The OpenSourceMalware Show

OpenSourceMalware

When you think about malware, you probably envision phishing emails or sketchy websites. But malicious open source - targeting software developers and their build systems - is becoming a top way that threat actors deliver malware. Just one 'npm install' can trigger payloads that steal information and credentials. Software supply chain attacks by state actors, ransomware groups, and freelancers are happening every day. Hosted by Jenn Gile and Paul McCarty (co-founders of OpenSourceMalware), this podcast explores the latest trends and attacks, and helps defenders understand the tactics needed to prevent their orgs from being the next target. OpenSourceMalware provides community-driven threat intelligence on malicious open source assets including packages, domains, IP addresses, crypto wallets, and more. https://opensourcemalware.com/

  1. prije 2 d

    Hacker Summer Camp trends, npm kills 2FA-bypass tokens, DPRK tradecraft

    This week we talked about:  Hacker Summer Camp trends. Jenn and Paul share observations from Black Hat, DEF CON, and BSides Las Vegas last week, including a maturing AI security conversation that has shifted to focus on where AI still falls short, particularly the last mile of precision and finesse that still requires a human to verify. They also discuss the emerging challenge of identifying malicious AI skills, where the natural language format makes static analysis much harder than it is for traditional package ecosystems. And they revisit the recurring gap between security teams who understand binary malware and incident response and those who understand the open source software supply chain.GitHub revokes npm bypass-2FA token privileges. GitHub announced it is closing a gap that let npm granular access tokens configured to bypass two factor authentication perform sensitive account, org, and package management actions, a change Jenn and Paul say is overdue but underexplained.DPRK's NullReceiver technique keeps spreading. Following up on last week's episode, Paul shares that the number of packages using the NullReceiver technique, tied to the PolinRider campaign, has grown well past the seven originally confirmed, and that DPRK's use of crypto payments for infrastructure like VPN services could offer new tracking opportunities for defenders.Episode resources: (blog) Restricting npm bypass-2FA granular access tokens(blog) NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

    Hacker Summer Camp trends, npm kills 2FA-bypass tokens, DPRK tradecraft

  2. 7. kol

    New npm worm, WEL1DROPPER AI slopsquatting campaign, DPRK NullRider innovation

    This week we talked about: New npm worm hits Keyv and cacheable. Jared Wray's GitHub account was compromised on Tuesday, and threat actors used it to publish a worm based on the open-sourced Mini Shai-Hulud malware. The worm spread to over 400 packages, with ServiceTitan alone losing 100 packages, and it searches developer machines and CI runners for credentials across GitHub, npm, AWS, Kubernetes, Vault, Azure, Google Cloud, Terraform, Docker, and Slack before exfiltrating them. We also talk about how this got caught within minutes despite GitHub's recent claims of proactive pre-publication malware scanning.The WEL1DROPPER campaign is flooding npm with AI slopsquatted packages. Over the past 72 hours, more than a thousand malicious packages have been published to npm as part of a campaign we're calling WEL1DROPPER. It doesn't rely on install scripts at all, executing instead when a package is imported, and we believe it's loosely connected to the earlier Moika campaign based on shared tradecraft. We dig into why attribution to Russian threat actors is complicated given the campaign also targets Russian and Belarusian financial institutions.DPRK is using a new C2 technique we're calling NullReceiver. We found DPRK-linked malware hiding its C2 IP address inside the recipient address of a completely empty Ethereum transaction, an evolution of the EtherHiding technique that fixes its biggest weakness: a fixed, publicly known destination address. We've confirmed at least 10 packages using this new technique so far.Episode Resources: (blog) New npm Worm Hits 400+ Packages Including Keyv, Cachable(blog) Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages(blog) NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

    New npm worm, WEL1DROPPER AI slopsquatting campaign, DPRK NullRider innovation

  3. 30. srp

    Hugging Face update, GitHub security improvements, DPRK linked to chald/debug, and more new PolinRider research

