Takaitaccen Bayani na Wata-wata na Mummunan Lambobi: Afrilu

Barka da zuwa sabon bugu na Tsarin Lambobin Xygeni na Maleriya (Buga na Wata-wata)Har yanzu, ƙungiyar tsaronmu ta yi nazarin ainihin fakitin bayanai a cikin rajistar jama'a don gano abin da na'urorin daukar hoto na gargajiya ke watsi da su: lambar ɓarna da aka tsara don haɗawa cikin ingantattun ayyukan haɓaka masu haɓakawa.

A cikin 'yan makonnin da suka gabata, mun tabbatar fiye da fakitin cutarwa 260, musamman a fadin npmtare da ƙarin shari'o'in da suka shafi PyPI, VS Code, OpenVSX, da kuma MawallafiDuk da haka, wannan watan ba wai kawai game da girma ba ne.

Ƙungiyar bincikenmu ta gudanar zurfafa bincike kan barazanar da ke da tasiri sosai, Ciki har da:

Raƙuman malware masu ci gaba da aka gina a kusa kayan aikin ciki na bogi, Fakitin da ke ɗauke da jigo na AI, tsarin biyan kuɗi da biyan kuɗi, abokan ciniki na nazari, abubuwan haɗin gaba, kayan aikin masu haɓaka, Kubernetes da kayan aikin girgije, Fadada VS Code da OpenVSX, kuma sigar da aka maimaita ta fashe a ƙarƙashin iyalai ɗaya na fakiti.

Ƙungiyoyin wallafe-wallafen da suka shafi mugunta suna cin zarafi Tsarin suna masu aminci kamar alama, enterprise-sunayen fakitin da ke fuskantar, Tushen UI, SDKs na yanar gizo, masu binciken sassan, Da kuma wuraren suna na ciki an tsara shi don haɗawa cikin isar da software na gaske pipelines.

Waɗannan ba su da sauƙi yunƙurin yin amfani da rubutuSun shiga cikin lamarin tsare-tsaren cin zarafin takardar shaidar, Sarrafa sarkar samar da kayayyaki, maimaita cin zarafin sunaspace, Da kuma labaran wallafe-wallafe marasa kyau an tsara shi don yin tasiri ga ainihin CI/CD pipelines da kuma yanayin samarwa.

Bayan waɗannan binciken, sauye-sauyen da aka yi kwanan nan sun ci gaba da nunawa wallafe-wallafen da aka sarrafa ta atomatik, kumbura mai ƙarfi sigar, tsarin kwaikwayon kayan aiki na ciki, Da kuma tarin fakiti a cikin sunaye masu alaƙa, tare da dabarun gargajiya kamar typosquatting, rikicewar dogaro, Da kuma tace bayanaiManufar ta ci gaba da kasancewa daidai: Keɓe bayanan aminci da kuma yin sulhu a hankali da tsarin masu haɓaka kafin a gano su.

Wannan sabuntawa na wata-wata wani ɓangare ne na ci gaba da muke yi rahoton malware, inda muke bugawa binciken da aka tabbatar, tabbata barazana masu tasowa, da samar hankali mai aiki don taimakawa Ƙungiyoyin DevSecOps ci gaba hadarin sarkar wadata.

Don cikakken bayani game da kowace manhajar cutarwa da aka bincika a wannan watan, bincika cikakken bayani game da ita Tsarin Lambobin Mugunta.