Advertise on podcast: The OpenSourceMalware Show

This week we talked about: OVH CLI compromised by GlassWorm: GlassWorm is back. The Russian threat actor went quiet after its infrastructure was taken down earlier this year, and it resurfaced with malicious versions of OVH’s official CLI tool. It got in through a contributor account it had held for seven months, a reminder that compromised credentials can be used long after they’re stolen. The malicious builds came from a laptop rather than OVH’s normal pipeline, which helped a user spot them quickly.Compound payloads: Threat actors are splitting malware into pieces, often spread across several packages. They only do damage when they run together, and the purpose is to evade detection because each piece looks harmless on its own. DPRK is using a similar approach in Contagious Interview, in which a private repo’s .npmrc points to a different registry, so the malicious package only resolves for the target.GhostAction copycats PolinRider: GhostAction has moved from attacking CI to going after developers directly. It used its malicious workflows to plant PolinRider’s fake font trick repos already compromised with the malicious workflows. Anyone who opens one of those repos in VS Code runs a credential stealer and gets a cron job that checks in with the attacker every five minutes. Removing the malicious workflows doesn’t remove it, and at least one maintainer who did exactly that missed the new malware. Luckily, the code is sloppy and only partly works, but that doesn’t make it harmless.Resources (blog) Glassworm Hacks OVH Clouds CLI tool(threat report) webrunc(blog) GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File

This week we talked about:   GitHub push attribution: GitHub now shows when the account that pushed a commit is different from the one listed as the committer, which makes faked Git history easier to spot. That could help flag PolinRider-style changes and pushes made with stolen credentials. The catch is that it’s in public preview for GitHub Enterprise only. The related push rules may also not work on public repos, which leaves out the open source maintainers who are targeted most.GitHub Actions workflow lockfiles: Workflow lockfiles keep a GitHub Actions workflow pointed at the version you chose, even if an attacker moves the tag. That should help against attacks like tj-actions and Trivy, though it wouldn’t stop GhostAction, and setup requires installing a GitHub CLI extension. GhostAction expands to phishing: GitGuardian first discovered GhostAction in 2025. It’s a malicious GitHub Actions workflow that sweeps a repo’s full Git history for credentials. The operators have now registered a GitHub lookalike domain and are phishing open source maintainers with fake sign-in alerts. Their kit proxies the real GitHub login and got past the MFA methods it was tested against. The same IP has also been mass scanning the internet for about a year.North Korean IT worker laptop farms: The US Department of Justice announced Operation Lonestar Roundup, with law enforcement actions in Ohio and Texas and approximately 187 computers seized. We explain how the IT worker scheme works and why operatives need US-based laptop farms to hide where they are. We also cover how they find people to host the laptops.Resources (blog) Push attribution for commits in limited public preview(blog) GitHub Actions workflow lockfiles in public preview(blog) GhostAction Attack Escalates By Targeting GitHub Users(blog) GhostAction Is Now Phishing Open Source Maintainers(webpage) Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies

This week we talked about:  Tensorlake SDK compromise: The npm SDK for Tensorlake, a tool for building and operating AI agents, was compromised with two malicious files. A setup.mjs file fires through a preinstall hook and launches the payload with Bun, and math_symbol.js carries a credential stealer and self-propagating worm. It is at least the second attack built on the open-sourced Mini Shai-Hulud worm, following the August attack on keyv and cachable. We discuss why this well-known pattern should have been caught by registry scanning, and what the lack of impact suggests about the attacker.Rogue .npmrc in a fake job interview: A new attack follows the Contagious Interview playbook but is not yet attributed. The repo a candidate clones quietly drops a custom .npmrc, so a later npm install resolves a package from a Chinese npm mirror instead of the public registry. We also look at packages with no malicious payload on their own that only become malicious when combined through dependencies, and why scanners miss them.Malicious crypto gems on RubyGems: OpenSourceMalware's automated detection flagged 42 malicious gems published by a single account calling itself Ghost Dev. They target crypto and Web3 developers through typosquats, brandjacking, and plausible utility names. Installing the gem runs a native extension build script that sleeps for 20 to 40 minutes, then either opens a reverse shell or installs a wallet theft kit posing as a tool called Wallet Guard. We also cover why a Python payload inside a Ruby package is a useful signal, and how slopsquatting gets more effective as AI tools hallucinate dependencies across ecosystems.Resources (report) tensorlake threat report(blog) New npm Worm Hits 400+ Packages Including Keyv, Cachable(blog) Malicious Crypto Shell Packages Target RubyGems

