The OpenSourceMalware Show #13

**Executive summary:** This episode reports active supply-chain and repo compromise activity: JScrambler had malicious npm releases pushed via a stolen/published credential, AsyncAPI was abused through a disclosed GitHub Actions pull_request_target vulnerability to publish packages with Miasma-derived payloads, and new PolinRider (North Korean) research identifies ~2,417 newly poisoned repositories (over ~4,400 total) using config file injections, fake font/dictionary files and VS Code/task hooks to trigger malware; the hosts also note GitHub enabling a 3-day Dependabot cooldown by default and provide detection/hardening guidance for developers.