Fàilte don deasachadh as ùire de Xygeni Malicious Code Digest (Deasachadh Mìosail). A-rithist, tha na sgiobaidhean tèarainteachd againn air a bhith a’ sgrùdadh dàta pasgan fìor gus faighinn a-mach dè a bhios innealan traidiseanta tric a’ call. An t-amas? Pacaidean droch-rùnach a ghlacadh agus a bhacadh mus tig iad air tìr anns a’ bhunait chòd agad no pipeline.
Thar nan beagan sheachdainean a dh’fhalbh, tha sinn air dearbhadh gu bheil còrr is 225 pasgan droch-rùnach a’ sgaoileadh thar npm agus PyPI. Chleachd mòran innleachdan adhartach mar clò-bhualadh, troimh-chèile eisimeileachd, agus sgaoileadh dàta, uile air an dealbhadh gus teicheadh seachad air sgrùdaidhean fèin-ghluasadach agus cron a dhèanamh air an àrainneachd agad.
Tha an ùrachadh mìosail seo mar phàirt de ar aithisg malware leantainneach, far a bheil sinn a’ foillseachadh co-dhùnaidhean seachdaineil, dearbhaich bagairtean ùra, agus cuidich sgiobaidhean DevSecOps gus fuireach air thoiseach. Ma tha thu ag iarraidh làn cho-theacsa thar gach pasgan droch-rùnach a rinn sinn sgrùdadh air, dèan cinnteach gun dèan thu sin rannsaich geàrr-chunntas iomlan a’ chòd droch-rùnach an seo.
Seachdain 3: Còrr is 125 Pasgan air an Lorg
Prìomh Thoraidhean:
NPM
- (npm) mysqldbstool:1.0.4
- (npm) dashboard-demo:1.0.0
- (npm) brfsddd:0.0.1
- (npm) @0xzyo111/clàr-aghaidh:0.0.2
- (npm) @0xzyo111/clàr-aghaidh:0.0.1
- (npm) teachdaire-teacsa-ionadail: 1.0.1
- (npm) raon-cluiche-sruthadh: 1.0.0
- (npm) gnìomh-sgeama-cruinneachaidh: 99.0.9
- (npm) pasgan-esm: 7.0.2
- (npm) ngi-core:1.0.0
- (npm) rig-nòd-ionadail-de-cheangailte: 9.1.1
- (npm) air a dhearbhadh123:3.0.3
- (npm) eth-exec-txs:1.0.0
- (npm) eisimeileachd faidhle: 7.0.1
- (npm) @vietnetco-distribution/internal-sdk: 999.999.999
- pròiseasar-còd (npm): 99.0.9
- (npm) eisimpleirean-lib:99.0.9
- cuimhne-còmhraidh (npm): 99.0.9
- (npm) solaraiche-àidseant-default: 99.0.9
- (npm) rig-nòd-ionadail-de-cheangailte: 99.0.9
- (npm) sganair-cridhe-tuagh:99.0.9
- (npm) azure-ai-foundry:99.0.9
- (npm) hyperion-react-native-testapp:10.0.0
- (npm) donuts.node:99.0.9
- (npm) eisimpleirean turborepo: 16.0.0
- (npm) airgeadan-hubot: 10.0.0
- (npm) mpesa-ui-components:1.5.2
- (npm) lunasec:1.0.0
- (npm) dà-cridhe-ui: 1.0.1
- (npm) lorg-jet-os: 1.9.4
- (npm) @ivy-shared-components/iconslibrary:99.99.99
- innealan-poblach-agus-taisbeanaidhean (npm): 1.0.0
- (npm) @huobi-lib/vulcan-js-sdk: 10.11.0
- (npm) gx-ui-common:1.0.0
- (npm) gx-ui-common:1.2.63
- (npm) react-native-gainsight-px:1.12.5
- (npm) luchd-cuideachaidh deuchainnean-turborepo: 16.0.0
- (npm) mpesa-ui-components:1.1.20
- (npm) bc-coimeas:4.1.1
- (npm) moladh-crìochnachaidh: 1.0.2
- (npm) gx-ui-common:1.2.67
