Kowace mako, tsarin gano ƙwayoyin cuta namu yana duba dubban sabbin fakiti da aka sabunta a cikin rajistar jama'a kamar npm da PyPI.
Wannan makon ya bambanta.
Bayan tabbatarwa Fakitin cutarwa sama da 40, ƙungiyar bincikenmu ta gudanar da bincike mai zurfi kan:
- Wani sabon kamfen da aka gano na satar bayanai yana cin zarafin tsarin npm
- Wani mummunan cokali mai yatsu da ke kai hari ga sarkar samar da kayan ɗakin karatu na Baileys WhatsApp
Waɗannan ba kalmomi ne masu sauƙi na rubuta rubutu ba. Dukansu sun haɗa da cin zarafin takardun shaida da kuma satar bayanai a zaman da ke iya yin tasiri ga yanayin masu haɓaka software na gaske.
Wannan hoton mako-mako wani ɓangare ne na ci gaba da muke yi Tsarin Lambobin Muguntainda muke tabbatar da sabbin barazanar da kuma samar da bayanan sirri masu amfani don taimakawa ƙungiyoyin DevSecOps su kare su pipelinekafin lalacewa ta faru.
Bari mu bayyana abin da muka samu a wannan makon da kuma dalilin da ya sa yake da muhimmanci.
| Kayan daji | Package | Rana |
|---|---|---|
| npm | amfani da hanyar sadarwa:2.95.0 | Feb 27, 2026 |
| npm | amfani da hanyar sadarwa:2.96.0 | Feb 27, 2026 |
| npm | amfani da hanyar sadarwa:2.97.0 | Feb 27, 2026 |
| npm | amfani da hanyar sadarwa:2.99.0 | Feb 27, 2026 |
| npm | amfani da hanyar sadarwa:2.98.0 | Feb 27, 2026 |
| npm | amfani da hanyar sadarwa:3.99.0 | Feb 27, 2026 |
| npm | rncalendareventsmisali:0.0.5 | Mar 02, 2026 |
| npm | misalimaimaimaimai76:0.0.8 | Mar 02, 2026 |
| npm | rncalendareventsmisali:0.0.10 | Mar 02, 2026 |
| npm | ƙaddamar da darkly-js:199.99.102 | Mar 03, 2026 |
| npm | ƙaddamar da darkly-js:199.99.103 | Mar 03, 2026 |
| npm | na'urar wasan bidiyo:1.3.0 | Mar 03, 2026 |
| npm | ƙaddamar da darkly-js:199.99.106 | Mar 03, 2026 |
| npm | securefiles-common:1.0.3 | Feb 28, 2026 |
| npm | nuget-task-common:1.0.4 | Feb 28, 2026 |
| npm | manhajar woltpicker:40.6.2 | Mar 02, 2026 |
| npm | xrpl-dev-portal:1.0.3 | Mar 03, 2026 |
| pypi | isb:1.0.0 | Mar 04, 2026 |
| pypi | aikina na bola:1.0.0 | Mar 03, 2026 |
| npm | haɗin ag:1.0.0 | Feb 28, 2026 |
| npm | haɗin ag:1.0.1 | Feb 28, 2026 |
| npm | haɗin ag:1.1.0 | Feb 28, 2026 |
| npm | haɗin ag:1.2.0 | Feb 28, 2026 |
| npm | haɗin ag:1.3.0 | Feb 28, 2026 |
| npm | haɗin ag:1.3.1 | Feb 28, 2026 |
| npm | fakitin da ba shi da kyau: 1.0.2 | Mar 02, 2026 |
| npm | gwajin_piyush_vadapav:1.0.1 | Mar 01, 2026 |
| npm | sake kunnawa-ci:1.0.0 | Mar 02, 2026 |
| npm | sake kunnawa-ci:1.0.1 | Mar 02, 2026 |
| npm | ng-vzbootstrap:1.0.3 | Mar 03, 2026 |
| npm | fakitin da ba shi da kyau: 1.0.6 | Mar 02, 2026 |
| npm | pdfjs-dist-v5:100.21.1 | Mar 03, 2026 |
| npm | pino-sdk:9.9.0 | Mar 04, 2026 |
| npm | samfurin gwajin tsaro na aio-security-erk1ny:1.0.0 | Mar 04, 2026 |
| npm | pino-sdk-v2:9.9.0 | Mar 04, 2026 |
| npm | nf-na'ura wasan bidiyo:99.0.0 | Mar 04, 2026 |
| npm | nf-na'ura wasan bidiyo:99.0.1 | Mar 04, 2026 |
| npm | yaml-manifest-utils-mynarratorai:2.0.0 | Mar 05, 2026 |
| npm | yaml-manifest-utils-mynarratorai:4.0.0 | Mar 05, 2026 |
| npm | ecto-module:99.0.0 | Mar 05, 2026 |
| npm | fatalwa mai rauni:9999.0.0 | Mar 05, 2026 |
| npm | siren-makoki:9999.0.0 | Mar 05, 2026 |
| npm | ect-472839:9999.0.0 | Mar 05, 2026 |
Kare Dogayen Tushenka na Buɗaɗɗen Bayani daga Rauni da Lambobin Mugunta
Rage haɗari kuma kare aikace-aikacenku daga fakitin cutarwa tare da Gano Malware na Farko na Xygeni. Ba da fifiko kuma magance raunin da ya fi muhimmanci. Cikakken mafitarmu tana ba da sa ido kan abubuwan da kake dogaro da su a ainihin lokaci don gano da rage barazanar kafin su shafi software ɗinka.
