{"@attributes":{"version":"2.0"},"channel":{"title":"OpenSourceMalware Blog","link":"https:\/\/opensourcemalware.com\/blog","description":"Security research and threat intelligence from OpenSourceMalware","language":"en-us","lastBuildDate":"Thu, 23 Jul 2026 20:18:09 GMT","item":[{"title":"ChainVeil and ViteVenom are DPRK\u2019s PolinRider Campaign","link":"https:\/\/opensourcemalware.com\/blog\/chainveil-and-vitevenom-dprk-polinrider-campaign","guid":"https:\/\/opensourcemalware.com\/blog\/chainveil-and-vitevenom-dprk-polinrider-campaign","description":"Shared infrastructure is the smoking gun connecting the pieces.","pubDate":"Fri, 17 Jul 2026 23:29:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"The OpenSourceMalware Show #13","link":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode13","guid":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode13","description":"Dependabot cooldowns, Jscrambler and AsynchAPI compromises, new PolinRider research","pubDate":"Thu, 16 Jul 2026 22:00:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"PolinRider Confirmed Footprint Grows 6.5x Since March","link":"https:\/\/opensourcemalware.com\/blog\/polinrider-blast-radius-grows","guid":"https:\/\/opensourcemalware.com\/blog\/polinrider-blast-radius-grows","description":"Our July hunt uncovered 2,417 newly-compromised repos, pushing confirmed footprint to 4,367 poisoned repos across 2,152 owners","pubDate":"Wed, 15 Jul 2026 19:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"Cybersecurity Startup Publishes Infostealers to NPM","link":"https:\/\/opensourcemalware.com\/blog\/cybersecurity-startup-publishes-infostealers-to-npm","guid":"https:\/\/opensourcemalware.com\/blog\/cybersecurity-startup-publishes-infostealers-to-npm","description":"Typosquatted AI-tool packages quietly collected git, SSH, and cloud identity data through install scripts, tracing back to one unexpected publisher","pubDate":"Thu, 09 Jul 2026 23:53:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"The OpenSourceMalware Show #12","link":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode12","guid":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode12","description":"Interview with Head of Security at Open VSX, plus new PolinRider research, and two security venders get in trouble with the community","pubDate":"Thu, 09 Jul 2026 23:52:35 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"PolinRider Jumps the Fence to Go, Packagist, npm, PyPI","link":"https:\/\/opensourcemalware.com\/blog\/polinrider-jumps-the-fence","guid":"https:\/\/opensourcemalware.com\/blog\/polinrider-jumps-the-fence","description":"DPRK\u2019s most successful campaign spread from GitHub into several package ecosystems without any changes to the malware.\n","pubDate":"Wed, 08 Jul 2026 16:52:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"The OpenSourceMalware Show #11","link":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode11","guid":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode11","description":"NPM account lockout protection, GitHub Enterprise credential revocation, researcher-deployed malware, and an FBI notice on Team PCP","pubDate":"Thu, 02 Jul 2026 23:30:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"The OpenSourceMalware Show #10","link":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode10","guid":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode10","description":"Version sandwiching, blockchain C2 reuse, cross-ecosystem attacks, dynamic imports, and payload splitting","pubDate":"Thu, 25 Jun 2026 22:30:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"The OpenSourceMalware Show #9","link":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode09","guid":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode09","description":"Mastra compromise, agentjacking, and malware mythbusting","pubDate":"Thu, 18 Jun 2026 23:20:56 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier","link":"https:\/\/opensourcemalware.com\/blog\/mastra-npm-malware","guid":"https:\/\/opensourcemalware.com\/blog\/mastra-npm-malware","description":"A