlassian's Contagious Interview research: Atlassian published research on Contagious Interview activity across Bitbucket, GitLab, and GitHub, along with the actions it has taken on its own platform. We discuss what the report reveals about the campaign beyond GitHub and how platforms differ in responding to researcher reports.Developer questions from TikTok: Our viral TikTok explainer on the VS Code tasks autorun technique drew a set of recurring questions from developers. We answer them, including "How this malware gets onto developer machines", "Whether signed commits or switching editors would stop it", "Why antivirus misses it", and "How researc...

OpenAI allegedly attacked RubyGems, PyPI typosquats contain prompt injection, and new Mac malware

Sep 16, 2026 32 min

This week we talked about: New research alleges OpenAI agents were behind the RubyGems attack. A report from independent researchers argues an OpenAI agent swarm is responsible for the GemStuffer campaign, which uploaded hundreds of spammy packages to RubyGems in May. Truffle Security's Luke Marshall followed up with the vulnerability the agents used (a CDN misconfiguration) that could expose other users' RubyGems API keys. OpenAI has yet to comment on either report."lurves-agent" campaign is typosquats PyPI packages to target AI users. The campaign name comes from a string the malware's own AI-generated code self-attributed inside a bash script, suggesting the threat actor used an AI agent to write it without reviewing the output. Across five or six packages typosquatting OpenAI and other AI framework names, the payload is a short info-stealer, and the surrounding comments function as a prompt injection aimed at any AI reviewing the code.A typosquatted Claude site is distributing signed Mac malware. claude-desktop.com delivers a signed DMG instead of the real Claude desktop app, taking advantage of the fact that official install instructions for tools like Claude and OpenAI's CLI have changed repeatedly over the past year, making people less careful about where they install from. Resources: (report) OpenAI agents carried out an undisclosed cyber-attack on RubyGems(blog) We discovered a Ruby account takeover; Rogue OpenAI Agents exploited it 2 months prior(threat feed) lurves-agent records on OpenSourceMalware(LinkedIn) Three Injections and a Rootkit: How Lurves PyPI Typosquat Attacks...

Live from Strasbourg & Underground Economy

Sep 9, 2026 46 min

Jenn and Paul also mark OpenSourceMalware's first anniversary, now tracking close to 200,000 verified threats and over 100,000 IOCs. We also discuss: Mini Shai-Hulud payload resurfaces on npm. A payload from May's Mini Shai-Hulud campaign against AntV reappeared in four packages published within the same hour on September 7th, sitting undetected for 111 days despite npm's publish-time scanning. Q&A from the Underground Economy conference. Reporting live from Team Cymru's conference in Strasbourg, Jenn and Paul answer the questions they fielded all week: whether DPRK and Russia collaborate on supply chain attacks, why malicious open source rarely targets specific countries, whether North Korea needs AI to close a skills gap, why GitHub allows git history to be rewritten and hasn't done more to stop PolinRider, and what developers can realistically do to protect themselves, since PolinRider's payload runs regardless of what language a repo is written in.

TeamPCP members arrested, PolinRider persistence mechanisms defeat remediation attempts

Aug 27, 2026 30 min

This week we talked about: TeamPCP arrests — Australian Federal Police and the FBI arrested Ruben Thomson (21) and Louis Gaebler (23) in Perth on TeamPCP-related charges. The arrests align with the OpenSourceMalware team's longstanding assessment that TeamPCP was a very small operation, effectively one or two people, despite the scale of its attacks. Krebs' reporting details the OPSEC failures (reused usernames and passwords, prolific unredacted social media activity) that led to their identification, and despite the technical complexity of the attacks, the financial payout was reportedly modest (around $20K). Jenn and Paul discuss what this could mean for other overlapping threat groups like Lapsus$ and ShinyHunters.PolinRider's persistence outlasts partial remediation — A look at how DPRK's PolinRider campaign continues to reinfect developers who believed they'd already cleaned up. When a developer only removes the malicious payload files but not the underlying persistence mechanism (like a vscode-task.json trigger) or the RAT running on their machine, DPRK can push new payloads that ride along on the developer's own legitimate package publishes. Paul and Jenn cover what's changed in the kill chain: a new NullReceiver-branded payload, a persistence technique that overwrites the npm CLI binary itself so simply removing payloads from repos isn't sufficient, and an expanding target list of JavaScript/TypeScript file types the malware will inject into. They close on why disclosing an infection to collaborators matters, since silent individual cleanup doesn't stop reinfection through shared repos and contributors.Episode resources TeamPCP: (news) Two WA men charged after investigation into alleged cybercrime(official) Two WA men charged following AFP FBI WAPF disruption alleged global cybercrime syndicate(news) Two Alleged 'TeamPCP' Hackers Arrested in AustraliaPolinRider: (blog) PolinRider npm case study of a DPRK attack(blog) Developer guide to getting over PolinRi...

