This week we talked about: 

• New research alleges OpenAI agents were behind the RubyGems attack. A report from independent researchers argues an OpenAI agent swarm is responsible for the GemStuffer campaign, which uploaded hundreds of spammy packages to RubyGems in May. Truffle Security's Luke Marshall followed up with the vulnerability the agents used (a CDN misconfiguration) that could expose other users' RubyGems API keys. OpenAI has yet to comment on either report.
• "lurves-agent" campaign is typosquats PyPI packages to target AI users. The campaign name comes from a string the malware's own AI-generated code self-attributed inside a bash script, suggesting the threat actor used an AI agent to write it without reviewing the output. Across five or six packages typosquatting OpenAI and other AI framework names, the payload is a short info-stealer, and the surrounding comments function as a prompt injection aimed at any AI reviewing the code.
• A typosquatted Claude site is distributing signed Mac malware. claude-desktop.com delivers a signed DMG instead of the real Claude desktop app, taking advantage of the fact that official install instructions for tools like Claude and OpenAI's CLI have changed repeatedly over the past year, making people less careful about where they install from. 

Resources: 

• (report) OpenAI agents carried out an undisclosed cyber-attack on RubyGems
• (blog) We discovered a Ruby account takeover; Rogue OpenAI Agents exploited it 2 months prior
• (threat feed) lurves-agent records on OpenSourceMalware
• (LinkedIn) Three Injections and a Rootkit: How Lurves PyPI Typosquat Attacks...

Jenn and Paul also mark OpenSourceMalware's first anniversary, now tracking close to 200,000 verified threats and over 100,000 IOCs. We also discuss:

• Mini Shai-Hulud payload resurfaces on npm. A payload from May's Mini Shai-Hulud campaign against AntV reappeared in four packages published within the same hour on September 7th, sitting undetected for 111 days despite npm's publish-time scanning. 
• Q&A from the Underground Economy conference. Reporting live from Team Cymru's conference in Strasbourg, Jenn and Paul answer the questions they fielded all week: whether DPRK and Russia collaborate on supply chain attacks, why malicious open source rarely targets specific countries, whether North Korea needs AI to close a skills gap, why GitHub allows git history to be rewritten and hasn't done more to stop PolinRider, and what developers can realistically do to protect themselves, since PolinRider's payload runs regardless of what language a repo is written in.

This week we talked about: 

• TeamPCP arrests — Australian Federal Police and the FBI arrested Ruben Thomson (21) and Louis Gaebler (23) in Perth on TeamPCP-related charges. The arrests align with the OpenSourceMalware team's longstanding assessment that TeamPCP was a very small operation, effectively one or two people, despite the scale of its attacks. Krebs' reporting details the OPSEC failures (reused usernames and passwords, prolific unredacted social media activity) that led to their identification, and despite the technical complexity of the attacks, the financial payout was reportedly modest (around $20K). Jenn and Paul discuss what this could mean for other overlapping threat groups like Lapsus$ and ShinyHunters.
• PolinRider's persistence outlasts partial remediation — A look at how DPRK's PolinRider campaign continues to reinfect developers who believed they'd already cleaned up. When a developer only removes the malicious payload files but not the underlying persistence mechanism (like a vscode-task.json trigger) or the RAT running on their machine, DPRK can push new payloads that ride along on the developer's own legitimate package publishes. Paul and Jenn cover what's changed in the kill chain: a new NullReceiver-branded payload, a persistence technique that overwrites the npm CLI binary itself so simply removing payloads from repos isn't sufficient, and an expanding target list of JavaScript/TypeScript file types the malware will inject into. They close on why disclosing an infection to collaborators matters, since silent individual cleanup doesn't stop reinfection through shared repos and contributors.

