Open VSX security improvements, new PolinRider researcher, shady vendor practices

So, Paul, we published two pieces of research this week, right? The first is is about the pollen writer campaign this is a Lazarus group North Korean uh campaign that you discovered earlier this year that's kind of a a little bit of a spin-off of contagious interview that's more focused on taking over GitHub repositories but what I think is super interesting about the research that you published this week is about how it is jumping to package ecosystems without any additional effort on the part of the threat actors.

So maybe just talk like a paragraph, right? Real quick.

What is it? I know I'm telling you to be brief.

This is the difficult one.

Okay.

Pollen Rider is basically North Korea has automated when they compromise developer victims, they basically automatically push malicious packages into all the repos that person has access to them locally.

Initially, that was just a GitHub thing.

That's what we found earlier this year.

But now in the Go and PHP ecosystems, those registries, Packagist and the Go registry, they ship packages that are GitHub repos.

So now the jumping the fence is these repos automatically become packages inside this ecosystem, which is crazy.

You know, you don't have the same additional authentication that you do in NPM and PyPI and some of the other ecosystems.

Nice.

I am dropping the link to that in the chat.