Skip to content

Back to the catalog

OpenSourceMalware Blog
opensourcemalware.comarticle

OpenSourceMalware Blog

OpenSourceMalware's blog is an active threat-intelligence feed tracking malicious open-source packages across npm, PyPI, RubyGems, and other registries, publishing frequent posts with IOCs, campaign attribution, and remediation guidance. Recent coverage spans DPRK-linked actors (Lazarus Group, TeamPCP, PolinRider) using techniques like VS Code tasks.json abuse, npm worms (Mini Shai-Hulud, Miasma), trusted-publishing abuse, and cross-ecosystem typosquatting to compromise maintainer accounts and steal credentials.

TL;DR A prolific threat-intel blog cataloging npm/PyPI supply-chain attacks, DPRK malware campaigns, and self-spreading package worms with IOCs.
Open original ↗

Organisations named here

  • ClawHub
  • NullReceiver
  • Shai-Hulud

Technologies named here

  • fa-solid-400.woff2
  • Dependabot
  • npm ecosystem
  • OSV
  • PyPI
  • npm
  • VirusTotal
  • RubyGems
  • CrowdStrike
  • GitHub
  • VS Code
  • Package firewalls
  • axios
  • LiteLLM
  • Trivy
  • aquasec-com GitHub organization
  • Neutralinojs
  • Antrea
  • Bitwarden
  • chalk/debug
  • @velora-dex/sdk
  • Keyv and cacheable
  • mastra
  • AntV suite
  • Open VSX
  • Hugging Face
  • jscrambler
  • AsynchAPI
  • Canvas
  • cPanel
  • Mobile SDK installs
  • Ethereum
  • AntV
  • cacheable
  • keyv

Techniques named here

  • NullReceiver DPRK C2 technique
  • Version sandwiching
  • Blockchain C2 reuse
  • Cross-ecosystem attacks
  • Dynamic imports
  • Payload splitting
  • Git hook persistence
  • npm lifecycle script weaponization
  • VS Code tasks.json weaponization
  • Trusted publishing abuse
  • Typosquatting / slopsquatting
  • Account takeover via social engineering
  • Force-pushed backdated malicious commits
  • Transitive dependency compromise
  • Agentjacking
  • Fake recruiter social engineering
  • Malicious pull request

Threat actors named here

  • PolinRider
  • ShinyHunters
  • WeaselBiscuit
  • StubMaker
  • WEL1DROPPER
  • NUL1DROPPER
  • DPRK
  • Mini Shai-Hulud
  • TeamPCP
  • AgentBaiting
  • Miasma
  • Moika
  • GlassWorm
  • Lazarus Group
  • ClawHub
  • ClawdBot
  • Contagious Interview
  • TaskJacker
  • InvisibleFerret
  • BeaverTail / Beavertail
  • PureHVNC
  • BeaverTail
  • TasksJacker

Related in Supply Chain