- (npm) mpesa-backoffice-ekyc-frontend: 3.17.99
- (npm) mysql-dumpdiscord:1.0.2
- (npm) gx-ui-common:1.2.66
- (npm) gx-ui-common:1.2.65
- (npm) berachain-metadata: 1.0.1
- (npm) beairteach-markdown-render: 20.0.0
- (npm) eslint-plugin-rdv-insertion:6.99.99
- (npm) eslint-plugin-rdv-insertion:7.99.99
- làrach-lìn na leabharlainn (npm): 6.0.2
- (npm) modúl-cuideachaidh-suidheachaidh: 1.0.5
- (npm) modúl-cuideachaidh-suidheachaidh: 2.1.2
- (npm) hb-otc:10.15.0
- (npm) bun-structar-newrelic:8.9.1
- (npm) hb-otc:10.17.0
- (npm) gdex-sdk:1.0.9
- (npm) @huobi-lib/vulcan-js-sdk: 10.10.0
- (npm) mysqldbstool:1.0.5
- (npm) mysqldbtool:1.0.3
- (npm) hrpqvq123111:1.0.0
- (npm) uairprce:1.0.0
- (npm) hrp9871:1.0.0
- (npm) json-regels-engine-examples:7.1.0
- (npm) cuspair calientepe: 100.0.2
- (npm) internallib_v606:1.0.2
- (npm) stolbovsaseeminglyinnocentpackage2:0.30.1
- (npm) modúl-cuideachaidh-suidheachaidh: 2.1.7
- (npm) internallib_v249:1.0.1
- (npm) neo-mhall:2.1.2
- (npm) @s21games/einnsean-geama:1.15.2
- (npm) @s21games/einnsean-geama:1.15.5
- (npm) @s21games/einnsean-geama:1.15.6
- (npm) @s21games/einnsean-geama:1.15.8
- (npm) @s21games/einnsean-geama:1.15.7
- (npm) @s21games/einnsean-geama:1.15.10
- (npm) modaldeuchainnsimple5:1.1.0
- (npm) modaldeuchainnsimpletest5:1.1.1
- (npm) @s21games/einnsean-geama:1.15.9
- (npm) @s21games/einnsean-geama:1.15.4
- (npm) @s21games/einnsean-geama:1.15.11
- (npm) @s21games/einnsean-geama:1.15.12
- (npm) @s21games/einnsean-geama:1.15.13
- (npm) @s21games/einnsean-geama:1.15.14
- (npm) internallib_v714:1.0.2
- (npm) internallib_v714:1.0.3
- (npm) @s21games/einnsean-geama:1.15.16
- (npm) internallib_v354:1.0.1
- (npm) @s21games/einnsean-geama:1.15.17
- (npm) @s21games/einnsean-geama:1.15.15
- (npm) @s21games/einnsean-geama:1.15.19
- (npm) @s21games/einnsean-geama:1.15.20
- (npm) @s21games/einnsean-geama:1.15.21
- (npm) @s21games/einnsean-geama:1.15.22
- (npm) @s21games/einnsean-geama:1.15.23
- (npm) @s21games/einnsean-geama:1.15.25
- (npm) @crioptochords/air a roinn:1.0.2
- (npm) @s21games/einnsean-geama:1.15.26
- (npm) vusd-lib:1.0.0
- (npm) @newth/mem0-redis-hybrid: 1.0.0
- (npm) @callcenter-frontend/ui-components:99.0.2025091-3.2
- (npm) @callcenter-frontend/ui:99.0.2025091-3.1
- (npm) @ionad-call-aghaidh/seòrsachan-roinnte:99.0.2025091-3.1
- (npm) @callcenter-frontend/ui:99.0.2025091-3.15
- (npm) @callcenter-frontend/ui-components:99.0.2025091-3.14
- (npm) @ionad-call-aghaidh/seòrsachan-roinnte:99.0.2025091-3.13
- (npm) @ionad-call-aghaidh/cuideachaidhean:99.0.2025091-3.11
- (npm) @ionad-call-aghaidh/seirbheisean:99.0.2025091-3.12
- (npm) @ionad-call-aghaidh/api:99.0.2025091-3.10
- (npm) internallib_v715:1.0.1
