GIỚI THIỆU VỀ PODCAST NÀY 🔗
When you think about malware, you probably envision phishing emails or sketchy websites. But malicious open source - targeting software developers and their build systems - is becoming a top way that threat actors deliver malware. Just one 'npm install' can trigger payloads that steal information and credentials. Software supply chain attacks by state actors, ransomware groups, and freelancers are happening every day.
Hosted by Jenn Gile and Paul McCarty (co-founders of OpenSourceMalware), this podcast explores the latest trends and attacks, and helps defenders understand the tactics needed to prevent their orgs from being the next target.
OpenSourceMalware provides community-driven threat intelligence on malicious open source assets including packages, domains, IP addresses, crypto wallets, and more.
https://opensourcemalware.com/
Tần suất cập nhật:
weekly
Độ dài âm thanh trung bình:
35 minutes
Tiếng Anh
Hoa Kỳ
24 tập
kể từ Ngày 27 tháng 4 năm 2026
episodic
TRONG PODCAST NÀY 🔗
TẬP MỚI NHẤT 🔗
This week we talked about:
Tensorlake SDK compromise: The npm SDK for Tensorlake, a tool for building and operating AI agents, was compromised with two malicious files. A setup.mjs file fires through a preinstall hook and launches the payload with Bun, and math_symbol.js carries a credential stea…
TÌM KIẾM CÁC TẬP TRƯỚC
Tìm kiếm các tập trước của The OpenSourceMalware Show.
TẬP TRƯỚC 🔗
This week we talked about:
ShinyHunters and KillSec arrests: Dutch police arrested Pepijn van der Stap, a long-time ShinyHunters member known as Umbreon, on September 16, less than a year after he finished a prison sentence for earlier hacking. His arrest followed a power struggle with the group&…
This week we discussed:
ShinyHunters vs. the FBI and Cl0p: ShinyHunters claims it stole data from an FBI jobs website through a PeopleSoft zero-day, and it is threatening to leak that data unless the FBI retracts a May FLASH tied to the Instructure Canvas breach. We cover why aging enterprise mon…
This week we talked about:
New research alleges OpenAI agents were behind the RubyGems attack. A report from independent researchers argues an OpenAI agent swarm is responsible for the GemStuffer campaign, which uploaded hundreds of spammy packages to RubyGems in May. Truffle Security's Luke…
Jenn and Paul also mark OpenSourceMalware's first anniversary, now tracking close to 200,000 verified threats and over 100,000 IOCs. We also discuss:
Mini Shai-Hulud payload resurfaces on npm. A payload from May's Mini Shai-Hulud campaign against AntV reappeared in four packages publishe…
This week we talked about:
TeamPCP arrests — Australian Federal Police and the FBI arrested Ruben Thomson (21) and Louis Gaebler (23) in Perth on TeamPCP-related charges. The arrests align with the OpenSourceMalware team's longstanding assessment that TeamPCP was a very small operation, eff…
This week we talked about:
Rust arrayref compromise tied to DPRK infrastructure: A compromised maintainer account published malicious versions of the arrayref crate, along with internment and append-only-vec, adding a typosquatted build dependency that downloaded and executed a remote binary at co…
This week we talked about:
Hacker Summer Camp trends. Jenn and Paul share observations from Black Hat, DEF CON, and BSides Las Vegas last week, including a maturing AI security conversation that has shifted to focus on where AI still falls short, particularly the last mile of precision and finess…
This week we talked about:
New npm worm hits Keyv and cacheable. Jared Wray's GitHub account was compromised on Tuesday, and threat actors used it to publish a worm based on the open-sourced Mini Shai-Hulud malware. The worm spread to over 400 packages, with ServiceTitan alone losing 100 pack…
This week we discussed:
Update from Hugging Face: Hugging Face published a technical timeline of the OpenAI evaluation agent that breached its production infrastructure between July 9 and July 13, reconstructing over 17,000 attacker actions across the five day window. OpenAI's own follow-up di…
Tuyên bố miễn trừ trách nhiệm: Podcast và tác phẩm nghệ thuật được nhúng trên trang này là của OpenSourceMalware, là tài sản của chủ sở hữu và không được liên kết hoặc xác nhận bởi Listen Notes, Inc.
CÔNG CỤ TÌM KIẾM PODCAST
Bạn có thể sử dụng trang web của chúng tôi để tìm kiếm các podcast3,823,510và các tập195,640,596theo người, địa điểm hoặc chủ đề.
If I have seen further than others, it is by listening to podcasts and standing upon the shoulders of
giants.
‐ Isaac "Llamacorn" Newton
TÌM KIẾM CÁC TẬP TRƯỚC
Tìm kiếm các tập trước của The OpenSourceMalware Show.
NHẬN PODCAST NÀY
Why to claim podcasts?
If you are a podcaster, the best way to manage your podcasts on Listen Notes is by claiming your Listen Notes
podcast pages.
It is a great, free way to engage the podcast community and increase the visibility of your podcasts.
After claiming your Listen Notes podcast pages, you will be able to:
✓
Manually refresh the RSS feed to sync up
✓
Get a verified badge (
✓
) alongside with your podcast name on Listen Notes
✓
Post quảng cáo rao vặt for sponsorship,
guests, co-hosts,
cross-promotion...
✓
Respond to listener comments on Listen Notes
✓
Use speech-to-text techniques to transcribe your show and
edit transcripts
✓
Improve the presence of your podcasts, e.g., self-service
phỏng vấn người làm podcast...
✓
If you share your Listen Notes page and at-mention @ListenNotes
on X (formerly Twitter),
tài khoản X chính thức của chúng tôi (trước đây là Twitter) will retweet to promote
your show to our followers.
Coming soon:
◯ Self-service promotion on Listen Notes
◯ Track your podcast stats on Listen
Notes, e.g., listens, page
views...
◯ Manage episodes
CHỈNH SỬA
Cảm ơn bạn đã giúp cơ sở dữ liệu podcast luôn cập nhật.