malicious transitive dependency hit 140+ npm packages, with tradecraft matching the Axios compromise","pubDate":"Thu, 18 Jun 2026 05:57:35 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"The OpenSourceMalware Show #8","link":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode08","guid":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode08","description":"MSFT unpublished 73 repos, VS Code extension cooldowns, npm v12, Miasma open-sourced, and package firewalls","pubDate":"Thu, 11 Jun 2026 12:00:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"The Pros and Cons of NPM v12's Security Improvements","link":"https:\/\/opensourcemalware.com\/blog\/npm-v12","guid":"https:\/\/opensourcemalware.com\/blog\/npm-v12","description":"NPM package manager (v12) closes serious security gaps, including making install scripts opt-in, but implementing it may not have the intended outcomes.","pubDate":"Wed, 10 Jun 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"Active Malware Campaigns in January-May 2026","link":"https:\/\/opensourcemalware.com\/blog\/active-malware-campaigns-in-january-may-2026","guid":"https:\/\/opensourcemalware.com\/blog\/active-malware-campaigns-in-january-may-2026","description":"We surfaced three trends about malware: npm and PyPI growing at similar rates, ATOs aren\u2019t the only risk, and threat actors targeted non-developers.","pubDate":"Mon, 08 Jun 2026 12:00:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"Miasma Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds","link":"https:\/\/opensourcemalware.com\/blog\/miasma-blight-reaches-microsoft-73-repos-disabled-in-105-seconds","guid":"https:\/\/opensourcemalware.com\/blog\/miasma-blight-reaches-microsoft-73-repos-disabled-in-105-seconds","description":"A terms of use violation triggered repos for Microsoft and Azure to go down for investigations - signs point to Miasma npm malware","pubDate":"Sat, 06 Jun 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"The Software Supply Chain Malware Landscape: January - May 2026","link":"https:\/\/opensourcemalware.com\/blog\/the-software-supply-chain-malware-landscape-january-may-2026","guid":"https:\/\/opensourcemalware.com\/blog\/the-software-supply-chain-malware-landscape-january-may-2026","description":"We surfaced three trends about malware: npm and PyPI growing at similar rates, ATOs aren\u2019t the only risk, and threat actors targeted non-developers.","pubDate":"Wed, 03 Jun 2026 12:00:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"The OpenSourceMalware Show #7","link":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode07","guid":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode07","description":"Miasma npm worm targets Red Hat via trusted publishing abuse, OpenSourceMalware 2026 threat data, and the gray-area Moika campaign.","pubDate":"Wed, 03 Jun 2026 12:00:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"The OpenSourceMalware Show #6","link":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode06","guid":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode06","description":"OSV false positives, Crowdstrike takedown of Glassworm infra, and MSFT nukes a researcher","pubDate":"Thu, 28 May 2026 12:00:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"The OpenSourceMalware Show #5","link":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode05","guid":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode05","description":"npm staged publishing, DPRK's Axios-linked packages, TeamPCP's biggest npm maintainer compromise yet, and how a poisoned VS Code extension led to a GitHub emplo","pubDate":"Thu, 21 May 2026 12:00:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"TeamPCP Compromises AntV and 322 Other NPM Packages","link":"https:\/\/opensourcemalware.com\/blog\/teampcp-compromises-antv-npm","guid":"https:\/\/opensourcemalware.com\/blog\/teampcp-compromises-antv-npm","description":"TeamPCP compromised npm maintainers atool and prop, republishing 324 packages including the AntV suite across 645 versions. IOCs and remediation steps inside.","pubDate":"Wed, 