The OpenSourceMalware Show #16

**Executive summary:** This blog/podcast episode reports three active supply‑chain and malware threats: a Keyv/cacheable npm worm (based on Mini Shai-Hulud) that infected ~400+ packages and searches developer machines/CI for credentials to exfiltrate; the WEL1DROPPER campaign which pushed >1,000 AI slopsquatted npm packages that execute on import and may be linked to Moika; and NullReceiver, a DPRK-linked C2 technique embedding C2 IPs in the recipient field of empty Ethereum transactions observed in at least 10 packages.