    This week we discussed: Update from Hugging Face: Hugging Face published a technical timeline of the OpenAI evaluation agent that breached its production infrastructure between July 9 and July 13, reconstructing over 17,000 attacker actions across the five day window. OpenAI's own follow-up disclosure this week revealed the agent didn't stop at Hugging Face. It accessed accounts on four other services during the intrusion. We dig into why the agent went after the ExploitGym answer key instead of solving the benchmark honestly, and what that says about reward-seeking behavior in autonomous agents. GitHub ships publish-time malware scanning and holds risky Actions workflows: On July 28, GitHub announced two supply chain security changes on the same day. npm packages are now scanned before they become available for install rather than after, and GitHub Actions will hold workflow runs identified as potentially malicious until a repository collaborator with write access approves them. Both announcements are thin on technical detail, and we talk through what triggers are probably getting flagged and why GitHub and npm have been slow to take on this kind of liability. Amazon ties DPRK to the chalk and debug compromise: Amazon published research attributing the September 2025 compromise of the debug and chalk npm packages, along with the typo-crypto package first seen in March 2025, to the DPRK threat actor tracked as SAPPHIRE SLEET. We talk about why this link wasn't news to researchers who've been tracking DPRK's tradecraft for a while, and why TeamPCP's loud, public style keeps pulling attention away from the North Korean groups doing far more financial damage. PolinRider automation causes account takeovers without targeting: New OSM research examined 20 npm and Go packages compromised through PolinRider's automatic credential harvesting rather than a deliberate account takeover. We explain why maintainers infected through fake job interviews and poisoned VS Code tasks ended up publishing malware to packages nobody had specifically targeted, and why that distinction changes how defenders should think about the threat. Episode resources: (report) Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident(blog) OpenAI Says Its Rogue AI Agent Didn't Just Hack Hugging Face(changelog) npm publish-time malware scanning and dual-use metadata(changelog) GitHub Actions holds potentially malicious workflows for approval(report) Amazon identifies North Korean hacker group behind open-source supply chain attacks(blog) Amazon Links Debug and Chalk npm Hijack to North Korea's Sapphire Sleet(webpage) typo-crypto(podcast) To Catch a Thief: North Korea On Our Payroll(blog) PolinRider Caused Dozens of npm and Go Compromises

    Hugging Face update, GitHub security improvements, DPRK linked to chald/debug, and more new PolinRider research

  4. 24. srp

    Hugging Face incident, AgentBaiting, RubyGems, CrashStealer, and new PolinRider research

    This week we talked about: Hugging Face breach and OpenAI's rogue model claim — Hugging Face disclosed a breach with thin details; OpenAI followed up claiming one of its models caused it during an internal security test, escaping its sandbox. The security community is skeptical about OpenAI's role in this incident.AgentBaiting: 6,000+ malicious GitHub repos target AI agents — Island's research found over 800 repos posing as AI skills or MCP servers, part of a wave that peaked in April. The bigger concern is malware hidden in natural-language instructions rather than code.RubyGems GemStuffer copycat campaign — 2,539 new RubyGems threat reports resembling the GemStuffer campaign that used gem publishing as a channel to hide exfiltrated data.RubyGems was leaking user API keys for years — A caching flaw exposed other users' API credentials under certain conditions. RubyGems fixed it fast and is notifying affected users.CrashStealer: a macOS infostealer with multiple tracks — Jamf published research on this novel C/C++ infostealer impersonating Apple's crash reporter. Paul found the threat actor also running a RAT and other malware tracks in parallel.Info stealers 101 — A quick primer on what characterizes an infostealer (what it targets, how it exfiltrates) and how our technology traces backward from the exfil point.ChainVeil and ViteVenom are PolinRider — Jenn's research connecting Checkmarx's ChainVeil/ViteVenom npm campaign to DPRK's PolinRider via five byte-for-byte identical IOCs (wallets and XOR keys).Episode Resources (blog) Hugging Face Confirms Breach Affected Internal Datasets and Credentials, Urges Users to Take Action(blog) OpenAI Says Hugging Face Was Breached by Its Pre-Release Models(blog) AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware(blog) GemStuffer Abuses 150+ RubyGems to Exfiltrate Scraped U.K. Council Portal Data(blog) Security Advisory: Possible Leak of Legacy API Keys via Improper Cache Configuration(blog) CrashStealer: C++ macOS Infostealer Posing as Crash Reporter(blog) ChainVeil and ViteVenom are DPRK's PolinRider Campaign

