Paul McCarty & Jenn Gile on how 540 packages under one maintainer expose a supply chain blind spot

Paul McCarty and Jenn Gile, Co-Founders of OpenSourceMalware, join Eli Woodward to discuss how malicious open source packages have become a major software supply chain attack vector, and why most organizations lack the visibility and threat data to defend against them.

Topics discussed:

• Defining open source malware across packages, extensions, and repos
• Team PCP’s credential hoarding and multi-wave attack strategy
• Account takeovers versus “bad from the start” malicious packages
• DPRK’s Contagious Interview and Task Jacker campaigns
• Using GitHub as backup C2 for exfiltrated credentials
• Bridging the gap between CTI teams and application security
• Malicious AI agent skills as a new attack surface

Key Takeaways:

• Audit single-maintainer packages in your dependency tree, especially those with high download counts, to identify supply chain concentration risk
• Rotate all credentials immediately after a supply chain compromise, prioritizing short-lived tokens that attackers sort and exploit first
• Integrate malicious open source threat feeds into your threat intelligence platform and disseminate indicators across CTI, AppSec, and SOC teams
• Train developers to recognize Contagious Interview tactics, including fake recruiter outreach and take-home coding assessments that deliver malware through forked repos
• Monitor GitHub for unauthorized public repositories created in your organization’s accounts, which attackers use as encrypted backup C2 for stolen credentials
• Evaluate AI agent skill registries with the same rigor as package registries, since natural language payloads bypass traditional static analysis tools
• Designate a central owner for malicious open source intelligence who connects development, application security, and threat hunting teams

Listen to More Episodes:  YouTube  •  Apple  •  Spotify  •  Website