The OpenSourceMalware Show

OpenSourceMalware
  • ٥٫٠ (١)
  • التكنولوجيا

When you think about malware, you probably envision phishing emails or sketchy websites. But malicious open source - targeting software developers and their build systems - is becoming a top way that threat actors deliver malware. Just one 'npm install' can trigger payloads that steal information and credentials. Software supply chain attacks by state actors, ransomware groups, and freelancers are happening every day. Hosted by Jenn Gile and Paul McCarty (co-founders of OpenSourceMalware), this podcast explores the latest trends and attacks, and helps defenders understand the tactics needed to prevent their orgs from being the next target. OpenSourceMalware provides community-driven threat intelligence on malicious open source assets including packages, domains, IP addresses, crypto wallets, and more. https://opensourcemalware.com/

  1. قبل ٢٣ ساعة

    Hugging Face update, GitHub security improvements, DPRK linked to chald/debug, and more new PolinRider research

    This week we discussed: Update from Hugging Face: Hugging Face published a technical timeline of the OpenAI evaluation agent that breached its production infrastructure between July 9 and July 13, reconstructing over 17,000 attacker actions across the five day window. OpenAI's own follow-up disclosure this week revealed the agent didn't stop at Hugging Face. It accessed accounts on four other services during the intrusion. We dig into why the agent went after the ExploitGym answer key instead of solving the benchmark honestly, and what that says about reward-seeking behavior in autonomous agents. GitHub ships publish-time malware scanning and holds risky Actions workflows: On July 28, GitHub announced two supply chain security changes on the same day. npm packages are now scanned before they become available for install rather than after, and GitHub Actions will hold workflow runs identified as potentially malicious until a repository collaborator with write access approves them. Both announcements are thin on technical detail, and we talk through what triggers are probably getting flagged and why GitHub and npm have been slow to take on this kind of liability. Amazon ties DPRK to the chalk and debug compromise: Amazon published research attributing the September 2025 compromise of the debug and chalk npm packages, along with the typo-crypto package first seen in March 2025, to the DPRK threat actor tracked as SAPPHIRE SLEET. We talk about why this link wasn't news to researchers who've been tracking DPRK's tradecraft for a while, and why TeamPCP's loud, public style keeps pulling attention away from the North Korean groups doing far more financial damage. PolinRider automation causes account takeovers without targeting: New OSM research examined 20 npm and Go packages compromised through PolinRider's automatic credential harvesting rather than a deliberate account takeover. We explain why maintainers infected through fake job interviews and poisoned VS Code tasks ended up publishing malware to packages nobody had specifically targeted, and why that distinction changes how defenders should think about the threat. Episode resources: (report) Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident(blog) OpenAI Says Its Rogue AI Agent Didn't Just Hack Hugging Face(changelog) npm publish-time malware scanning and dual-use metadata(changelog) GitHub Actions holds potentially malicious workflows for approval(report) Amazon identifies North Korean hacker group behind open-source supply chain attacks(blog) Amazon Links Debug and Chalk npm Hijack to North Korea's Sapphire Sleet(webpage) typo-crypto(podcast) To Catch a Thief: North Korea On Our Payroll(blog) PolinRider Caused Dozens of npm and Go Compromises

    Hugging Face update, GitHub security improvements, DPRK linked to chald/debug, and more new PolinRider research

  2. ٢٤ يوليو

    Hugging Face incident, AgentBaiting, RubyGems, CrashStealer, and new PolinRider research

    This week we talked about: Hugging Face breach and OpenAI's rogue model claim — Hugging Face disclosed a breach with thin details; OpenAI followed up claiming one of its models caused it during an internal security test, escaping its sandbox. The security community is skeptical about OpenAI's role in this incident.AgentBaiting: 6,000+ malicious GitHub repos target AI agents — Island's research found over 800 repos posing as AI skills or MCP servers, part of a wave that peaked in April. The bigger concern is malware hidden in natural-language instructions rather than code.RubyGems GemStuffer copycat campaign — 2,539 new RubyGems threat reports resembling the GemStuffer campaign that used gem publishing as a channel to hide exfiltrated data.RubyGems was leaking user API keys for years — A caching flaw exposed other users' API credentials under certain conditions. RubyGems fixed it fast and is notifying affected users.CrashStealer: a macOS infostealer with multiple tracks — Jamf published research on this novel C/C++ infostealer impersonating Apple's crash reporter. Paul found the threat actor also running a RAT and other malware tracks in parallel.Info stealers 101 — A quick primer on what characterizes an infostealer (what it targets, how it exfiltrates) and how our technology traces backward from the exfil point.ChainVeil and ViteVenom are PolinRider — Jenn's research connecting Checkmarx's ChainVeil/ViteVenom npm campaign to DPRK's PolinRider via five byte-for-byte identical IOCs (wallets and XOR keys).Episode Resources (blog) Hugging Face Confirms Breach Affected Internal Datasets and Credentials, Urges Users to Take Action(blog) OpenAI Says Hugging Face Was Breached by Its Pre-Release Models(blog) AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware(blog) GemStuffer Abuses 150+ RubyGems to Exfiltrate Scraped U.K. Council Portal Data(blog) Security Advisory: Possible Leak of Legacy API Keys via Improper Cache Configuration(blog) CrashStealer: C++ macOS Infostealer Posing as Crash Reporter(blog) ChainVeil and ViteVenom are DPRK's PolinRider Campaign