Episode resources

TeamPCP:

• (news) Two WA men charged after investigation into alleged cybercrime
• (official) Two WA men charged following AFP FBI WAPF disruption alleged global cybercrime syndicate
• (news) Two Alleged 'TeamPCP' Hackers Arrested in Australia

PolinRider:

• (blog) PolinRider npm case study of a DPRK attack
• (blog) Developer guide to getting over PolinRider

This week we talked about: 

Rust arrayref compromise tied to DPRK infrastructure: A compromised maintainer account published malicious versions of the arrayref crate, along with internment and append-only-vec, adding a typosquatted build dependency that downloaded and executed a remote binary at compile time. arrayref alone has more than 245 million lifetime downloads and sits in roughly three quarters of all Rust environments. Wiz Research has tied the campaign's infrastructure, including a shared C2 endpoint pattern and overlapping IP ranges, to the same DPRK actor behind the Mastra and Axios npm compromises.

StubMaker spreads from RubyGems to npm: What started as a RubyGems typosquatting campaign targeting bundler, i18n, rake, and activesupport turned out to share byte-for-byte identical payloads with a separate 40 package npm typosquatting cluster targeting axios, chalk, commander, lodash, react, and typescript. Both campaigns deliver the same 22MB Rust loader and embedded Go infostealer, confirmed by matching SHA-256 hashes, giving one threat actor two independent paths into any organization running both a Ruby and a Node stack. There's also evidence that this campaign hit the PowerShell ecosystem.

DIY binary payloads make a comeback: Paul has seen a sharp increase over the last two weeks in software supply chain attacks bundling compiled binaries (C++, Rust, Go) instead of sticking to the interpreted languages that dominate malicious open source. The theory: less experienced threat actors are following old malware-writing conventions, possibly with an assist from AI coding agents, without realizing that shipping a binary inside an npm or RubyGems package is itself one of the biggest red flags an analyst can ask for.

PolinRider reinfection wave using NullReceiver: We're still continuously seeing developers talking about getting reinfected with PolinRider. This latest iteration swaps out EtherHiding for NullReceiver as its stage two hiding method, and Paul and Jenn walk through why victims keep getting reinfected even after they think they've cleaned up: the malware lives on the developer's machine, not just in the repo, and it can commit to Git history without leaving an obvious trail.

Episode Resources:

1. (blog) Supply chain attack on arrayref
2. (blog) Rust Supply Chain Attack on arrayref, Significant Overlap with DPRK Campaigns
3. (webpage) arrayref crate threat report
4. (blog) StubMaker RubyGems Campaign Delivers a Windows Infostealer
5. (blog) Windows Infostealer Hits npm and Ruby

This week we talked about: 

• Hacker Summer Camp trends. Jenn and Paul share observations from Black Hat, DEF CON, and BSides Las Vegas last week, including a maturing AI security conversation that has shifted to focus on where AI still falls short, particularly the last mile of precision and finesse that still requires a human to verify. They also discuss the emerging challenge of identifying malicious AI skills, where the natural language format makes static analysis much harder than it is for traditional package ecosystems. And they revisit the recurring gap between security teams who understand binary malware and incident response and those who understand the open source software supply chain.
• GitHub revokes npm bypass-2FA token privileges. GitHub announced it is closing a gap that let npm granular access tokens configured to bypass two factor authentication perform sensitive account, org, and package management actions, a change Jenn and Paul say is overdue but underexplained.
• DPRK's NullReceiver technique keeps spreading. Following up on last week's episode, Paul shares that the number of packages using the NullReceiver technique, tied to the PolinRider campaign, has grown well past the seven originally confirmed, and that DPRK's use of crypto payments for infrastructure like VPN services could offer new tracking opportunities for defenders.

Episode resources:

• (blog) Restricting npm bypass-2FA granular access tokens
• (blog) NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

This week we talked about:

