Compendio de códigos maliciosos de Xygeni 73

Almost every week, our malware detection systems scan thousands of new and updated packages across public registries like npm and PyPI. This week was very active.

Lo confirmamos 198 paquetes maliciosos, primarily across npm, with additional cases in PyPI, OpenVSX, Composer, and VS Code extensions. Several appeared in coordinated clusters, with repeated malicious releases published under the same names or across closely related package families. A standout case was the sensivity package, which flooded npm with over 60 versioned releases across the 2.5.x range. Other notable clusters included ai-sdk-helpers (8 versions targeting AI developers), @antoncallahan/aws-user-helper (7 versions impersonating an AWS utility), @apple-pay-trust y @google-pay-trust families (mimicking payment checkout modules), @frengki0707/google-cloud-clone (5 versions spoofing Google Cloud), and cms-storehub, cms-helpgit y cms-github (targeting CMS pipelines). Many packages mimicked payment and checkout modules, enterprise and internal web packages, analytics clients, UI foundations, developer utilities, component explorers, cloud- and Google-themed packages, and other modules commonly trusted in modern development workflows.

No se trataba de anomalías aisladas. Lo que destacó esta semana fue la magnitud de las publicaciones repetidas en las mismas familias de paquetes, la reutilización de patrones de nomenclatura y la forma en que los paquetes maliciosos se disfrazaban para parecer dependencias legítimas dentro de la entrega de software real. pipelines.

Esta instantánea semanal forma parte de nuestro Resumen de Código Malicioso continuo, donde validamos nuevas amenazas y proporcionamos inteligencia práctica para ayudar a los equipos de DevSecOps a proteger sus pipelines antes de que se produzcan daños.

Analicemos lo que encontramos esta semana y por qué es importante.