Skip to content

Back to the catalog

The OpenSourceMalware Show #12
opensourcemalware.comtalk

The OpenSourceMalware Show #12

Episode 12 of the OpenSourceMalware Show covers three security stories and features an extended interview with Mikael Barbero, Head of Security at the Eclipse Foundation, about securing Open VSX. The interview details Open VSX's pre-publish YARA/AI-assisted malware scanning pipeline, quarantine-and-human-review workflow, token expiration and revocation overhaul, namespace/publisher verification, and detection of 'sleeper' extensions that turn malicious after an update (as seen with GlassWorm-style campaigns). The quick-hits segment covers Paul McCarty's PolinRider research showing a DPRK automated repo-hijacking campaign spreading into Go and PHP ecosystems via Packagist/Go registry packaging of GitHub repos, a cybersecurity startup caught publishing seven infostealer npm packages to manufacture its own threat data, and MeetingTV's lawsuit against Palo Alto Networks/Koi Security alleging an AI-hallucinated domain on a C2 IOC list caused real business harm.

TL;DR Podcast interview with Open VSX's Head of Security on its malware-scanning pipeline, plus DPRK's PolinRider campaign spreading to Go/PHP registries, a vendor caught seeding npm with infostealers, and a lawsuit over an AI-hallucinated IOC.
Open original ↗

Organisations named here

  • Eclipse Foundation
  • MeetingTV
  • Mikael Barbero
  • Palo Alto Networks

Technologies named here

  • Open VSX pre-publish security scanning pipeline
  • Open VSX
  • YARA
  • npm
  • AI-assisted malware detection
  • Packagist
  • Go registry
  • Open VSX Security Researcher Recognition Program
  • GitHub
  • Open VSX Managed Registry
  • MeetingTV domain
  • OpenSourceMalware Threat Reports for Open VSX
  • VS Code extensions / task.json
  • Go
  • PHP
  • VS Code
  • Nx Console
  • Project Glasswing
  • Koi Security

Techniques named here

  • Automated repo-hijacking / malicious package propagation
  • Manufacturing threat data for marketing
  • Selective data exfiltration to build identity graphs
  • AI hallucination in threat intel analysis
  • IOC propagation / block-list supply chain
  • Sleeper malicious extensions
  • Typosquatting / brandjacking / namespace squatting
  • Obfuscation tricks
  • Bot-inflated download counts
  • Credential/token leakage via published extensions
  • Malware delivery via task.json in VS Code extensions

Threat actors named here

  • PolinRider
  • GlassWorm
  • TeamPCP
  • Contagious Interview
  • Unnamed cybersecurity startup
  • Lazarus Group
  • DPRK

Related in Threat Intel