The OpenSourceMalware Show #22

What it is

Episode 22's developer Q&A (the back third of the transcript) carries the actionable substance the summary only names. The hosts answer why standard developer controls fail against DPRK's PolinRider / Contagious Interview / VS Code tasks-autorun campaigns, and give the one mitigation they actually endorse.

How the controls fail

• Signed commits don't help. DPRK already has persistence on the developer's workstation. When you commit legitimately, the attacker's staged code "rides the successful commit in" — the signature covers their payload too because it's your machine signing.
• Fake git history. DPRK force-pushes to fabricate commit history. Commit hashes would reveal tampering, but only if you record and compare them — which nobody does as part of normal process, so the check is theoretical.
• Antivirus/EDR miss it by design. The malicious artifacts are tasks.json autorun entries, config files with obfuscated JS, and git hooks — normal development files with bad content, not binaries. There's no signature or behavioral signal because it "weaponizes the normal way people write code." Kaspersky hashes individual JavaScript payload files (and sometimes flags in VirusTotal where CrowdStrike/SentinelOne don't), but the hosts call this ineffective.
• Vim over VS Code only avoids the tasks-autorun vector specifically. Git hooks affect every editor, so switching IDEs doesn't protect you.

What to do

The single mitigation Paul says he personally uses: an SSH key wrapped with a passphrase. This forces a password prompt on every push, which is the only way to guarantee that code running on your machine (i.e. the attacker's implant) cannot push commits as you. He accepts the per-commit latency deliberately; signed commits without this give false assurance.

On attribution (why "North Korea")

For fast-moving JS supply-chain malware, attribution is pattern-matching, not indicator-matching. Most DPRK payloads share no URL/IP with known-attributed indicators because DPRK generates "hundreds a day" and no vendor attributes them all. Instead, researchers deconstruct the full payload and match its structure, format, and delivered components (OtterCookie, etc.) to previously attributed families. Some early PolinRider and TasksJacker samples did reuse classic Contagious Interview URLs/IPs, which anchored the chain. The hosts are explicit that this "is not a science."

Caveats

WeaselBiscuit attribution is stated as Paul's "90% certain," with supporting reasons "we can't talk about" — firmer than tentative but his own hedge, not corroborated. The controls critique is argument, not measured data; the "76% of developers use VS Code" figure is cited loosely without source.