• New npm worm hits Keyv and cacheable. Jared Wray's GitHub account was compromised on Tuesday, and threat actors used it to publish a worm based on the open-sourced Mini Shai-Hulud malware. The worm spread to over 400 packages, with ServiceTitan alone losing 100 packages, and it searches developer machines and CI runners for credentials across GitHub, npm, AWS, Kubernetes, Vault, Azure, Google Cloud, Terraform, Docker, and Slack before exfiltrating them. We also talk about how this got caught within minutes despite GitHub's recent claims of proactive pre-publication malware scanning.
• The WEL1DROPPER campaign is flooding npm with AI slopsquatted packages. Over the past 72 hours, more than a thousand malicious packages have been published to npm as part of a campaign we're calling WEL1DROPPER. It doesn't rely on install scripts at all, executing instead when a package is imported, and we believe it's loosely connected to the earlier Moika campaign based on shared tradecraft. We dig into why attribution to Russian threat actors is complicated given the campaign also targets Russian and Belarusian financial institutions.
• DPRK is using a new C2 technique we're calling NullReceiver. We found DPRK-linked malware hiding its C2 IP address inside the recipient address of a completely empty Ethereum transaction, an evolution of the EtherHiding technique that fixes its biggest weakness: a fixed, publicly known destination address. We've confirmed at least 10 packages using this new technique so far.

Episode Resources:

• (blog) New npm Worm Hits 400+ Packages Including Keyv, Cachable
• (blog) Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages
• (blog) NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

This week we discussed:

Update from Hugging Face: Hugging Face published a technical timeline of the OpenAI evaluation agent that breached its production infrastructure between July 9 and July 13, reconstructing over 17,000 attacker actions across the five day window. OpenAI's own follow-up disclosure this week revealed the agent didn't stop at Hugging Face. It accessed accounts on four other services during the intrusion. We dig into why the agent went after the ExploitGym answer key instead of solving the benchmark honestly, and what that says about reward-seeking behavior in autonomous agents.

GitHub ships publish-time malware scanning and holds risky Actions workflows: On July 28, GitHub announced two supply chain security changes on the same day. npm packages are now scanned before they become available for install rather than after, and GitHub Actions will hold workflow runs identified as potentially malicious until a repository collaborator with write access approves them. Both announcements are thin on technical detail, and we talk through what triggers are probably getting flagged and why GitHub and npm have been slow to take on this kind of liability.

Amazon ties DPRK to the chalk and debug compromise: Amazon published research attributing the September 2025 compromise of the debug and chalk npm packages, along with the typo-crypto package first seen in March 2025, to the DPRK threat actor tracked as SAPPHIRE SLEET. We talk about why this link wasn't news to researchers who've been tracking DPRK's tradecraft for a while, and why TeamPCP's loud, public style keeps pulling attention away from the North Korean groups doing far more financial damage.

PolinRider automation causes account takeovers without targeting: New OSM research examined 20 npm and Go packages compromised through PolinRider's automatic credential harvesting rather than a deliberate account takeover. We explain why maintainers infected through fake job interviews and poisoned VS Code tasks ended up publishing malware to packages nobody had specifically targeted, and why that distinction changes how defenders should think about the threat.

Episode resources:

• (report) Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident
• (blog) OpenAI Says Its Rogue AI Agent Didn't Just Hack Hugging Face
• (changelog) npm publish-time malware scanning and dual-use metadata
• (changelog) GitHub Actions holds potentially malicious workflows for approval
• (report) Amazon identifies North Korean hacker group behind open-source supply chain attacks
• (blog) Amazon Links Debug and Chalk npm Hijack to North Korea's Sapphire Sleet
• (webpage) typo-crypto
• (podcast) To Catch a Thief: North Korea On Our Payroll
• (blog) PolinRider Caused Dozens of npm and Go Compromises

This week we talked about:

• Hugging Face breach and OpenAI's rogue model claim — Hugging Face disclosed a breach with thin details; OpenAI followed up claiming one of its models caused it during an internal security test, escaping its sandbox. The security community is skeptical about OpenAI's role in this incident.
• AgentBaiting: 6,000+ malicious GitHub repos target AI agents — Island's research found over 800 repos posing as AI skills or MCP servers, part of a wave that peaked in April. The bigger concern is malware hidden in natural-language instructions rather than code.
• RubyGems GemStuffer copycat campaign — 2,539 new RubyGems threat reports resembling the GemStuffer campaign that used gem publishing as a channel to hide exfiltrated data.
• RubyGems was leaking user API keys for years — A caching flaw exposed other users' API credentials under certain conditions. RubyGems fixed it fast and is notifying affected users.
• CrashStealer: a macOS infostealer with multiple tracks — Jamf published research on this novel C/C++ infostealer impersonating Apple's crash reporter. Paul found the threat actor also running a RAT and other malware tracks in parallel.
• Info stealers 101 — A quick primer on what characterizes an infostealer (what it targets, how it exfiltrates) and how our technology traces backward from the exfil point.
• ChainVeil and ViteVenom are PolinRider — Jenn's research connecting Checkmarx's ChainVeil/ViteVenom npm campaign to DPRK's PolinRider via five byte-for-byte identical IOCs (wallets and XOR keys).

