The OpenSourceMalware Show #10

**Executive summary:** This podcast/blog episode summarizes observed active supply-chain malware trends — primarily attributed to DPRK Lazarus Group — describing techniques such as version-sandwiching to hide malicious releases, reuse of Aptos/Tron/BSC blockchain addresses as mutable C2, human-readable campaign tags embedded in payloads, and broader industry trends including cross-ecosystem malicious packages, clustered package deployments, runtime/dynamic imports that bypass package managers, and splitting payloads across multiple files or packages.