Paul McCarty & Jenn Gile on how 540 packages under one maintainer expose a supply chain blind spot

Future of Threat Intelligence · Nov 5, 2026 · 40m

Paul McCarty and Jenn Gile, Co-Founders of OpenSourceMalware, join Eli Woodward to discuss how malicious open source packages have become a major software supply chain attack vector, and why most organizations lack the visibility and threat data to defend against them.

Topics discussed:

Defining open source malware across packages, extensions, and repos

Team PCP’s credential hoarding and multi-wave attack strategy

Account takeovers versus “bad from the start” malicious packages

DPRK’s Contagious Interview and Task Jacker campaigns

Using GitHub as backup C2 for exfiltrated credentials

Bridging…