The OpenSourceMalware Show

This week we had a special guest on the show: Jared Wray, who is the maintainer of several popular open source projects, including Keyv and Cacheable. In August 2026, he was the victim of an account takeover. A threat actor used a GitHub token he thought he'd retired to push malware into his Kevy and Cachable, and his own release pipeline shipped it to npm with valid provenance. It contained a worm that propagated the malware into 400+ npm packages. The campaign became known as ChainDrop, and the worm code was based on TeamPCP's open-sourced Mini Shai-Hulud worm. We talked about:

• How the attack happened
• Getting his accounts back
• Rebuilding his setup
• Security controls that are harder than they sound
• Vetting new dependencies
• Staying on GitHub Actions

Episode resources:

• (webpage) Jared Wray on GitHub
• (blog) New npm Worm Hits 400+ Packages Including Keyv, Cachable
• (blog) Keyv and Cacheable - Chaindrop Worm
• (blog) Coding Securely in the Age of AI

This week we talked about:

• Trojanized Claude Code extension: On October 29, a trojanized Claude Code extension was shipped from Cursor's own mirror of the Open VSX registry. Cursor's mirror can carry different versions than Open VSX itself, so the only people who got it pulled Claude Code through Cursor, and most of them appear to have had auto-update turned on. The extension included the official binary plus code that gives attackers persistent remote access. 
• Binance robbed by North Korea: The $6.3 billion Binance crypto theft started in June, when an engineer downloaded a malicious version of Homebrew. Binance cleaned it up, but the attackers had already learned enough about that engineer and his colleagues to pick their next target. In September a second engineer was compromised through a fake job interview's take-home assignment on a work laptop.. That access led to two more developer machines, and a container deployment token on one of them was used to deploy the container that launched the attack on October 29.
• Polymarket compromised through DebugBear: Polymarket was compromised through malicious JavaScript from DebugBear, a third-party vendor whose DNS records were hijacked at its domain registrar. Beyond DebugBear's first incident post on X, there's no public information about the attack yet. Injected JavaScript isn't new: it has been a common WordPress incident for years, through sites with an upload function and path traversal.
• PolinRider backdated to 2025: A set of legitimate npm packages compromised in May 2025 carried an obfuscated payload that turns out to be the earliest known PolinRider infection. The same maintainer was hit again multiple times this year, indicating they were likely compromised the entire time and could be one of the earliest victims.

Resources

• (blog) Trojanized Claude Code Extension Plants an SSH Backdoor
• (blog) Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace
• (blog) 29 October 2026 Binance Security Incident: Initial Findings and Response Update
• (webpage) North Korea Responsible for $6 Billion+ Binance Attack
• (blog) SEAL Releases Advisory on DPRK Threat to Crypto Exchanges
• (article) Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack
• (blog) Earliest Known PolinRider Malware Found in 2025 npm Packages

This week we talked about:

• Brotli vulnerability: The Brotli decoder bug behind Node2Shell reaches far beyond Node, and it's been overshadowed by the hype around PHP2Shell. Google's Brotli C code is usually vendored into projects like Python, Rust and PHP instead of pulled in as a dependency, so it won't show up in your package manifests. You have to hunt for copies yourself, and finding them all could take as long as Log4j did. We cover how to check for vulnerable copies.
  LiteLLM postmortem: LiteLLM's second compromise this year started with an admin key that was committed to a public repo in May and never revoked. In October, attackers used it to push malicious version 1.107.0, helped by a release control the team had relaxed so they could ship faster. It's a clear case for threat modeling any time you trade security for speed.
  MALFEX campaign: A malicious AGENTS.md file in a developer's Downloads folder tried to get their AI coding agent to install a package from MALFEX, an npm campaign that's been running since 2023. MALFEX packages are tiny, have no install script, and hide their payload in a file with a PNG header. 

Resources

• (blog) Blog - Dear Open Source Developers: It's OK not to embargo
• (blog) Python Packages Vulnerable to Node2Shell Brotli CVE
• (blog) CVE-2026-111497 Brotli Bug Reaches Far Beyond Node.js
• (blog) Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
• (blog) The attack chain behind the v1.107.0 LiteLLM release
• (webpage) The Ultimate Beginner's Guide to Threat Modeling
• (blog) Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
• (blog) Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
• (feed) OpenSourceMalware threat reports tagged #malfex

This week we talked about:

• OVH CLI compromised by GlassWorm: GlassWorm is back. The Russian threat actor went quiet after its infrastructure was taken down earlier this year, and it resurfaced with malicious versions of OVH’s official CLI tool. It got in through a contributor account it had held for seven months, a reminder that compromised credentials can be used long after they’re stolen. The malicious builds came from a laptop rather than OVH’s normal pipeline, which helped a user spot them quickly.
• Compound payloads: Threat actors are splitting malware into pieces, often spread across several packages. They only do damage when they run together, and the purpose is to evade detection because each piece looks harmless on its own. DPRK is using a similar approach in Contagious Interview, in which a private repo’s .npmrc points to a different registry, so the malicious package only resolves for the target.
• GhostAction copycats PolinRider: GhostAction has moved from attacking CI to going after developers directly. It used its malicious workflows to plant PolinRider’s fake font trick repos already compromised with the malicious workflows. Anyone who opens one of those repos in VS Code runs a credential stealer and gets a cron job that checks in with the attacker every five minutes. Removing the malicious workflows doesn’t remove it, and at least one maintainer who did exactly that missed the new malware. Luckily, the code is sloppy and only partly works, but that doesn’t make it harmless.