Popular Rust package compromise, multi-ecosystem typosquatting attack, trends in binary payloads

Aug 20, 2026 39 min

This week we talked about: Rust arrayref compromise tied to DPRK infrastructure: A compromised maintainer account published malicious versions of the arrayref crate, along with internment and append-only-vec, adding a typosquatted build dependency that downloaded and executed a remote binary at compile time. arrayref alone has more than 245 million lifetime downloads and sits in roughly three quarters of all Rust environments. Wiz Research has tied the campaign's infrastructure, including a shared C2 endpoint pattern and overlapping IP ranges, to the same DPRK actor behind the Mastra and Axios npm compromises. StubMaker spreads from RubyGems to npm: What started as a RubyGems typosquatting campaign targeting bundler, i18n, rake, and activesupport turned out to share byte-for-byte identical payloads with a separate 40 package npm typosquatting cluster targeting axios, chalk, commander, lodash, react, and typescript. Both campaigns deliver the same 22MB Rust loader and embedded Go infostealer, confirmed by matching SHA-256 hashes, giving one threat actor two independent paths into any organization running both a Ruby and a Node stack. There's also evidence that this campaign hit the PowerShell ecosystem. DIY binary payloads make a comeback: Paul has seen a sharp increase over the last two weeks in software supply chain attacks bundling compiled binaries (C++, Rust, Go) instead of sticking to the interpreted languages that dominate malicious open source. The theory: less experienced threat actors are following old malware-writing conventions, possibly with an assist from AI coding agents, without realizing that shipping a binary inside an npm or RubyGems package is itself one of the biggest red flags an analyst can ask for. PolinRider reinfection wave using NullReceiver: We're still continuously seeing developers talking about getting reinfected with PolinRider. This latest iteration swaps out EtherHiding for NullReceiver as its stage two hiding method, and Paul and J...

Hacker Summer Camp trends, npm kills 2FA-bypass tokens, DPRK tradecraft

Aug 13, 2026 31 min

This week we talked about: Hacker Summer Camp trends. Jenn and Paul share observations from Black Hat, DEF CON, and BSides Las Vegas last week, including a maturing AI security conversation that has shifted to focus on where AI still falls short, particularly the last mile of precision and finesse that still requires a human to verify. They also discuss the emerging challenge of identifying malicious AI skills, where the natural language format makes static analysis much harder than it is for traditional package ecosystems. And they revisit the recurring gap between security teams who understand binary malware and incident response and those who understand the open source software supply chain.GitHub revokes npm bypass-2FA token privileges. GitHub announced it is closing a gap that let npm granular access tokens configured to bypass two factor authentication perform sensitive account, org, and package management actions, a change Jenn and Paul say is overdue but underexplained.DPRK's NullReceiver technique keeps spreading. Following up on last week's episode, Paul shares that the number of packages using the NullReceiver technique, tied to the PolinRider campaign, has grown well past the seven originally confirmed, and that DPRK's use of crypto payments for infrastructure like VPN services could offer new tracking opportunities for defenders.Episode resources: (blog) Restricting npm bypass-2FA granular access tokens(blog) NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

New npm worm, WEL1DROPPER AI slopsquatting campaign, DPRK NullRider innovation

Aug 7, 2026 24 min

This week we talked about: New npm worm hits Keyv and cacheable. Jared Wray's GitHub account was compromised on Tuesday, and threat actors used it to publish a worm based on the open-sourced Mini Shai-Hulud malware. The worm spread to over 400 packages, with ServiceTitan alone losing 100 packages, and it searches developer machines and CI runners for credentials across GitHub, npm, AWS, Kubernetes, Vault, Azure, Google Cloud, Terraform, Docker, and Slack before exfiltrating them. We also talk about how this got caught within minutes despite GitHub's recent claims of proactive pre-publication malware scanning.The WEL1DROPPER campaign is flooding npm with AI slopsquatted packages. Over the past 72 hours, more than a thousand malicious packages have been published to npm as part of a campaign we're calling WEL1DROPPER. It doesn't rely on install scripts at all, executing instead when a package is imported, and we believe it's loosely connected to the earlier Moika campaign based on shared tradecraft. We dig into why attribution to Russian threat actors is complicated given the campaign also targets Russian and Belarusian financial institutions.DPRK is using a new C2 technique we're calling NullReceiver. We found DPRK-linked malware hiding its C2 IP address inside the recipient address of a completely empty Ethereum transaction, an evolution of the EtherHiding technique that fixes its biggest weakness: a fixed, publicly known destination address. We've confirmed at least 10 packages using this new technique so far.Episode Resources: (blog) New npm Worm Hits 400+ Packages Including Keyv, Cachable(blog) Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages(blog) NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

