Barka da zuwa Bugawar watan Yuni ta Xygeni Malcious Code DigestA wannan watan, ƙungiyar binciken tsaro ta tabbatar da fiye da Fakiti 645 na cutarwa a fadin npm, PyPI, da kuma (a karon farko) kasuwar fadada VSCode.
An bayyana watan Yuni ta hanyar yanayi guda uku masu haɗuwa: kamfen ɗin ambaliyar sigar da aka tsara don wuce jerin toshewa, hanzarta hare-hare da ke kai hari kan kayan aikin AI da ayyukan haɓaka wakilai, da kuma hare-haren rikice-rikicen dogaro da kai kan wuraren suna na ciki na monorepo.
Daga cikin manyan kamfen da aka rubuta a wannan watan:
- hankali An cika da npm tare da sama da nau'ikan 70 a cikin kewayon 2.5.x, wani kamfen na gujewa kai tsaye wanda ke sake bugawa akai-akai don ci gaba da kasancewa gaba da cirewa.
- A kamfen ɗin rubuta rubutu na Solana mai zango biyu (7–8 ga Yuni) sun buga fakiti 15 suna kwaikwayon kansu
@solana-labskayan aikin muhalli, wanda ke niyya ga masu haɓaka Web3 da DeFi kai tsaye. - houzidawang806 sun yi rikodin sama da sigar 25 a cikin kwana ɗaya (13 ga Yuni), tare da ma'auni-pipeline-d8k2 An sake buga shi a cikin sigar 21 tsakanin 15-18 ga Yuni.
- The Rikici na CryptoDAO kamfen (Yuni 17) ya buga fakiti 11 a sigar 99.99.99, kowannensu yana ɗauke da irin wannan aikin bayan shigarwa. CI/CD Alamu, takardun shaidar girgije, da sirrin walat ɗin crypto.
- Makon 20-26 ga Yuni ya kawo mafi girman maƙasudin kayan aikin AI na watan: masu taimaka wa ollama (Sifofi 20), masu taimako na openai-wakilai (Sifofi 23), monoclaude, masu taimaka wa ai-sdk, Da kuma @langgraphjs/kayan aiki, duk an tabbatar da su cikin mako guda, suna mai da hankali kai tsaye kan haɗin gwiwar Ollama, wakilan OpenAI SDK, LangGraph, da Claude API.
- An tabbatar da biyu Tsarukan VSCode masu cutarwa ya bayyana a wannan watan, yana nuna cewa maharan suna faɗaɗa fiye da rajistar fakiti zuwa yanayin masu haɓakawa da kansu.
Tsarin da ya bayyana a watan Yuni: hare-hare suna komawa zuwa ga faɗaɗa IDE, kayan aikin wakili na AI, da ayyukan aiki na wakili inda wani fakitin mugunta da aka shigar ba shi da mai duba ɗan adam tsakanin kamuwa da cuta da aiwatarwa.
Wannan sabuntawa na wata-wata wani ɓangare ne na shirin binciken barazanar malware da samar da kayayyaki na Xygeni. Don cikakken bayani game da kowace kunshin malware da aka tabbatar a wannan watan, bincika cikakken Tsarin Code na Yuni da binciken da ya shafi hakan daga Ƙungiyar Tsaro ta Xygeni.
Mako na 4: An Gano Fakiti Sama da 201
| Kayan daji | Package | Rana |
|---|---|---|
| Yuni 20, 2026 | ||
| npm | na'urar sadarwa ta panrouter: 5.0.2 + Sigogi 30 a cikin kewayon 5.x–6.x har zuwa 22 ga Yuni - kamfen mafi rinjaye na mako | Jun 20, 2026 |
| npm | trimprompt:1.0.5 + Sigogi 4 - ci gaba daga makon da ya gabata, har yanzu yana aiki | Jun 20, 2026 |
| npm | monoclaude: 1.0.1 + Sigogi 2 — Kwaikwayon kayan aikin Claude API | Jun 20, 2026 |
| vscode | shirye-shiryen-ko'ina-agent-pair-programming-for-smalltalk:1.206.0 + Sigar 1 — faɗaɗa VSCode mai cutarwa wanda ke niyya ga ci gaban wakili | Jun 20, 2026 |
| npm | simplisafe-gatsby:1.0.1 Kwaikwayon namespace na dandamalin gida mai wayo | Jun 20, 2026 |
| Yuni 21, 2026 | ||