This week we talked about:  ShinyHunters and KillSec arrests: Dutch police arrested Pepijn van der Stap, a long-time ShinyHunters member known as Umbreon, on September 16, less than a year after he finished a prison sentence for earlier hacking. His arrest followed a power struggle with the group's 16-year-old leader over who controls its infrastructure. Separately, police arrested three suspected members of the KillSec ransomware group. The group is linked to roughly 1,000 attacks and used AI to build its infrastructure and identify victims.Bitget crypto heist: Suspected North Korean hackers stole $351.6 million from the hot and warm wallets of crypto exchange Bitget. Customer accounts still showed full balances after the funds were drained. Incident response firm SlowMist attributes the initial access to a zero-day in an unnamed security product.Signed Mac malware posing as Claude Desktop: A lookalike Claude Desktop site is serving a signed macOS installer hosted on GitHub. It appears to be the real app with a padded payload added. Because it's signed, macOS installs it without warning, and the file is about four times the size of the real installer.Baileys campaign update: The number of malicious npm packages abusing the Baileys WhatsApp library now tops 100. Most only inflate follower counts for WhatsApp channels, so the direct risk is low. Some have also served as a base for other attacks, including WhatsApp-based C2.PolinRider A/B testing: DPRK's PolinRider campaign is changing its fake font trick to slip past detections that rely on a single file name. The fa-solid-400.woff2 payload has been renamed to 500, 900, and 300 and moved deep into legitimate folders. Most recently it was given a .llf extension that has nothing to do with fonts.We're hiring: OpenSourceMalware is looking for a part-time malware researcher with software supply chain experience.Resources (blog) Dutch Police Arrest 'Reformed' Hacker in Shiny Hunters Investigation(blog) Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers(blog) Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise(feed) OpenSourceMalware threat reports tagged #baileys(blog) 101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent(blog) PolinRider is A/B Testing its Way Past Your Detections

This week we discussed:  ShinyHunters vs. the FBI and Cl0p: ShinyHunters claims it stole data from an FBI jobs website through a PeopleSoft zero-day, and it is threatening to leak that data unless the FBI retracts a May FLASH tied to the Instructure Canvas breach. We cover why aging enterprise monoliths like PeopleSoft and WebLogic are such attractive targets. We also get into the group's escalating public feud with ransomware crew Cl0p.A correction on WhatsApp Baileys attacks: Malicious Baileys typosquats aren't targeting WhatsApp payments, as we said last week. We explain what these packages actually do and how threat actors make money from them.WeaselBiscuit: A new, stripped-down, self-contained malware family derived from BeaverTail and OtterCookie has turned up in 16 npm packages so far. We share the latest on attribution, what the malware is designed to steal, and why its minimal design helps it slip past detection.FBI joint advisory on Contagious Interview: The FBI and international partners issued a joint warning about the DPRK IT workers scam and Contagious Interview (under the name WaterPlum), with figures on infected devices and stolen cryptocurrency. We discuss what the advisory leaves out. We also explain why its finding of shared infrastructure with the IT workers scam matters for researchers and defenders.Atlassian's Contagious Interview research: Atlassian published research on Contagious Interview activity across Bitbucket, GitLab, and GitHub, along with the actions it has taken on its own platform. We discuss what the report reveals about the campaign beyond GitHub and how platforms differ in responding to researcher reports.Developer questions from TikTok: Our viral TikTok explainer on the VS Code tasks autorun technique drew a set of recurring questions from developers. We answer them, including "How this malware gets onto developer machines", "Whether signed commits or switching editors would stop it", "Why antivirus misses it", and "How researchers know North Korea is behind it."Episode resources: (X) ShinyHunters statement on the FBI(webpage) ShinyHunters - Cyber Criminal Group Attacks Learning Management System(blog) ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach(feed) Baileys threat reports(blog) WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials(PDF) North Korean "WaterPlum," commonly referred to as "Contagious Interview," Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe(blog) From fake interviews to malicious repositories - Disrupting Contagious Interview(TikTok) How the VS Code tasks autorun attack works