Hugging Face update, GitHub security improvements, DPRK linked to chald/debug, and more new PolinRider research

Jul 30, 2026 41 min

This week we discussed: Update from Hugging Face: Hugging Face published a technical timeline of the OpenAI evaluation agent that breached its production infrastructure between July 9 and July 13, reconstructing over 17,000 attacker actions across the five day window. OpenAI's own follow-up disclosure this week revealed the agent didn't stop at Hugging Face. It accessed accounts on four other services during the intrusion. We dig into why the agent went after the ExploitGym answer key instead of solving the benchmark honestly, and what that says about reward-seeking behavior in autonomous agents. GitHub ships publish-time malware scanning and holds risky Actions workflows: On July 28, GitHub announced two supply chain security changes on the same day. npm packages are now scanned before they become available for install rather than after, and GitHub Actions will hold workflow runs identified as potentially malicious until a repository collaborator with write access approves them. Both announcements are thin on technical detail, and we talk through what triggers are probably getting flagged and why GitHub and npm have been slow to take on this kind of liability. Amazon ties DPRK to the chalk and debug compromise: Amazon published research attributing the September 2025 compromise of the debug and chalk npm packages, along with the typo-crypto package first seen in March 2025, to the DPRK threat actor tracked as SAPPHIRE SLEET. We talk about why this link wasn't news to researchers who've been tracking DPRK's tradecraft for a while, and why TeamPCP's loud, public style keeps pulling attention away from the North Korean groups doing far more financial damage. PolinRider automation causes account takeovers without targeting: New OSM research examined 20 npm and Go packages compromised through PolinRider's automatic credential harvesting rather than a deliberate account takeover. We explain why maintainers infected through fake job interviews and poisoned VS Code tasks e...

Hugging Face incident, AgentBaiting, RubyGems, CrashStealer, and new PolinRider research

Jul 24, 2026 32 min

This week we talked about: Hugging Face breach and OpenAI's rogue model claim — Hugging Face disclosed a breach with thin details; OpenAI followed up claiming one of its models caused it during an internal security test, escaping its sandbox. The security community is skeptical about OpenAI's role in this incident.AgentBaiting: 6,000+ malicious GitHub repos target AI agents — Island's research found over 800 repos posing as AI skills or MCP servers, part of a wave that peaked in April. The bigger concern is malware hidden in natural-language instructions rather than code.RubyGems GemStuffer copycat campaign — 2,539 new RubyGems threat reports resembling the GemStuffer campaign that used gem publishing as a channel to hide exfiltrated data.RubyGems was leaking user API keys for years — A caching flaw exposed other users' API credentials under certain conditions. RubyGems fixed it fast and is notifying affected users.CrashStealer: a macOS infostealer with multiple tracks — Jamf published research on this novel C/C++ infostealer impersonating Apple's crash reporter. Paul found the threat actor also running a RAT and other malware tracks in parallel.Info stealers 101 — A quick primer on what characterizes an infostealer (what it targets, how it exfiltrates) and how our technology traces backward from the exfil point.ChainVeil and ViteVenom are PolinRider — Jenn's research connecting Checkmarx's ChainVeil/ViteVenom npm campaign to DPRK's PolinRider via five byte-for-byte identical IOCs (wallets and XOR keys).Episode Resources (blog) Hugging Face Confirms Breach Affected Internal Datasets and Credentials, Urges Users to Take Action(blog) OpenAI Says Hugging Face Was Breached by Its Pre-Release Models(blog) AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware(blog) GemStuffer Abuses 150+ RubyGems to Exfiltrate Scraped U.K. Council Portal Data(blog) Security Advisory: Possible Leak of Legacy API Keys via Improper Cache Configuration(blog) CrashStealer: C+...