| npm | raba atlasora: 1.0.0 + fakiti 6 — rikicewar dogaro da monorepo mai tsari: atlasora-api, -client, -sdk, -types, -utils, -config | Jun 21, 2026 |
| npm | sakon apintergration:4.0.2 + Sigogi 6 - kamfen ɗin kuskuren rubutu da aka yi niyya don kayan aikin haɗin kai | Jun 21, 2026 |
| npm | llm-traces-app:1.0.1 An yi niyya ga kayan aikin lura na LLM | Jun 21, 2026 |
| pypi | d0rk3r-telemetry:1.0.0 Kunshin telemetry mai ɓoye a cikin PyPI | Jun 21, 2026 |
| Yuni 22, 2026 | ||
| pypi | tm-ai:2.91.75 + Sigogi 7 - kamfen ɗin ambaliyar ruwa na PyPI mai ɗorewa | Jun 22, 2026 |
| pypi | request-cache-py:1.0.4 + Sigogi 6 — ambaliyar sigar PyPI | Jun 22, 2026 |
| pypi | corvinos:0.17.0 + Sigogi 6 - Yaƙin neman zaɓen PyPI mai yawa | Jun 22, 2026 |
| Yuni 23, 2026 | ||
| npm | mai taimaka wa shafin yanar gizo na web3-token:1.1.1 + Sigogi 2 — Amfanin amfani da alamun Web3 | Jun 23, 2026 |
| npm | monocross:1.0.1 + Sigar 1 — ƙungiyar suna mono-* tare da monoclaude da monotacos | Jun 23, 2026 |
| Yuni 24, 2026 | ||
| npm | masu taimaka wa ollama:0.1.0 + Sigogi 19 - mafi girman kamfen ɗin kayan aikin AI na watan, wanda ke niyya ga lokacin gudanar da AI na Ollama na gida | Jun 24, 2026 |
| npm | masu taimakawa wajen buɗewa: 0.1.1 + Sigogi 22 - kamfen ɗin da aka tsara wanda ke niyya ga wakilan OpenAI SDK tsarin halittu | Jun 24, 2026 |
| Yuni 25, 2026 | ||
| npm | masu taimaka wa ai-sdk:1.4.3 An yi niyya ga kayan aikin AI SDK tare da @langgraphjs/toolkit:1.2.11 | Jun 25, 2026 |
| npm | rajista-embedder:99.99.99-poc3 + hs-locale-management — HubSpot rikicewar dogaro da namespace na ciki, ƙarin bayani na poc ya tabbatar da kamfen ɗin bincike mai aiki | Jun 25, 2026 |
| Yuni 26, 2026 | ||
| npm | kayan aiki mai sauƙi: 1.0.1 + Sigogi 8, gami da bambance-bambancen easy-string-kit232, - rajista mai yawa a ƙarƙashin sunan amfani na gabaɗaya | Jun 26, 2026 |
| npm | kunshin-mugunta mara aminci:1.0.0 + Sigogi 5 - fakitin da aka sanya wa suna a fili a matsayin abin ƙyama, an tabbatar da nauyin da aka ɗauka, gwajin da ake tsammanin zai iya zama ko kamfen na tsokana | Jun 26, 2026 |
| npm | @vpms/tsarin ƙira:1.1.2 + Sigogi 2 — kwaikwayon tsarin suna namespace | Jun 26, 2026 |
Mako na 3: An Gano Fakiti Sama da 200
| Kayan daji | Package | Rana |
|---|---|---|
| Yuni 13, 2026 | ||
| npm | houzidawang806:1.0.0 + Sigogi 25 a fadin 1.0.x–1.2.x, gami da 'yan'uwa houzidawang807 da houzidawang808 - kamfen mafi rinjaye na mako | Jun 13, 2026 |
| npm | demo mai kyau-gaisuwa-mai kyau:1.0.2 + Sigogi 4 - kamfen mai ɗorewa yana sake bayyana a cikin kwanaki da yawa | Jun 13, 2026 |
| npm | tsc-ai:1.2.0 tsc-* cluster: tsc-ai, tsc-mesh, tsc-lotl — CI kayan aikin kwaikwayon sunan namespace | Jun 13, 2026 |
| pypi | neuralbridge-sdk:4.5.4 + Sigogi 6 a fadin 4.5.x–5.1.x — yakin PyPI na kwanaki da yawa mai dorewa | Jun 13, 2026 |
| Yuni 15, 2026 | ||
| npm | farashin alama-cron:999.0.0 + fakiti 6 - Rukunin rikice-rikicen dogaro da kayayyakin more rayuwa na DeFi wanda ke niyya ga kayan aikin cron na ciki da kuma kayan aiki na vault | Jun 15, 2026 |
| Yuni 16, 2026 | ||
| npm | bodega-sdk:9.9.9 + fakiti 8 — lamunin DeFi da kuma ƙungiyar yanayin ƙasa ta Cardano: lamunin kwarara, lamunin hawan igiyar ruwa, janus-*, flowcardano, flowdefi | Jun 16, 2026 |
