# Securing The Build. Malicious Packages: When Trust in Open Source Breaks. Ben Rieger, Mend.io.

Page: https://stenobird.com/podcast/cybercrime-magazine-podcast-71258/securing-the-build-malicious-packages-when-trust-in-open-source-breaks-ben-rieger-mend-io
Text version: https://stenobird.com/podcast/cybercrime-magazine-podcast-71258/securing-the-build-malicious-packages-when-trust-in-open-source-breaks-ben-rieger-mend-io.md
Podcast: [Cybercrime Magazine Podcast](https://stenobird.com/podcast/cybercrime-magazine-podcast-71258)
Published: 2026-07-15T14:27:39+00:00
Episode link: https://soundcloud.com/cybercrimemagazine/securing-the-build-malicious-packages-ben-rieger-mend-io
Audio file: https://feeds.soundcloud.com/stream/2360072756-cybercrimemagazine-securing-the-build-malicious-packages-ben-rieger-mend-io.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/cybercrime-magazine-podcast-71258/episodes/securing-the-build-malicious-packages-when-trust-in-open-source-breaks-ben-rieger-mend-io
Duration seconds: 597

## Resource

Ben Rieger is the head of DevOps, Security, and IT at Mend.io. In this episode, he joins host Scott Schober to discuss real-world supply chain attacks and what actual defenses can mitigate risk. Securing The Build is brought to you by Mend.io, the leading application security solution, helping organizations reduce application risk efficiently. To learn more about our sponsor, visit https://mend.io.

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/cybercrime-magazine-podcast-71258/episodes/securing-the-build-malicious-packages-when-trust-in-open-source-breaks-ben-rieger-mend-io/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/cybercrime-magazine-podcast-71258/securing-the-build-malicious-packages-when-trust-in-open-source-breaks-ben-rieger-mend-io.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.