20 May 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"Axios Attacker Behind Three More Malicious NPM Packages","link":"https:\/\/opensourcemalware.com\/blog\/axios-attacker-strikes-again","guid":"https:\/\/opensourcemalware.com\/blog\/axios-attacker-strikes-again","description":"Three malicious NPM packages connected to the March Axios compromise have been quietly harvesting developer credentials since early April","pubDate":"Tue, 19 May 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"How Malware Abuses NPM Lifecycle Scripts and VS Code Tasks","link":"https:\/\/opensourcemalware.com\/blog\/how-malware-abuses-npm-lifecycle-scripts-and-vs-code-tasks","guid":"https:\/\/opensourcemalware.com\/blog\/how-malware-abuses-npm-lifecycle-scripts-and-vs-code-tasks","description":"npm lifecycle scripts and VS Code tasks.json are productivity features that threat actors have learned to weaponize triggering malware","pubDate":"Thu, 14 May 2026 12:00:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"The OpenSourceMalware Show #4","link":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode04","guid":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode04","description":"RubyGems bot attack, ShinyHunters ransom Canvas, and the latest on Mini Shai-Hulud.","pubDate":"Thu, 14 May 2026 12:00:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"TeamPCP Hits TanStack, OpenSearch, and Mistral with Mini Shai-Hulud","link":"https:\/\/opensourcemalware.com\/blog\/teampcp-mini-shai-hulud-tanstack-opensearch-and-mistral","guid":"https:\/\/opensourcemalware.com\/blog\/teampcp-mini-shai-hulud-tanstack-opensearch-and-mistral","description":"TeamPCP's self-spreading npm worm \"Mini Shai-Hulud\" has compromised 170 npm packages and crossed into PyPI.","pubDate":"Wed, 13 May 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"The OpenSourceMalware Show #3","link":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode03","guid":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode03","description":"git hook persistence, Antrea compromise, Dirty Frag, cPanel exploitation, interpreted language malware","pubDate":"Thu, 07 May 2026 12:00:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"Lazarus Group Using Git Hooks To Hide Malware","link":"https:\/\/opensourcemalware.com\/blog\/lazarus-group-uses-git-hooks-to-hide-malware","guid":"https:\/\/opensourcemalware.com\/blog\/lazarus-group-uses-git-hooks-to-hide-malware","description":"The Contagious Interview and TaskJacker campaigns now hides the stage-2 loader inside git hooks that download InvisibleFerret and Beavertail malware","pubDate":"Wed, 06 May 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"CNCF Project Antrea Compromised in Daring GitHub Attack","link":"https:\/\/opensourcemalware.com\/blog\/cncf-project-antrea-compromised-in-daring-github-attack","guid":"https:\/\/opensourcemalware.com\/blog\/cncf-project-antrea-compromised-in-daring-github-attack","description":"The Antrea open-source Kubernetes project was attacked via its Jenkins integration on May 2 by an unknown threat actor who opened a malicious pull request,","pubDate":"Tue, 05 May 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"The OpenSourceMalware Show #2","link":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode02","guid":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode02","description":"Lovable and Vercel security incidents, a crazy git push RCE exploit, EDR vs AI agents, and the Mini-Shai-Hulud attack","pubDate":"Thu, 30 Apr 2026 12:00:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"The OpenSourceMalware Show #1","link":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode01","guid":"https:\/\/opensourcemalware.com\/blog\/opensourcemalware-show-episode01","description":"TeamPCP compromises Bitwarden, npm lifecycle scripts, OWASP's npm security cheat sheet","pubDate":"Thu, 30 Apr 2026 12:00:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"Mini Shai-Hulud Weaponizes Tasks.JSON