technology
Hosted by OpenSourceMalware · technology · EN-US
When you think about malware, you probably envision phishing emails or sketchy websites. But malicious open source - targeting software developers and their build systems - is becoming a top way that threat actors deliver malware. Just one 'npm install' can trigger payloads that steal information and credentials. Software supply chain attacks by state actors, ransomware groups, and freelancers are happening every day. Hosted by Jenn Gile and Paul McCarty (co-founders of OpenSourceMalware), this podcast explores the latest trends and attacks, and helps defenders understand the tactics needed to prevent their orgs from being the next target. OpenSourceMalware provides community-driven threat intelligence on malicious open source assets including packages, domains, IP addresses, crypto wallets, and more. https://opensourcemalware.com/
Required Pod Score for this podcast. PitchCentric checks your profile against host openness, topical fit, and audience signals before you generate a pitch.
Contact path
Public web form
Booking probability
29%
Guest openness
Selective
Sign up to generate a grounded pitch for The OpenSourceMalware Show.
Signup to Generate a PitchWhen you think about malware, you probably envision phishing emails or sketchy websites. But malicious open source - targeting software developers and their build systems - is becoming a top way that threat actors deliver malware. Just one 'npm install' can trigger payloads that steal information and credentials.
The OpenSourceMalware Show is hosted by OpenSourceMalware. The show has published 26 episodes to date.
Recent episodes include "Brotli vulnerability, LiteLLM breached via unrevoked key, poisoned prompt downloads malware" (28 October 2026, 31 minutes), "OVH CLI compromised by Glassworm, compound payloads hide malware, GhostAction copycats PolinRider" (21 October 2026, 42 minutes), and "GitHub security improvements, GhostAction phishes OSS maintainers, and DoJ shuts down DPRK laptop farms" (15 October 2026, 27 minutes).
The OpenSourceMalware Show publishes roughly weekly, with episodes averaging 36 minutes across 26 episodes.
Booking probability for The OpenSourceMalware Show is 29%, and the host is rated Selective on guests. The OpenSourceMalware Show requires a Pod Score of 80 or higher. The OpenSourceMalware Show's contact route on record: public web form.
The strongest fits for The OpenSourceMalware Show are IT Services & Software Development. The OpenSourceMalware Show has a technology audience.
OpenSourceMalware hosts The OpenSourceMalware Show, a technology podcast with 26 episodes published.
Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.
Episode #27
This week we talked about: Brotli vulnerability: The Brotli decoder bug behind Node2Shell reaches far beyond Node, and it's been overshadowed by the hype around PHP2Shell. Google's Brotli C code is usually vendored into...
Episode #26
This week we talked about: OVH CLI compromised by GlassWorm: GlassWorm is back. The Russian threat actor went quiet after its infrastructure was taken down earlier this year, and it resurfaced with malicious versions of...
Episode #25
This week we talked about: GitHub push attribution: GitHub now shows when the account that pushed a commit is different from the one listed as the committer, which makes faked Git history easier to spot. That could help...
Episode #23
This week we talked about: ShinyHunters and KillSec arrests: Dutch police arrested Pepijn van der Stap, a long-time ShinyHunters member known as Umbreon, on September 16, less than a year after he finished a prison...
Episode #22
This week we discussed: ShinyHunters vs. the FBI and Cl0p: ShinyHunters claims it stole data from an FBI jobs website through a PeopleSoft zero-day, and it is threatening to leak that data unless the FBI retracts a May...
Episode #21
This week we talked about: New research alleges OpenAI agents were behind the RubyGems attack. A report from independent researchers argues an OpenAI agent swarm is responsible for the GemStuffer campaign, which...
Episode #20
Jenn and Paul also mark OpenSourceMalware's first anniversary, now tracking close to 200,000 verified threats and over 100,000 IOCs. We also discuss: Mini Shai-Hulud payload resurfaces on npm. A payload from May's Mini...
Episode #19
This week we talked about: TeamPCP arrests — Australian Federal Police and the FBI arrested Ruben Thomson (21) and Louis Gaebler (23) in Perth on TeamPCP-related charges. The arrests align with the OpenSourceMalware...
Episode #18
This week we talked about: Rust arrayref compromise tied to DPRK infrastructure: A compromised maintainer account published malicious versions of the arrayref crate, along with internment and append-only-vec, adding a...
Episode #17
This week we talked about: Hacker Summer Camp trends. Jenn and Paul share observations from Black Hat, DEF CON, and BSides Las Vegas last week, including a maturing AI security conversation that has shifted to focus on...
The OpenSourceMalware Show
This week we talked about: New npm worm hits Keyv and cacheable. Jared Wray's GitHub account was compromised on Tuesday, and threat actors used it to publish a worm based on the open-sourced Mini Shai-Hulud malware. The...
Episode #15
This week we discussed: Update from Hugging Face: Hugging Face published a technical timeline of the OpenAI evaluation agent that breached its production infrastructure between July 9 and July 13, reconstructing over...
Episode #14
This week we talked about: Hugging Face breach and OpenAI's rogue model claim — Hugging Face disclosed a breach with thin details; OpenAI followed up claiming one of its models caused it during an internal security...
Episode #13
This week we talked about: GitHub turns on Dependabot cooldown periods by default — A three day cooldown is now applied automatically to all Dependabot version updates, a shift we've been anticipating in the fight...
Episode #12
This week we talked about: PolinRider jumps the fence — Paul's research on North Korea's automated repo-hijacking campaign spreading into the Go and PHP ecosystems without any extra effort from the threat actors...
Episode #11
This week we talked about: GitHub’s two new account protection features: NPM added a 72-hour read-only lockout for high-impact accounts triggered by an email change or 2FA recovery code use, aimed at slowing account...
Episode #10
This week we talked about: DPRK Lazarus Group trends in software supply chain malware: Three active techniques he's observing from North Korea's Lazarus Group. The first is “version sandwiching,” where threat actors...
Episode #9
Mastra Package Compromise: Threat actors hijacked the entire Mastra npm organization (116 packages) after a maintainer was targeted with a ClickFix-style attack that stole his credentials. Rather than injecting malware...
Episode #8
Miasma Worm Hits Microsoft — On June 5th, 73 Microsoft GitHub repositories were disabled in 105 seconds after being compromised by the Miasma worm. Four GitHub organizations were affected, including Azure Functions...
Episode #7
This week Paul and Jenn talk about: Miasma Campaign — Starting June 1st with 32 Red Hat @redhat-cloud-services packages (averaging 80,000 weekly downloads) compromised, the campaign expanded to over 80 packages and 286+...
Recent guests on The OpenSourceMalware Show. Study who booked and why before you pitch.
PitchCentric classifies The OpenSourceMalware Show under these industries. Guests from them are the closest fit, and each links to the best podcasts in that industry.
Shows with the most semantically similar episode content. Pitch one, pitch all; producers cluster.
Bad Dependencies Podcast
Below the Surface (Audio) - The Supply Chain Security Podcast
Exploited: The Cyber Truth
Cyber Threat Intel
ConversingLabs Podcast
The Exploit Archives
Is this podcast yours and you'd like to remove or correct details? Request removal or email privacy@pitchcentric.com.
Questions about the free trial? See the pricing FAQ