이 팟캐스트 소개 🔗
When you think about malware, you probably envision phishing emails or sketchy websites. But malicious open source - targeting software developers and their build systems - is becoming a top way that threat actors deliver malware. Just one 'npm install' can trigger payloads that steal information and credentials. Software supply chain attacks by state actors, ransomware groups, and freelancers are happening every day.
Hosted by Jenn Gile and Paul McCarty (co-founders of OpenSourceMalware), this podcast explores the latest trends and attacks, and helps defenders understand the tactics needed to prevent their orgs from being the next target.
OpenSourceMalware provides community-driven threat intelligence on malicious open source assets including packages, domains, IP addresses, crypto wallets, and more.
https://opensourcemalware.com/
업데이트 빈도:
weekly
평균 오디오 길이:
35 minutes
영어
미국
에피소드 24 개
2026년 4월 27일부터
episodic
최신 에피소드 🔗
This week we talked about:
Tensorlake SDK compromise: The npm SDK for Tensorlake, a tool for building and operating AI agents, was compromised with two malicious files. A setup.mjs file fires through a preinstall hook and launches the payload with Bun, and math_symbol.js carries a credential stea…
이전 에피소드 🔗
This week we talked about:
ShinyHunters and KillSec arrests: Dutch police arrested Pepijn van der Stap, a long-time ShinyHunters member known as Umbreon, on September 16, less than a year after he finished a prison sentence for earlier hacking. His arrest followed a power struggle with the group&…
This week we discussed:
ShinyHunters vs. the FBI and Cl0p: ShinyHunters claims it stole data from an FBI jobs website through a PeopleSoft zero-day, and it is threatening to leak that data unless the FBI retracts a May FLASH tied to the Instructure Canvas breach. We cover why aging enterprise mon…
This week we talked about:
New research alleges OpenAI agents were behind the RubyGems attack. A report from independent researchers argues an OpenAI agent swarm is responsible for the GemStuffer campaign, which uploaded hundreds of spammy packages to RubyGems in May. Truffle Security's Luke…
Jenn and Paul also mark OpenSourceMalware's first anniversary, now tracking close to 200,000 verified threats and over 100,000 IOCs. We also discuss:
Mini Shai-Hulud payload resurfaces on npm. A payload from May's Mini Shai-Hulud campaign against AntV reappeared in four packages publishe…
This week we talked about:
TeamPCP arrests — Australian Federal Police and the FBI arrested Ruben Thomson (21) and Louis Gaebler (23) in Perth on TeamPCP-related charges. The arrests align with the OpenSourceMalware team's longstanding assessment that TeamPCP was a very small operation, eff…
This week we talked about:
Rust arrayref compromise tied to DPRK infrastructure: A compromised maintainer account published malicious versions of the arrayref crate, along with internment and append-only-vec, adding a typosquatted build dependency that downloaded and executed a remote binary at co…
This week we talked about:
Hacker Summer Camp trends. Jenn and Paul share observations from Black Hat, DEF CON, and BSides Las Vegas last week, including a maturing AI security conversation that has shifted to focus on where AI still falls short, particularly the last mile of precision and finess…
This week we talked about:
New npm worm hits Keyv and cacheable. Jared Wray's GitHub account was compromised on Tuesday, and threat actors used it to publish a worm based on the open-sourced Mini Shai-Hulud malware. The worm spread to over 400 packages, with ServiceTitan alone losing 100 pack…
This week we discussed:
Update from Hugging Face: Hugging Face published a technical timeline of the OpenAI evaluation agent that breached its production infrastructure between July 9 and July 13, reconstructing over 17,000 attacker actions across the five day window. OpenAI's own follow-up di…
면책 조항: 이 페이지에 포함된 팟캐스트와 작품은 OpenSourceMalware에서 가져온 것입니다. 이 팟캐스트는 소유자의 재산이며 Listen Notes, Inc.와 제휴하거나 보증하지 않습니다.
팟캐스트 검색 엔진
당사 웹사이트를 사용하여3,823,510팟캐스트 및195,640,596에피소드를 사람, 장소 또는 주제별로 검색할 수 있습니다.
If I have seen further than others, it is by listening to podcasts and standing upon the shoulders of
giants.
‐ Isaac "Llamacorn" Newton
이 팟캐스트 요청하기
Why to claim podcasts?
If you are a podcaster, the best way to manage your podcasts on Listen Notes is by claiming your Listen Notes
podcast pages.
It is a great, free way to engage the podcast community and increase the visibility of your podcasts.
After claiming your Listen Notes podcast pages, you will be able to:
✓
Manually refresh the RSS feed to sync up
✓
Get a verified badge (
✓
) alongside with your podcast name on Listen Notes
✓
Post 분류 광고 for sponsorship,
guests, co-hosts,
cross-promotion...
✓
Respond to listener comments on Listen Notes
✓
Use speech-to-text techniques to transcribe your show and
edit transcripts
✓
Improve the presence of your podcasts, e.g., self-service
팟캐스터 인터뷰...
✓
If you share your Listen Notes page and at-mention @ListenNotes
on X (formerly Twitter),
공식 X(구 Twitter) 계정 will retweet to promote
your show to our followers.
Coming soon:
◯ Self-service promotion on Listen Notes
◯ Track your podcast stats on Listen
Notes, e.g., listens, page
views...
◯ Manage episodes
