
Insights from recent episode analysis
Audience Interest
Podcast Focus
Publishing Consistency
Platform Reach
Insights are generated by CastFox AI using publicly available data, episode content, and proprietary models.
Total monthly reach
Estimated from 1 chart position in 1 market.
By chart position
- 🇳🇿NZ · Technology#132500 to 3K
- Per-Episode Audience
Est. listeners per new episode within ~30 days
250 to 1.5K🎙 Weekly cadence·10 episodes·Last published 1w ago - Monthly Reach
Unique listeners across all episodes (30 days)
500 to 3K🇳🇿100% - Active Followers
Loyal subscribers who consistently listen
200 to 1.2K
Market Insights
Platform Distribution
Reach across major podcast platforms, updated hourly
Total Followers
—
Total Plays
—
Total Reviews
—
* Data sourced directly from platform APIs and aggregated hourly across all major podcast directories.
On the show
Recent episodes
GitHub Breach: Inside the Team PCP Supply Chain Breach
May 21, 2026
Unknown duration
Shai-Hulud is Back: TanStack & Mistral AI Breach by TeamPCP Mini Worm
May 13, 2026
Unknown duration
From Trivy to LiteLLM: The Domino Effect of TeamPCP’s Attack
Mar 30, 2026
Unknown duration
Inside ShaiHulud 2.0: The Supply-Chain Worm That Read Your Secrets
Nov 27, 2025
Unknown duration
The OpenVSX Supply Chain Attack: Invisible Malware in VS Code - Bad Dependencies Podcast
Oct 27, 2025
Unknown duration
Social Links & Contact
Official channels & resources
Official Website
Login
RSS Feed
Login
| Date | Episode | Description | Length | ||||||
|---|---|---|---|---|---|---|---|---|---|
| 5/21/26 | ![]() GitHub Breach: Inside the Team PCP Supply Chain Breach | In this episode of Bad Dependencies, we analyze the reported leak of GitHub's source code and the sale of thousands of its repositories. We map out the chain of events leading up to the incident, including recent compromises of a Visual Studio Code extension and a PyPI package. The discussion covers the tactics of the threat actor group Team PCP, the practical limitations of rapid credential rotation at scale, and why implementing a cooldown period for dependency updates can help safeguard your development pipeline. -- This episode is sponsored by Aikido Security: Protect your developer environments from supply chain attacks with Aikido Device Security. Learn more at aikido.dev/protect/device-protection. | — | ||||||
| 5/13/26 | ![]() Shai-Hulud is Back: TanStack & Mistral AI Breach by TeamPCP Mini Worm | In this episode of Bad Dependencies, we dive into the "wormy" chaos of the latest supply chain attack hitting the JavaScript ecosystem. Join researcher Charlie Eriksen as he breaks down how the threat actor group TeamPCP compromised the widely-used TanStack ecosystem and successfully pivoted into Mistral AI. We explore the technical "perfection" of this attack: a lethal combination of pull_request_target misconfigurations, GitHub Actions cache poisoning, and OIDC signature abuse. Charlie also sheds light on a terrifying new trend, the attackers have open-sourced their worm, complete with a "dead man's switch" designed to wipe infected machines if credentials are revoked. | — | ||||||
| 3/30/26 | ![]() From Trivy to LiteLLM: The Domino Effect of TeamPCP’s Attack | In this episode of Bad Dependencies, Mackenzie and security researcher Charlie Erickson break down a fast-moving software supply chain attack led by Team PCP.Starting with the compromise of Trivy, the attackers leveraged stolen credentials to spread into ecosystems like NPM and LiteLLM, impacting widely used developer tools and AI infrastructure. The conversation explores how the attack evolved, including worm-like behavior, credential harvesting, and ransomware tactics.Charlie shares real-time insights into the attackers’ methods, motivations, and the ongoing nature of the incident, along with practical advice on mitigation such as credential rotation, dependency pinning, and securing CI/CD pipelines. | — | ||||||
| 11/27/25 | ![]() Inside ShaiHulud 2.0: The Supply-Chain Worm That Read Your Secrets | In this episode, I sit down with Charlie Eriksen, the researcher who uncovered the Shai Hulud 2.0 campaign, for a deep dive into one of the wildest supply-chain attacks we’ve seen. What began as a strange detection quickly unraveled into a worm that spread across npm, GitHub, and even a compromised Open VSX extension.“Patient Zero” was AsyncAPI, where the attackers exploited a subtle GitHub Actions flaw that let them run malicious code inside the org’s own CI pipelines without their pull request ever being merged. Unmerged PR → full RCE → stolen org-level credentials.From there, the worm propagated through packages, harvested secrets with TruffleHog, dumped them into tens of thousands of GitHub repos, and, most shockingly, contained a wiper mode that deleted a victim’s entire home directory if it couldn’t create new repos.It’s a fascinating and slightly terrifying look at how modern supply-chain attacks actually work under the hood. Give it a listen. | — | ||||||
