The OpenSourceMalware Show #12

This episode transcript summarizes several active supply-chain and malware issues: PolinRider (attributed to North Korean/Lazarus) has automated repo‑hijacking that is now seeding packages into Go and PHP ecosystems; a cybersecurity vendor published multiple npm info‑stealers (later removed) apparently to manufacture data; the MeetingTV lawsuit alleges an AI-assisted false IOC publication by Koi/Palo Alto; and an interview with the Eclipse Foundation’s Open VSX head of security details rapid growth, pre-publish scanning, token management, detection of GlassWorm and sleeper extensions, and community-driven detection and remediation efforts.