The OpenSourceMalware Show #11

**Executive summary:** The OpenSourceMalware show covers recent supply-chain and credential risks: NPM introduced a 72-hour read-only lock for high-impact accounts and GitHub Enterprise added credential revocation tools; a researcher-published set of npm packages were found to act as info-stealers targeting AI companies (exfiltrating .git and .ssh data without direct credentials); and the FBI issued a FLASH on TeamPCP with IOCs and behaviour notes—overall a situational intelligence roundup highlighting active but not widespread exploitation.