Gaming Roundtable
The crew kicks things off with the Gaming Roundtable. Matt discusses his experience finishing Star Wars Outlaws, sharing plenty of frustration with how the game wrapped up. He also details his time hitting the road in Forza Horizon 6 and diving into a brand-new Starship Troopers boomer shooter. Brent follows up with his own impressions of Forza Horizon 6 before sharing his thoughts on the gothic, top-down action-adventure title Mina the Hollower. Brandon finishes out the roundtable by checking in with his personal gaming logs and latest weekend grinds.
Interview: Mike of Flightless Squid Studios
We sit down with our special guest, Mike, to talk about his career as an indie game developer. Mike introduces us to his six-person indie studio, Flightless Squid Studios, and pulls back the curtain on the independent creation grind:
- Electron Flux: He details their unique project currently available on Steam—a circuit-themed roguelite tower defense game.
- The Indie Grind: He walks us through how he originally broke into the development scene, sharing the specific elements he loves and hates about building a game from scratch.
- Working with Valve: We get a fascinating inside look at what it's really like dealing directly with Steam as a small team.
- Industry Advice: Mike drops his core recommendations for anyone looking to get their foot in the door of modern game development.
Mike on Securing the Software Pipeline
We transition to the other side of Mike's professional background as a security researcher representing Black Lodge Research. We tackle the massive hurdles of modern engineering security:
- Defending the Pipeline: How solo developers or small teams can realistically protect their code repositories from hostile third-party interference.
- The npm Problem: A look at why package managers are so structurally vulnerable, debating whether it is an isolated registry flaw or a deeper systemic issue with open-source culture.
The Shai-Hulud Worm Timeline
We map out the terrifying, rapidly escalating timeline of the Shai-Hulud software supply chain worm:
- September 2025 (The Origin): The first wave of the self-replicating worm infects hundreds of npm packages. When an unsuspecting developer downloads a poisoned dependency, an embedded infostealer harvests their credentials and automatically republishes the malware to their own dependencies with zero manual threat actor interaction required.
- November 2025 (Shai-Hulud 2.0): The worm surfaces with aggressive modifications. Execution moves to the pre-install lifecycle phase to maximize CI/CD pipeline damage, and a punitive directory-wipe payload is added to entirely destroy the host system if token harvesting fails.
- March–April 2026 (The Escalation): A highly sophisticated threat group tracked as TeamPCP mounts massive cascading operations against core open-source infrastructure, compromising vital development chokepoints—including Aqua Security's Trivy vulnerability scanner, the Bitwarden CLI, Checkmarx KICS, SAP, and PyPI registries—to exfiltrate vast troves of cloud access keys.
- May 11, 2026 (Mini Shai-Hulud): TeamPCP deploys a new variant utilizing a novel CI cache-poisoning technique and npm’s OIDC endpoints to hijack workflows across major platforms like Mistral AI, UiPath, OpenSearch, and TanStack. Attackers manipulate Git history using "orphaned commits" on repository forks to append legitimate digital SLSA signatures onto automated, malicious software releases.
- May 12, 2026 (Capability Diffusion): In a final, deliberate move, TeamPCP dumps the entire functional Shai-Hulud source code publicly on GitHub, triggering an immediate wave of copycat variants and modified malware publications across the npm registry.
Watch & Listen
Twitch: https://twitch.tv/TheDigitalAscent
YouTube: https://youtube.com/@TheDigitalAscent
Spotify: https://creators.spotify.com/pod/profile/digitalascent/
Hosts & Credits
- Hosts: Brent, Matt, Brandon
- Guest: Mike (Flightless Squid Studios / Black Lodge Research)
- Technical Design / Production: Brent