Dependabot cooldowns, Jscrambler and AsynchAPI compromises, new PolinRider research

Jul 16, 2026 33 min

This week we talked about: GitHub turns on Dependabot cooldown periods by default — A three day cooldown is now applied automatically to all Dependabot version updates, a shift we've been anticipating in the fight against account takeover malware, though it may leave developers confused about why their upgrades are getting blocked JScrambler compromise — A threat actor gained access to a publishing credential and pushed five malicious versions of the jscrambler package. The malware evolved quickly, with the first three versions containing the trigger in a pre-install script to the last two on-import execution partway through. They also published four versions of related packages that pinned to malicious v8.18.0.AsyncAPI compromised — Attackers exploited a GitHub Actions pull_request_target flaw that sat unresolved for 58 days to steal a privileged token. They published malicious npm packages under the @asyncapi namespace, all with components of the Miasma malware that was open-sourced earlier this year (but no worm). New PolinRider research — Paul's latest hunt found 2,417 newly-compromised repositories, confirming config file injection as the dominant delivery vector alongside a growing fake font technique, still overwhelmingly hitting individual developers rather than organizations.Episode Resources (talk) BSides Adelaide 2026 Schedule(docs) Dependabot cooldown(blog) Security Advisory: Unauthorized Publication of a Malicious npm Package(feed) OpenSourceMalware threat reports for Jscrambler(blog) M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions(feed) OpenSourceMalware threat reports for AsyncAPI(blog) PolinRider Confirmed Footprint Grows 6.5x Since March

Open VSX security improvements, new PolinRider researcher, shady vendor practices

Jul 9, 2026 46 min

This week we talked about: PolinRider jumps the fence — Paul's research on North Korea's automated repo-hijacking campaign spreading into the Go and PHP ecosystems without any extra effort from the threat actorsCybersecurity startup publishes infostealers to npm — a vendor publishing malicious packages to manufacture threat data for its own marketing, and getting their npm account pulled for itMeetingTV sues Palo Alto Networks — a lawsuit alleging Koi Security's AI-assisted analysis hallucinated a company's domain onto a C2 infrastructure list, with real business falloutThis episode also features an interview with Mikael Barbero (Head of Security, Eclipse Foundation) on OpenVSX security — We covered OpenVSX's explosive growth, its pre-publish scanning pipeline, looking for "sleeper malicious" extensions, publisher verification, and token management. Episode Resources (blog) PolinRider Jumps the Fence to Go, Packagist, npm, PyPI(blog) Cybersecurity Startup Publishes Infostealers to NPM(PDF) MeetingTV’s First Amended Complaint Against Palo Alto Networks and Koi Security(LinkedIn) Mikael Barbero, Head of Security at Eclipse Foundation(webpage) Open VSX Security Researcher Recognition Program(report) GlassWorm: Open VSX Transitive Dependency Supply-Chain Escalation(feed) OpenSourceMalware Threat Reports for Open VSX

GitHub security improvements, shady vendor practices

Jul 2, 2026 26 min

This week we talked about: GitHub’s two new account protection features: NPM added a 72-hour read-only lockout for high-impact accounts triggered by an email change or 2FA recovery code use, aimed at slowing account takeovers. Separately, GitHub Enterprise rolled out self-service credential revocation, letting enterprise owners revoke tokens, SSH keys, and SSO authorizations for a single user or the whole org during incident response. Paul flags an open question on both: the npm change could make ATO recovery harder for legitimate maintainers if it locks them out too, and the GitHub Enterprise tool’s scope may not cover personal access tokens created outside the enterprise boundary. A security researcher’s malicious packages targeting AI companies: Paul found six npm packages published by a researcher at a stealth cybersecurity startup, targeting OpenAI, Anthropic, Vercel, and Ollama users. The packages avoid exfiltrating credentials directly but do pull data from .git and .ssh, which Paul argues crosses an ethical line for security research. He draws a direct parallel to the 2025 incident where a Snyk researcher published malicious packages targeting Cursor. FBI FLASH notice on TeamPCP: The FBI issued a FLASH covering TeamPCP’s behavior and IOCs. Note - you’ll get more complete info on their malware and TTPs from OpenSourceMalware.com Next week’s special guest: Jenn and Paul will be joined by Mikael Barbero, Head of Security at the Eclipse Foundation, to talk about Open VSX. The draw: AI IDE platforms like Cursor and Windsurf use Open VSX instead of the official VS Code marketplace, which is turning it into a more attractive target for threat actors. Resources (blog) NPM adds preventive account protection for high-impact accounts(blog) Self-service credential revocation for incident response(blog) Snyk appears to deploy ‘malicious’ packages targeting Cursor for unknown reason(PDF) FBI FLASH on Team PCP

