Sam: [dry] The malware steals your credentials, then publishes them to a brand new GitHub repo it creates under your own account. Neatly versioned and everything.
Kai: [excited] Okay, THAT is diabolical, and I hate how impressed I am.
Sam: This is Sam.
Kai: And this is Kai! It's July 25th, 2026, and we've got three open-source stories on the board today.
Sam: One of them will make you rotate every token you own. The other two are actually lovely. It's about balance.
Kai: First up — four more supply-chain attacks slam npm and PyPI in a fresh Shai-Hulud wave.
Sam: Then Harper — Automattic's offline, privacy-first grammar checker written in Rust, quietly racking up stars.
Kai: And finally Pumpkin — a from-scratch Minecraft server, also in Rust, climbing GitHub Trending.
Sam: Two Rust darlings and one dumpster fire. Let's start with the fire.
Kai: So the Shai-Hulud worm is BACK, and this time it brought friends. GitGuardian counted four separate hits between early June and July 14th.
Sam: Four distinct attacks. A worm variant they're calling the Miasma, or Hades, branch on PyPI, plus typosquatted payment SDKs, a stolen publishing token, and a hijacked CI pipeline.
Kai: Wait — payment SDKs? Someone typosquats a package that literally handles money?
Sam: [dry] Go where the wallets are, Kai. That's not coincidence, that's targeting.
Kai: Okay, but the self-spreading part — explain the worm bit, because that's the sci-fi horror.
Sam: It harvests credentials off the infected machine, uses those creds to publish itself into more packages, and keeps going. That's the worm — it doesn't wait for you.
Kai: And the exfil trick — publishing your stolen secrets to a fresh public GitHub repo. That's our cold open.
Sam: Right. No sketchy server to trace. It just uses GitHub as the drop box, and your own account becomes the leak.
Kai: Hot take: I think GitHub could kill this by scanning for these auto-created repos.
Sam: Sure, until the worm renames the pattern. This is whack-a-mole, and the mole publishes to npm.
Kai: So what does this mean for the person listening on their commute right now?
Sam: Pin your dependencies. Rotate your npm and PyPI publishing tokens today. Turn on 2FA for publishing, and audit any new repos you didn't create.
Kai: And stop blindly running install scripts. That post-install hook is the front door.
Sam: Lockfiles, provenance, and paranoia. That's the whole security stack this week.
Kai: Okay, palate cleanser! Harper, from Automattic — an offline, privacy-first grammar checker in Rust. Twelve thousand seven hundred stars, plus eight hundred more today.
Sam: [surprised] Automattic. The WordPress people. And it runs locally? No cloud round-trip?
Kai: Zero cloud. Your prose never leaves your machine. It's the anti-Grammarly.
Sam: [dry] So the pitch is a grammar tool that doesn't read your diary and sell it back to you.
Kai: [laughs] Exactly! And it's genuinely non-AI-hype — just rules and linguistics, fast, tiny footprint.
Sam: Which I love, honestly. No forty-billion-parameter model to check if you wrote 'their' wrong.
Kai: It's got editor integrations too — VS Code, Neovim, browsers. Local-first is having a moment.
Sam: And eight hundred stars in a day off a real corporate maintainer? That velocity actually looks legit for once.
Kai: See, when the skeptic says the stars are real, you know they're real.
Sam: I said 'looks legit,' not 'I've audited the source.' But yeah, Automattic backing lowers my eyebrow.
Kai: What this means for you: if you write anything sensitive — legal, medical, unreleased — this keeps it on-device.
Sam: Privacy-conscious teams, this is a drop-in win. Just read the license and confirm it's the real Automattic repo before you install.
Kai: And last one — Pumpkin! A Minecraft server written from scratch in Rust. Ninety-two hundred stars, plus six hundred more today.
Sam: From scratch? Not a fork of the vanilla Java server?
Kai: [excited] Completely ground-up. The tagline is 'empowering everyone to host fast and efficient Minecraft servers.'
Sam: Rewriting Minecraft in Rust is the most 2026 sentence you've ever said.
Kai: And it works! Lower memory, faster tick rates — the whole point is you can run it on a potato.
Sam: Give me the skeptic beat, though — six hundred stars in a day, organic or bot-farmed?
Kai: Looks organic to me. Steady climb, real contributors, real issues, actual gameplay clout.
Sam: [dry] Fine. It passes the smell test. Minecraft nostalgia plus Rust hype is a genuinely viral combo.
Kai: Hot take: this is the best onboarding project for Rust in years. Kids will learn systems programming just to run a server.
Sam: That's... actually a good point. Motivation beats a tutorial every time.
Kai: What this means for you: if you host a small server, give it a try — but it's early, so don't nuke your prod world.
Sam: Back up your world, run it alongside, and don't trust it with the survival base yet. Rust's still eating the trending list, though.
Kai: Quick recap — four fresh Shai-Hulud supply-chain hits on npm and PyPI, and the worm publishes your secrets to repos it makes in YOUR name.
Sam: Harper gives you an offline, privacy-first grammar checker from Automattic, and the stars actually look real.
Kai: And Pumpkin proves you can rewrite a Minecraft server in Rust and go viral doing it.
Sam: Before we go — notice today's theme? Two of three trending projects are Rust. And the malware? Node and Python.
Kai: [laughs] Are you saying Rust's borrow checker would've stopped the worm?
Sam: [dry] I'm saying the worm still needs a token to publish, and memory safety won't save you from a stolen credential.
Kai: [laughs] He never lets me have the win. That's the show!
Sam: Rotate your tokens, check for repos you didn't create, and we'll see you tomorrow. Can't wait.
This show is made with AI: the hosts’ voices are synthetic and the scripts are AI-assisted. Every story links to its original source.