Files","link":"https:\/\/opensourcemalware.com\/blog\/mini-shai-hulud-weaponizes-tasks-json-files","guid":"https:\/\/opensourcemalware.com\/blog\/mini-shai-hulud-weaponizes-tasks-json-files","description":"Mini Shai-Hulud is a malicious npm worm by TeamPCP. It weaponizes tasks.json files, a technique first seen in North Korean Lazarus Group campaigns.","pubDate":"Thu, 30 Apr 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"Security Anti-Patterns Caused by AI Coding Tools","link":"https:\/\/opensourcemalware.com\/blog\/security-anti-patterns-caused-by-ai-coding-tools","guid":"https:\/\/opensourcemalware.com\/blog\/security-anti-patterns-caused-by-ai-coding-tools","description":"Agentic platforms like Lovable, Claude, and Codex cause unexpected security anti-patterns","pubDate":"Sun, 26 Apr 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"Stardrop Supply Chain Attack Targets Venture Capital Firms, Luxury Brands, and AI Companies","link":"https:\/\/opensourcemalware.com\/blog\/stardrop-supply-chain-attack-targets-venture-capital-firms-luxury-brands-and-ai-companies","guid":"https:\/\/opensourcemalware.com\/blog\/stardrop-supply-chain-attack-targets-venture-capital-firms-luxury-brands-and-ai-companies","description":"Dozens of malicious npm packages to targeting AI companies, luxury brands, and venture capital firms. ","pubDate":"Tue, 14 Apr 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"PolinRider DPRK Attack Expands Across GitHub","link":"https:\/\/opensourcemalware.com\/blog\/polinrider-rides-again-north-korean-attack-expands-across-github","guid":"https:\/\/opensourcemalware.com\/blog\/polinrider-rides-again-north-korean-attack-expands-across-github","description":"This North Korean attack has compromised 1,951 unique repositories belonging to 1,047 unique owners - a 3x growth since the campaign's discovery","pubDate":"Sun, 12 Apr 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"Velora (formerly ParaSwap) SDK Version 9.4.1 Compromised And Installing Malware","link":"https:\/\/opensourcemalware.com\/blog\/velora-formerly-paraswap-sdk-version-941-compromised-and-installing-malware","guid":"https:\/\/opensourcemalware.com\/blog\/velora-formerly-paraswap-sdk-version-941-compromised-and-installing-malware","description":"The npm package @velora-dex\/sdk version 9.4.1 contains malicious code that automatically downloads and executes a shell script from a remote server  when the","pubDate":"Wed, 08 Apr 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"The Social Engineering Playbook Attackers Use to Target OSS Maintainers","link":"https:\/\/opensourcemalware.com\/blog\/the-social-engineering-playbook-attackers-use-to-target-oss-maintainers","guid":"https:\/\/opensourcemalware.com\/blog\/the-social-engineering-playbook-attackers-use-to-target-oss-maintainers","description":"Account takeovers are some of the most harmful malware campaigns. Many start by compromising a maintainer account through social engineering.","pubDate":"Wed, 01 Apr 2026 12:00:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"Has TeamPCP Pivoted To Using The PureHVNC RAT?","link":"https:\/\/opensourcemalware.com\/blog\/has-teampcp-pivoted-to-using-the-purehvnc-rat","guid":"https:\/\/opensourcemalware.com\/blog\/has-teampcp-pivoted-to-using-the-purehvnc-rat","description":"New threat campaign using PureHVNC has been tied to TeamPCP.  ","pubDate":"Tue, 31 Mar 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"TasksJacker DPRK Attack Compromises GitHub Users Via VS Code Tasks","link":"https:\/\/opensourcemalware.com\/blog\/tasksjacker-dprk-attack-github-vscode","guid":"https:\/\/opensourcemalware.com\/blog\/tasksjacker-dprk-attack-github-vscode","description":"A technical deep-dive into the next generation of DPRK attacks that borrows from Shai-hulud and Contagious Interview to compromise dozens of GitHub users","pubDate":"Tue, 31 Mar 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"Malicious Transitive Dependency in Axios Affects Millions of Users","link":"https:\/\/opensourcemalware.com\/blog\/axios-compromise-transitive-dependency","guid":"https:\/\/opensourcemalware.com\/blog\/axios-compromise-transitive-dependency","description":"The Axios NPM package has been compromised and the maintainer of the project has been locked out of their account.  