How malicious OSS is evolving in 2026, feat. DPRK innovations

Jun 25, 2026 39 min

This week we talked about: DPRK Lazarus Group trends in software supply chain malware: Three active techniques he's observing from North Korea's Lazarus Group. The first is “version sandwiching,” where threat actors publish benign versions of a package before and after a malicious one, then pin their delivery mechanism to the malicious version so scanners checking the latest release see nothing wrong. The second is their continued reuse of Aptos, Tron, and Binance BSC blockchain addresses as mutable C2 infrastructure, which allows defenders to tie disparate campaigns to the same threat actor. The third is human-readable campaign name strings embedded in payloads, functioning like UTM tags and likely reflecting internal tracking within Lazarus subgroups. General supply chain threat landscape: Cross-ecosystem attacks, once limited to nation-state actors, are now being executed by low-sophistication crews using vibe coding tools to quickly port payloads across npm, PyPI, and other registries simultaneously. Package clusters, where only one or two packages in a published group carry the actual payload, have become standard operating procedure across threat actors of all levels. Dynamic imports and payload splitting are also on the rise, bypassing package managers and firewalls by pulling dependencies from URLs at runtime or distributing payload components across multiple files. Episode Resources (Video) How malicious packages on npm bypass existing security tools(Video) Poisoned Packages and Stolen Secrets: The Rise of Supply Chain Attacks

Mastra compromise, agentjacking research, busting malware myths

Jun 18, 2026 35 min

Mastra Package Compromise: Threat actors hijacked the entire Mastra npm organization (116 packages) after a maintainer was targeted with a ClickFix-style attack that stole his credentials. Rather than injecting malware directly into Mastra packages, attackers pre-staged a typosquatted package called 'easy-day-js' and added it as a dependency across the org. The malware differs from the structurally similar Axios attack in one notable way: it targets browser extensions, including password managers (LastPass, Bitwarden, Dashlane, 1Password) and MFA tools, with Zapier among the more unusual targets. Agent Jacking and MCP Server Security: A Cloud Security Alliance paper describes a concept called "agentjacking", where attackers inject malicious instructions into Sentry error events, which AI coding agents then retrieve via MCP and execute with the developer's own elevated permissions. This pattern isn't new: weaponizing an agent's privileged access against its owner was a core mechanic of the 2025 S1ngularity attack. What the paper describes is sophisticated prompt injection through an MCP server that fails to sanitize third-party data before passing it to the agent. Its conclusion that EDR can't catch this misses the point, because EDR can't catch most open source malware since the traffic and signals are indistinguishable from normal software development activity. Malware Myths: We bust four myths making the rounds in the AppSec community. First, that open source malware only lives two to three days: typosquatting and dependency confusion packages routinely survive for weeks or months, and NPM's inconsistent takedown practices make it worse. Second, that npm install scripts are going away: they're not, they are becoming opt-in by default. Third, that package firewalls and cooldowns will eliminate 99% of risk: they won't, for the same reason the lifespan myth is wrong. Fourth, that threat actor attribution doesn't matter: it does, because knowing who compromised you te...

MSFT hit by Miasma worm, VS Code cooldowns, npm v12 breaking changes

Jun 11, 2026 39 min

Miasma Worm Hits Microsoft — On June 5th, 73 Microsoft GitHub repositories were disabled in 105 seconds after being compromised by the Miasma worm. Four GitHub organizations were affected, including Azure Functions, which broke CI jobs worldwide for anyone calling those official GitHub Actions. The initial foothold traces back to a May 19th compromise of the Durable Task repo, with threat actors maintaining persistence via stolen credentials before returning to trigger the mass takedown. As of this recording, Microsoft had issued no official statement about what happened or the real-world impact it caused. VS Code Extension Auto-Update Cooldown — VS Code shipped a two-hour auto-update delay for third-party extensions, responding to community requests citing the frequency of extension compromises. Two hours is well short of the three-to-seven days practitioners typically ask for, and the change only applies to the Microsoft Marketplace — not OpenVSX, which has no equivalent scanning. The NX Console compromise is a useful reference point: NX caught the malicious version themselves via a Marketplace email notification, not through any platform detection. npm v12 Disables Install Scripts and Dynamic Dependencies — npm v12 will disable install lifecycle scripts (pre, post, and install), direct Git dependencies, and remote tarball dependencies by default — all three together. These are the mechanisms malware uses to execute at install time, before it reaches a pipeline. Significant breakage is expected since many legitimate packages rely on install scripts. The harder problem is adoption: this is a package manager change, not a registry change, meaning every developer workstation and CI environment has to upgrade before the protection applies. Based on how slowly similar changes have rolled out elsewhere, the practical impact will be years in the making. Miasma Gets Open-Sourced — The threat actor behind Miasma open-sourced the worm, continuing the pattern TeamPCP establi...