Resources

• (blog) Glassworm Hacks OVH Clouds CLI tool
• (threat report) webrunc
• (blog) GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File

This week we talked about:  

• GitHub push attribution: GitHub now shows when the account that pushed a commit is different from the one listed as the committer, which makes faked Git history easier to spot. That could help flag PolinRider-style changes and pushes made with stolen credentials. The catch is that it’s in public preview for GitHub Enterprise only. The related push rules may also not work on public repos, which leaves out the open source maintainers who are targeted most.
• GitHub Actions workflow lockfiles: Workflow lockfiles keep a GitHub Actions workflow pointed at the version you chose, even if an attacker moves the tag. That should help against attacks like tj-actions and Trivy, though it wouldn’t stop GhostAction, and setup requires installing a GitHub CLI extension. 
• GhostAction expands to phishing: GitGuardian first discovered GhostAction in 2025. It’s a malicious GitHub Actions workflow that sweeps a repo’s full Git history for credentials. The operators have now registered a GitHub lookalike domain and are phishing open source maintainers with fake sign-in alerts. Their kit proxies the real GitHub login and got past the MFA methods it was tested against. The same IP has also been mass scanning the internet for about a year.
• North Korean IT worker laptop farms: The US Department of Justice announced Operation Lonestar Roundup, with law enforcement actions in Ohio and Texas and approximately 187 computers seized. We explain how the IT worker scheme works and why operatives need US-based laptop farms to hide where they are. We also cover how they find people to host the laptops.

Resources

• (blog) Push attribution for commits in limited public preview
• (blog) GitHub Actions workflow lockfiles in public preview
• (blog) GhostAction Attack Escalates By Targeting GitHub Users
• (blog) GhostAction Is Now Phishing Open Source Maintainers
• (webpage) Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies

This week we talked about: 

• Tensorlake SDK compromise: The npm SDK for Tensorlake, a tool for building and operating AI agents, was compromised with two malicious files. A setup.mjs file fires through a preinstall hook and launches the payload with Bun, and math_symbol.js carries a credential stealer and self-propagating worm. It is at least the second attack built on the open-sourced Mini Shai-Hulud worm, following the August attack on keyv and cachable. We discuss why this well-known pattern should have been caught by registry scanning, and what the lack of impact suggests about the attacker.
• Rogue .npmrc in a fake job interview: A new attack follows the Contagious Interview playbook but is not yet attributed. The repo a candidate clones quietly drops a custom .npmrc, so a later npm install resolves a package from a Chinese npm mirror instead of the public registry. We also look at packages with no malicious payload on their own that only become malicious when combined through dependencies, and why scanners miss them.
• Malicious crypto gems on RubyGems: OpenSourceMalware's automated detection flagged 42 malicious gems published by a single account calling itself Ghost Dev. They target crypto and Web3 developers through typosquats, brandjacking, and plausible utility names. Installing the gem runs a native extension build script that sleeps for 20 to 40 minutes, then either opens a reverse shell or installs a wallet theft kit posing as a tool called Wallet Guard. We also cover why a Python payload inside a Ruby package is a useful signal, and how slopsquatting gets more effective as AI tools hallucinate dependencies across ecosystems.

Resources

• (report) tensorlake threat report
• (blog) New npm Worm Hits 400+ Packages Including Keyv, Cachable
• (blog) Malicious Crypto Shell Packages Target RubyGems

This week we talked about: 

• ShinyHunters and KillSec arrests: Dutch police arrested Pepijn van der Stap, a long-time ShinyHunters member known as Umbreon, on September 16, less than a year after he finished a prison sentence for earlier hacking. His arrest followed a power struggle with the group's 16-year-old leader over who controls its infrastructure. Separately, police arrested three suspected members of the KillSec ransomware group. The group is linked to roughly 1,000 attacks and used AI to build its infrastructure and identify victims.
• Bitget crypto heist: Suspected North Korean hackers stole $351.6 million from the hot and warm wallets of crypto exchange Bitget. Customer accounts still showed full balances after the funds were drained. Incident response firm SlowMist attributes the initial access to a zero-day in an unnamed security product.
• Signed Mac malware posing as Claude Desktop: A lookalike Claude Desktop site is serving a signed macOS installer hosted on GitHub. It appears to be the real app with a padded payload added. Because it's signed, macOS installs it without warning, and the file is about four times the size of the real installer.
• Baileys campaign update: The number of malicious npm packages abusing the Baileys WhatsApp library now tops 100. Most only inflate follower counts for WhatsApp channels, so the direct risk is low. Some have also served as a base for other attacks, including WhatsApp-based C2.
• PolinRider A/B testing: DPRK's PolinRider campaign is changing its fake font trick to slip past detections that rely on a single file name. The fa-solid-400.woff2 payload has been renamed to 500, 900, and 300 and moved deep into legitimate folders. Most recently it was given a .llf extension that has nothing to do with fonts.
• We're hiring: OpenSourceMalware is looking for a part-time malware researcher with software supply chain experience.