This will go down in history as one of the","pubDate":"Tue, 31 Mar 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"TeamPCP Supply Chain Campaign: A March 2026 Retrospective","link":"https:\/\/opensourcemalware.com\/blog\/teampcp-supply-chain-campaign-a-march-2026-retrospective","guid":"https:\/\/opensourcemalware.com\/blog\/teampcp-supply-chain-campaign-a-march-2026-retrospective","description":"TeamPCP executed a cascading multi-phase supply chain attack that started with a single unrevoked credential stolen from Trivy's CI pipeline.","pubDate":"Thu, 26 Mar 2026 12:00:00 GMT","author":"cb482791-4ef1-4762-96ad-b0ca4bdd538e"},{"title":"TeamPCP Hijacks LiteLLM's PyPI Package","link":"https:\/\/opensourcemalware.com\/blog\/teampcp-hijacks-litellms-pypi-package-credential-stealer-hits-40k-star-project","guid":"https:\/\/opensourcemalware.com\/blog\/teampcp-hijacks-litellms-pypi-package-credential-stealer-hits-40k-star-project","description":"TeamPCP compromised the LiteLLM maintainer's PyPI account and published malicious versions that steal credentials from every Python process on the host.","pubDate":"Wed, 25 Mar 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"TeamPCP Defaces Aqua Security\u2019s Internal GitHub Org","link":"https:\/\/opensourcemalware.com\/blog\/teampcp-defaces-aqua-securitys-internal-github-org-44-repos-exposed","guid":"https:\/\/opensourcemalware.com\/blog\/teampcp-defaces-aqua-securitys-internal-github-org-44-repos-exposed","description":"TeamPCP compromised the aquasec-com GitHub organization, renaming all 44 repositories and exposing internal source code, CI\/CD configs, and knowledge bases.","pubDate":"Mon, 23 Mar 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"GlassWorm Invades GitHub, NPM, VS Code, and Python","link":"https:\/\/opensourcemalware.com\/blog\/glassworm-invades-github-npm-open-vsx-and-vs-code","guid":"https:\/\/opensourcemalware.com\/blog\/glassworm-invades-github-npm-open-vsx-and-vs-code","description":"The latest Glassworm attack compromised 430+ GitHub projects by leveraging four different ecosystems","pubDate":"Mon, 16 Mar 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"Hundreds of GitHub Repos Compromised By DPRK's PolinRider Campaign","link":"https:\/\/opensourcemalware.com\/blog\/polinrider-dprk-compromised-hundreds-of-github-repos","guid":"https:\/\/opensourcemalware.com\/blog\/polinrider-dprk-compromised-hundreds-of-github-repos","description":"Lazarus Group compromises GitHub repositories by implanting a malicious, obfuscated JavaScript payload.","pubDate":"Sun, 08 Mar 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"Neutralinojs Compromised In DPRK Attack","link":"https:\/\/opensourcemalware.com\/blog\/neutralinojs-compromised-in-dprk-attack","guid":"https:\/\/opensourcemalware.com\/blog\/neutralinojs-compromised-in-dprk-attack","description":"DPRK threat actors compromised Neutralinojs as part of a larger attack that utilizes stolen GitHub credentials to force-push backdated malicious commits","pubDate":"Fri, 06 Mar 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"XPACK Malware Disguises Cryptocurrency Extortion as NPM Package Monetization","link":"https:\/\/opensourcemalware.com\/blog\/xpack-attack-cryptocurrency-extortion-disguised-as-npm-package-monetization","guid":"https:\/\/opensourcemalware.com\/blog\/xpack-attack-cryptocurrency-extortion-disguised-as-npm-package-monetization","description":"A malware campaign weaponizes npm to extort crypto payments from developers during package installation","pubDate":"Mon, 09 Feb 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"Malicious ClawHub Skills Use External Websites to Hide in Plain Sight","link":"https:\/\/opensourcemalware.com\/blog\/malicious-clawhub-skills-use-external-websites-to-hide-in-plain-sight","guid":"https:\/\/opensourcemalware.com\/blog\/malicious-clawhub-skills-use-external-websites-to-hide-in-plain-sight","description":"Threat actors evolved ClawHub malware by moving