Episode Resources

• (blog) Hugging Face Confirms Breach Affected Internal Datasets and Credentials, Urges Users to Take Action
• (blog) OpenAI Says Hugging Face Was Breached by Its Pre-Release Models
• (blog) AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware
• (blog) GemStuffer Abuses 150+ RubyGems to Exfiltrate Scraped U.K. Council Portal Data
• (blog) Security Advisory: Possible Leak of Legacy API Keys via Improper Cache Configuration
• (blog) CrashStealer: C++ macOS Infostealer Posing as Crash Reporter
• (blog) ChainVeil and ViteVenom are DPRK's PolinRider Campaign

This week we talked about: 

• GitHub turns on Dependabot cooldown periods by default — A three day cooldown is now applied automatically to all Dependabot version updates, a shift we've been anticipating in the fight against account takeover malware, though it may leave developers confused about why their upgrades are getting blocked
  JScrambler compromise — A threat actor gained access to a publishing credential and pushed five malicious versions of the jscrambler package. The malware evolved quickly, with the first three versions containing the trigger in a pre-install script to the last two on-import execution partway through. They also published four versions of related packages that pinned to malicious v8.18.0.
• AsyncAPI compromised — Attackers exploited a GitHub Actions pull_request_target flaw that sat unresolved for 58 days to steal a privileged token. They published malicious npm packages under the @asyncapi namespace, all with components of the Miasma malware that was open-sourced earlier this year (but no worm).
  New PolinRider research — Paul's latest hunt found 2,417 newly-compromised repositories, confirming config file injection as the dominant delivery vector alongside a growing fake font technique, still overwhelmingly hitting individual developers rather than organizations.

Episode Resources

• (talk) BSides Adelaide 2026 Schedule
• (docs) Dependabot cooldown
• (blog) Security Advisory: Unauthorized Publication of a Malicious npm Package
• (feed) OpenSourceMalware threat reports for Jscrambler
• (blog) M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
• (feed) OpenSourceMalware threat reports for AsyncAPI
• (blog) PolinRider Confirmed Footprint Grows 6.5x Since March

This week we talked about:

• PolinRider jumps the fence — Paul's research on North Korea's automated repo-hijacking campaign spreading into the Go and PHP ecosystems without any extra effort from the threat actors
• Cybersecurity startup publishes infostealers to npm — a vendor publishing malicious packages to manufacture threat data for its own marketing, and getting their npm account pulled for it
• MeetingTV sues Palo Alto Networks — a lawsuit alleging Koi Security's AI-assisted analysis hallucinated a company's domain onto a C2 infrastructure list, with real business fallout

This episode also features an interview with Mikael Barbero (Head of Security, Eclipse Foundation) on OpenVSX security — We covered OpenVSX's explosive growth, its pre-publish scanning pipeline, looking for "sleeper malicious" extensions, publisher verification, and token management.

Episode Resources

• (blog) PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
• (blog) Cybersecurity Startup Publishes Infostealers to NPM
• (PDF) MeetingTV’s First Amended Complaint Against Palo Alto Networks and Koi Security
• (LinkedIn) Mikael Barbero, Head of Security at Eclipse Foundation
• (webpage) Open VSX Security Researcher Recognition Program
• (report) GlassWorm: Open VSX Transitive Dependency Supply-Chain Escalation
• (feed) OpenSourceMalware Threat Reports for Open VSX