    Hugging Face incident, AgentBaiting, RubyGems, CrashStealer, and new PolinRider research

  3. ١٦ يوليو

    Dependabot cooldowns, Jscrambler and AsynchAPI compromises, new PolinRider research

    This week we talked about:  GitHub turns on Dependabot cooldown periods by default — A three day cooldown is now applied automatically to all Dependabot version updates, a shift we've been anticipating in the fight against account takeover malware, though it may leave developers confused about why their upgrades are getting blocked JScrambler compromise — A threat actor gained access to a publishing credential and pushed five malicious versions of the jscrambler package. The malware evolved quickly, with the first three versions containing the trigger in a pre-install script to the last two on-import execution partway through. They also published four versions of related packages that pinned to malicious v8.18.0.AsyncAPI compromised — Attackers exploited a GitHub Actions pull_request_target flaw that sat unresolved for 58 days to steal a privileged token. They published malicious npm packages under the @asyncapi namespace, all with components of the Miasma malware that was open-sourced earlier this year (but no worm). New PolinRider research — Paul's latest hunt found 2,417 newly-compromised repositories, confirming config file injection as the dominant delivery vector alongside a growing fake font technique, still overwhelmingly hitting individual developers rather than organizations.Episode Resources (talk) BSides Adelaide 2026 Schedule(docs) Dependabot cooldown(blog) Security Advisory: Unauthorized Publication of a Malicious npm Package(feed) OpenSourceMalware threat reports for Jscrambler(blog) M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions(feed) OpenSourceMalware threat reports for AsyncAPI(blog) PolinRider Confirmed Footprint Grows 6.5x Since March

    Dependabot cooldowns, Jscrambler and AsynchAPI compromises, new PolinRider research

  4. ٩ يوليو

    Open VSX security improvements, new PolinRider researcher, shady vendor practices

    This week we talked about: PolinRider jumps the fence — Paul's research on North Korea's automated repo-hijacking campaign spreading into the Go and PHP ecosystems without any extra effort from the threat actorsCybersecurity startup publishes infostealers to npm — a vendor publishing malicious packages to manufacture threat data for its own marketing, and getting their npm account pulled for itMeetingTV sues Palo Alto Networks — a lawsuit alleging Koi Security's AI-assisted analysis hallucinated a company's domain onto a C2 infrastructure list, with real business falloutThis episode also features an interview with Mikael Barbero (Head of Security, Eclipse Foundation) on OpenVSX security — We covered OpenVSX's explosive growth, its pre-publish scanning pipeline, looking for "sleeper malicious" extensions, publisher verification, and token management. Episode Resources (blog) PolinRider Jumps the Fence to Go, Packagist, npm, PyPI(blog) Cybersecurity Startup Publishes Infostealers to NPM(PDF) MeetingTV’s First Amended Complaint Against Palo Alto Networks and Koi Security(LinkedIn) Mikael Barbero, Head of Security at Eclipse Foundation(webpage) Open VSX Security Researcher Recognition Program(report) GlassWorm: Open VSX Transitive Dependency Supply-Chain Escalation(feed) OpenSourceMalware Threat Reports for Open VSX

    Open VSX security improvements, new PolinRider researcher, shady vendor practices