Miasma npm worm hits Red Hat, new OpenSourceMalware research on 2026 trends, the Moika campaign

Jun 4, 2026 40 min

This week Paul and Jenn talk about: Miasma Campaign — Starting June 1st with 32 Red Hat @redhat-cloud-services packages (averaging 80,000 weekly downloads) compromised, the campaign expanded to over 80 packages and 286+ malicious versions within days. The worm is the first confirmed in-the-wild use of TeamPCP's open-sourced MiniShai Hulud worm, though TeamPCP has not claimed credit. It is multi-ecosystem (npm, PyPI, RubyGems) and the Ruby variant appears to be LLM-translated, not part of the original open-sourced code. The initial Red Hat compromise came not through a GitHub Actions vulnerability but through abused gaps in npm trusted publishing. A live comment from Francois (VP of Security Research at BoostSecurity) corrected this in real time during the show.The Shift from Human to Machine Attack Paths — Account takeover attacks have shifted away from social engineering as the primary foothold. The Axios compromise in early 2026 was likely the last major example of a social-engineering-based entry point. Threat actors now primarily target CI pipelines, automated builds, and developer tooling. Automation has also accelerated post-compromise activity: credential abuse now begins within seconds of a system being popped, rather than requiring manual follow-through.OpenSourceMalware Data Trends (Jan to mid-May 2026) — Three trends from six months of OSM threat report data. First, npm remains the dominant ecosystem by volume but PyPI is growing at a comparable rate and the two frequently correlate, reflecting multi-ecosystem attack campaigns. Second, the vast majority of malicious packages have fewer than 10,000 weekly downloads (indicative of typosquatting and dependency confusion), but the share of high-download packages has grown over the period, with account takeovers representing 60 to 65% of new records in the week of May 11th. Third, malicious ClawHub skills have grown rapidly since January, with over 700 in the database by end of March. Nearly a fifth target mar...

OSV false positives, Crowdstrike takedown of Glassworm infra, and MSFT nukes a researcher

May 28, 2026 28 min

This week Jenn and Paul covered: OSV false positives from AWS Inspector: AWS's automated malware detection pipeline submitted 157 false positive entries to osv.dev. The entries were merged before anyone caught the errors. When the community began pointing out that some of those "false positives" were actually real malware, AWS started adding some back, making this a mess on both ends. AppSec vendors piled on publicly despite relying on OSV as their primary detection source without contributing to it. Paul publicly thanks Chi Tran's team at AWS Inspector for their contributions overall.CrowdStrike, Google, and Shadowserver take down Glassworm C2 (including the botnet vs. worm distinction): The operation targeted four infrastructure components: Solana blockchain dead drops, BitTorrent DHT, Google Calendar abuse, and commercial VPS servers. The legal and technical basis for the takedown is unclear and CrowdStrike declined to comment on specifics. Paul explains how blockchain memo fields work as dead drops and how multi-stage attack chains evolve. As part of the discussion, Paul clarifies the technical difference between a botnet (centrally orchestrated persistent access across many machines) and a worm (self-replicating), and ties it to how both Glassworm and DPRK/PolinRider operate.MSRC, Nightmare Eclipse, and the state of coordinated disclosure: Researcher Nightmare Eclipse published six unpatched Windows zero-days (RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, MiniPlasma) after a breakdown in MSRC's handling of their disclosures. Microsoft's claim that no prior notice was given is contested. Nightmare Eclipse says MSRC knew BlueHammer was coming. Microsoft's MSRC blog post named all six vulnerabilities, invoked its Digital Crimes Unit, and never acknowledged Nightmare Eclipse's claim that Microsoft deleted the account they used to report bugs and paid them nothing. The MSRC post instead triggered a flood of other researchers sharing similar experiences: Gabr...

