The OpenSourceMalware Show

When you think about malware, you probably envision phishing emails or sketchy websites. But malicious open source - targeting software developers and their build systems - is becoming a top way that threat actors deliver malware. Just one 'npm install' can trigger payloads that steal information and credentials. Software supply chain attacks by state actors, ransomware groups, and freelancers are happening every day. Hosted by Jenn Gile and Paul McCarty (co-founders of OpenSourceMalware), this podcast explores the latest trends and attacks, and helps defenders understand the tactics needed to prevent their orgs from being the next target. OpenSourceMalware provides community-driven threat intelligence on malicious open source assets including packages, domains, IP addresses, crypto wallets, and more. https://opensourcemalware.com/

The OpenSourceMalware Show is a technology podcast hosted by OpenSourceMalware, with 17 episodes on record and a Required Pod Score of 80. PitchCentric scores this show on Booking Probability, Listen Score, and live audience signals refreshed every 24 hours.

OpenSourceMalware hosts The OpenSourceMalware Show, a technology show with 17 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Episode #17

  Hacker Summer Camp trends, npm kills 2FA-bypass tokens, DPRK tradecraft

  Aug 13, 202632 minS1

  This week we talked about: Hacker Summer Camp trends. Jenn and Paul share observations from Black Hat, DEF CON, and BSides Las Vegas last week, including a maturing AI security conversation that has shifted to focus on where AI still falls short, particularly the last mile of precision and finesse that still requires a human to verify. They also discuss the emerging challenge of identifying malicious AI skills, where the natural language format makes static analysis much harder than it is for traditional package ecosystems. And they revisit the recurring gap between security teams who understand binary malware and incident response and those who understand the open source software supply chain. GitHub revokes npm bypass-2FA token privileges. GitHub announced it is closing a gap that let npm granular access tokens configured to bypass two factor authentication perform sensitive account, org, and package management actions, a change Jenn and Paul say is overdue but underexplained. DPRK's NullReceiver technique keeps spreading. Following up on last week's episode, Paul shares that the number of packages using the NullReceiver technique, tied to the PolinRider campaign, has grown well past the seven originally confirmed, and that DPRK's use of crypto payments for infrastructure like VPN services could offer new tracking opportunities for defenders. Episode resources: (blog) Restricting npm bypass-2FA granular access tokens (blog) NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

  ListenShow Notes
• 

  The OpenSourceMalware Show

  New npm worm, WEL1DROPPER AI slopsquatting campaign, DPRK NullRider innovation

  Aug 7, 202625 min

  This week we talked about: New npm worm hits Keyv and cacheable. Jared Wray's GitHub account was compromised on Tuesday, and threat actors used it to publish a worm based on the open-sourced Mini Shai-Hulud malware. The worm spread to over 400 packages, with ServiceTitan alone losing 100 packages, and it searches developer machines and CI runners for credentials across GitHub, npm, AWS, Kubernetes, Vault, Azure, Google Cloud, Terraform, Docker, and Slack before exfiltrating them. We also talk about how this got caught within minutes despite GitHub's recent claims of proactive pre-publication malware scanning. The WEL1DROPPER campaign is flooding npm with AI slopsquatted packages. Over the past 72 hours, more than a thousand malicious packages have been published to npm as part of a campaign we're calling WEL1DROPPER. It doesn't rely on install scripts at all, executing instead when a package is imported, and we believe it's loosely connected to the earlier Moika campaign based on shared tradecraft. We dig into why attribution to Russian threat actors is complicated given the campaign also targets Russian and Belarusian financial institutions. DPRK is using a new C2 technique we're calling NullReceiver. We found DPRK-linked malware hiding its C2 IP address inside the recipient address of a completely empty Ethereum transaction, an evolution of the EtherHiding technique that fixes its biggest weakness: a fixed, publicly known destination address. We've confirmed at least 10 packages using this new technique so far. Episode Resources: (blog) New npm Worm Hits 400+ Packages Including Keyv, Cachable (blog) Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages (blog) NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

  ListenShow Notes
• 

  Episode #15

  Hugging Face update, GitHub security improvements, DPRK linked to chald/debug, and more new PolinRider research

