I'm monitoring DPRK-generated forks of some of the world's most popular open-source projects, including @openclaw , @FlutterDev , @TensorFlow , VS Code, @AnthropicAI, and @OpenCode. As soon as the threat actor creates a PR, @ossmalware will flag it and reach out to maintainers.

Last week, I discovered a new JavaScript stealer we are calling "WeaselBiscuit". The name is a riff on "OtterCookie", as this is a tight, stripped-down stealer. It only steals browser extension storage and clipboard contents. Includes a keylogger and dead-simple HTTP C2. No socketio C2, doesn't steal tokens/keys, etc., and no persistence. Looks like DPRK, but attribution is still a work in progress. Read more: opensourcemalware.com/blog/i…

Join me at @BSidesCbr for an all-day workshop this Saturday, September 26th: "Software Supply Chain Threat Intelligence: Hands-On Training for SecOps and Threat Hunting Teams" cfp.bsidescbr.com.au/bsides-…

Heya @vercel, two PRs are pending for the github.com/shadcn-ui/ui/ project, and both contain hidden DPRK malware. This is a VERY popular NPM package, and I want to make sure you kill both PRs. Here's my GitHub Issue: github.com/shadcn-ui/ui/issu…

Great report from @chainalysis about growth of blockchain dead drops. I am seeing huge uptick in BDD’s in software supply chain attacks. Thanks for linking to @ossmalware NullReceiver research. chainalysis.com/blog/etherhi…

The OpenSourceMalware Show is going live in 45 minutes! @ossmalware linkedin.com/events/75056507…

I had an amazing time in France with @teamcymru_S2 and @ossmalware for the Underground Economy conference. So many great connections and looking forward to what comes next!

Ticket to @DEATHCon2026 acquired! Get yours at deathcon.io/

Oh snap! @watchtowrcyber just dropped a CVSS 10 on @gitlab versions 18.7 < 19.1.8, 19.2 < 19.2.6, and 19.3 < 19.3.2. CVE-2026-85706, and yes, it's on the KEV list. watchtowr.com/resources/rapi…

The crazy thing is, I bet that works with a bunch of the DIY scanners out there.

OMG, I called it! fetch-page-assets and html-to-gutenberg are both installing malware again. @GitHubSecurity when are you gonna realize this user is compromised by DPRK and disable his ability to publish packages? Also, aren't you supposed to be scanning packages now? Wut up with dat?!

I did a podcast with some of the leaders at @OX__Security, @SocketSecurity, @ossmalware, @step_security and @AikidoSecurity, hosted by the one and only @advocatemack. I say some spicy shizzle, so give it a listen --> piped.video/watch?v=DBVDR6SC…

Heya @npmjs and @github, maybe you should consider not letting new NPM user accounts publish hundreds of packages? Seems like an obvious control to limit the number of packages a new account can publish, but NPM has never been great at being proactive. So we get shit like this...🤦‍♀️ opensourcemalware.com/?searc…

Stoked for the latest episode of the @ctbbpodcast with the return of @0xteknogeek to the pod. Great conversation with @Rhynorater about the issues facing @Hacker0x01, and bug bounty as a whole. Legit. piped.video/watch?v=8GzITCxW…

TeamPCP - 0 @AusFedPolice - 2

The fetch-page-assets and html-to-gutenberg NPM packages have been compromised again. The maintainer was compromised by PolinRider back in May and their GitHub is absolutely overflowing with DPRK malware. Whenever the maintainer pushes new updates to his packages, the malware comes along for the ride. Nine malicious versions on @npmjs right now.

Has anyone seen #dprk using @GoDaddy for DNS registration before? I've heard a rumour that GoDaddy is accepting crypto as payment now through a third party, and I want to verify whether that's true.

Heya @VirginAustralia your Sydney experience is shit. First, you close Virgin only security entrance. Now today I found you have closed international to domestic transfer station. Then no priority lane at zone E checkin. Feels like Jetstar. Wtf?