This week we talked about:  New research alleges OpenAI agents were behind the RubyGems attack. A report from independent researchers argues an OpenAI agent swarm is responsible for the GemStuffer campaign, which uploaded hundreds of spammy packages to RubyGems in May. Truffle Security's Luke Marshall followed up with the vulnerability the agents used (a CDN misconfiguration) that could expose other users' RubyGems API keys. OpenAI has yet to comment on either report."lurves-agent" campaign is typosquats PyPI packages to target AI users. The campaign name comes from a string the malware's own AI-generated code self-attributed inside a bash script, suggesting the threat actor used an AI agent to write it without reviewing the output. Across five or six packages typosquatting OpenAI and other AI framework names, the payload is a short info-stealer, and the surrounding comments function as a prompt injection aimed at any AI reviewing the code.A typosquatted Claude site is distributing signed Mac malware. claude-desktop.com delivers a signed DMG instead of the real Claude desktop app, taking advantage of the fact that official install instructions for tools like Claude and OpenAI's CLI have changed repeatedly over the past year, making people less careful about where they install from. Resources:  (report) OpenAI agents carried out an undisclosed cyber-attack on RubyGems(blog) We discovered a Ruby account takeover; Rogue OpenAI Agents exploited it 2 months prior(threat feed) lurves-agent records on OpenSourceMalware(LinkedIn) Three Injections and a Rootkit: How Lurves PyPI Typosquat Attacks...

Jenn and Paul also mark OpenSourceMalware's first anniversary, now tracking close to 200,000 verified threats and over 100,000 IOCs. We also discuss: Mini Shai-Hulud payload resurfaces on npm. A payload from May's Mini Shai-Hulud campaign against AntV reappeared in four packages published within the same hour on September 7th, sitting undetected for 111 days despite npm's publish-time scanning. Q&A from the Underground Economy conference. Reporting live from Team Cymru's conference in Strasbourg, Jenn and Paul answer the questions they fielded all week: whether DPRK and Russia collaborate on supply chain attacks, why malicious open source rarely targets specific countries, whether North Korea needs AI to close a skills gap, why GitHub allows git history to be rewritten and hasn't done more to stop PolinRider, and what developers can realistically do to protect themselves, since PolinRider's payload runs regardless of what language a repo is written in.

This week we talked about:  TeamPCP arrests — Australian Federal Police and the FBI arrested Ruben Thomson (21) and Louis Gaebler (23) in Perth on TeamPCP-related charges. The arrests align with the OpenSourceMalware team's longstanding assessment that TeamPCP was a very small operation, effectively one or two people, despite the scale of its attacks. Krebs' reporting details the OPSEC failures (reused usernames and passwords, prolific unredacted social media activity) that led to their identification, and despite the technical complexity of the attacks, the financial payout was reportedly modest (around $20K). Jenn and Paul discuss what this could mean for other overlapping threat groups like Lapsus$ and ShinyHunters.PolinRider's persistence outlasts partial remediation — A look at how DPRK's PolinRider campaign continues to reinfect developers who believed they'd already cleaned up. When a developer only removes the malicious payload files but not the underlying persistence mechanism (like a vscode-task.json trigger) or the RAT running on their machine, DPRK can push new payloads that ride along on the developer's own legitimate package publishes. Paul and Jenn cover what's changed in the kill chain: a new NullReceiver-branded payload, a persistence technique that overwrites the npm CLI binary itself so simply removing payloads from repos isn't sufficient, and an expanding target list of JavaScript/TypeScript file types the malware will inject into. They close on why disclosing an infection to collaborators matters, since silent individual cleanup doesn't stop reinfection through shared repos and contributors.Episode resources TeamPCP: (news) Two WA men charged after investigation into alleged cybercrime(official) Two WA men charged following AFP FBI WAPF disruption alleged global cybercrime syndicate(news) Two Alleged 'TeamPCP' Hackers Arrested in AustraliaPolinRider: (blog) PolinRider npm case study of a DPRK attack(blog) Developer guide to getting over PolinRider

