OM DENNE PODCAST 🔗
When you think about malware, you probably envision phishing emails or sketchy websites. But malicious open source - targeting software developers and their build systems - is becoming a top way that threat actors deliver malware. Just one 'npm install' can trigger payloads that steal information and credentials. Software supply chain attacks by state actors, ransomware groups, and freelancers are happening every day.
Hosted by Jenn Gile and Paul McCarty (co-founders of OpenSourceMalware), this podcast explores the latest trends and attacks, and helps defenders understand the tactics needed to prevent their orgs from being the next target.
OpenSourceMalware provides community-driven threat intelligence on malicious open source assets including packages, domains, IP addresses, crypto wallets, and more.
https://opensourcemalware.com/
Opdateringsfrekvens:
weekly
Gennemsnitlig lydlængde:
35 minutes
Engelsk
USA
24 episoder
siden 27. april 2026
episodic
I DENNE PODCAST 🔗
SENESTE EPISODE 🔗
This week we talked about:
Tensorlake SDK compromise: The npm SDK for Tensorlake, a tool for building and operating AI agents, was compromised with two malicious files. A setup.mjs file fires through a preinstall hook and launches the payload with Bun, and math_symbol.js carries a credential stea…
SØG BLANDT TIDLIGERE EPISODER
Søg efter gamle afsnit af The OpenSourceMalware Show.
SIDSTE EPISODER 🔗
This week we talked about:
ShinyHunters and KillSec arrests: Dutch police arrested Pepijn van der Stap, a long-time ShinyHunters member known as Umbreon, on September 16, less than a year after he finished a prison sentence for earlier hacking. His arrest followed a power struggle with the group&…
This week we discussed:
ShinyHunters vs. the FBI and Cl0p: ShinyHunters claims it stole data from an FBI jobs website through a PeopleSoft zero-day, and it is threatening to leak that data unless the FBI retracts a May FLASH tied to the Instructure Canvas breach. We cover why aging enterprise mon…
This week we talked about:
New research alleges OpenAI agents were behind the RubyGems attack. A report from independent researchers argues an OpenAI agent swarm is responsible for the GemStuffer campaign, which uploaded hundreds of spammy packages to RubyGems in May. Truffle Security's Luke…
Jenn and Paul also mark OpenSourceMalware's first anniversary, now tracking close to 200,000 verified threats and over 100,000 IOCs. We also discuss:
Mini Shai-Hulud payload resurfaces on npm. A payload from May's Mini Shai-Hulud campaign against AntV reappeared in four packages publishe…
This week we talked about:
TeamPCP arrests — Australian Federal Police and the FBI arrested Ruben Thomson (21) and Louis Gaebler (23) in Perth on TeamPCP-related charges. The arrests align with the OpenSourceMalware team's longstanding assessment that TeamPCP was a very small operation, eff…
This week we talked about:
Rust arrayref compromise tied to DPRK infrastructure: A compromised maintainer account published malicious versions of the arrayref crate, along with internment and append-only-vec, adding a typosquatted build dependency that downloaded and executed a remote binary at co…
This week we talked about:
Hacker Summer Camp trends. Jenn and Paul share observations from Black Hat, DEF CON, and BSides Las Vegas last week, including a maturing AI security conversation that has shifted to focus on where AI still falls short, particularly the last mile of precision and finess…
This week we talked about:
New npm worm hits Keyv and cacheable. Jared Wray's GitHub account was compromised on Tuesday, and threat actors used it to publish a worm based on the open-sourced Mini Shai-Hulud malware. The worm spread to over 400 packages, with ServiceTitan alone losing 100 pack…
This week we discussed:
Update from Hugging Face: Hugging Face published a technical timeline of the OpenAI evaluation agent that breached its production infrastructure between July 9 and July 13, reconstructing over 17,000 attacker actions across the five day window. OpenAI's own follow-up di…
Ansvarsfraskrivelse: Podcasten og kunstværket, der er indlejret på denne side, er fra OpenSourceMalware, som tilhører dens ejer og ikke er tilknyttet eller godkendt af Listen Notes, Inc.
PODCAST SØGEMOTOR
Du kan bruge vores hjemmeside til at søge efter3,823,510podcasts og195,640,596episoder efter personer, steder eller emner.
If I have seen further than others, it is by listening to podcasts and standing upon the shoulders of
giants.
‐ Isaac "Llamacorn" Newton
SØG BLANDT TIDLIGERE EPISODER
Søg efter gamle afsnit af The OpenSourceMalware Show.
GØR KRAV PÅ DENNE PODCAST
Why to claim podcasts?
If you are a podcaster, the best way to manage your podcasts on Listen Notes is by claiming your Listen Notes
podcast pages.
It is a great, free way to engage the podcast community and increase the visibility of your podcasts.
After claiming your Listen Notes podcast pages, you will be able to:
✓
Manually refresh the RSS feed to sync up
✓
Get a verified badge (
✓
) alongside with your podcast name on Listen Notes
✓
Post rubrikannoncer for sponsorship,
guests, co-hosts,
cross-promotion...
✓
Respond to listener comments on Listen Notes
✓
Use speech-to-text techniques to transcribe your show and
edit transcripts
✓
Improve the presence of your podcasts, e.g., self-service
podcasterinterview...
✓
If you share your Listen Notes page and at-mention @ListenNotes
on X (formerly Twitter),
vores officielle X-konto (tidligere Twitter) will retweet to promote
your show to our followers.
Coming soon:
◯ Self-service promotion on Listen Notes
◯ Track your podcast stats on Listen
Notes, e.g., listens, page
views...
◯ Manage episodes
REDIG
Tak fordi du hjælper med at holde podcast-databasen opdateret.