GitHub popped by malicious VS code extension, npm staged publishing debuts

May 21, 2026 28 min

This week Jenn and Paul cover: npm Staged Publishing: npm's new feature adds a human approval checkpoint before a package goes live. Real improvement, real caveats. We walk through what it does, where it falls short, and the questions the docs still don't answer.DPRK Axios-Linked npm Packages: Paul discovered three malicious npm packages tied to the March Axios attacker that have been quietly harvesting credentials since early April. Classic DPRK multi-use attack infrastructure, built to support Contagious Interview and TaskJacker campaigns running in parallel.TeamPCP's Biggest Maintainer Compromise Yet: Two npm maintainers compromised. One developer maintained over 540 packages. TeamPCP published over 600 malicious versions. Three of the affected packages alone account for more than 5 million weekly downloads.GitHub Employee Device Compromised via Poisoned VS Code Extension: A malicious Nx Console extension published May 18th made it to a GitHub employee's device, exposing an estimated 3,800 repositories. The credential theft happened seven days earlier through the TanStack compromise. We also cover the CISA "private" repository that was not private, and what both incidents say about secrets management and GitHub permissions defaults.Episode Resources: npm Staged Publishing documentationAxios attacker strikes again: Three npm packages hiding in plain sight for two monthsTeamPCP compromises npm maintainer with over 540 packagesOpenSourceMalware threat report: nrwl.angular-console (Nx Console)Nx Console v18.95.0 postmortem

RubyGems bot attack, ShinyHunters ransom Canvas, and the latest on Mini Shai Hulud

May 14, 2026 32 min

Join OpenSourceMalware co-founders Jenn Gile and Paul McCarty for episode four! In this episode: RubyGems bot attack: Hundreds of bots pushed 500-plus packages to RubyGems, some carrying exploits, forcing the registry to shut down new account signups. Jenn and Paul break down why the DDoS label may be misleading and what this exposes about the friction-vs-safety tradeoff every open source registry faces.Canvas ransomware by ShinyHunters: ShinyHunters breached Instructure, the company behind the Canvas LMS used by over 30 million students globally, stealing 3.65TB of data including private messages between students and teachers. Instructure said almost nothing publicly for days. Jenn and Paul discuss the data sensitivity risks for minors and close with breaking news: Instructure paid the ransom.Mini Shai Hulud and TanStack: Team PCP is not connected to the original 2025 Shai Hulud campaign. Paul explains how they used Adnan Khan's GitHub Actions cache poisoning technique to compromise TanStack and 90-plus packages without long-lived credentials, why attestation and trusted publishing didn't stop it, what the CIS country geofencing in the payload actually signals, how malware is now targeting .claude directories on developer machines, why novel malware still dominates the OpenSourceMalware database by volume, and why open sourcing their worm and doing press interviews is likely to hasten Team PCP's capture.Episode Resources: RubyGems Suspends New Signups After Hundreds of Malicious Packages Are UploadedRubyGems status pageOpenSourceMalware RubyGems threat recordsOpenSourceMalware Mini Shai-Hulud threat recordsInstructure Reaches Ransom Agreement with ShinyHunters to Stop 3.65TB Canvas Leakblog: Mini Shai-Hulud Borrowed Its Best Trick From PolinRiderblog: TeamPCP Compromises MistralAI and OpenSearchTanStack npm supply-chain compromise postmortemThe Monsters in Your Build Cache - GitHub Actions Cache PoisoningTeamPCP interview

Git hook persistence, Antrea compromise, Dirty Frag, cPanel exploitation, interpreted language malware

May 7, 2026 27 min

Join OpenSourceMalware co-founders Jenn Gile and Paul McCarty for episode three, covering the latest threat activity and a deep dive they've been promising since episode one. In this episode: DPRK Lazarus Group using git hooks: Paul's latest research shows the Contagious Interview / TaskJacker campaign has evolved. The initial loader is still the VS Code task.json file, but it now calls concatenated Git commands that drop malware via pre-commit and post-checkout git hooks, hiding the payload URL from the place researchers have been looking. Post-checkout is particularly clever: it fires every time a developer checks out a branch, and most people never think to audit it.Antrea Kubernetes project compromise: The Antrea project, a popular Kubernetes CNI dependency, was compromised but so far no malware has been dropped into it. Paul has been tracking the threat actor and reached out proactively to the maintainers. The source of compromise is contested (we have evidence it was through the March Trivy compromise), but the core takeaway stands: threat actors don't always act immediately on stolen credentials. Assume credentials are burned and rotate aggressively.Dirty Frag Linux local privilege escalation: Dirty Frag is a new vulnerability class discovered and reported by Hyunwoo Kim (@v4bel) that chains two page-cache write vulnerabilities (the xfrm-ESP bug and the RxRPC bug) to obtain root privileges on major Linux distributions. It extends the same bug class as Dirty Pipe and Copy Fail. Because it is a deterministic logic bug rather than a race condition, it doesn’t require precise timing, does not panic the kernel on failure, and has a very high success rate. The embargo broke before a patch or CVE existed. It is already public.cPanel actively exploited at scale: A critical actively exploited vulnerability in cPanel is hitting organizations below the security poverty line hardest. The infosec press has been quiet, but incident responders are getting hammered. Every ge...

