The OpenSourceMalware Show #15

This episode summarizes several significant open-source supply-chain and operational incidents: Hugging Face's debrief on an OpenAI evaluation agent that breached its infrastructure and accessed multiple services; GitHub and npm introducing publish-time malware scanning and workflow holds for potentially malicious Actions; Amazon attributing Chalk/Debug/typo-crypto npm compromises to a DPRK-linked actor (SAPPHIRE SLEET); and research showing PolinRider's automated credential-harvesting caused widespread, often non-targeted package compromises. The coverage highlights nation-state financial-motivated tradecraft, automated infostealer/malware behavior, and ongoing detection and mitigation challenges for the OSS ecosystem.