This week we talked about: 

• GitHub turns on Dependabot cooldown periods by default — A three day cooldown is now applied automatically to all Dependabot version updates, a shift we've been anticipating in the fight against account takeover malware, though it may leave developers confused about why their upgrades are getting blocked
  JScrambler compromise — A threat actor gained access to a publishing credential and pushed five malicious versions of the jscrambler package. The malware evolved quickly, with the first three versions containing the trigger in a pre-install script to the last two on-import execution partway through. They also published four versions of related packages that pinned to malicious v8.18.0.
• AsyncAPI compromised — Attackers exploited a GitHub Actions pull_request_target flaw that sat unresolved for 58 days to steal a privileged token. They published malicious npm packages under the @asyncapi namespace, all with components of the Miasma malware that was open-sourced earlier this year (but no worm).
  New PolinRider research — Paul's latest hunt found 2,417 newly-compromised repositories, confirming config file injection as the dominant delivery vector alongside a growing fake font technique, still overwhelmingly hitting individual developers rather than organizations.

Episode Resources

• (talk) BSides Adelaide 2026 Schedule
• (docs) Dependabot cooldown
• (blog) Security Advisory: Unauthorized Publication of a Malicious npm Package
• (feed) OpenSourceMalware threat reports for Jscrambler
• (blog) M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
• (feed) OpenSourceMalware threat reports for AsyncAPI
• (blog) PolinRider Confirmed Footprint Grows 6.5x Since March