- (npm) @cnx-ui/cnx-ui-core: 10.0.10
- (npm) @cnx-ui/cnx-ui-core: 20.0.11
- (npm) @cnx-ui/cnx-ui-core: 20.0.12
- (npm) kreme-crypto:0.0.1
- (npm) abairtiche:5.1.0
- (npm) abairtiche:5.1.1
- (npm) regex-validator-utils:1.0.0
- (npm) regex-validator-utils:1.0.8
- (npm) lynx-dev:1.0.1
- (npm) rannsachair-lynx: 1.0.1
- (npm) humhub:5.0.3
- (npm) eslint-plugin-ge b' e dè: 9.0.1
- (npm) porscheofficial:2.9.9
PyPI
- (pypi) sinontop-utils:0.3.5
- (pypi) pasgan-innealan-leasachaidh-python:0.1.9
Seachdain 2: Còrr is 50 Pasgan air an Lorg
Prìomh Thoraidhean:
Pacaidean NPM
- (npm) @ayuda/search-tree: 1.1.6
- (npm) mv-ospadal:1.0.0
- (npm) luchd-cuideachaidh_fb:0.0.3
- (npm) fb_systemd:0.0.3
- (npm) clàr-tuiteam-sìos-pàipeir: 99.9.1
- (npm) react-markdown-v7:1.3.9
- (npm) seirbheisean-sfly:4.0.5
- (npm) sfly-web-vitals:4.0.7
- (npm) pahtkit-wasm:1.0.0
- (npm) vui-vform:10.12.0
- (npm) vui-vform:10.13.0
- (npm) hrpqwq123:1.0.0
- (npm) hrpq1wq123:1.0.0
- (npm) hr1pq1wq123:2.0.0
- (npm) hr1pq1wq123:3.0.0
- (npm) hrpqvq:3.0.0
- (npm) hrpqvq:1.0.0
- (npm) hrpqvq123:1.0.0
- (npm) tianqishengqishi: 1.0.0
- (npm) pahtkit-wasm:1.0.1
- (npm) pahtkit-wasm:1.0.2
- làrach-lìn na leabharlainn (npm): 6.0.5
- (npm) ad-react-wrapper:99.1.0
- (npm) bun-structar-newrelic:8.9.12
- (npm) obraiche-fo-structair-newrelic:8.9.12
- (npm) logadh-newrelic:8.9.12
- (npm) newrelic-pixie:8.9.12
- (npm) tachartasan nri-kube:8.9.12
- (npm) inneal-atharrachaidh-meatrach-newrelic-k8s:8.9.12
- (npm) seirbheisean-sfly:4.0.1
- (npm) sfly-web-vitals:4.0.5
- (npm) ifood-consumer-help-v2:4.15.1999
- (npm) ifood-faster-remote-config:2.0.0
- (npm) com.revenuecat.purchases-unity:13.3.0
- (npm) com.revenuecat.purchases-unity:13.5.0
- (npm) com.revenuecat.purchases-unity:13.6.0
- (npm) abairt-dùil:5.1.2
- (npm) mcp-cabadaich-neach-dèiligidh: 1.0.0
- (npm) ifood-faster-remote-config:3.0.0
- (npm) aledade-org:1.0.0
- (npm) codex-monorepo:8.1.1
- (npm) leabharlann-cridhe-roinnte-tdm:99.0.0
- (npm) leabharlann-cridhe-roinnte-tdm:99.0.2
- (npm) leabharlann-cridhe-roinnte-tdm:99.0.3
- (npm) aledade-org:1.1.0
- (npm) co-obrachadh-buaidh-ui: 1.0.2
- (npm) @gc-crm/gc-crm-lib:9999.0.1
Pacaidean PyPI
- roghainnean geama steam (pypi): 0.1.0
- roghainnean geama steam (pypi): 0.1.1
- roghainnean geama steam (pypi): 0.1.2
Seachdain 1: Còrr is 50 Pasgan air an Lorg
Prìomh Thoraidhean:
Pacaidean NPM
- (npm) òr-dhubhpvt:1.0.0
- (npm) @huobi-lib/vulcan-js-sdk: 10.11.0
- (npm) @stackgl/gl-conformance:9.999.999
- (npm) gen-studio:9.1.2
- (npm) logair-parse:3.3.6
- (npm) pp-react-segmented-controller:99.0.3
- (npm) azure-rest-api-specs-eng-tools:1.0.1
- (npm) pp-com-components:1.0.0
- (npm) pp-react-grid:1.0.0