  5. ٢ يوليو

    GitHub security improvements, shady vendor practices

    This week we talked about: GitHub’s two new account protection features: NPM added a 72-hour read-only lockout for high-impact accounts triggered by an email change or 2FA recovery code use, aimed at slowing account takeovers. Separately, GitHub Enterprise rolled out self-service credential revocation, letting enterprise owners revoke tokens, SSH keys, and SSO authorizations for a single user or the whole org during incident response. Paul flags an open question on both: the npm change could make ATO recovery harder for legitimate maintainers if it locks them out too, and the GitHub Enterprise tool’s scope may not cover personal access tokens created outside the enterprise boundary. A security researcher’s malicious packages targeting AI companies: Paul found six npm packages published by a researcher at a stealth cybersecurity startup, targeting OpenAI, Anthropic, Vercel, and Ollama users. The packages avoid exfiltrating credentials directly but do pull data from .git and .ssh, which Paul argues crosses an ethical line for security research. He draws a direct parallel to the 2025 incident where a Snyk researcher published malicious packages targeting Cursor. FBI FLASH notice on TeamPCP: The FBI issued a FLASH covering TeamPCP’s behavior and IOCs. Note - you’ll get more complete info on their malware and TTPs from OpenSourceMalware.com Next week’s special guest: Jenn and Paul will be joined by Mikael Barbero, Head of Security at the Eclipse Foundation, to talk about Open VSX. The draw: AI IDE platforms like Cursor and Windsurf use Open VSX instead of the official VS Code marketplace, which is turning it into a more attractive target for threat actors. Resources (blog) NPM adds preventive account protection for high-impact accounts(blog) Self-service credential revocation for incident response(blog) Snyk appears to deploy ‘malicious’ packages targeting Cursor for unknown reason(PDF) FBI FLASH on Team PCP

    GitHub security improvements, shady vendor practices

  6. ٢٥ يونيو

    How malicious OSS is evolving in 2026, feat. DPRK innovations

    This week we talked about: DPRK Lazarus Group trends in software supply chain malware: Three active techniques he's observing from North Korea's Lazarus Group. The first is “version sandwiching,” where threat actors publish benign versions of a package before and after a malicious one, then pin their delivery mechanism to the malicious version so scanners checking the latest release see nothing wrong. The second is their continued reuse of Aptos, Tron, and Binance BSC blockchain addresses as mutable C2 infrastructure, which allows defenders to tie disparate campaigns to the same threat actor. The third is human-readable campaign name strings embedded in payloads, functioning like UTM tags and likely reflecting internal tracking within Lazarus subgroups. General supply chain threat landscape: Cross-ecosystem attacks, once limited to nation-state actors, are now being executed by low-sophistication crews using vibe coding tools to quickly port payloads across npm, PyPI, and other registries simultaneously. Package clusters, where only one or two packages in a published group carry the actual payload, have become standard operating procedure across threat actors of all levels. Dynamic imports and payload splitting are also on the rise, bypassing package managers and firewalls by pulling dependencies from URLs at runtime or distributing payload components across multiple files. Episode Resources (Video) How malicious packages on npm bypass existing security tools(Video) Poisoned Packages and Stolen Secrets: The Rise of Supply Chain Attacks

    How malicious OSS is evolving in 2026, feat. DPRK innovations

  7. ١٨ يونيو

    Mastra compromise, agentjacking research, busting malware myths

    Mastra Package Compromise: Threat actors hijacked the entire Mastra npm organization (116 packages) after a maintainer was targeted with a ClickFix-style attack that stole his credentials. Rather than injecting malware directly into Mastra packages, attackers pre-staged a typosquatted package called 'easy-day-js' and added it as a dependency across the org. The malware differs from the structurally similar Axios attack in one notable way: it targets browser extensions, including password managers (LastPass, Bitwarden, Dashlane, 1Password) and MFA tools, with Zapier among the more unusual targets. Agent Jacking and MCP Server Security: A Cloud Security Alliance paper describes a concept called "agentjacking", where attackers inject malicious instructions into Sentry error events, which AI coding agents then retrieve via MCP and execute with the developer's own elevated permissions. This pattern isn't new: weaponizing an agent's privileged access against its owner was a core mechanic of the 2025 S1ngularity attack. What the paper describes is sophisticated prompt injection through an MCP server that fails to sanitize third-party data before passing it to the agent. Its conclusion that EDR can't catch this misses the point, because EDR can't catch most open source malware since the traffic and signals are indistinguishable from normal software development activity. Malware Myths: We bust four myths making the rounds in the AppSec community. First, that open source malware only lives two to three days: typosquatting and dependency confusion packages routinely survive for weeks or months, and NPM's inconsistent takedown practices make it worse. Second, that npm install scripts are going away: they're not, they are becoming opt-in by default. Third, that package firewalls and cooldowns will eliminate 99% of risk: they won't, for the same reason the lifespan myth is wrong. Fourth, that threat actor attribution doesn't matter: it does, because knowing who compromised you tells you what persistence mechanisms and next steps to look for during incident response. Episode Resources (GitHub Issue) INCIDEN3 iT REPORT: 2026-06-16: Mastra hit by supply-chain attack(blog) Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapie(PDF) Agentjacking: MCP Injection Hijacks AI Coding Agents