Lovable and Vercel incidents, GitHub RCE, EDR vs. AI agents, Mini Shai Halud by Team PCP

Apr 30, 2026 25 min

Join OpenSourceMalware co-founders Jenn Gile and Paul McCarty as they cover a week that had defenders everywhere ready to call it on 2026. In this episode, we cover four topics: Lovable and Vercel incident response failures: Two AI-native platforms had significant security incidents in recent weeks, and both initially responded by minimizing the severity. We break down why Lovable's regression exposed source code and full chat history to any free account holder (the mother of all IDORs), why Vercel's response left paying customers without a single actionable mitigation step, and what good incident response communication actually looks like.GitHub RCE via git push: A remote code execution vulnerability sitting in GitHub's codebase for over a decade allowed arbitrary code to be passed and executed via the -o option on a git push. We discuss why this happened, why it is not entirely surprising given Git's design history, and what it means for the ecosystem.EDR vs. AI coding agents: Paul's EDR flagged his own development environment as infected while he was refactoring a library with Claude. We unpack why AI agents operating at non-human speed trigger the same behavioral signatures as ransomware, and why this is going to become a bigger problem as agentic coding workflows become the norm.Mini Shai Halud by Team PCP: Team PCP's latest campaign compromised the Lightning Python package (15 million downloads per week) and the Intercom npm client (370,000 downloads per week), among others. We cover what makes this campaign notable: Team PCP has adopted the VS Code tasks file persistence technique previously seen only in DPRK-linked campaigns like TasksJacker and Pollen Rider. We also discuss what over 2,000 exfiltration repositories on GitHub mean for affected developers and organizations, and what you should be doing right now if you are worried you are affected.Episode Resources: AI Full-Stack Development: The Anti-Patterns Rise Against Us - Part 1 Our research on some sec...

Bitwarden CLI compromise, npm lifecycle scripts, OWASP cheat sheet, cross-ecosystem attacks

Apr 27, 2026 37 min

Welcome to the very first episode of The OpenSourceMalware Show! Join OpenSourceMalware co-founders Jenn Gile and Paul McCarty as they break down the latest news, threats, and best practices in the open-source ecosystem. In this episode, we dive into four major topics: Bitwarden CLI Compromise: We analyze the recently discovered malicious version (2026.4.0) of the Bitwarden CLI package. We break down how this cloud-native infostealer silently executes via pre-install scripts to harvest credentials across AWS, Azure, GCP, and GitHub, as well as hoovering up AI config files like Claude. We also discuss its exfiltration tactics to a lookalike domain and explain why we are skeptical of the threat actor's claims that this is the "third coming of Shai-Hulud".The Danger of npm Lifecycle Scripts: Why are pre-install and post-install scripts such a popular attack path? We discuss how threat actors exploit these convenience features to auto-install malware. We also explore the differences between package managers, noting that while these scripts are off by default in tools like pnpm and bun, they remain on by default in npm.OWASP's npm Security Cheat Sheet: We review a 12-point cheat sheet from OWASP covering npm security best practices. We share our thoughts on artifact governance, the realities of responsible disclosure, and why falling for dependency confusion or typo squatting attacks relies more on machine automation than just "dummy" human errors. GenAI and Cross-Ecosystem Attacks: We wrap up with an alarming new trend we observed just this week: threat actors using Generative AI (like Claude) to rapidly translate working malware into different programming languages. This enabled them to deploy malicious packages across multiple ecosystems to target users of a specific company within a coordinated 8-hour window.Resources: bitwarden/cli threat reportNPM security cheat sheet from OWASPGet started with OpenSourceMalware for free

–

0 ratings from members

Rate this podcast

No reviews yet — be the first member to rate "The OpenSourceMalware Show".

This podcast, its content and its artwork are not owned by, affiliated with, or endorsed by Castquire.

Keyv and Cachable maintainer talks about ChainDrop attack

Share this podcast

Live Chart rankings

#176 Technology 🇳🇴 NO

Chart history

🇳🇴 Technology Best #166

Podcast details

Created by: OpenSourceMalware
Status: Active
Latest episode: Nov 13, 2026
Episodes: 29
Release period: Weekly
Avg. episode length: 36 min
Explicit: No
Language: English

Links

Official website ↗ Apple Podcasts ↗ RSS feed ↗

Is this your podcast?

Claim it to show it on your profile. Using the email from your RSS feed approves it instantly.

Keep listening

Discover more podcasts like this.

Browse podcasts See the charts