Russian threat actors compromised a GitHub contributor back in March and used that access today to hack the @OVHcloud CLI tool. opensourcemalware.com/blog/g…

Heya @neumenetwork, the GhostAction threat actor has compromised three of your repos: github.com/neume-network/cor… github.com/neume-network/str… and github.com/neume-network/dat…

We're going live with the @ossmalware podcast in 30 minutes! linkedin.com/events/75158038…

Yes! DPRK has brought the post-checkout git hook back! Dunno why they slept on this cuz no one has a mitigation for it. *shrug*

Heads up! A phishing campaign is using the my-github[.]com domain to target contributors on critical open-source projects. I've written up a technical blog post here: opensourcemalware.com/blog/g…

Maybe if your models didn't make stuff up all the time, I wouldn't have to yell at it to STOP MAKING SHIT UP, YOU DUMB, SOULLESS, PIECE OF SHIT

New stage in the GhostActions campaign as the threat actor has registered two domains targeting @github and @gitlab. Read about it in my latest blog post: opensourcemalware.com/blog/g…

I do a LOT of disclosure, and I've been meaning to get something off my chest: “Responsible disclosure” is a two-way street. I am not legally obligated to report a finding to your shitty, low-paying bug bounty program. Got it?! So, now that we have that sorted, this is how "responsible disclosure" is supposed to work: I disclose the vulnerability responsibly and, in return, you communicate with me, act in good faith, respect my work (and time!), and treat me like the person who HELPED you—not the person who attacked you. You don't get to demand responsibility from researchers while behaving irresponsibly toward them. Fuck that noise.

Heya @CommBank_ID, whoever is in charge of your Yello App rollout, please fire them ASAP. This has got to be one of the worst product rollouts I've ever seen.

Heya @pypi team, can I make a suggestion? Please require a validated @pypi username when publishing so it's included in the package metadata. Right now, that field isn't validated, which makes tracking threat actors harder. Also, this is one of the few areas that NPM has you beat, which is youch.

Woot! xitter.cf/ossmalware/status/2106…

If you look up "fuck around and find out" in the dictionary, you will see this: bleepingcomputer.com/news/se…

The @ossmalware podcast is going live in an hour! linkedin.com/events/75112183…

Yes, I identified the new Ethereum transaction technique in August and named it NullReceiver. opensourcemalware.com/blog/n…

I'm monitoring DPRK-generated forks of some of the world's most popular open-source projects, including @openclaw , @FlutterDev , @TensorFlow , VS Code, @AnthropicAI, and @OpenCode. As soon as the threat actor creates a PR, @ossmalware will flag it and reach out to maintainers.

Last week, I discovered a new JavaScript stealer we are calling "WeaselBiscuit". The name is a riff on "OtterCookie", as this is a tight, stripped-down stealer. It only steals browser extension storage and clipboard contents. Includes a keylogger and dead-simple HTTP C2. No socketio C2, doesn't steal tokens/keys, etc., and no persistence. Looks like DPRK, but attribution is still a work in progress. Read more: opensourcemalware.com/blog/i…

Join me at @BSidesCbr for an all-day workshop this Saturday, September 26th: "Software Supply Chain Threat Intelligence: Hands-On Training for SecOps and Threat Hunting Teams" cfp.bsidescbr.com.au/bsides-…

Heya @vercel, two PRs are pending for the github.com/shadcn-ui/ui/ project, and both contain hidden DPRK malware. This is a VERY popular NPM package, and I want to make sure you kill both PRs. Here's my GitHub Issue: github.com/shadcn-ui/ui/issu…

Great report from @chainalysis about growth of blockchain dead drops. I am seeing huge uptick in BDD’s in software supply chain attacks. Thanks for linking to @ossmalware NullReceiver research. chainalysis.com/blog/etherhi…

The OpenSourceMalware Show is going live in 45 minutes! @ossmalware linkedin.com/events/75056507…