🧰 OpenSourceMalware

The items that name it 17

• Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace
  articleas tools2026-10-30

  Published the initial analysis, written by Paul McCarty, of the unpacked macOS extension. The article has since been substantially revised.

• Earliest Known PolinRider Malware Found in 2025 npm Packages
  writeupas tools2026-10-30

  Source of the PolinRider documentation and indicator lists that this sample was compared against

• Brotlipocalypse
  writeupas classification.key entities2026-10-24
• Python packages are also vulnerable to the Node2Shell Brotli flaw (CVE-2026-111497)
  advisoryas classification.key entities2026-10-23
• LiteLLM 1.107.0 PyPI Wheel Contains a Credential Stealer and Persistent Python Backdoor
  writeupas tools2026-10-21It is written here as OpenSourceMalware: analyzed the wheel, decoded the payloads without executing them and verified all 3,946 hashed RECORD entries.
• The OpenSourceMalware Show #26
  talkas tools2026-10-21It is written here as OpenSourceMalware (OSM): malicious open source package detection and threat intel, with forward hunting automation that found webrunc.

  OSM

• Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI
  articleas classification.key entities2026-10-21
• GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
  writeupas tools2026-10-16It is written here as OpenSourceMalware (malware tracking community platform; #ghostaction tag; submissions by Thijs Xhaflaire).

  malware tracking community platform; #ghostaction tag; submissions by Thijs Xhaflaire

• The OpenSourceMalware Show #25
  talkas tools2026-10-15It is written here as OpenSourceMalware (published GhostAction research and blog posts).

  published GhostAction research and blog posts

• The OpenSourceMalware Show #15
  talkas tools2026-07-31It is written here as OpenSourceMalware (OSM).

  The hosts' own platform/research group tracking npm/Go supply chain malware, referenced as having had DPRK-related IOC data before Amazon's report.

• NPM Implements Pre-Publication Malware Scanning, But Will It Work?
  articleas tools2026-07-31

  Publishes tooling and documents incidents involving malicious packages published to npm; the outlet publishing this analysis

• ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
  writeupas tools2026-07-17

  Security research group/dataset that tracks and attributes malicious open-source packages; publisher of this blog and multiple PolinRider/TasksJacker reports; maintains a public PolinRider dossier

• The OpenSourceMalware Show #10
  talkas tools2026-06-25It is written here as OpenSourceMalware (OSM).

  The hosts' own platform/dataset tracking malicious open source packages, blockchain addresses/wallets used as C2, and campaign identifiers for pivoting and threat hunting; used to add new NPM (and expanding to PyPI, VS Code) malicious package data daily.

• The OpenSourceMalware Show #7
  talkas tools2026-06-03It is written here as OpenSourceMalware (OSM).

  Threat intelligence database/platform tracking malicious open source packages; source of the six-month (Jan to mid-May 2026) data trends discussed in the episode

• The Software Supply Chain Malware Landscape: January - May 2026
  articleas tools2026-06-03

  Threat intelligence database tracking malicious packages across 16 ecosystems; adds a median of 1000 threat reports per week and contains more than 166,000 threats as of publication; also tracks package downloads as a proxy for attack vector.

• VSCode Lifecycle Script Malware
  writeupas tools2026-05-16

  Organization/blog tracking malware campaigns abusing npm lifecycle scripts and VS Code tasks

• Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
  articleas tools

  Research group/platform (researcher Paul McCarty, co-founder Jenn Gile) tracking and reporting on the malicious npm package campaign