OpenSourceMalware Blog
ID: a33ff194-0219-5a2f-8d57-900cc8675349
STIX ID: identity--a33ff194-0219-5a2f-8d57-900cc8675349
Feed Type: rss
Earliest post: 2024-01-15
Latest post: 2026-11-20
In-depth malware research, threat analysis, and technical dissections of malicious code — focused on open-source investigations, reverse engineering breakdowns, and actionable insights for defenders.
All
01/01/2020
09/21/2026
| Title | Date Published ↓ | Describes Incident | Author | Visible | |||
|---|---|---|---|---|---|---|---|
 | WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials | 2026-09-17 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| The OpenSourceMalware Show #21 | 2026-09-17 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| The OpenSourceMalware Show #20 | 2026-09-09 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| The OpenSourceMalware Show #19 | 2026-08-28 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| NPM Isn't Prepared For North Korean PolinRider Attack | 2026-08-25 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| The OpenSourceMalware Show #18 | 2026-08-21 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| Windows Infostealer Hits npm and Ruby | 2026-08-19 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| StubMaker RubyGems Campaign Delivers a Windows Infostealer | 2026-08-16 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| The OpenSourceMalware Show #17 | 2026-08-14 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| A Developer's Guide to Getting Rid of PolinRider | 2026-08-13 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| The OpenSourceMalware Show #16 | 2026-08-08 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages | 2026-08-06 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| New npm Worm Hits 400+ Packages Including Keyv, Cachable | 2026-08-05 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding | 2026-08-02 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| The OpenSourceMalware Show #15 | 2026-07-31 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| PolinRider Caused Dozens of npm and Go Compromises | 2026-07-31 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| NPM Implements Pre-Publication Malware Scanning, But Will It Work? | 2026-07-31 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| The OpenSourceMalware Show #14 | 2026-07-23 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| ChainVeil and ViteVenom are DPRK’s PolinRider Campaign | 2026-07-17 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| The OpenSourceMalware Show #13 | 2026-07-16 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| PolinRider Confirmed Footprint Grows 6.5x Since March | 2026-07-15 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| Cybersecurity Startup Publishes Infostealers to NPM | 2026-07-09 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| The OpenSourceMalware Show #12 | 2026-07-09 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| PolinRider Jumps the Fence to Go, Packagist, npm, PyPI | 2026-07-08 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| The OpenSourceMalware Show #11 | 2026-07-02 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| The OpenSourceMalware Show #10 | 2026-06-25 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| The OpenSourceMalware Show #10 | 2026-06-25 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| The OpenSourceMalware Show: #9 | 2026-06-18 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| Active Malware Campaigns in January-May 2026 | 2026-06-08 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| Miasma Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds | 2026-06-06 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| The Software Supply Chain Malware Landscape: January - May 2026 | 2026-06-03 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| TeamPCP Compromises AntV and 322 Other NPM Packages | 2026-05-20 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| Axios Attacker Behind Three More Malicious NPM Packages | 2026-05-19 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| How Malware Abuses NPM Lifecycle Scripts and VS Code Tasks | 2026-05-14 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| TeamPCP Hits TanStack, OpenSearch, and Mistral with Mini Shai-Hulud | 2026-05-13 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| Lazarus Group Using Git Hooks To Hide Malware | 2026-05-06 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| CNCF Project Antrea Compromised in Daring GitHub Attack | 2026-05-05 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| Mini Shai-Hulud Weaponizes Tasks.JSON Files | 2026-04-30 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| Security Anti-Patterns Caused by AI Coding Tools | 2026-04-26 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| Stardrop Supply Chain Attack Targets Venture Capital Firms, Luxury Brands, and AI Companies | 2026-04-14 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| PolinRider DPRK Attack Expands Across GitHub | 2026-04-12 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| Hundreds of GitHub Repos Compromised By DPRK's PolinRider Campaign | 2026-04-08 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| Velora (formerly ParaSwap) SDK Version 9.4.1 Compromised And Installing Malware | 2026-04-08 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| The Social Engineering Playbook Attackers Use to Target OSS Maintainers | 2026-04-01 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| Has TeamPCP Pivoted To Using The PureHVNC RAT? | 2026-03-31 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| Malicious Transitive Dependency in Axios Affects Millions of Users | 2026-03-31 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| TasksJacker DPRK Attack Compromises GitHub Users Via VS Code Tasks | 2026-03-31 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| TeamPCP Supply Chain Campaign: A March 2026 Retrospective | 2026-03-26 | True | cb482791-4ef1-4762-96ad-b0ca4bdd538e | True | ||
| TeamPCP Hijacks LiteLLM's PyPI Package | 2026-03-25 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True | ||
| TeamPCP Defaces Aqua Security’s Internal GitHub Org | 2026-03-23 | True | c0a15726-c5b1-4b0d-85e6-fe15553df9e2 | True |