NPM malware a yau yana ci gaba da bunkasa, tare da masu kai hari suna wallafawa malic code, fakitin npm na mugunta, Da kuma Shirye-shiryen cutarwa na PyPI an tsara shi don niyya ga ayyukan ci gaba, CI/CD pipelines, da kuma tsarin halittu masu buɗaɗɗen tushe. Tsarin Lambobin Mugunta shine rahoton bincike na Xygeni wanda ke ci gaba da bin diddigin kuma yana tabbatar da ainihin fakitin ɓarna a faɗin npm, PyPI, VS Code, Da kuma OpenVSX, gami da ƙofofin baya da aka tabbatar, masu satar bayanai, nauyin fitar da bayanai, da kuma kamfen ɗin malware na atomatik iri-iri.
Ƙungiyar bincikenmu tana sabunta wannan shafin akai-akai tare da binciken da aka tabbatar, alamun sulhu (IOCs), tsarin halayya, Da kuma fasaha analysisSakamakon haka, masu haɓaka Ƙungiyoyin AppSec, kuma injiniyoyin tsaro za su iya ci gaba da malware na npm a yau da kuma ayyukan ɓarna da ke tasowa waɗanda ke shafar sarƙoƙin samar da manhajoji na zamani.
Malware na NPM a Yau: Takaitaccen Bayani na Mako-mako 24–29 Afrilu 2026
Masu bincike sun tabbatar Fakiti 97 na cutarwa a cikin rajistar jama'a a wannan lokacin.
Abubuwan da aka lura da saitin bayanai
- An buga yawancin fakitin da aka tabbatar a cikin npm
- Ƙarin shari'o'in da abin ya shafa PyPI, OpenVSX, Da kuma mawaki
- Maimaita buga mugayen labarai a cikin iyalai ɗaya da sunayen da suka shafi fakitin
- Tsarin sigar ko mara tsari kamar 99.x, 99.9.x, Da kuma 1.0.x
- Amfani mai ƙarfi biya da biya, enterprise-style, manhajar yanar gizo ta ciki, analytics, Tushen UI, kayan aikin mai haɓakawa, mai jigon girgije, Da kuma masu alaƙa da kayan aiki tsarin suna
- An tsara fasalin da aka tsara don kama da sabbin abubuwan da suka dace na fakiti
Rahoton Malware na Wata-wata: An Tabbatar da Fakitin npm na Maleriya a watan Afrilun 2026
Barka da zuwa sabon bugu na Tsarin Lambobin Xygeni na Maleriya (Buga na Wata-wata). a Afrilu 2026, ƙungiyar bincikenmu ta tabbatar fiye da fakitin cutarwa 250, musamman a fadin npmtare da ƙarin shari'o'in da suka shafi PyPI, VS Code, OpenVSX, da kuma Mawallafi.
Afrilu ba wai kawai game da girma ba ne. raƙuman wallafe-wallafen da ke sarrafa ta atomatik, kamfen ɗin hauhawar farashin kayayyaki mai tsauri, tarin iyali na kunshin, Da kuma kwaikwayon kayan aiki na ciki, mun lura da wasu daga cikin shahararrun tsare-tsare na watan a cikin wallafe-wallafen da ba su da kyau a cikin:
Kayan aikin ciki na bogi, fakitin AI, tsarin biyan kuɗi da biyan kuɗi, abokan ciniki na nazari, kayan aikin gaba, kayan aikin haɓakawa, kayan aikin Kubernetes da girgije, ƙarin VS Code da OpenVSX, da kuma sunayen fakiti masu kama da alama waɗanda aka tsara don haɗawa cikin isar da software na gaske pipelines.
Waɗannan ba abubuwa ne masu sauƙi ba wajen rubuta rubutu. Afrilu bayanai, mun lura tsare-tsaren cin zarafin takardar shaidar, Sarrafa sarkar samar da kayayyaki, sake amfani da namespace akai-akai, Da kuma wallafe-wallafen da aka tsara masu cutarwa an tsara shi don haɗawa cikin yanayin masu haɓaka haɓakawa na gaske da isar da software pipelines.
A cikin faffadan bayanai, mun ci gaba da lura Bugawa ta hanyar rubutu mai sigar da yawa, Tsarin sigar da aka ƙaru, biyan kuɗi- kuma enterprise-sunan jigo, Sunayen fakitin AI- da kuma masu jigon wakili, Kwaikwayon SDK da abubuwan haɗin gaba, kwaikwayon kayan aiki na cikida dabarun gargajiya kamar su rikicewar dogaro da kuma tace bayanai.