payloads to convincing fake websites, allowing them to completely circumvent VirusTotal scans.","pubDate":"Mon, 09 Feb 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"Malicious ClawHub Skills Target OpenClaw Users","link":"https:\/\/opensourcemalware.com\/blog\/malicious-clawhub-skills-target-openclaw-users","guid":"https:\/\/opensourcemalware.com\/blog\/malicious-clawhub-skills-target-openclaw-users","description":"Malicious ClawdBot skills target ByBit, Polymarket, Axiom, Reddit and LinkedIn, installing malware on unsuspecting OpenClaw user machines.","pubDate":"Sun, 01 Feb 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"DPRK Contagious Interview \u201cFake Font\u201d Abuses VS Code Tasks","link":"https:\/\/opensourcemalware.com\/blog\/dprk-contagious-interview-campaign-fake-font-uses-malicious-vs-code-fonts","guid":"https:\/\/opensourcemalware.com\/blog\/dprk-contagious-interview-campaign-fake-font-uses-malicious-vs-code-fonts","description":"\u201cLazarus Group's Fake Font campaign abuses VS Code task automation to silently execute BeaverTail malware, delivering the InvisibleFerret backdoor\u201d","pubDate":"Wed, 28 Jan 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"Small Open-Source Maintainers Targeted by VS Code Tasks Malware","link":"https:\/\/opensourcemalware.com\/blog\/small-open-source-maintainers-targeted-by-vs-code-tasks-malware","guid":"https:\/\/opensourcemalware.com\/blog\/small-open-source-maintainers-targeted-by-vs-code-tasks-malware","description":"At least 21 small OSS maintainers hit in 72 hours via malicious VS Code task configurations","pubDate":"Mon, 26 Jan 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"A Comprehensive Analysis of DPRK's Contagious Interview","link":"https:\/\/opensourcemalware.com\/blog\/contagious-interview-gets-an-upgrade-for-2026","guid":"https:\/\/opensourcemalware.com\/blog\/contagious-interview-gets-an-upgrade-for-2026","description":"A single NPM package that led us to the Lazarus Groups latest campaign targeting software engineers using fake recruiters on LinkedIn, Fiverr and UpWork.","pubDate":"Tue, 20 Jan 2026 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"DPRK Malware Hiding in Microsoft VSCode Dictionary Files","link":"https:\/\/opensourcemalware.com\/blog\/dprk-malware-microsoft-vscode-dictionary-files","guid":"https:\/\/opensourcemalware.com\/blog\/dprk-malware-microsoft-vscode-dictionary-files","description":"North Korean threat actors are hiding multi-stage malware droppers in VSCode configuration files, disguised as spell-check dictionaries.","pubDate":"Tue, 23 Dec 2025 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"Elf-Stats NPM Christmas Spam Campaign","link":"https:\/\/opensourcemalware.com\/blog\/elf-stats-npm-christmas-spam-campaign","guid":"https:\/\/opensourcemalware.com\/blog\/elf-stats-npm-christmas-spam-campaign","description":"This campaign includes 36 individual packages spread across 23 different NPM users.","pubDate":"Wed, 03 Dec 2025 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"DPRK Contagious Interview Malware Weaponizes Microsoft VSCode Tasks","link":"https:\/\/opensourcemalware.com\/blog\/latest-contagious-interview-malware-campaign-abuses-microsoft-vscode-tasks","guid":"https:\/\/opensourcemalware.com\/blog\/latest-contagious-interview-malware-campaign-abuses-microsoft-vscode-tasks","description":"Lazarus Group evolves their developer-focused campaign to hide malware in VS Code tasks.json files","pubDate":"Sat, 29 Nov 2025 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"},{"title":"IndonesianFoods Worm Publishes 86,000+ Malicious NPM Packages","link":"https:\/\/opensourcemalware.com\/blog\/indonesianfoods-worm-86000-malicious-npm-packages","guid":"https:\/\/opensourcemalware.com\/blog\/indonesianfoods-worm-86000-malicious-npm-packages","description":"NPM was flooded with junk packages that waste infrastructure resources, pollute search results, and creates supply chain risks if devs accidentall consume them.","pubDate":"Thu, 13 Nov 2025 12:00:00 GMT","author":"c0a15726-c5b1-4b0d-85e6-fe15553df9e2"}]}}