The OpenSourceMalware Show

About The OpenSourceMalware Show

When you think about malware, you probably envision phishing emails or sketchy websites. But malicious open source - targeting software developers and their build systems - is becoming a top way that threat actors deliver malware. Just one 'npm install' can trigger payloads that steal information and credentials. Software supply chain attacks by state actors, ransomware groups, and freelancers are happening every day. Hosted by Jenn Gile and Paul McCarty (co-founders of OpenSourceMalware), this podcast explores the latest trends and attacks, and helps defenders understand the tactics needed to prevent their orgs from being the next target. OpenSourceMalware provides community-driven threat intelligence on malicious open source assets including packages, domains, IP addresses, crypto wallets, and more. https://opensourcemalware.com/

Publisher

OpenSourceMalware

Category

technology

Language

en

Explicit

No

First episode

27 Apr 2026

Latest episode

9 Oct 2026

Latest episodes

24 episodes in the feed.

1. 

   9 Oct 2026

   Tensorlake compromised with mini Shai-Hulud worm, new RubyGems attack

   This week we talked about: Tensorlake SDK compromise: The npm SDK for Tensorlake, a tool for building and operating AI agents, was compromised with two malicious files. A setup.mjs file fires through a preinstall hook and launches the payload with Bun, and math_symbol.js carries a credential stealer and self-propagating worm. It is at least the second attack built on the open-sourced Mini Shai-Hulud worm, following the August attack on keyv and cachable. We discuss why this well-known p...

2. 

   1 Oct 2026

   Ransomeware arrests, crypto heist, Mac and Baileys malware, DPRK's A/B testing

   This week we talked about: ShinyHunters and KillSec arrests: Dutch police arrested Pepijn van der Stap, a long-time ShinyHunters member known as Umbreon, on September 16, less than a year after he finished a prison sentence for earlier hacking. His arrest followed a power struggle with the group's 16-year-old leader over who controls its infrastructure. Separately, police arrested three suspected members of the KillSec ransomware group. The group is linked to roughly 1,000 attacks and u...

3. 

   24 Sept 2026

   ShinyHunters attacks FBI, new WeaselBiscuit malware, Contagious Interview research, and dev FAQs

   This week we discussed: ShinyHunters vs. the FBI and Cl0p: ShinyHunters claims it stole data from an FBI jobs website through a PeopleSoft zero-day, and it is threatening to leak that data unless the FBI retracts a May FLASH tied to the Instructure Canvas breach. We cover why aging enterprise monoliths like PeopleSoft and WebLogic are such attractive targets. We also get into the group's escalating public feud with ransomware crew Cl0p.A correction on WhatsApp Baileys attacks: Malicious...

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Apple Podcasts (US)

5.0 / 5

1 ratings

Spotify

5.0 / 5

2 ratings

Contact The OpenSourceMalware Show

Guest appearances

Does not typically book guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.

Shows with a similar audience

• 

  Coffee, Chaos and ProdSec

• 

  Open Source Security Podcast

• 

  Risky Business

• 

  AI CyberSecurity Podcast