    Hugging Face incident, AgentBaiting, RubyGems, CrashStealer, and new PolinRider research

  5. 16. srp

    Dependabot cooldowns, Jscrambler and AsynchAPI compromises, new PolinRider research

    This week we talked about:  GitHub turns on Dependabot cooldown periods by default — A three day cooldown is now applied automatically to all Dependabot version updates, a shift we've been anticipating in the fight against account takeover malware, though it may leave developers confused about why their upgrades are getting blocked JScrambler compromise — A threat actor gained access to a publishing credential and pushed five malicious versions of the jscrambler package. The malware evolved quickly, with the first three versions containing the trigger in a pre-install script to the last two on-import execution partway through. They also published four versions of related packages that pinned to malicious v8.18.0.AsyncAPI compromised — Attackers exploited a GitHub Actions pull_request_target flaw that sat unresolved for 58 days to steal a privileged token. They published malicious npm packages under the @asyncapi namespace, all with components of the Miasma malware that was open-sourced earlier this year (but no worm). New PolinRider research — Paul's latest hunt found 2,417 newly-compromised repositories, confirming config file injection as the dominant delivery vector alongside a growing fake font technique, still overwhelmingly hitting individual developers rather than organizations.Episode Resources (talk) BSides Adelaide 2026 Schedule(docs) Dependabot cooldown(blog) Security Advisory: Unauthorized Publication of a Malicious npm Package(feed) OpenSourceMalware threat reports for Jscrambler(blog) M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions(feed) OpenSourceMalware threat reports for AsyncAPI(blog) PolinRider Confirmed Footprint Grows 6.5x Since March

    Dependabot cooldowns, Jscrambler and AsynchAPI compromises, new PolinRider research

  6. 9. srp

    Open VSX security improvements, new PolinRider researcher, shady vendor practices

    This week we talked about: PolinRider jumps the fence — Paul's research on North Korea's automated repo-hijacking campaign spreading into the Go and PHP ecosystems without any extra effort from the threat actorsCybersecurity startup publishes infostealers to npm — a vendor publishing malicious packages to manufacture threat data for its own marketing, and getting their npm account pulled for itMeetingTV sues Palo Alto Networks — a lawsuit alleging Koi Security's AI-assisted analysis hallucinated a company's domain onto a C2 infrastructure list, with real business falloutThis episode also features an interview with Mikael Barbero (Head of Security, Eclipse Foundation) on OpenVSX security — We covered OpenVSX's explosive growth, its pre-publish scanning pipeline, looking for "sleeper malicious" extensions, publisher verification, and token management. Episode Resources (blog) PolinRider Jumps the Fence to Go, Packagist, npm, PyPI(blog) Cybersecurity Startup Publishes Infostealers to NPM(PDF) MeetingTV’s First Amended Complaint Against Palo Alto Networks and Koi Security(LinkedIn) Mikael Barbero, Head of Security at Eclipse Foundation(webpage) Open VSX Security Researcher Recognition Program(report) GlassWorm: Open VSX Transitive Dependency Supply-Chain Escalation(feed) OpenSourceMalware Threat Reports for Open VSX

    Open VSX security improvements, new PolinRider researcher, shady vendor practices

