Skip to content

Back to the catalog

Open Source Malware Podcast — episodes
podcast.opensourcemalware.comother

Open Source Malware Podcast — episodes

The OpenSourceMalware Show is a weekly podcast hosted by Jenn Gile and Paul McCarty (co-founders of OpenSourceMalware) covering software supply-chain attacks, malicious npm/PyPI/RubyGems/Rust packages, and DPRK/Lazarus-linked campaigns. Episodes track specific incidents like the Miasma npm worm hitting Microsoft and Red Hat, the Mastra npm organization takeover, RubyGems bot attacks, Hugging Face and OpenAI-related breaches, and ongoing PolinRider/DPRK repo-hijacking research, drawing on OpenSourceMalware's threat intel database of ~200,000 verified threats.

TL;DR Weekly podcast from OpenSourceMalware's founders dissecting current open-source supply-chain attacks, npm worms, and DPRK-linked package compromises.
Open original ↗

Organisations named here

  • ClickFix
  • Shai-Hulud

Technologies named here

  • Dependabot
  • FBI jobs website
  • npm Staged Publishing
  • RubyGems
  • OSV
  • PyPI
  • AWS Inspector
  • npm packages Keyv and cacheable
  • Rust arrayref crate
  • CrowdStrike
  • Hugging Face infrastructure
  • OWASP cheat sheet
  • GitHub repositories
  • Red Hat @redhat-cloud-services npm packages
  • Mastra npm organization
  • Bitwarden CLI
  • VS Code
  • Open VSX
  • AsynchAPI
  • jscrambler
  • Canvas
  • Antrea
  • cPanel
  • chald/debug package
  • npm
  • OSV.dev
  • Rust
  • Cargo
  • GitHub
  • Hugging Face
  • OpenAI
  • mastra
  • arrayref
  • cacheable
  • keyv
  • debug

Techniques named here

  • PeopleSoft zero-day exploitation
  • Prompt Injection
  • Typosquatting
  • Slopsquatting
  • Version sandwiching
  • Git hook persistence
  • npm lifecycle scripts
  • 2FA-bypass tokens
  • ClickFix-style attack
  • Dirty Frag
  • Interpreted language malware
  • Persistence mechanisms defeating remediation

Threat actors named here

  • ShinyHunters
  • Cl0p
  • WeaselBiscuit
  • Contagious Interview
  • OpenAI agent swarm
  • GemStuffer campaign
  • Mini Shai-Hulud
  • TeamPCP / Team PCP
  • PolinRider
  • DPRK / Lazarus Group
  • NullRider
  • WEL1DROPPER
  • Miasma worm
  • Moika campaign
  • GlassWorm
  • AgentBaiting
  • CrashStealer
  • TeamPCP
  • DPRK
  • Lazarus Group

Related in Supply Chain