Podcast Covers RubyGems Attack, Canvas Ransomware and Team PCP’s Supply-Chain Campaign
Summary
The OpenSourceMalware Show discusses malicious RubyGems uploads, the ShinyHunters attack on Canvas operator Instructure, and Team PCP’s package compromises using GitHub Actions cache poisoning.
Key points
- RubyGems disabled new account signups after hundreds of bots pushed around 500 packages, some containing malicious code; the hosts questioned whether calling it a DDoS attack was accurate.
- The hosts said ShinyHunters stole 3.65TB of data from Instructure, including private Canvas messages, and reported that Instructure paid a ransom and the group removed the data.
- The hosts said Team PCP claimed responsibility for Mini Shai-Hulud but was not connected to the original 2025 campaign.
- The TanStack compromise used a GitHub Actions cache-poisoning technique and affected more than 90 packages, according to the hosts; it did not rely on long-lived credentials.
- The hosts said malware is increasingly targeting transitive dependencies and hidden .claude directories on developer machines.
- They recommended checking packages and repositories against threat feeds throughout CI and using isolation, network controls, and staging practices.
Article Details
- Event Type
- Cybersecurity news discussion covering malicious package campaigns, a ransomware breach, and an npm supply-chain compromise.
- Impact
- The RubyGems registry disabled new account signups after bots uploaded around 500 packages, some containing malicious code. ShinyHunters breached Instructure and stole 3.65 TB of Canvas data, including private messages; the speakers report that Instructure paid a ransom and ShinyHunters removed the data. Team PCP’s Mini Shai-Hulud campaign compromised TanStack and more than 90 packages, with potential downstream risk to package users and developer environments.
People
Adnan KhanResearcher whose GitHub Actions cache-poisoning technique was used in the TanStack compromise, according to the discussion.Jenn GileCo-host discussing the incidents and their cybersecurity implications.Ronnie CarterNamed as a researcher who publishes research on GitHub Actions cache poisoning with Adnan Khan.
Threat Actors
Lazarus GroupDescribed as continuing to focus on Contagious Interview-style attacks targeting individual developers.ShinyHuntersThreat group reported to have breached Instructure, stolen Canvas data, demanded ransom, and later removed the data after Instructure paid.TeamPCPThreat group that admitted responsibility for Mini Shai-Hulud and was reported to have compromised TanStack and more than 90 packages.
Malware
Vendors
Products
CanvasCanvas ransomware by ShinyHunters: ShinyHunters breached Instructure, the company behind the Canvas LMS used by over 30 million students globally, stealing 3.65TB of data including private messages between students andGitHub Actionsis not connected to the original 2025 Shai-Hulud campaign. Paul explains how they used Adnan Khan’s GitHub Actions cache poisoning technique to compromise TanStack and 90-plus packages without long-lived credentials,npmTanStack npm supply-chain compromise postmortemRubyGemsRubyGems bot attack: Hundreds of bots pushed 500-plus packages to RubyGems, some carrying exploits, forcing the registry to shut down new account signups. Jenn and Paul break down why the DDoS label may be misleadingTanStackMini Shai-Hulud and TanStack: Team PCP is not connected to the original 2025 Shai-Hulud campaign. Paul explains how they used Adnan Khan’s GitHub Actions cache poisoning technique to compromise TanStack and 90-plus