Gudanar da abubuwan da ke cikin tushen buɗewa a cikin yanayin haɓaka software na yanzu yana da mahimmanci saboda ƙaruwar rauni da barazanar lambar mugunta. Open Source Security Yana duba da kuma toshe fakiti masu cutarwa bayan an buga su, yana rage haɗarin malware da rauni da ke shiga tsarin ku sosai. Cikakken sa ido namu ya shafi rajistar jama'a da yawa, yana tabbatar da cewa an bincika duk abubuwan da suka dogara da su don aminci da mutunci. Xygeni yana haɓaka ikon ƙungiyar ku na kula da ayyukan software masu aminci da inganci ta hanyar fifita mahimman batutuwa a cikin mahallin da kuma sauƙaƙe hanyoyin gyarawa.
Xygeni yana amfani da dabarun da suka kunshi matakai da yawa don dakatar da lambar mugunta kafin ta bazu. Da farko dai, nazarin lambar da ba ta canzawa yana gano tsarin ɓoyewa, ɓoyayyun abubuwan biyan kuɗi, da cin zarafin rubutun. Bugu da ƙari, yin amfani da sandar halayya yana nazarin shigarwa. hooks, umarnin lokacin aiki, da dabarun juriya. Bugu da ƙari, gano koyo na na'ura yana gano nau'ikan malware na npm na rana da pypi da na'urorin daukar hoto na sa hannu suka rasa. A ƙarshe, Tsarin Gargaɗi na Farko yana sa ido kan ma'ajiyar jama'a a ainihin lokaci, yana tabbatar da sakamakon, kuma yana sanar da ƙungiyoyin DevOps nan take.
Sakamakon haka, wannan haɗin yana tabbatar da cewa masu haɓakawa suna samun saurin bayanai masu aiki waɗanda aka haɗa kai tsaye cikin CI/CD workflows.
Dalilin da Ya Sa Masu Haɓaka Ya Kamata Su Kula da Mummunan Kunshin NPM
Barazanar zamani ba kasafai take jiran lokacin aiki ba. Misali, fakitin npm masu cutarwa galibi suna aiki yayin shigarwa, yayin da fakitin pypi masu cutarwa ke ɓoye fitar da alamun ko ƙofofin baya. Masu kai hari:
- Juya bayanan GitHub na sirri zuwa ga jama'a don kwafi su.
- Tattara bayanan sirri da sirri ta amfani da kayan aikin da aka ɓoye.
- Yi amfani da na'urorin loda JavaScript masu ɓoye don aika ransomware ko botnets.
A gaskiya ma, fakitin buɗe tushen mugunta ya karu da kashi 156% a cikin shekara guda. Saboda haka, ƙungiyoyin da suka dogara kawai akan ciyarwar da aka jinkirta ko na'urorin ɗaukar hoto na asali suna faɗuwa a baya.
Abin da Wannan Rahoton Malware Yake Bin Diddiginsa a cikin npm da PyPI
Wannan bincike shine babban cibiyar bincike:
- An tabbatar da fakitin npm mara kyau
- An tabbatar da fakitin pypi masu cutarwa
- Gano lambar cutarwa bisa ga ɗabi'a
- Abubuwan da suka faru da aka tabbatar da rajista
- Takaitattun rahotannin malware na mako-mako da na wata-wata
- Tarihin canjin duk abubuwan da aka gano na malware na npm da pypi
A wata ma'anar, yana ba da ma'ana ɗaya tilo. Ƙungiyar bincike a Xygeni tana sabunta wannan shafin kowane mako tare da hanyoyin haɗi zuwa cikakkun nazarin fasaha da GitHub IOCs.
Yadda Ake Kare Kariya Daga Fakitin npm Masu Lalacewa da Malware na PyPI
Saboda wannan haɗarin da ke ƙaruwa, ƙungiyoyi suna buƙatar kariya mai ƙarfi:
- Tilasta shigarwar fayil ɗin makulli kawai (
npm ci) a cikin CI/CD. - Bugu da ƙari, shigar da abubuwan da suka dogara da na'urar Xygeni kafin amfani da injin gargaɗi na farko.
- Bugu da ƙari, toshe yana ginawa akan siginar lambar cuta ta amfani da Guardrails.
- Generate SBOMs don bin diddigin dogaro kai tsaye da kuma amfani da manufofi.
- Fiye da komai, horar da masu haɓaka software don gano kuskuren rubutu, ɓoyewa, da kuma rubutun shigarwa da ake zargi.
Gwada Kayan Aikin Gano Malware na Xygeni
Xygeni yana bayarwa:
- Gano lambobin cutarwa a ainihin lokaci, gami da ƙofofin baya, kayan leƙen asiri, da kuma na'urar ransomware.
- Sabanin na'urorin daukar hoto na asali, analysis a fadin npm, PyPI, Maven, NuGet, rubygems, Kuma mafi.
- Toshewar ginin ta atomatik lokacin da rahoton malware ya gano haɗari.
- Fahimtar amfani da abubuwan da ba su dace ba, duba suna da kuma gano abubuwan da ba su dace ba.