Wannan rahoto yana cikin jerin rahotannin da muke gabatarwa a yau Tsarin Lambobin Mugunta, inda muke tabbatar da sabbin barazanar da kuma samar da hankali mai aiki don taimakawa Ƙungiyoyin DevSecOps ci gaba haɗarin sarkar samar da software.
| Kayan daji | Package | Rana |
|---|---|---|
| npm | alamar pa:99.1.10 | Apr 27, 2026 |
| pypi | moonbit-locale-compat:0.2.3 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.13 | Apr 27, 2026 |
| npm | @sbt_gitverse/analytics-client:99.0.1 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.33.1 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.14 | Apr 27, 2026 |
| npm | @tochka-ui/tushen:99.0.2 | Apr 27, 2026 |
| budevsx | girgizar ƙasa/ubel:0.1.0 | Apr 28, 2026 |
| npm | @2011-08-19/n:99.9.9 | Apr 28, 2026 |
| npm | @frengki0707/google-cloud-clone:1.38.0 | Apr 27, 2026 |
Yadda Muke Gano Lambobin Cuta a cikin npm Malware da PyPI Malware
Xygeni yana amfani da dabarun da suka kunshi matakai da yawa don dakatar da lambar mugunta kafin ta bazu. Da farko dai, nazarin lambar da ba ta canzawa yana gano tsarin ɓoyewa, ɓoyayyun abubuwan biyan kuɗi, da cin zarafin rubutun. Bugu da ƙari, yin amfani da sandar halayya yana nazarin shigarwa. hooks, umarnin lokacin aiki, da dabarun juriya. Bugu da ƙari, gano koyo na na'ura yana gano nau'ikan malware na npm na rana da pypi da na'urorin daukar hoto na sa hannu suka rasa. A ƙarshe, Tsarin Gargaɗi na Farko yana sa ido kan ma'ajiyar jama'a a ainihin lokaci, yana tabbatar da sakamakon, kuma yana sanar da ƙungiyoyin DevOps nan take.
Sakamakon haka, wannan haɗin yana tabbatar da cewa masu haɓakawa suna samun saurin bayanai masu aiki waɗanda aka haɗa kai tsaye cikin CI/CD workflows.
Dalilin da Ya Sa Masu Haɓaka Ya Kamata Su Kula da Mummunan Kunshin NPM
Barazanar zamani ba kasafai take jiran lokacin aiki ba. Misali, fakitin npm masu cutarwa galibi suna aiki yayin shigarwa, yayin da fakitin pypi masu cutarwa ke ɓoye fitar da alamun ko ƙofofin baya. Masu kai hari:
- Juya bayanan GitHub na sirri zuwa ga jama'a don kwafi su.
- Tattara bayanan sirri da sirri ta amfani da kayan aikin da aka ɓoye.
- Yi amfani da na'urorin loda JavaScript masu ɓoye don aika ransomware ko botnets.
A gaskiya ma, fakitin buɗe tushen mugunta ya karu da kashi 156% a cikin shekara guda. Saboda haka, ƙungiyoyin da suka dogara kawai akan ciyarwar da aka jinkirta ko na'urorin ɗaukar hoto na asali suna faɗuwa a baya.
Abin da Wannan Rahoton Malware Yake Bin Diddiginsa a cikin npm da PyPI
Wannan bincike shine babban cibiyar bincike:
- An tabbatar da fakitin npm mara kyau
- An tabbatar da fakitin pypi masu cutarwa
- Gano lambar cutarwa bisa ga ɗabi'a
- Abubuwan da suka faru da aka tabbatar da rajista
- Takaitattun rahotannin malware na mako-mako da na wata-wata
- Tarihin canjin duk abubuwan da aka gano na malware na npm da pypi
A wata ma'anar, yana ba da ma'ana ɗaya tilo. Ƙungiyar bincike a Xygeni tana sabunta wannan shafin kowane mako tare da hanyoyin haɗi zuwa cikakkun nazarin fasaha da GitHub IOCs.
Yadda Ake Kare Kariya Daga Fakitin npm Masu Lalacewa da Malware na PyPI
Saboda wannan haɗarin da ke ƙaruwa, ƙungiyoyi suna buƙatar fiye da binciken dogaro na asali. Ƙarfin kariya daga ƙwayoyin cuta na npm da ƙwayoyin cuta na pypi suna buƙatar duka hanyoyin kariya da kuma aiwatar da lokacin aiki:
Aiwatar da Shigarwa na Fayil na Makulli kawai akan Fakitin npm mara kyau
amfani npm ci or pip install --require-hashes in CI/CD.
Wannan yana tabbatar da cewa an yi amfani da ainihin bishiyar dogaro da aka ayyana a cikin fayilolin kulle. Sakamakon haka, masu kai hari ba za su iya zamewa cikin sigar da aka gyara ko aka rubuta ta hanyar kuskure ba na fakitin npm masu cutarwa.