  7. 2. srp

    GitHub security improvements, shady vendor practices

    This week we talked about: GitHub’s two new account protection features: NPM added a 72-hour read-only lockout for high-impact accounts triggered by an email change or 2FA recovery code use, aimed at slowing account takeovers. Separately, GitHub Enterprise rolled out self-service credential revocation, letting enterprise owners revoke tokens, SSH keys, and SSO authorizations for a single user or the whole org during incident response. Paul flags an open question on both: the npm change could make ATO recovery harder for legitimate maintainers if it locks them out too, and the GitHub Enterprise tool’s scope may not cover personal access tokens created outside the enterprise boundary. A security researcher’s malicious packages targeting AI companies: Paul found six npm packages published by a researcher at a stealth cybersecurity startup, targeting OpenAI, Anthropic, Vercel, and Ollama users. The packages avoid exfiltrating credentials directly but do pull data from .git and .ssh, which Paul argues crosses an ethical line for security research. He draws a direct parallel to the 2025 incident where a Snyk researcher published malicious packages targeting Cursor. FBI FLASH notice on TeamPCP: The FBI issued a FLASH covering TeamPCP’s behavior and IOCs. Note - you’ll get more complete info on their malware and TTPs from OpenSourceMalware.com Next week’s special guest: Jenn and Paul will be joined by Mikael Barbero, Head of Security at the Eclipse Foundation, to talk about Open VSX. The draw: AI IDE platforms like Cursor and Windsurf use Open VSX instead of the official VS Code marketplace, which is turning it into a more attractive target for threat actors. Resources (blog) NPM adds preventive account protection for high-impact accounts(blog) Self-service credential revocation for incident response(blog) Snyk appears to deploy ‘malicious’ packages targeting Cursor for unknown reason(PDF) FBI FLASH on Team PCP

    GitHub security improvements, shady vendor practices

  8. 25. lip

    How malicious OSS is evolving in 2026, feat. DPRK innovations

    This week we talked about: DPRK Lazarus Group trends in software supply chain malware: Three active techniques he's observing from North Korea's Lazarus Group. The first is “version sandwiching,” where threat actors publish benign versions of a package before and after a malicious one, then pin their delivery mechanism to the malicious version so scanners checking the latest release see nothing wrong. The second is their continued reuse of Aptos, Tron, and Binance BSC blockchain addresses as mutable C2 infrastructure, which allows defenders to tie disparate campaigns to the same threat actor. The third is human-readable campaign name strings embedded in payloads, functioning like UTM tags and likely reflecting internal tracking within Lazarus subgroups. General supply chain threat landscape: Cross-ecosystem attacks, once limited to nation-state actors, are now being executed by low-sophistication crews using vibe coding tools to quickly port payloads across npm, PyPI, and other registries simultaneously. Package clusters, where only one or two packages in a published group carry the actual payload, have become standard operating procedure across threat actors of all levels. Dynamic imports and payload splitting are also on the rise, bypassing package managers and firewalls by pulling dependencies from URLs at runtime or distributing payload components across multiple files. Episode Resources (Video) How malicious packages on npm bypass existing security tools(Video) Poisoned Packages and Stolen Secrets: The Rise of Supply Chain Attacks

    How malicious OSS is evolving in 2026, feat. DPRK innovations
Pogledajte sve (17)

Opis

When you think about malware, you probably envision phishing emails or sketchy websites. But malicious open source - targeting software developers and their build systems - is becoming a top way that threat actors deliver malware. Just one 'npm install' can trigger payloads that steal information and credentials. Software supply chain attacks by state actors, ransomware groups, and freelancers are happening every day. Hosted by Jenn Gile and Paul McCarty (co-founders of OpenSourceMalware), this podcast explores the latest trends and attacks, and helps defenders understand the tactics needed to prevent their orgs from being the next target. OpenSourceMalware provides community-driven threat intelligence on malicious open source assets including packages, domains, IP addresses, crypto wallets, and more. https://opensourcemalware.com/

Informacije

  • Autor
    OpenSourceMalware
  • Aktivne godine
    2026.
  • Epizode
    17
  • Ocjena
    Eksplicitno
  • Copyright
    © 2026 The OpenSourceMalware Show
  • Web‑stranica emisije
    The OpenSourceMalware Show

Također bi vam se moglo svidjeti