opensourcemalware.comtalkThe OpenSourceMalware Show #17
Episode 17 of The OpenSourceMalware Show covers GitHub's move to revoke npm granular access tokens that could bypass 2FA, and follows up on the DPRK NullReceiver obfuscation technique (now found in well over the 7 originally confirmed packages, overlapping with the PolinRider campaign). The hosts also discuss why malicious AI 'skills' are hard to detect via static analysis due to their natural-language format, note DPRK's use of crypto payments (e.g. via Astrill VPN, hosting provider Evoxt) as a potential tracking vector for defenders, and touch on MCP server risk being more about vulnerabilities than outright malware.
TL;DR OSM podcast recap: GitHub kills npm 2FA-bypass tokens, DPRK's NullReceiver/PolinRider campaign keeps growing and is trackable via crypto-funded infrastructure, and malicious AI skills remain hard to statically detect.
Organisations named here
- EtherHiding
- NCSC
- NullReceiver
Technologies named here
- npm
- GitHub
- IDA
- AI coding assistants / models
- Binary Ninja
- AI skills
- Shodan
- VirusTotal
- Astrill VPN
- Evoxt
- OSM threat feed / internal analysis engine
- Model Context Protocol
Techniques named here
- npm bypass-2FA granular access tokens
- NullReceiver
- EtherHiding
- Skill/dependency confusion via local hierarchy
- Malicious AI skill detection difficulty
- Crypto payments for infrastructure
Threat actors named here
- DPRK / North Korea threat actors
- NullReceiver
- PolinRider
- EtherHiding
- WEL1DROPPER
- Keyv and cacheable npm worm
- Kelki
- DPRK
- Contagious Interview
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup