cyber.hendryadrian.com
Security News · opensourcemalware.com

Podcast Covers PolinRider’s Spread, Malicious npm Packages and Open VSX Security

· Original article ↗

Summary

The episode discusses PolinRider’s spread into Go and PHP, malicious npm packages attributed to a cybersecurity startup, a lawsuit over an allegedly false IOC, and Open VSX’s security controls.

Key points

  • The hosts say North Korea’s PolinRider campaign can spread malicious packages into Go and PHP ecosystems through compromised developers’ GitHub repositories.
  • The episode reports that seven malicious npm infostealer packages attributed to a cybersecurity startup were taken down and the publisher’s npm account was removed.
  • MeetingTV alleges Koi Security wrongly listed its domain as C2 infrastructure, causing business harm. Koi removed the domain; the lawsuit’s allegations are not presented as court findings.
  • The Open VSX security lead describes pre-publication scanning, quarantine and human review for suspicious extensions.
  • Open VSX scans for malware, secrets, impersonation and obfuscation, and is developing checks for malicious changes to previously benign extensions.
  • The interview covers limited-lifetime publishing tokens and revocation, publisher and namespace verification, and collaboration with security researchers.

Article Details

Event Type
Cybersecurity news episode covering software supply-chain threats, malicious package publishing, a lawsuit over a false-positive IOC, and Open VSX security.
Impact
The discussed threats include malicious packages and extensions spreading through developer ecosystems, infostealers collecting data from developer machines, and a reported false-positive IOC that MeetingTV says led to blocking and lost revenue. Open VSX describes measures including pre-publication scanning, token controls, and human review of quarantined extensions.

MITRE ATT&CK

T1195.002 · Compromise Software Supply ChainMalicious packages and extensions were published or distributed through software repositories and package or extension ecosystems.

People

Jenn GileHost of the episode discussing the reported security incidents and Open VSX.Mikael BarberoHead of security at the Eclipse Foundation who described Open VSX security measures.Paul McCartyResearcher who discussed discovering the PolinRider campaign and malicious npm packages.

Threat Actors

Lazarus GroupIdentified in the episode as the North Korean group behind the PolinRider repository-hijacking campaign.TeamPCPNamed as having gained access to several thousand GitHub repositories after a malicious Nx Console extension was consumed.

Malware

GlassWorm(report) GlassWorm: Open VSX Transitive Dependency Supply-Chain Escalation

Vendors

Eclipse FoundationThis episode also features an interview with Mikael Barbero (Head of Security, Eclipse Foundation) on OpenVSX security — We covered OpenVSX's explosive growth, its pre-publish scanning pipeline, looking for "sleeperKoi SecurityMeetingTV sues Palo Alto Networks — a lawsuit alleging Koi Security's AI-assisted analysis hallucinated a company's domain onto a C2 infrastructure list, with real business falloutPalo Alto NetworksMeetingTV sues Palo Alto Networks — a lawsuit alleging Koi Security's AI-assisted analysis hallucinated a company's domain onto a C2 infrastructure list, with real business fallout

Products

GitHub[00:00:37] Paul McCarty: Yeah, it was on, like, hunting threats, adversary threats in, in GitHub.npmCybersecurity startup publishes infostealers to npm — a vendor publishing malicious packages to manufacture threat data for its own marketing, and getting their npm account pulled for itOpen VSX(webpage) Open VSX Security Researcher Recognition ProgramPackagist(blog) PolinRider Jumps the Fence to Go, Packagist, npm, PyPIVS Codeis to make a name for themselves, they do a bunch of, um... You know, they publish malicious, uh, VS Code extensions or malicious npm packages, or whatever the case may be, and then they use their publishing of

Tools

YARA[00:29:06] Mikael Barbero: So we search for p- payload, known payloads for malware of course. We use Yara in the background for many of those scans. We also use AI assisted malware detection, of course, for some

Countries

North KoreaPolinRider jumps the fence — Paul's research on North Korea's automated repo-hijacking campaign spreading into the Go and PHP ecosystems without any extra effort from the threat actors

Related Articles