Shigar da Scanning kafin lokaci don npm Malware da PyPI Malware
Haɗa Injin Gargaɗi na Farko na Xygeni don bincika malware na npm da malware na pypi kafin fakitin ya isa ga muhallinka.
Bugu da ƙari, tabbatar da cewa akwai tuhuma postinstall rubutun, masu lodawa masu ɓoye, ko URL ɗin C2 masu lamba mai lamba.
Guardrails Don Toshe Gine-gine Masu Lambobin Mugunta
kafa guardrails zai gaza ginawa ta atomatik idan an gano fakitin npm mara kyau ko fakitin pypi mara kyau.
Misali, fasa ginin da aka yi akan fakitin da masu kula da ba a buga ba, tsarin ɓoyewa, ko daidaitawar IOC. Saboda haka, lambar ɓarna ba ta taɓa wucewa ba tare da an lura da ita ba.
Samar da Tabbatarwa SBOMs Against Malious npm Packages da PyPI Malware
Create SBOMs (CycloneDX, SPDX) don kowane gini.
Bayan haka, kwatanta da fakitin npm masu cutarwa da aka sani da ciyarwar malware ta pypi don bin diddigin dogaro kai tsaye da na wucin gadi.
Kariyar Takardar Shaida da Alamu daga npm Malware da PyPI Malware
Yawancin fakitin npm masu cutarwa suna ƙoƙarin karantawa .npmrc, .pypirc, ko kuma masu canjin yanayi.
Saboda haka, gudanar da ginin a cikin kwantena masu tauri waɗanda ƙananan sirrin da aka fallasa ba su da yawa. Bugu da ƙari, yi amfani da manajojin sirri maimakon masu canjin yanayi don toshe cin zarafin lambar da ba ta dace ba.
Kula da Canje-canjen Rijista da Mai Kulawa a cikin Fakitin npm mara kyau
Masu kai hari kan sace ayyukan da aka yi watsi da su.
Musamman ma, a kula da musayar masu kula da su kwatsam, tsalle-tsalle na sigar da ba a saba gani ba, ko kuma bugu mai yawa a cikin malware na npm da fakitin pypi masu cutarwa.
Horarwa kan Masu Haɓaka Haɓaka Lambobin da Ba Su Da Kyau a cikin npm da PyPI
Koyar da ƙungiyoyi yadda za su gano jajayen tutoci kamar:
- Sunayen fakiti masu rubutu (
reqeustmaimakonrequest). - sabon abu
installorpreparerubuce-rubuce. - An ƙirƙiri fakiti kwanan nan tare da lambobin sigar da ake zargi masu yawa.
Fiye da komai, wannan wayar tana taimakawa wajen gano ƙwayoyin cuta da wuri.
Gano Abubuwan da ke Faruwa a Lokacin Runtime don Fakitin npm Masu Lalacewa da Malware na PyPI
Ko da malware yana wucewa ta hanyar bincike na tsaye, gano lokacin aiki a cikin CI/CD iya kamawa:
- Haɗin hanyar sadarwa mara tsammani.
- Gyaran tsarin fayil a waje da kundin adireshi da ake tsammani.
- Gwaje-gwajen dagewa a cikin ayyuka.
A ƙarshe, wannan yana tabbatar da cewa an dakatar da barazanar malware na npm da pypi malware koda bayan shigarwa.
Ta hanyar haɗa waɗannan sarrafawa, ƙungiyoyi suna hana fakitin npm masu cutarwa da fakitin pypi masu cutarwa daga kaiwa ga samarwa har abada pipelines.
Gwada Kayan Aikin Gano Malware na Xygeni
Xygeni yana bayarwa:
- Gano lambobin cutarwa a ainihin lokaci, gami da ƙofofin baya, kayan leƙen asiri, da kuma na'urar ransomware.
- Sabanin na'urorin daukar hoto na asali, analysis a fadin npm, PyPI, Maven, NuGet, RubyGems, da sauransu.
- Toshewar ginin ta atomatik lokacin da rahoton malware ya gano haɗari.
- Fahimtar amfani da abubuwan da ba su dace ba, duba suna da kuma gano abubuwan da ba su dace ba.
Tsaya Bayani
Ƙungiyarmu tana sabunta wannan shafin kowane mako. Don karɓar faɗakarwa da rahotanni masu cikakken bayani:
- Biyan kuɗi zuwa ga namu Tsako
- Follow @XygeniTsaro akan Linkedin
- Yi alamar shafi a wannan shafin domin bin diddigin sabbin abubuwan da suka faru npm malware da kuma pypi malware barazanar