| npm | ma'aunin taron-q3x7:1.0.0 + Sigogi 8 - fakitin hex-suffix na gama gari sunaye masu jigogi masu yawa | Jun 16, 2026 |
| npm | nic-datagov:1.0.0 + fakiti 3 — kwaikwayon sunan dandamalin bayanai na gwamnati: ogd-analytics, ogd-platform, dms-backend | Jun 16, 2026 |
| Yuni 17, 2026 | ||
| npm | kwangilolin cryptodao:99.99.99 + Fakiti 10 — Rikicewar dogaro da CryptoDAO: core, sdk, bot, config, utils, deploy, signer, backend, types | Jun 17, 2026 |
| pypi | teambot-ai:1.48.0 Kayan aikin wakilin AI da aka yi niyya a cikin PyPI | Jun 17, 2026 |
| Yuni 18, 2026 | ||
| npm | ma'auni-pipeline-d8k2:1.0.0 + Sigogi 20 a cikin 18 ga Yuni - kamfen ɗin gujewa na kwana ɗaya ya ci gaba, yana sake bugawa akai-akai don wuce jerin toshewa | Jun 18, 2026 |
| npm | duba-kawai: 0.4.5 + Sigogi 6 - kamfen ɗin ambaliyar ruwa na sigar | Jun 18, 2026 |
| npm | color-utils-dee0:1.0.0 + Fakitin haɗin hex guda 5 na gaba ɗaya: bayanai-utils, kayan aikin string, type-check, fmt-helpers, metrics-probe — scripted bulk register | Jun 18, 2026 |
| npm | @azure-lab-services/ml-ts:99.0.0 Kwaikwayon Azure ML namespace | Jun 18, 2026 |
| Yuni 19, 2026 | ||
| npm | trimprompt:1.0.2 + trimprompt-hub - kayan aikin injiniya masu sauri da aka yi niyya | Jun 19, 2026 |
| npm | kofin claude: 0.8.6 Kwaikwayon kayan aikin Claude API | Jun 19, 2026 |
| pypi | wakili na aiaddin:0.1.0 Kayan aikin wakilin AI da aka yi niyya a cikin PyPI | Jun 19, 2026 |
| npm | web3-crypto-address-utils:0.1.0 Tsarin amfani na Web3 | Jun 19, 2026 |
Mako na 2: An Gano Fakiti Sama da 135
| Kayan daji | Package | Rana |
|---|---|---|
| Yuni 7, 2026 | ||
| npm | @solana-labs/web3.js:1.0.0 + Bambance-bambance 5 — kamfen ɗin typosquat na Solana na yanayin ƙasa, zangon farko | Jun 7, 2026 |
| npm | @jisan901/teamfocus:1.0.0 + Sigogi 2 | Jun 7, 2026 |
| npm | @sflyinc-knapsack/shutterfly-react:999.0.0 Ruɗani game da dogaro, sigar da aka ƙara girmanta | Jun 7, 2026 |
| Yuni 8, 2026 | ||
| npm | @solana-labs/web3.js:1.98.102 + Bambance-bambancen guda 9 — kamfen ɗin typosquat na Solana na yanayin ƙasa, zango na biyu | Jun 8, 2026 |
| pypi | helixagentai:0.1.3 Kayan aikin wakilin AI da aka yi niyya a cikin PyPI | Jun 8, 2026 |
| Yuni 9, 2026 | ||
| npm | @nstrlabs/sdk:99.0.0 + fakiti 7 - rikicewar dogaro da yanayin suna na ciki na monorepo | Jun 9, 2026 |
| npm | @klapp-login-dandamali/native-sdk:99.0.0 + Fakiti 9 - kwaikwayon dandamalin tantancewa a cikin wurare da yawa na suna na klapp | Jun 9, 2026 |
| npm | blockchain-helper-0:1.0.0 + fakiti 7 - ƙungiyar amfani ta crypto/DeFi da ke niyya ga masu haɓaka Web3 | Jun 9, 2026 |
| npm | @card-pci-data/store:99.0.0 An yi niyya ga bayanan katin biyan kuɗi na sunan wurin da aka yi niyya | Jun 9, 2026 |
| Yuni 10, 2026 | ||
| npm | Tsarin ƙira na morningstar:99.0.0 + Sigogi 2 — kwaikwayon tsarin ƙirar kuɗi | Jun 10, 2026 |
| Yuni 11, 2026 | ||
| npm | matsakaicin girman:1.0.1 + Sigogi 5 da aka buga a rana ɗaya | Jun 11, 2026 |
| npm | @coze-common/chat-area:99.1.1 kwaikwayon sunan dandamalin hira na AI | Jun 11, 2026 |
| pypi | Telegramlite:1.0.0 + Sigar 1 — kwaikwayon dandamalin aika saƙo a cikin PyPI | Jun 11, 2026 |
| Yuni 12, 2026 | ||
