opensourcemalware.comtalkThe OpenSourceMalware Show #24
Weekly OpenSourceMalware podcast episode discussing three fresh supply-chain attacks: the Tensorlake AI-agent SDK compromised via a preinstall-triggered Mini Shai-Hulud-derived worm (setup.mjs + math_symbol.js, run via Bun) that steals credentials; a Contagious Interview-style attack where a cloned GitHub repo drops a malicious .npmrc pointing npm install at a Chinese mirror (npmmirror.com) to resolve a hidden package; and 42 malicious RubyGems published by "Ghost Dev" that typosquat/brandjack crypto tooling, sleep 20–40 minutes via extconf.rb to evade detection, then either open a reverse shell or deploy a Python-based "Wallet Guard" crypto-theft kit targeting TronLink, MetaMask, Phantom, Binance, Coinbase, Trust Wallet, Exodus, and Electrum. The hosts also discuss multi-package "combined payload" evasion and how AI-driven slopsquatting is making cross-ecosystem typosquats more effective.
Organisations named here
- npmmirror.com
- slopsquatting
- Wallet Guard
Technologies named here
- Tensorlake SDK
- OpenSourceMalware automated detection
- keyv
- npm/GitHub registry scanning
- cachable
- Aikido
- 42 malicious RubyGems gems
- Software supply chain firewall scanners
- YARA
- npm
- RubyGems
- Bun
- Ruby
- Python
- cacheable
- Bitget
- TronLink
- MetaMask
- Phantom
- Binance
- Coinbase
- Trust Wallet
- Exodus
- Electrum
Techniques named here
- Preinstall hook payload execution
- Credential stealing and self-propagation
- Rogue .npmrc registry redirection
- Multi-package combined/split payload
- Native extension build script with delayed execution
- Reverse shell
- Fake security tool / trojanized utility
- Clipboard hijacking
- Wallet and secret harvesting
- Cross-language staged payloads
- Typosquatting and brandjacking
- Slopsquatting
Threat actors named here
- Mini Shai-Hulud
- Ghost Dev
- Contagious Interview
- DPRK
- GemStuffer
Related in Supply Chain