| 10/27/25 | ![]() The OpenVSX Supply Chain Attack: Invisible Malware in VS Code - Bad Dependencies Podcast | In this episode of Bad Dependencies, Mackenzie Jackson and Charlie Eriksen dive into one of the most sophisticated malware incidents to target developers — the OpenVSX compromise. They unpack how attackers hid malicious code using Unicode obfuscation, discuss the shift from npm to VS Code extension attacks, and explore how the open-source ecosystem is responding. The episode also covers npm’s new token policies, trusted publishing, and what these changes mean for the future of supply chain security.Chapters:00:00 – Introduction & Discovery02:00 – What is OpenVSX and How It Works03:40 – Anatomy of the Malware Attack05:00 – Unicode Obfuscation and Detection08:20 – Attackers Move from npm to VS Code11:00 – npm’s Security Policy Overhaul17:40 – Trusted Publishing and the Future of Supply Chain Security | — | ||||||
| 9/18/25 | ![]() Discovering Shai-Hulud and the Struggle to Raise the Alarm: Bad Dependencies ft Daniel Pereira | In this episode, host Mackenzie Jackson is joined by Charlie Erikson and Daniel Pereira to uncover the story of Shai-Hulud — a self-propagating worm that shook the NPM ecosystem. Like the great sandworm of Arrakis, it surfaced suddenly, exfiltrating secrets and spreading through unsuspecting packages.Daniel recounts his discovery and the frustrating desert-like silence from major platforms as he tried to raise the alarm. Charlie dives into the worm’s anatomy, from environment variable theft to GitHub action exploits, showing how attackers evolved their tactics from the earlier NX breach.Together, they reflect on what it takes to fight worms in the shifting sands of open source, and why the community needs faster ways to respond before the next Shai-Hulud emerges. | — | ||||||
| 9/17/25 | ![]() Yep, I Got Pwned: A Candid Chat With The Chalk & Debug Maintainer | Charlie Eriksen and I sat down for a candid chat with Josh Junon, the maintainer of chalk and debug, who found himself at the center of one of the largest npm supply-chain attacks.Josh talks openly about: ✅ How the phishing attack actually worked ✅ What it felt like to have his packages hijacked ✅ The lessons for every open source maintainer and company that relies on npmIt’s a rare, first-hand account of what it’s like to be the person behind the breach, raw, honest, and essential listening for anyone in tech.We are releasing it live at 16:00 CEST , 07:00 Pacific Time | — | ||||||
| 8/29/25 | ![]() The NX S1ingularity Attack: Secrets in Plain Sight | Charlie Erkson and Mackenzie Jackson return with breaking news on one of the wildest supply chain compromises to date. The popular NX packages—with millions of weekly downloads—were hijacked, and attackers used an LLM-powered malware to crawl systems for secrets like GitHub and NPM tokens. Even stranger, instead of exfiltrating data to a private server, the stolen information was dumped into public GitHub repositories, exposing sensitive credentials for anyone to see.In this episode of Bad Dependencies, the hosts unpack:How the NX compromise happened and why it’s uniquely reckless.The bizarre use of LLMs for system enumeration.Why publishing secrets to public repos raises the stakes for everyone.The remediation steps users must take if they were affected.Broader implications for the future of software supply chain security.Is this careless malware, or was the chaos intentional? Tune in for analysis, insights, and some grim humor as the hosts dissect a case study in just how bad things can get when package compromises go wrong. | — | ||||||
| 7/31/25 | ![]() Phishing Attacks on NPM, Accidental Stylus Removal and Aikido Safe Chain: Bad Dependencies Episode 4 | In this Episode Mackenzie and Charlie sit down to discuss exactly what is going on with all the Phishing campaigns against NPM maintainers, what was compromised, and what you can do about it. We also discuss the weird removal by NPM of Stylus, which caused massive build issues and also discuss Aikido Safe-Chain, a new open-source package to keep your dependencies safe. | — | ||||||