- (npm) azure-ipam-ui:1.0.0
- (npm) powerbi-visuals-powerkpi:9.0.1
- (npm) air a dhearbhadh123:3.0.3
- (npm) @vietnetco-distribution/internal-sdk: 999.999.999
- (npm) rig-nòd-ionadail-de-cheangailte: 9.1.1
- (npm) cuir-a-steach-pàipeir-tuiteam-sìos: 99.9.3
- (npm) deuchainn343tttt:99.9.1
- (npm) cuir-a-steach-pàipeir-tuiteam-sìos: 99.9.5
- (npm) @auro-formkit/rèiteachadh:5.0.0
- (npm) cuir-a-steach-pàipeir-tuiteam-sìos: 99.9.6
- (npm) mpesa-backoffice-ekyc-frontend: 3.17.99
- (npm) @hpx-core-experiences/react-my-account-commons:11.0.1
- (npm) @hpx-core-experiences/react-my-account-commons:11.0.2
- (npm) gx-ui-common:1.2.66
- (npm) gx-ui-common:1.2.65
- (npm) luathaichear azure-fosgailte-ai:1.0.0
- deuchainnean cuideam azure-iot: 1.0.0 (npm)
- (npm) togail-teamplaidean-gnìomhan-azure:1.0.0
- (npm) berachain-metadata: 1.0.1
- (npm) pp-react-cuspair:1.0.0
- (npm) pp-react-icons:1.0.1
- (npm) pp-react-icons:1.0.0
- (npm) pp-react-country-input:1.0.0
- (npm) dealbhadh-co-phàirtean-siostam-angular-àite-obrach: 1.1.13
- (npm) react-markdown-v7:1.3.9
- (npm) pasgan-esm: 7.0.2
- (npm) beairteach-markdown-render: 20.0.0
- (npm) eslint-plugin-rdv-insertion:6.99.99
- (npm) eslint-plugin-rdv-insertion:7.99.99
- làrach-lìn na leabharlainn (npm): 6.0.2
- pàtrain riochdairean (npm): 99.11.9
- (npm) taisbeanadh-fìor-ùine: 99.11.9
- (npm) hb-otc:10.15.0
- (npm) ngi-core:1.0.0
- (npm) bun-structar-newrelic:8.9.1
- (npm) hb-otc:10.17.0
- (npm) moodle-core-widget-focusafterclose:1.2.0
- (npm) moodle-core-tooltip:1.2.0
- (npm) yui2-beòthachadh:2.2.0
- (npm) nexus-ai-frontend:7.7.8
- (npm) @huobi-lib/vulcan-js-sdk: 10.10.0
- (npm) eisimeileachd faidhle: 7.0.1
Dìon do eisimeileachdan stòr fosgailte an aghaidh so-leòntachd agus còd droch-rùnach
Chan e dìreach cunnart teòiridheach a th’ ann am malware tuilleadh, tha e mu thràth falaichte ann am pasganan poblach. Lorgaireachd Tràth Malware aig Xygeni, faodaidh tu nochdadh a lùghdachadh le bhith a’ glacadh bhagairtean cho luath ‘s a thèid an fhoillseachadh, mus ruig iad do pipeline.
Bidh an t-inneal sganaidh is prìomhachaidh fìor-ùine againn a’ cumail sùil leantainneach air clàran poblach leithid npm agus PyPI. Tha pacaidean droch-rùnach air am bacadh, air an comharrachadh, agus air an rangachadh a rèir buaidh, gus am bi fios agad dè dìreach a dh’ fheumas a bhith air a chàradh, agus cuin. Co-dhiù a tha e na typosquatting, troimh-chèile eisimeileachd, no luchd-goid teisteanasan, bidh sinn a’ cuideachadh an sgioba agad gus fuireach air thoiseach.
Ma tha thu ag iarraidh làn-shealladh air toraidhean seachdaineil is mìosail, thoir sùil air an làn Geàrr-chunntas Còd Mì-rùnach.
Fuirich tèarainte. Fuirich luath. Fuirich fo smachd le Xygeni.
