Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec
Jul 3, 2026 · 1 hr 3 min · 10 segments
Please consider supporting the DefSec podcast here. This week’s stories…
Jerry BellHost
Andrew KellettHost
The first one comes from Security Week, and this is... a follow-up to a long spate of what I now like to call repo worms.
And I think, I don't know for sure, but I think that GitHub really started taking these worms seriously when something like 4,000 of their own repos got launched.
But anyway, last time we talked about how they were going to start requiring multi-factor authentication.
And now they've announced another change with NPM version 12, which is going to no longer allow execution from untrusted sources by default.
Why is that? So I am a little concerned that the developer community at large has kind of gotten used to how things work.
And as we talk about a lot... things that inject friction into systems tend to get bypassed.
And so my concern is that we're going to start seeing some of these really sensible protections being bypassed or worked around and kind of reset back to the way it was for the sake of expediency.
So it's a good idea, and it will stop some of the current attacks we're seeing, at least making it a lot more difficult.
You're concerned that certain developers have come to rely on this or want this option, and they'll go, that's great, and they'll go turn this feature back on and just defeat all of the good work that...
I mean, and look, so kudos, first off, kudos to GitHub and the team for doing this.
So, um, you know, hopefully, hopefully I'm wrong on this and we, we don't see people running to bypass it, but know what? I've worked with developers for the better part of 30 years.
I, I think we've talked a lot on the show that these different types of package and code owning entities or code hosting entities are going to have to do
The first one comes from Security Week, and this is... a follow-up to a long spate of what I now like to call repo worms.
And I think, I don't know for sure, but I think that GitHub really started taking these worms seriously when something like 4,000 of their own repos got launched.
But anyway, last time we talked about how they were going to start requiring multi-factor authentication.
And now they've announced another change with NPM version 12, which is going to no longer allow execution from untrusted sources by default.
Why is that? So I am a little concerned that the developer community at large has kind of gotten used to how things work.
And as we talk about a lot... things that inject friction into systems tend to get bypassed.
And so my concern is that we're going to start seeing some of these really sensible protections being bypassed or worked around and kind of reset back to the way it was for the sake of expediency.
So it's a good idea, and it will stop some of the current attacks we're seeing, at least making it a lot more difficult.
You're concerned that certain developers have come to rely on this or want this option, and they'll go, that's great, and they'll go turn this feature back on and just defeat all of the good work that...
I mean, and look, so kudos, first off, kudos to GitHub and the team for doing this.
So, um, you know, hopefully, hopefully I'm wrong on this and we, we don't see people running to bypass it, but know what? I've worked with developers for the better part of 30 years.
I, I think we've talked a lot on the show that these different types of package and code owning entities or code hosting entities are going to have to do
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.