| npm | ecto-corsair-whisper-6f3b9:1.0.18 + Bambance-bambancen ecto-* guda 7 — tarin suna mai ɓoye | Jun 12, 2026 |
| npm | internallib_v984:1.0.3 + ƙungiyar internallib_v557 — nau'ikan masu yaudarar ɗakin karatu na ciki guda 13 | Jun 12, 2026 |
| npm | voyager-web:999.0.0 Ruɗani game da dogaro, sigar da aka ƙara girmanta | Jun 12, 2026 |
| pypi | cdjeez:0.32.0 | Jun 12, 2026 |
Mako na 1: An Gano Fakiti Sama da 118
| Kayan daji | Package | Rana |
|---|---|---|
| Bari 30, 2026 | ||
| npm | @cloudplatform-single-spa/administration:99.99.100 Ruɗani game da dogaro, sigar da aka ƙara girmanta | Bari 30, 2026 |
| vscode | xampp-manaja: 5.1.3 Fadada VSCode — kayan aikin mai haɓakawa | Bari 30, 2026 |
| Yuni 1, 2026 | ||
| npm | @tse-dijital/core:99.0.0 Rikici tsakanin dogaro — @telenor-se da @ownit suma sun yi tasiri | Jun 1, 2026 |
| npm | Tsarin ajiya na cms: 1.3.4 + Sigogi 2, Tarin sunayen CMS | Jun 1, 2026 |
| npm | @antoncallahan/aws-mai-hannun-mai-hannu:6767.67.69 + Sigogi 6, lambobin sigar da aka ƙaru waɗanda ke niyya ga takardun shaidar AWS | Jun 1, 2026 |
| npm | Takardun marasa lafiya:75.0.0 Manufar sunan cibiyar kiwon lafiya | Jun 1, 2026 |
| npm | @emcd-vue/auth:6.4.9 Kwaikwayon sunan musayar Crypto | Jun 1, 2026 |
| pypi | simtooreal-cli:0.3.0 | Jun 1, 2026 |
| Yuni 2, 2026 | ||
| npm | hankali: 2.5.8 + Sigogi 70 a cikin kewayon 2.5.x, Yuni 2-5 - kamfen mafi rinjaye na lokacin | Jun 2, 2026 |
| npm | @langgraphjs/kayan aiki:1.2.10 An yi niyya ga kayan aikin LangGraph | Jun 2, 2026 |
| Yuni 4, 2026 | ||
| npm | @sentry-browser-sdk/profiling-node:1.0.1 + Sigogi 2, kwaikwayon sunan Sentry | Jun 4, 2026 |
| npm | internallib_v346:1.0.3 + Sigogi 2, mai zamba a ɗakin karatu na ciki | Jun 4, 2026 |
| npm | masu taimaka wa ai-sdk:0.2.1 + Sigogi 7, waɗanda ke niyya ga kayan aikin AI SDK | Jun 4, 2026 |
Dakatar da Lambobin Mugunta Kafin Ta Isa Gareka Pipeline
Barazanar sarkar samar da manhajoji ta wuce ka'ida. Hare-haren rikice-rikicen dogaro da kai, satar bayanai, malware da aka yi niyya ga AI, da kayan aikin haɓaka software masu guba suna shafar ƙungiyoyi na gaske a zahiri. SDLCs kowane mako.
Xygeni's gano malware da kuma dandalin tsaron sarkar samar da kayayyaki Yana bawa ƙungiyoyi damar gano abubuwan da suka shafi miyagun halaye kafin su aiwatar da su a kan na'urar haɓaka manhaja, shigar da tsarin gini, ko isa ga samarwa. Rufewar ta shafi npm, PyPI, VSCode, da sauransu, sa ido kan tsarin bugawa da ake zargi, cin zarafin suna, rubuta rubutu, da dabarun kai hari na asali na AI yayin da suke bayyana.
Kowanne bincike ana fifita shi ta atomatik ta hanyar amfani da shi, yadda za a iya isa gare shi, da kuma tasirin kasuwanci, don haka ƙungiyar ku ta mai da hankali kan abin da ke buƙatar gyarawa, ba hayaniya ba.
Ko dai wani fakitin buɗe tushen mugunta ne, kayan aikin haɓaka mai rauni, ko kuma haɗarin lambar da AI ta samar, Xygeni yana ci gaba da sa ƙungiyoyin tsaro da injiniya su yi gaba da yanayin barazanar sarkar samar da kayayyaki.
Bincika kowane fakitin mugunta da kamfen da ƙungiyar tsaro ta Xygeni ta tabbatar a cikin Tsarin Lambobin Mugunta.
Ku kasance cikin aminci. Ku kasance cikin sauri. Ku kasance cikin iko da Xygeni.