This week we talked about:  Rust arrayref compromise tied to DPRK infrastructure: A compromised maintainer account published malicious versions of the arrayref crate, along with internment and append-only-vec, adding a typosquatted build dependency that downloaded and executed a remote binary at compile time. arrayref alone has more than 245 million lifetime downloads and sits in roughly three quarters of all Rust environments. Wiz Research has tied the campaign's infrastructure, including a shared C2 endpoint pattern and overlapping IP ranges, to the same DPRK actor behind the Mastra and Axios npm compromises. StubMaker spreads from RubyGems to npm: What started as a RubyGems typosquatting campaign targeting bundler, i18n, rake, and activesupport turned out to share byte-for-byte identical payloads with a separate 40 package npm typosquatting cluster targeting axios, chalk, commander, lodash, react, and typescript. Both campaigns deliver the same 22MB Rust loader and embedded Go infostealer, confirmed by matching SHA-256 hashes, giving one threat actor two independent paths into any organization running both a Ruby and a Node stack. There's also evidence that this campaign hit the PowerShell ecosystem. DIY binary payloads make a comeback: Paul has seen a sharp increase over the last two weeks in software supply chain attacks bundling compiled binaries (C++, Rust, Go) instead of sticking to the interpreted languages that dominate malicious open source. The theory: less experienced threat actors are following old malware-writing conventions, possibly with an assist from AI coding agents, without realizing that shipping a binary inside an npm or RubyGems package is itself one of the biggest red flags an analyst can ask for. PolinRider reinfection wave using NullReceiver: We're still continuously seeing developers talking about getting reinfected with PolinRider. This latest iteration swaps out EtherHiding for NullReceiver as its stage two hiding method, and Paul and Jenn walk through why victims keep getting reinfected even after they think they've cleaned up: the malware lives on the developer's machine, not just in the repo, and it can commit to Git history without leaving an obvious trail. Episode Resources: (blog) Supply chain attack on arrayref(blog) Rust Supply Chain Attack on arrayref, Significant Overlap with DPRK Campaigns(webpage) arrayref crate threat report(blog) StubMaker RubyGems Campaign Delivers a Windows Infostealer(blog) Windows Infostealer Hits npm and Ruby

This week we talked about:  Hacker Summer Camp trends. Jenn and Paul share observations from Black Hat, DEF CON, and BSides Las Vegas last week, including a maturing AI security conversation that has shifted to focus on where AI still falls short, particularly the last mile of precision and finesse that still requires a human to verify. They also discuss the emerging challenge of identifying malicious AI skills, where the natural language format makes static analysis much harder than it is for traditional package ecosystems. And they revisit the recurring gap between security teams who understand binary malware and incident response and those who understand the open source software supply chain.GitHub revokes npm bypass-2FA token privileges. GitHub announced it is closing a gap that let npm granular access tokens configured to bypass two factor authentication perform sensitive account, org, and package management actions, a change Jenn and Paul say is overdue but underexplained.DPRK's NullReceiver technique keeps spreading. Following up on last week's episode, Paul shares that the number of packages using the NullReceiver technique, tied to the PolinRider campaign, has grown well past the seven originally confirmed, and that DPRK's use of crypto payments for infrastructure like VPN services could offer new tracking opportunities for defenders.Episode resources: (blog) Restricting npm bypass-2FA granular access tokens(blog) NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

