על אודות פודקאסט זה 🔗
When you think about malware, you probably envision phishing emails or sketchy websites. But malicious open source - targeting software developers and their build systems - is becoming a top way that threat actors deliver malware. Just one 'npm install' can trigger payloads that steal information and credentials. Software supply chain attacks by state actors, ransomware groups, and freelancers are happening every day.
Hosted by Jenn Gile and Paul McCarty (co-founders of OpenSourceMalware), this podcast explores the latest trends and attacks, and helps defenders understand the tactics needed to prevent their orgs from being the next target.
OpenSourceMalware provides community-driven threat intelligence on malicious open source assets including packages, domains, IP addresses, crypto wallets, and more.
https://opensourcemalware.com/
תדירות עדכון:
weekly
אורך אודיו ממוצע:
35 minutes
אנגלית
ארצות הברית
24 פרקים
מאז 27 באפריל 2026
episodic
הפרק החדש ביותר 🔗
This week we talked about:
Tensorlake SDK compromise: The npm SDK for Tensorlake, a tool for building and operating AI agents, was compromised with two malicious files. A setup.mjs file fires through a preinstall hook and launches the payload with Bun, and math_symbol.js carries a credential ste…
פרקים קודמים 🔗
This week we talked about:
ShinyHunters and KillSec arrests: Dutch police arrested Pepijn van der Stap, a long-time ShinyHunters member known as Umbreon, on September 16, less than a year after he finished a prison sentence for earlier hacking. His arrest followed a power struggle with the group…
This week we discussed:
ShinyHunters vs. the FBI and Cl0p: ShinyHunters claims it stole data from an FBI jobs website through a PeopleSoft zero-day, and it is threatening to leak that data unless the FBI retracts a May FLASH tied to the Instructure Canvas breach. We cover why aging enterprise mo…
This week we talked about:
New research alleges OpenAI agents were behind the RubyGems attack. A report from independent researchers argues an OpenAI agent swarm is responsible for the GemStuffer campaign, which uploaded hundreds of spammy packages to RubyGems in May. Truffle Security's Luk…
Jenn and Paul also mark OpenSourceMalware's first anniversary, now tracking close to 200,000 verified threats and over 100,000 IOCs. We also discuss:
Mini Shai-Hulud payload resurfaces on npm. A payload from May's Mini Shai-Hulud campaign against AntV reappeared in four packages publish…
This week we talked about:
TeamPCP arrests — Australian Federal Police and the FBI arrested Ruben Thomson (21) and Louis Gaebler (23) in Perth on TeamPCP-related charges. The arrests align with the OpenSourceMalware team's longstanding assessment that TeamPCP was a very small operation, ef…
This week we talked about:
Rust arrayref compromise tied to DPRK infrastructure: A compromised maintainer account published malicious versions of the arrayref crate, along with internment and append-only-vec, adding a typosquatted build dependency that downloaded and executed a remote binary at c…
This week we talked about:
Hacker Summer Camp trends. Jenn and Paul share observations from Black Hat, DEF CON, and BSides Las Vegas last week, including a maturing AI security conversation that has shifted to focus on where AI still falls short, particularly the last mile of precision and fines…
This week we talked about:
New npm worm hits Keyv and cacheable. Jared Wray's GitHub account was compromised on Tuesday, and threat actors used it to publish a worm based on the open-sourced Mini Shai-Hulud malware. The worm spread to over 400 packages, with ServiceTitan alone losing 100 pac…
This week we discussed:
Update from Hugging Face: Hugging Face published a technical timeline of the OpenAI evaluation agent that breached its production infrastructure between July 9 and July 13, reconstructing over 17,000 attacker actions across the five day window. OpenAI's own follow-up d…
הצהרה: הפודקאסט והגרפיקה המוטבעים בדף זה הם מ-OpenSourceMalware, שהוא רכושו של בעליו ואינו קשור או מאושר על ידי Listen Notes, Inc.
מנוע חיפוש PODCAST
אתה יכול להשתמש באתר שלנו כדי לחפש3,823,510פודקאסטים ופודקאסטים195,640,596לפי אנשים, מקומות או נושאים.
השקעה בידע מניבה את התשואה הטובה ביותר, ולכן אני מאזין לפודקאסטים.
‐ Benjamin "Llamacorn" Franklin
בקש/י פודקאסט זה
Why to claim podcasts?
If you are a podcaster, the best way to manage your podcasts on Listen Notes is by claiming your Listen Notes
podcast pages.
It is a great, free way to engage the podcast community and increase the visibility of your podcasts.
After claiming your Listen Notes podcast pages, you will be able to:
✓
Manually refresh the RSS feed to sync up
✓
Get a verified badge (
✓
) alongside with your podcast name on Listen Notes
✓
Post מודעות מסווגות for sponsorship,
guests, co-hosts,
cross-promotion...
✓
Respond to listener comments on Listen Notes
✓
Use speech-to-text techniques to transcribe your show and
edit transcripts
✓
Improve the presence of your podcasts, e.g., self-service
ריאיון עם פודקאסטר...
✓
If you share your Listen Notes page and at-mention @ListenNotes
on X (formerly Twitter),
חשבון ה־X הרשמי שלנו (לשעבר Twitter) will retweet to promote
your show to our followers.
Coming soon:
◯ Self-service promotion on Listen Notes
◯ Track your podcast stats on Listen
Notes, e.g., listens, page
views...
◯ Manage episodes
