Dependabot cooldowns, Jscrambler and AsynchAPI compromises, new PolinRider research

**This week we talked about:**  - **GitHub turns on Dependabot cooldown periods by default —** A three day cooldown is now applied automatically to all Dependabot version updates, a shift we've been anticipating in the fight against account takeover malware, though it may leave developers confused about why their upgrades are getting blocked **JScrambler compromise —** A threat actor gained access to a publishing credential and pushed five malicious versions of the jscrambler package. The malware evolved quickly, with the first three versions containing the trigger in a pre-install script to the last two on-import execution partway through. They also published four versions of related packages that pinned to malicious v8.18.0. - **AsyncAPI compromised —** Attackers exploited a GitHub Actions pull\_request\_target flaw that sat unresolved for 58 days to steal a privileged token. They published malicious npm packages under the @asyncapi namespace, all with components of the Miasma malware that was open-sourced earlier this year (but no worm). **New PolinRider research —** Paul's latest hunt found 2,417 newly-compromised repositories, confirming config file injection as the dominant delivery vector alongside a growing fake font technique, still overwhelmingly hitting individual developers rather than organizations. **Episode Resources** - (talk) BSides Adelaide 2026 Schedule - (docs) Dependabot cooldown - (blog) Security Advisory: Unauthorized Publication of a Malicious npm Package - (feed) OpenSourceMalware threat reports for Jscrambler - (blog) M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions - (feed) OpenSourceMalware threat reports for AsyncAPI - (blog) PolinRider Confirmed Footprint Grows 6.5x Since March