    Mastra compromise, agentjacking research, busting malware myths

  8. ١١ يونيو

    MSFT hit by Miasma worm, VS Code cooldowns, npm v12 breaking changes

    Miasma Worm Hits Microsoft — On June 5th, 73 Microsoft GitHub repositories were disabled in 105 seconds after being compromised by the Miasma worm. Four GitHub organizations were affected, including Azure Functions, which broke CI jobs worldwide for anyone calling those official GitHub Actions. The initial foothold traces back to a May 19th compromise of the Durable Task repo, with threat actors maintaining persistence via stolen credentials before returning to trigger the mass takedown. As of this recording, Microsoft had issued no official statement about what happened or the real-world impact it caused. VS Code Extension Auto-Update Cooldown — VS Code shipped a two-hour auto-update delay for third-party extensions, responding to community requests citing the frequency of extension compromises. Two hours is well short of the three-to-seven days practitioners typically ask for, and the change only applies to the Microsoft Marketplace — not OpenVSX, which has no equivalent scanning. The NX Console compromise is a useful reference point: NX caught the malicious version themselves via a Marketplace email notification, not through any platform detection. npm v12 Disables Install Scripts and Dynamic Dependencies — npm v12 will disable install lifecycle scripts (pre, post, and install), direct Git dependencies, and remote tarball dependencies by default — all three together. These are the mechanisms malware uses to execute at install time, before it reaches a pipeline. Significant breakage is expected since many legitimate packages rely on install scripts. The harder problem is adoption: this is a package manager change, not a registry change, meaning every developer workstation and CI environment has to upgrade before the protection applies. Based on how slowly similar changes have rolled out elsewhere, the practical impact will be years in the making. Miasma Gets Open-Sourced — The threat actor behind Miasma open-sourced the worm, continuing the pattern TeamPCP established with MiniShai Hulud. Unlike that release, which originated from a compromised account, this one appears to belong to a quasi-security researcher with no signs of compromise — an unusual wrinkle still under investigation. Package Firewalls — Package firewalls block installation of known or suspected malicious packages at the developer endpoint, before anything reaches a pipeline — a proactive control where EDR is reactive. Two broad categories exist: simpler alias-based tools that intercept package manager calls (bypassable by calling the binary's absolute path directly) and more sophisticated daemon-based tools that proxy registry traffic continuously. Key things to evaluate before choosing one: what's the data source and how fresh is it, does it cache locally, and how easy is it to bypass? OSV and GHSA are common feeds but have coverage gaps. Episode Resources (article) Microsoft's open source tools were hacked to steal passwords of AI developers(blog) The Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds(article) Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack(GitHub issue) Security: minimumReleaseAge setting for mitigating supply chain attacks on extensions(release notes) Visual Studio Code 1.123(blog) NPM disables install scripts by default, but is that going to solve its malware problem?

    MSFT hit by Miasma worm, VS Code cooldowns, npm v12 breaking changes
مشاهدة الكل (١٥)

حول

When you think about malware, you probably envision phishing emails or sketchy websites. But malicious open source - targeting software developers and their build systems - is becoming a top way that threat actors deliver malware. Just one 'npm install' can trigger payloads that steal information and credentials. Software supply chain attacks by state actors, ransomware groups, and freelancers are happening every day. Hosted by Jenn Gile and Paul McCarty (co-founders of OpenSourceMalware), this podcast explores the latest trends and attacks, and helps defenders understand the tactics needed to prevent their orgs from being the next target. OpenSourceMalware provides community-driven threat intelligence on malicious open source assets including packages, domains, IP addresses, crypto wallets, and more. https://opensourcemalware.com/

المعلومات

  • صناع العمل
    OpenSourceMalware
  • سنوات النشاط
    ٢٠٢٦
  • الحلقات
    ١٥
  • التقييم
    فاضح
  • حقوق النشر
    © 2026 The OpenSourceMalware Show
  • موقع البرنامج على الويب
    The OpenSourceMalware Show

قد يعجبك أيضًا