The OpenSourceMalware Show #27

What it is

A 28 October 2026 episode of The OpenSourceMalware Show, hosted by Jenn Gile and Paul McCarty (the founders of OpenSourceMalware). The episode centres on CVE-2026-111497, a bug in the decoder of Google's Brotli C library. The bug was first publicised as "Node2Shell" (named by Imperva and another party), which McCarty says wrongly implies it affects only Node. The episode also covers the LiteLLM v1.107.0 postmortem and the MALFEX npm campaign.

Preconditions / Affected

Brotli's C source is usually copied directly into a project rather than declared as a dependency. McCarty says he found it in Rust, PHP and Python, and that Node 20, 22 and 24 bundled it. Package manifests and SCA tools will not list these copies. He made 15 to 20 disclosures, to Microsoft, ClickHouse, Rust, Python, Cloudflare and Bazel among others. He says some bug bounty triagers closed his reports as if he were a bounty researcher, and that Bazel took no action.

What to do

McCarty's Brotli check, as described on air (the full steps are in the OpenSourceMalware blog post, which he says he will extend):

1. Search code, and container images, for decode.c and decode.h.
2. Check whether the file contains the string that marks the fixed copy.
3. A decode.c without that string is likely an older, vulnerable Brotli decoder.
4. Upgrade directly to the patched Brotli where you can. Products that vendor it may still be waiting on their own patches.

He expects a long tail of findings, comparable to Log4j, and says he found tens of thousands of copies on GitHub. The episode does not give the exact string.

For file-based malware, do not filter by extension. McCarty says some people exclude image files from malware downloads to save space, and that this would miss the MALFEX payload. Jenn Gile advises looking at signals in the payload content rather than the file type. McCarty notes that public detections keyed on *.woff2 are visible to attackers, who can simply switch extensions.

How it works

LiteLLM v1.107.0. An admin key for an internal deployment was committed to a public repo in May 2026. The file was deleted, but the commit stayed in public history until 22 October, and the key was never revoked, which the team called human error. On 10 October an attacker used it to take control of the deployment. McCarty read a passage from The Hacker News: a release control had been relaxed that week, for more frequent releases and bug-fix backports, so that any two engineers could trigger and approve a release. The attacker used one token to trigger a release after re-pointing the deployer at a malicious repo, and another to approve it. The hosts say this is unrelated to the March compromise, which came through the TeamPCP/Trivy chain. Their advice is general: threat model any speed-for-security trade, use finer-grained scopes and shorter token lifetimes, and make sure each person holding approval rights understands the responsibility.

MALFEX. The campaign has run since 2023 and is assessed as likely a lone actor, possibly a Portuguese speaker. The payload is Overlord, a Go RAT for Windows that reads its C2 address from Solana transactions. It targets Discord, browsers, Telegram and crypto wallets, and includes a downloader. The packages have three files, including a lowercase readme.md, and no install script. The payload runs on import, through a roughly 10-line main entry point from package.json. It fetches and extracts a blob from a file that has a valid PNG header but is not an image. McCarty cites cdn-img-fetch, about 1,000 downloads, as an example. A security vendor found a malicious AGENTS.md in a developer's Downloads folder, written to make an AI coding agent run unauthorised steps and, per the episode, install a MALFEX package.

DPRK. Jenn Gile documented new variants hiding JavaScript in TTF and OTF font files. They are often force-pushed over existing infections that still contain WOFF and WOFF2 files.

Caveats

• McCarty says the PHP2Shell hype outran real exploitation, though in-the-wild exploitation has since started.
• The hosts say they lack the full LiteLLM chronology and give only general advice.
• McCarty says MALFEX payload contents are changing quickly and he has not tracked every change.