This week we talked about: New npm worm hits Keyv and cacheable. Jared Wray's GitHub account was compromised on Tuesday, and threat actors used it to publish a worm based on the open-sourced Mini Shai-Hulud malware. The worm spread to over 400 packages, with ServiceTitan alone losing 100 packages, and it searches developer machines and CI runners for credentials across GitHub, npm, AWS, Kubernetes, Vault, Azure, Google Cloud, Terraform, Docker, and Slack before exfiltrating them. We also talk about how this got caught within minutes despite GitHub's recent claims of proactive pre-publication malware scanning.The WEL1DROPPER campaign is flooding npm with AI slopsquatted packages. Over the past 72 hours, more than a thousand malicious packages have been published to npm as part of a campaign we're calling WEL1DROPPER. It doesn't rely on install scripts at all, executing instead when a package is imported, and we believe it's loosely connected to the earlier Moika campaign based on shared tradecraft. We dig into why attribution to Russian threat actors is complicated given the campaign also targets Russian and Belarusian financial institutions.DPRK is using a new C2 technique we're calling NullReceiver. We found DPRK-linked malware hiding its C2 IP address inside the recipient address of a completely empty Ethereum transaction, an evolution of the EtherHiding technique that fixes its biggest weakness: a fixed, publicly known destination address. We've confirmed at least 10 packages using this new technique so far.Episode Resources: (blog) New npm Worm Hits 400+ Packages Including Keyv, Cachable(blog) Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages(blog) NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

This week we discussed: Update from Hugging Face: Hugging Face published a technical timeline of the OpenAI evaluation agent that breached its production infrastructure between July 9 and July 13, reconstructing over 17,000 attacker actions across the five day window. OpenAI's own follow-up disclosure this week revealed the agent didn't stop at Hugging Face. It accessed accounts on four other services during the intrusion. We dig into why the agent went after the ExploitGym answer key instead of solving the benchmark honestly, and what that says about reward-seeking behavior in autonomous agents. GitHub ships publish-time malware scanning and holds risky Actions workflows: On July 28, GitHub announced two supply chain security changes on the same day. npm packages are now scanned before they become available for install rather than after, and GitHub Actions will hold workflow runs identified as potentially malicious until a repository collaborator with write access approves them. Both announcements are thin on technical detail, and we talk through what triggers are probably getting flagged and why GitHub and npm have been slow to take on this kind of liability. Amazon ties DPRK to the chalk and debug compromise: Amazon published research attributing the September 2025 compromise of the debug and chalk npm packages, along with the typo-crypto package first seen in March 2025, to the DPRK threat actor tracked as SAPPHIRE SLEET. We talk about why this link wasn't news to researchers who've been tracking DPRK's tradecraft for a while, and why TeamPCP's loud, public style keeps pulling attention away from the North Korean groups doing far more financial damage. PolinRider automation causes account takeovers without targeting: New OSM research examined 20 npm and Go packages compromised through PolinRider's automatic credential harvesting rather than a deliberate account takeover. We explain why maintainers infected through fake job interviews and poisoned VS Code tasks ended up publishing malware to packages nobody had specifically targeted, and why that distinction changes how defenders should think about the threat. Episode resources: (report) Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident(blog) OpenAI Says Its Rogue AI Agent Didn't Just Hack Hugging Face(changelog) npm publish-time malware scanning and dual-use metadata(changelog) GitHub Actions holds potentially malicious workflows for approval(report) Amazon identifies North Korean hacker group behind open-source supply chain attacks(blog) Amazon Links Debug and Chalk npm Hijack to North Korea's Sapphire Sleet(webpage) typo-crypto(podcast) To Catch a Thief: North Korea On Our Payroll(blog) PolinRider Caused Dozens of npm and Go Compromises

