The OpenSourceMalware Show #26

What it is

Episode 26 of the OpenSourceMalware Show (recorded 21 October 2026, hosts Jenn Gile and Paul McCarty) covers three supply chain findings. The clearest advice is for repos hit by GhostAction, because deleting the malicious workflows does not clean them. The episode is a transcript of a conversation. The linked blogs and the webrunc report hold the technical detail.

How it works

GhostAction reinfection. Jenn Gile's git forensics on the affected repos found this sequence:

1. A malicious GhostAction workflow compromises the repo.
2. The actor uses that foothold to push a PolinRider-style payload for persistence and onward infection.
3. The payload survives removal of the workflows.

Thijs from Jamf found about 94 repos while hunting for PolinRider indicators. Each had a VS Code tasks file that auto-runs a fake font file. The payload was plain, unobfuscated JavaScript, not PolinRider's obfuscated code, and it contacted an IP address GhostAction had used before. Opening the repo in VS Code runs the stealer. It reads AWS, PyPI, npm, Git, Claude login, Gemini login and Kubernetes credentials plus SSH private keys, and greps the home directory for matches. It also installs a cron job that checks in with the attacker, which Jenn Gile put at roughly every five minutes.

Compared with PolinRider, the payload sits at the same path as the original PolinRider .woff2 400 file. In some variants the other fake font files are .tif instead of .woff2. Paul McCarty has seen at least three variants, most often a single .woff2 file.

OVH CLI. GlassWorm pushed malicious code to four OVH CLI GitHub repos on 5 March 2026, using a long-held contributor account. Four versions were compromised. The builds came from the contributor's laptop, not OVH's CI pipeline, and a user noticed a new version behaving oddly. Paul McCarty says that after OVH's CEO announced incident response was done, the contributor's account was still compromised and the pre-installs were still present. Version numbers are not given.

Compound payloads. Actors shard malware across three or four packages, sometimes more, so that no single package reaches a scanner's combined-signal threshold. The example given is a package that only loads .env, which looks like normal CLI behaviour. An umbrella package ties the pieces together. If one is taken down, the actor swaps it out. The PyPI package webrunc has a fetch-and-execute pattern but no secondary payload or exfil destination. It appears meant to run alongside other packages.

DPRK's Contagious Interview variant sends the target an invite to a private repo. That repo's .npmrc points at a different registry. The package.json names a package that is absent from the public registry, so it fails for anyone else but resolves on the target's npm install.

What to do

• Check repos that ever carried GhostAction workflows for a .vscode tasks file that runs a font file, and for a new public fonts folder. Jenn Gile says most affected repos had no prior fonts folder.
• Check developer machines that opened those repos for the cron check-in, and rotate the credential types listed above.
• Alert when a package version is published from outside the normal CI pipeline.
• Sign commits. Paul McCarty says it precludes a lot of malicious behaviour, but he is not certain GitHub can enforce it on public repos.
• Audit the actions and containers your CI calls, especially workflows copied years ago. Paul McCarty names old pwn-request-prone action versions as the risk.

Caveats

• The page gives no indicator values (IP, file names beyond the font path) or commands. Those are in the linked blogs.
• Paul McCarty says the GhostAction stealer is only partly working, about 60% by his estimate. Jenn Gile and Paul McCarty both say it is still dangerous.
• Jenn Gile attributes the code to an inexperienced actor using an LLM. This is their reading, not a confirmed finding.
• The seven-month dwell time is inferred from the 5 March push date. Paul McCarty says the date the credentials were stolen is unknown.