Takaitaccen Bayani na Wata-wata na Mummunan Lambar Lambobi: Mayu

Barka da zuwa bugu na Xygeni Malcious Code Digest na watan Mayu. A wannan watan, ƙungiyar binciken tsaro tamu ta ci gaba da bin diddigin yanayin barazanar sarkar samar da software a cikin rajistar fakitin jama'a, kayan aikin haɓakawa, ayyukan da AI ke tallafawa, da kuma na zamani. CI/CD muhalli. A cikin watan Mayu, Xygeni ya gano kuma ya tabbatar da ɗaruruwan fakitin ɓarna da ke kai hari ga yanayin halittu na npm, PyPI, VS Code, da OpenVSX.

Amma watan Mayu ba wai kawai ya shafi yawan jama'a ba ne. Wata ne kuma da masu kai hari suka ƙara daidaita ayyukansu zuwa yanayin ci gaban AI, zato na amincewa da masu haɓakawa, da kuma sarrafa kansa ta atomatik pipelines.

Daga cikin manyan binciken da Ƙungiyar Tsaro ta Xygeni ta buga a wannan watan:

• JulesJacker, wani kamfen na npm mai matakai da yawa wanda ke kwaikwayon wakilin Jules AI na Google don satar ma'ajiyar bayanai, cin zarafi CI/CD Muhalli, har ma da kai hari ga akwatin sandbox da ke nazarin sa. Yaƙin neman zaɓen ya gabatar da na'urorin lodawa masu ɓoye, waɗanda aka ƙirƙira google-labs-jules[bot] commits, satar bayanai ta girgije, da kuma leƙen asiri na Kubernetes akan kayayyakin aikin bincike da kansu.
• PhantomBot, wani mummunan kamfen na npm wanda ke cin zarafin walat ɗin karya, blockchain, da kayan aikin Web3 don satar takardun shaida, yin sulhu ga yanayin masu haɓaka haɓakawa, da kuma kai hari ga ayyukan aiki da suka shafi crypto ta hanyar cin zarafin dogaro da jigilar kaya.
• Tsarin npm mai girman gaske wanda ke lalata kayan aikin TypeScript na bogi, fakitin AI, kwaikwayon kayan aikin ciki, ɗakunan karatu na gaba, masu taimakawa ga girgije, da tsarin gini don yanayin yatsar hannu, fitar da takaddun shaida, tura juriya, da kuma daidaita tsarin masu haɓaka.
• Ci gaba da tarin fakitin cutarwa suna amfani da rikicewar dogaro, rubutu a cikin rubutu, cin zarafin bayan shigarwa, kwaikwayon kayan aikin AI, hauhawar sigar sigar, da maimaita cin zarafin suna wanda aka tsara don kauce wa tsarin fahimtar masu haɓakawa da kuma yin sulhu da zamani. SDLC tsarin aiki kafin a fara bincike.
• Gano kamfe ɗin malware na dandamali daban-daban kamar @jaggle/resizeobserves mai satar allo, wanda ya yi kwaikwayon wani fakiti na halal yayin da yake amfani da tsarin Python mai dorewa da madadin allo na walat ɗin crypto a cikin tsarin Linux, macOS, da Windows.

A cikin wannan watan, mun kuma lura da ƙaruwar haɗuwa tsakanin kayan aikin AI, yanayin halittu na buɗe tushen bayanai, da hare-haren sarkar samar da software. Masu yin barazana suna ƙara kai hari kan ayyukan ci gaba da AI ke tallafawa, muhallin wakili, matukin jirgi, da ginin girgije. pipelinea matsayin wani ɓangare na ayyukan satar takardun shaida da kuma yarjejeniyar adana bayanai.

Waɗannan hare-haren ba su zama kamar wasu lokutan da ake yin rubutu a cikin rubutu ba. Sun haɗa da kamfen ɗin bugawa mai tsari, fashewar sigar atomatik, satar alamun girgije, CI/CD cin zarafi, tsare-tsaren ɗaukar nauyin da aka ɓoye, guje wa akwatin sandbox, da dabarun sulhu na dindindin waɗanda aka tsara musamman don haɗawa cikin amintaccen tsarin halittu na masu haɓaka.

Wannan sabuntawa na wata-wata wani ɓangare ne na shirin Xygeni na ci gaba da bincike kan barazanar malware da sarkar samar da kayayyaki, inda ƙungiyarmu ke ci gaba da tabbatar da fakitin ɓarna, bincika sabbin dabarun kai hari, da kuma buga bayanan sirri masu amfani don taimakawa tsaro, ƙungiyoyin AppSec, da DevSecOps su ci gaba da fuskantar barazanar sarkar samar da kayayyaki.

Don cikakken bayani game da kowace manhajar cutarwa, kamfen ɗin malware, da nazarin barazanar da aka buga a wannan watan, bincika cikakken Tsarin Lambar Mallaka na Mayu da binciken da ya shafi hakan daga Ƙungiyar Tsaro ta Xygeni.