AppSec
Designed around vulnerabilities and detection after package ingestion
About Us
Threat intel for the open source supply chain
Every threat is human-verified, covering malicious packages, repositories, and IOCs across every major open source ecosystem.
Milestones
- — Database launched
- — ADDED Domains
- — ADDED Go, Maven, Crates, Open VSX, VS Code, Packagist, URLs, IPs
- Users: 500
- — ADDED AI skills
- — OSM Security, Inc launched
- — ADDED Docker hub / containers, crypto wallets
- Users: 1,000
- — ADDED Homebrew
- Users: 1,500
- — ADDED Chrome
Our Story
Shai Hulud. TeamPCP. Miasma. In 2025, malware became top-of-mind for organizations consuming open source software. Blocking known malicious packages. Incident response for the latest supply chain attack. Researching emerging threats.
But software supply chain threat intel sits in the middle of three silos that weren't built for this challenge. OpenSourceMalware brings them together.
EDR
Focused on suspicious behavior not associated with the SDLC
Threat Intel
Specialize in traditional malware that reaches people directly
OpenSourceMalware is a purpose-built threat intelligence feed for malicious OSS. Not just “Is this malware?” but also “What does it do? What's the payload? Who's behind it? How do I know if I'm compromised?”
We believe everyone should be able to find out if a piece of open source software is dangerous to use. That's why the OpenSourceMalware web search and core APIs are free for everyone. We also built the platform so community members can report malware instead of letting research stagnate in blogs. The whole ecosystem gets safer as more people contribute. These elements are, and will always be, free.
On top of that foundation, we founded OSM Security, Inc. to provide licensed tiers for organizations that need deeper integration: higher API limits, custom alerts, threat actor attribution, structured IOCs, and dedicated research support.
Our Team
Paul McCarty
Co-Founder and CTO
Paul created the OpenSourceMalware threat intelligence database and analysis engine, drawing on years of research into how attackers exploit open source ecosystems. He speaks regularly at security conferences and teaches workshops on malware security research. Paul is a serial entrepreneur who's founded multiple startups going back to the 1990s and has worked with NASA, Boeing, Blue Cross Blue Shield, John Deere, the US military, and the Australian government.
Jenn Gile
Co-Founder and CEO
Jenn co-founded OpenSourceMalware and runs the business, drawing on a specialty in translating deep technical security research into work practitioners and executives actually use. Her cybersecurity and DevOps writing has appeared in Dark Reading, The New Stack, InfoWorld, and Feedly, and she speaks regularly at conferences including OWASP and BSides. Jenn has spent decades building programs and security education at Endor Labs, NGINX, F5, and the U.S. Department of State.