| 7/8/25 | ![]() Bad Dependencies Episode 3: Malware, Bug Bounties, and the Ethics of Offense | In this episode of Bad Dependencies, we explore the gray zone of offensive security with researcher Raphael Silva from Checkmarx. Hosts Mackenzie and Charlie break down June’s 4,000+ flagged malicious packages, then chat with Raphael about his real-world experiments planting “malicious-but-not” packages in places like npm and the VS Code Marketplace. From unicode deception to malware hidden in PNGs, this episode unpacks the ethics of bug bounties, the dangers of going too far, and how easy it is to slip past marketplace defenses—until a random security guy in Poland catches you first.00:00 – Intro & Weather Woes00:50 – Malware Madness: 4,000+ Packages Flagged02:00 – Offensive Security 10104:00 – The Ethics of Fake Malware06:00 – Where Researchers Cross the Line10:00 – Common Pitfalls & Accidental Exposure12:05 – Guest Joins: Raphael Silva from Checkmarx13:50 – Malicious-but-Not: ExpressJS-Session Deep Dive17:30 – Why Target VS Code Extensions?22:20 – Unicode Tricks, Copycats & What’s Next | — | ||||||
Want analysis for the episodes below?Free for Pro Submit a request, we'll have your selected episodes analyzed within an hour. Free, at no cost to you, for Pro users. | |||||||||
| 6/20/25 | ![]() Bad Dependencies – Episode 2: The React Native Aria Backdoor Meltdown | In this explosive episode of Bad Dependencies, Mackenzie Jackson and Charlie Eriksen uncover a sophisticated malware campaign that compromised 16 popular npm packages—including libraries under the "react-native-aria" scope. The hosts break down how the breach was discovered, what the payload did, and the widespread implications for the JavaScript ecosystem. From obscure obfuscation tricks to potential state-sponsored tactics, this is a deep dive into one of the most alarming supply chain attacks of 2025. Plus, the duo discusses a case of open-source copycatting following their first episode and gives insight into how threat detection has evolved.00:00 Welcome & Catching Up 01:00 react-native-aria Malware Discovery 05:10 Repeat Offender: The Same Threat Actor 06:30 Offscreen Obfuscation & Reverse Shell Payload 07:40 Potential Fallout 08:50 GitHub Compromises & Wider Infection Vectors 10:30 Who’s Behind It? 11:40 Copycat Incident: The LLM Confusion 13:10 The Power & Risks of Sharing 14:30 Closing Remarks & Threat Feed | — | ||||||
| 6/2/25 | ![]() Bad Dependencies: JPEGs, JavaScript, and Janky Malware: Image-Based Attacks in NPM | In the debut episode of Bad Dependencies, Charlie and Mackenzie unpack some seriously strange cases of malware hidden in plain sight on NPM. They explore how malicious actors are stuffing payloads into image files like JPEGs and PNGs, and how these are being unpacked with clever JavaScript tricks to evade detection.You'll hear how AI-generated decoy code, fake Readme files, and hidden PowerShell scripts are being used to disguise the true intent of packages — from base64 blobs in JPEGs to fake "fingerprinting" logic that serves no purpose other than distraction.Expect deep dives into packages like node-wave-http, axios-fingerprint, and expressjs-session, with behind-the-scenes insights on how attackers are setting the stage for future payload delivery. Plus, discover why Discord and Cloudflare are often abused for hosting malware — and what makes Windows such a popular target for these campaigns.If you've ever wondered how bad dependencies make it past package registry checks — or how to spot them — this episode is for you.00:00 - Welcome to Bad Dependencies01:10 - Hiding Malware in Images: NodeWave HTTP04:59 - Malicious JPEG Unpacks via PowerShell07:09 - Why Hackers Use Discord for Malware Delivery09:06 - Why NPM & GitHub Don’t Catch This Stuff11:00 - A Legit App or Malware Decoy? The OSU Twist12:34 - AI-Generated Code as Distraction Noise14:44 - Obscure Pre-flight Checks & Fake Logic17:09 - Alternate Payloads Hosted on Cloudflare22:00 - PNG with Base64-Encoded Eval Exploit26:30 - This Just Sends System Info: Bug Bounty Play?30:59 - Detecting Malware with Entropy Analysis | — | ||||||
Showing 12 of 12
Sponsor Intelligence
Sign in to see which brands sponsor this podcast, their ad offers, and promo codes.
Chart Positions
1 placement across 1 market.
Chart Positions
1 placement across 1 market.