Resources

• (blog) Dutch Police Arrest 'Reformed' Hacker in Shiny Hunters Investigation
• (blog) Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers
• (blog) Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise
• (feed) OpenSourceMalware threat reports tagged #baileys
• (blog) 101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent
• (blog) PolinRider is A/B Testing its Way Past Your Detections

This week we discussed: 

• ShinyHunters vs. the FBI and Cl0p: ShinyHunters claims it stole data from an FBI jobs website through a PeopleSoft zero-day, and it is threatening to leak that data unless the FBI retracts a May FLASH tied to the Instructure Canvas breach. We cover why aging enterprise monoliths like PeopleSoft and WebLogic are such attractive targets. We also get into the group's escalating public feud with ransomware crew Cl0p.
• A correction on WhatsApp Baileys attacks: Malicious Baileys typosquats aren't targeting WhatsApp payments, as we said last week. We explain what these packages actually do and how threat actors make money from them.
• WeaselBiscuit: A new, stripped-down, self-contained malware family derived from BeaverTail and OtterCookie has turned up in 16 npm packages so far. We share the latest on attribution, what the malware is designed to steal, and why its minimal design helps it slip past detection.
• FBI joint advisory on Contagious Interview: The FBI and international partners issued a joint warning about the DPRK IT workers scam and Contagious Interview (under the name WaterPlum), with figures on infected devices and stolen cryptocurrency. We discuss what the advisory leaves out. We also explain why its finding of shared infrastructure with the IT workers scam matters for researchers and defenders.
• Atlassian's Contagious Interview research: Atlassian published research on Contagious Interview activity across Bitbucket, GitLab, and GitHub, along with the actions it has taken on its own platform. We discuss what the report reveals about the campaign beyond GitHub and how platforms differ in responding to researcher reports.
• Developer questions from TikTok: Our viral TikTok explainer on the VS Code tasks autorun technique drew a set of recurring questions from developers. We answer them, including "How this malware gets onto developer machines", "Whether signed commits or switching editors would stop it", "Why antivirus misses it", and "How researchers know North Korea is behind it."

Episode resources:

• (X) ShinyHunters statement on the FBI
• (webpage) ShinyHunters - Cyber Criminal Group Attacks Learning Management System
• (blog) ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach
• (feed) Baileys threat reports
• (blog) WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials
• (PDF) North Korean "WaterPlum," commonly referred to as "Contagious Interview," Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe
• (blog) From fake interviews to malicious repositories - Disrupting Contagious Interview
• (TikTok) How the VS Code tasks autorun attack works

This week we talked about: 

• New research alleges OpenAI agents were behind the RubyGems attack. A report from independent researchers argues an OpenAI agent swarm is responsible for the GemStuffer campaign, which uploaded hundreds of spammy packages to RubyGems in May. Truffle Security's Luke Marshall followed up with the vulnerability the agents used (a CDN misconfiguration) that could expose other users' RubyGems API keys. OpenAI has yet to comment on either report.
• "lurves-agent" campaign is typosquats PyPI packages to target AI users. The campaign name comes from a string the malware's own AI-generated code self-attributed inside a bash script, suggesting the threat actor used an AI agent to write it without reviewing the output. Across five or six packages typosquatting OpenAI and other AI framework names, the payload is a short info-stealer, and the surrounding comments function as a prompt injection aimed at any AI reviewing the code.
• A typosquatted Claude site is distributing signed Mac malware. claude-desktop.com delivers a signed DMG instead of the real Claude desktop app, taking advantage of the fact that official install instructions for tools like Claude and OpenAI's CLI have changed repeatedly over the past year, making people less careful about where they install from. 

Resources: 

• (report) OpenAI agents carried out an undisclosed cyber-attack on RubyGems
• (blog) We discovered a Ruby account takeover; Rogue OpenAI Agents exploited it 2 months prior
• (threat feed) lurves-agent records on OpenSourceMalware
• (LinkedIn) Three Injections and a Rootkit: How Lurves PyPI Typosquat Attacks...

Jenn and Paul also mark OpenSourceMalware's first anniversary, now tracking close to 200,000 verified threats and over 100,000 IOCs. We also discuss:

• Mini Shai-Hulud payload resurfaces on npm. A payload from May's Mini Shai-Hulud campaign against AntV reappeared in four packages published within the same hour on September 7th, sitting undetected for 111 days despite npm's publish-time scanning. 
• Q&A from the Underground Economy conference. Reporting live from Team Cymru's conference in Strasbourg, Jenn and Paul answer the questions they fielded all week: whether DPRK and Russia collaborate on supply chain attacks, why malicious open source rarely targets specific countries, whether North Korea needs AI to close a skills gap, why GitHub allows git history to be rewritten and hasn't done more to stop PolinRider, and what developers can realistically do to protect themselves, since PolinRider's payload runs regardless of what language a repo is written in.