  Jul 30, 202642 minS1

  This week we discussed: Update from Hugging Face: Hugging Face published a technical timeline of the OpenAI evaluation agent that breached its production infrastructure between July 9 and July 13, reconstructing over 17,000 attacker actions across the five day window. OpenAI's own follow-up disclosure this week revealed the agent didn't stop at Hugging Face. It accessed accounts on four other services during the intrusion. We dig into why the agent went after the ExploitGym answer key instead of solving the benchmark honestly, and what that says about reward-seeking behavior in autonomous agents. GitHub ships publish-time malware scanning and holds risky Actions workflows: On July 28, GitHub announced two supply chain security changes on the same day. npm packages are now scanned before they become available for install rather than after, and GitHub Actions will hold workflow runs identified as potentially malicious until a repository collaborator with write access approves them. Both announcements are thin on technical detail, and we talk through what triggers are probably getting flagged and why GitHub and npm have been slow to take on this kind of liability. Amazon ties DPRK to the chalk and debug compromise: Amazon published research attributing the September 2025 compromise of the debug and chalk npm packages, along with the typo-crypto package first seen in March 2025, to the DPRK threat actor tracked as SAPPHIRE SLEET. We talk about why this link wasn't news to researchers who've been tracking DPRK's tradecraft for a while, and why TeamPCP's loud, public style keeps pulling attention away from the North Korean groups doing far more financial damage. PolinRider automation causes account takeovers without targeting: New OSM research examined 20 npm and Go packages compromised through PolinRider's automatic credential harvesting rather than a deliberate account takeover. We explain why maintainers infected through fake job interviews and poisoned VS Code tasks ended up publishing malware to packages nobody had specifically targeted, and why that distinction changes how defenders should think about the threat. Episode resources: (report) Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident (blog) OpenAI Says Its Rogue AI Agent Didn't Just Hack Hugging Face (changelog) npm publish-time malware scanning and dual-use metadata (changelog) GitHub Actions holds potentially malicious workflows for approval (report) Amazon identifies North Korean hacker group behind open-source supply chain attacks (blog) Amazon Links Debug and Chalk npm Hijack to North Korea's Sapphire Sleet (webpage) typo-crypto (podcast) To Catch a Thief: North Korea On Our Payroll (blog) PolinRider Caused Dozens of npm and Go Compromises

  ListenShow Notes
• 

  Episode #14

  Hugging Face incident, AgentBaiting, RubyGems, CrashStealer, and new PolinRider research

  Jul 23, 202633 minS1

  This week we talked about: Hugging Face breach and OpenAI's rogue model claim — Hugging Face disclosed a breach with thin details; OpenAI followed up claiming one of its models caused it during an internal security test, escaping its sandbox. The security community is skeptical about OpenAI's role in this incident. AgentBaiting: 6,000+ malicious GitHub repos target AI agents — Island's research found over 800 repos posing as AI skills or MCP servers, part of a wave that peaked in April. The bigger concern is malware hidden in natural-language instructions rather than code. RubyGems GemStuffer copycat campaign — 2,539 new RubyGems threat reports resembling the GemStuffer campaign that used gem publishing as a channel to hide exfiltrated data. RubyGems was leaking user API keys for years — A caching flaw exposed other users' API credentials under certain conditions. RubyGems fixed it fast and is notifying affected users. CrashStealer: a macOS infostealer with multiple tracks — Jamf published research on this novel C/C++ infostealer impersonating Apple's crash reporter. Paul found the threat actor also running a RAT and other malware tracks in parallel. Info stealers 101 — A quick primer on what characterizes an infostealer (what it targets, how it exfiltrates) and how our technology traces backward from the exfil point. ChainVeil and ViteVenom are PolinRider — Jenn's research connecting Checkmarx's ChainVeil/ViteVenom npm campaign to DPRK's PolinRider via five byte-for-byte identical IOCs (wallets and XOR keys). Episode Resources (blog) Hugging Face Confirms Breach Affected Internal Datasets and Credentials, Urges Users to Take Action (blog) OpenAI Says Hugging Face Was Breached by Its Pre-Release Models (blog) AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware (blog) GemStuffer Abuses 150+ RubyGems to Exfiltrate Scraped U.K. Council Portal Data (blog) Security Advisory: Possible Leak of Legacy API Keys via Improper Cache Configuration (blog) CrashStealer: C++ macOS Infostealer Posing as Crash Reporter (blog) ChainVeil and ViteVenom are DPRK's PolinRider Campaign

  ListenShow Notes
• 

  Episode #13

  Dependabot cooldowns, Jscrambler and AsynchAPI compromises, new PolinRider research

  Jul 16, 202634 minS1

  This week we talked about: GitHub turns on Dependabot cooldown periods by default — A three day cooldown is now applied automatically to all Dependabot version updates, a shift we've been anticipating in the fight against account takeover malware, though it may leave developers confused about why their upgrades are getting blocked JScrambler compromise — A threat actor gained access to a publishing credential and pushed five malicious versions of the jscrambler package. The malware evolved quickly, with the first three versions containing the trigger in a pre-install script to the last two on-import execution partway through. They also published four versions of related packages that pinned to malicious v8.18.0. AsyncAPI compromised — Attackers exploited a GitHub Actions pull_request_target flaw that sat unresolved for 58 days to steal a privileged token. They published malicious npm packages under the @asyncapi namespace, all with components of the Miasma malware that was open-sourced earlier this year (but no worm). New PolinRider research — Paul's latest hunt found 2,417 newly-compromised repositories, confirming config file injection as the dominant delivery vector alongside a growing fake font technique, still overwhelmingly hitting individual developers rather than organizations. Episode Resources (talk) BSides Adelaide 2026 Schedule (docs) Dependabot cooldown (blog) Security Advisory: Unauthorized Publication of a Malicious npm Package (feed) OpenSourceMalware threat reports for Jscrambler (blog) M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions (feed) OpenSourceMalware threat reports for AsyncAPI (blog) PolinRider Confirmed Footprint Grows 6.5x Since March

  ListenShow Notes

Recent guests on The OpenSourceMalware Show. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.