This week we talked about: Hugging Face breach and OpenAI's rogue model claim — Hugging Face disclosed a breach with thin details; OpenAI followed up claiming one of its models caused it during an internal security test, escaping its sandbox. The security community is skeptical about OpenAI's role in this incident.AgentBaiting: 6,000+ malicious GitHub repos target AI agents — Island's research found over 800 repos posing as AI skills or MCP servers, part of a wave that peaked in April. The bigger concern is malware hidden in natural-language instructions rather than code.RubyGems GemStuffer copycat campaign — 2,539 new RubyGems threat reports resembling the GemStuffer campaign that used gem publishing as a channel to hide exfiltrated data.RubyGems was leaking user API keys for years — A caching flaw exposed other users' API credentials under certain conditions. RubyGems fixed it fast and is notifying affected users.CrashStealer: a macOS infostealer with multiple tracks — Jamf published research on this novel C/C++ infostealer impersonating Apple's crash reporter. Paul found the threat actor also running a RAT and other malware tracks in parallel.Info stealers 101 — A quick primer on what characterizes an infostealer (what it targets, how it exfiltrates) and how our technology traces backward from the exfil point.ChainVeil and ViteVenom are PolinRider — Jenn's research connecting Checkmarx's ChainVeil/ViteVenom npm campaign to DPRK's PolinRider via five byte-for-byte identical IOCs (wallets and XOR keys).Episode Resources (blog) Hugging Face Confirms Breach Affected Internal Datasets and Credentials, Urges Users to Take Action(blog) OpenAI Says Hugging Face Was Breached by Its Pre-Release Models(blog) AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware(blog) GemStuffer Abuses 150+ RubyGems to Exfiltrate Scraped U.K. Council Portal Data(blog) Security Advisory: Possible Leak of Legacy API Keys via Improper Cache Configuration(blog) CrashStealer: C++ macOS Infostealer Posing as Crash Reporter(blog) ChainVeil and ViteVenom are DPRK's PolinRider Campaign

This week we talked about:  GitHub turns on Dependabot cooldown periods by default — A three day cooldown is now applied automatically to all Dependabot version updates, a shift we've been anticipating in the fight against account takeover malware, though it may leave developers confused about why their upgrades are getting blocked JScrambler compromise — A threat actor gained access to a publishing credential and pushed five malicious versions of the jscrambler package. The malware evolved quickly, with the first three versions containing the trigger in a pre-install script to the last two on-import execution partway through. They also published four versions of related packages that pinned to malicious v8.18.0.AsyncAPI compromised — Attackers exploited a GitHub Actions pull_request_target flaw that sat unresolved for 58 days to steal a privileged token. They published malicious npm packages under the @asyncapi namespace, all with components of the Miasma malware that was open-sourced earlier this year (but no worm). New PolinRider research — Paul's latest hunt found 2,417 newly-compromised repositories, confirming config file injection as the dominant delivery vector alongside a growing fake font technique, still overwhelmingly hitting individual developers rather than organizations.Episode Resources (talk) BSides Adelaide 2026 Schedule(docs) Dependabot cooldown(blog) Security Advisory: Unauthorized Publication of a Malicious npm Package(feed) OpenSourceMalware threat reports for Jscrambler(blog) M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions(feed) OpenSourceMalware threat reports for AsyncAPI(blog) PolinRider Confirmed Footprint Grows 6.5x Since March

This week we talked about: PolinRider jumps the fence — Paul's research on North Korea's automated repo-hijacking campaign spreading into the Go and PHP ecosystems without any extra effort from the threat actorsCybersecurity startup publishes infostealers to npm — a vendor publishing malicious packages to manufacture threat data for its own marketing, and getting their npm account pulled for itMeetingTV sues Palo Alto Networks — a lawsuit alleging Koi Security's AI-assisted analysis hallucinated a company's domain onto a C2 infrastructure list, with real business falloutThis episode also features an interview with Mikael Barbero (Head of Security, Eclipse Foundation) on OpenVSX security — We covered OpenVSX's explosive growth, its pre-publish scanning pipeline, looking for "sleeper malicious" extensions, publisher verification, and token management. Episode Resources (blog) PolinRider Jumps the Fence to Go, Packagist, npm, PyPI(blog) Cybersecurity Startup Publishes Infostealers to NPM(PDF) MeetingTV’s First Amended Complaint Against Palo Alto Networks and Koi Security(LinkedIn) Mikael Barbero, Head of Security at Eclipse Foundation(webpage) Open VSX Security Researcher Recognition Program(report) GlassWorm: Open VSX Transitive Dependency Supply-Chain Escalation(feed) OpenSourceMalware Threat Reports for Open VSX