Sep 23, 2026 · 21 min · 15 segments
Inside Cyber Minds S3E7 — Alessandra Rizzo, Senior Threat Researcher at Databricks, on hunting North Korean threat actors in the npm supply chain, nation-state malware, and securing the open source…
Luciano FerrariHost
And you're also running a workshop here, right? Can you tell me more about that?
Yes, I'm running a workshop tomorrow here at Recon Village at 10 a.m., so check it out if you're in the area.
It will be about one of the campaigns that we have tracked this year related to Contagious Trader.
Contagious Trader, for those who don't know, is a wave of malware attributed to famous Colima, who is a DPRK-affiliated nation-state group.
um we have tracked this campaign extensively with over 50 npm packages as of may 2026 and by now there's probably 50 more um so we will dive into that methodology that we have used ourselves to be able to track this uh from distribution layer which happens at the social media So operators creating fake identities to find victims that they can target with crypto related projects.
Usually this happens through GitHub and NPM because they are open source projects.
ecosystems, which I do think people, you know, it is the backbone of the modern technology stocks and people have an implicit trust, I think, still.
So after that, we will dive into like how we mapped it from the distribution layer, social media layer.
Yeah, it's short of 110 campaigns that we have tracked separately related to GitHub repos.
And you're also running a workshop here, right? Can you tell me more about that?
Yes, I'm running a workshop tomorrow here at Recon Village at 10 a.m., so check it out if you're in the area.
It will be about one of the campaigns that we have tracked this year related to Contagious Trader.
Contagious Trader, for those who don't know, is a wave of malware attributed to famous Colima, who is a DPRK-affiliated nation-state group.
um we have tracked this campaign extensively with over 50 npm packages as of may 2026 and by now there's probably 50 more um so we will dive into that methodology that we have used ourselves to be able to track this uh from distribution layer which happens at the social media So operators creating fake identities to find victims that they can target with crypto related projects.
Usually this happens through GitHub and NPM because they are open source projects.
ecosystems, which I do think people, you know, it is the backbone of the modern technology stocks and people have an implicit trust, I think, still.
So after that, we will dive into like how we mapped it from the distribution layer, social media layer.
Yeah, it's short of 110 campaigns that we have tracked separately related to GitHub repos.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.