D2DO300: Open Source Malware!

In this episode of Day 2 DevOps, hosts Ned Bellavance and Kyler Middleton dive deep into the rising threat of open source malware, particularly within NPM and AI agent ecosystems. Guest Jen Geil, co-founder of Open Source Malware, reveals how malicious actors are exploiting the open source supply chain through account takeovers, transitive dependencies, and AI-driven infiltration. She highlights a major 2025 incident involving the NX package, where attackers used post-install scripts to weaponize AI tools like Cloud and Gemini, tricking them into scraping developer secrets and exposing 3,000 repositories. The episode underscores how AI's ease of use and high permission levels have created new attack vectors, with malicious agents now infiltrating marketplaces like OpenClaw. Despite the alarming pace of innovation in cyberattacks—such as using invisible Unicode characters to hide malicious code—Geil emphasizes that the situation is not hopeless. She introduces the Open Source Malware database, a community-driven, publicly accessible threat intelligence platform designed to track and expose malicious packages, domains, and AI skills. The episode concludes with actionable advice for developers and organizations: implement dependency pinning, cool-down policies, and cross-functional security teams, while advocating for systemic changes in platform design and continuous education across all departments, not just engineering. The episode delivers a sobering yet hopeful message: while the speed of AI and open source development has outpaced traditional security measures, collective vigilance, community-driven tools, and proactive defense strategies can still make a difference. The key takeaways include slowing down the adoption of new packages, adopting automated scanning tools integrated with the Open Source Malware API, and expanding security training beyond software engineers to include finance, marketing, and sales teams. The hosts and guest stress that the responsibility isn't just on individuals but requires organizational commitment and structural changes in how open source ecosystems are governed.