Kowace mako, tsarin gano ƙwayoyin cuta namu yana duba dubban sabbin fakiti da aka sabunta a cikin rajistar jama'a kamar npm da PyPI.
Wannan makon ya kasance mai aiki sosai.
Mun tabbatar Fakiti 45 na cutarwa, musamman a fadin npm, tare da ƙarin shari'o'i a cikin PyPI da kuma VS CodeDa dama sun bayyana a cikin ƙungiyoyi masu haɗin gwiwa, tare da sake buga munanan bayanai da aka maimaita a ƙarƙashin sunaye iri ɗaya ko kuma a cikin iyalai masu alaƙa da juna. Da yawa sun kwaikwayi Kayan aikin da suka shafi AI, kayan aikin masu haɓaka, Kubernetes da kayan aikin girgije, masu taimakawa bayanai, abubuwan haɗin gaba, fakitin edita, da sauran kayayyaki da aka fi amincewa da su a cikin ayyukan ci gaba na zamani.
Waɗannan ba wasu abubuwa ne da ba a saba gani ba. Abin da ya fi jan hankali a wannan makon shi ne yawan bugawa a cikin gidajen fakitin guda ɗaya, sake amfani da tsarin suna, da kuma yadda aka ɓoye fakitin da ba su dace ba don su yi kama da dogaro na gaskiya a cikin isar da software na gaske. pipelines.
Wannan hoton mako-mako wani ɓangare ne na ci gaba da muke yi Tsarin Lambobin Mugunta, inda muke tabbatar da sabbin barazanar da kuma samar da bayanan sirri masu amfani don taimakawa Ƙungiyoyin DevSecOps kare su pipelinekafin lalacewa ta faru.
Bari mu bayyana abin da muka samu a wannan makon da kuma dalilin da ya sa yake da muhimmanci.
| Kayan daji | Package | Rana |
|---|---|---|
| npm | gwajin sn3akysnak3:1.1.1 | Apr 17, 2026 |
| npm | gano abu mai launin ja a cikin node-red:9.1.11 | Apr 17, 2026 |
| npm | gano abu mai launin ja a cikin node-red:9.1.12 | Apr 17, 2026 |
| vscode | ptah-coding-orchestra:0.2.18 | Apr 17, 2026 |
| pypi | deathstar-ai:0.19.9 | Apr 17, 2026 |
| npm | wazir-xlocaletstnpm:9.9.2 | Apr 20, 2026 |
| pypi | notrandompacketname:0.1.12 | Apr 20, 2026 |
| npm | gwajin pocbitbarron:1.0.0 | Apr 20, 2026 |
| npm | ac-sasskit-cikin ciki:100.0.12 | Apr 21, 2026 |
| npm | editan sy-v3:8.0.0 | Apr 19, 2026 |
| npm | editan sy-v3:9.0.0 | Apr 19, 2026 |
| npm | editan sy-v3:9.0.1 | Apr 19, 2026 |
| npm | @caspian2026/wakilin-sdk:0.0.5 | Apr 20, 2026 |
| npm | alamar pa:99.1.10 | Apr 20, 2026 |
| npm | react-spa-shadcn:99.3.0 | Apr 24, 2026 |
| pypi | moonbit-locale-compat:0.2.3 | Apr 20, 2026 |
| npm | shadxino:1.0.0 | Apr 21, 2026 |
| npm | ɗakin karatu na ƙwarewa na Claude: 2.0.6 | Apr 21, 2026 |
| npm | ɗakin karatu na ƙwarewa na Claude: 2.0.3 | Apr 21, 2026 |
| npm | ɗakin karatu na ƙwarewa na Claude: 1.0.2 | Apr 21, 2026 |
| npm | ɗakin karatu na ƙwarewa na Claude: 2.0.0 | Apr 21, 2026 |
| npm | ɗakin karatu na ƙwarewa na Claude: 1.0.1 | Apr 21, 2026 |
| npm | ɗakin karatu na ƙwarewa na Claude: 2.0.18 | Apr 22, 2026 |
| npm | ɗakin karatu na ƙwarewa na Claude: 2.0.19 | Apr 22, 2026 |
| npm | kayan aikin kiwon lafiya na kube:2.4.0 | Apr 22, 2026 |
| npm | shafi:1.1.11 | Apr 22, 2026 |
| npm | shafi:1.1.12 | Apr 22, 2026 |
| npm | shafi:1.1.13 | Apr 22, 2026 |
| npm | kayan aikin kiwon lafiya na kube:2.4.1 | Apr 22, 2026 |
| npm | Mai duba k8s-pod:0.0.1 | Apr 22, 2026 |
| npm | node-perf-utils:0.0.1 | Apr 22, 2026 |
| npm | saitin dev-env:0.0.1 | Apr 22, 2026 |
| npm | kayan aikin kiwon lafiya na kube:2.4.2 | Apr 22, 2026 |
| npm | saitin dev-env:0.0.2 | Apr 22, 2026 |
| npm | Mai duba k8s-pod:0.0.2 | Apr 22, 2026 |
| npm | node-perf-utils:0.0.2 | Apr 22, 2026 |
| npm | @automakik/genie:4.260421.40 | Apr 22, 2026 |
| npm | shafi:1.1.14 | Apr 22, 2026 |
| npm | kayan aikin kiwon lafiya na kube:2.4.3 | Apr 22, 2026 |
| npm | node-perf-utils:0.0.3 | Apr 22, 2026 |
| npm | Mai duba k8s-pod:0.0.3 | Apr 22, 2026 |
| npm | saitin dev-env:0.0.3 | Apr 22, 2026 |
| npm | react-spa-shadcn:100.9.9 | Apr 24, 2026 |
| npm | ƙwarewar ma'aikaci ta microsoft:99.2.1 | Apr 24, 2026 |
| npm | ƙwarewar ma'aikaci ta microsoft:99.2.2 | Apr 24, 2026 |
Kare Dogayen Tushenka na Buɗaɗɗen Bayani daga Rauni da Lambobin Mugunta
Rage haɗari kuma kare aikace-aikacenku daga fakitin cutarwa tare da Gano Malware na Farko na Xygeni. Ba da fifiko kuma magance raunin da ya fi muhimmanci. Cikakken mafitarmu tana ba da sa ido kan abubuwan da kake dogaro da su a ainihin lokaci don gano da rage barazanar kafin su shafi software ɗinka.
Gudanar da abubuwan da ke cikin tushen buɗewa a cikin yanayin haɓaka software na yanzu yana da mahimmanci saboda ƙaruwar rauni da barazanar lambar mugunta. Open Source Security Yana duba da kuma toshe fakiti masu cutarwa bayan an buga su, yana rage haɗarin malware da rauni da ke shiga tsarin ku sosai. Cikakken sa ido namu ya shafi rajistar jama'a da yawa, yana tabbatar da cewa an bincika duk abubuwan da suka dogara da su don aminci da mutunci. Xygeni yana haɓaka ikon ƙungiyar ku na kula da ayyukan software masu aminci da inganci ta hanyar fifita mahimman batutuwa a cikin mahallin da kuma sauƙaƙe hanyoyin gyarawa.
Xygeni yana amfani da dabarun da suka kunshi matakai da yawa don dakatar da lambar mugunta kafin ta bazu. Da farko dai, nazarin lambar da ba ta canzawa yana gano tsarin ɓoyewa, ɓoyayyun abubuwan biyan kuɗi, da cin zarafin rubutun. Bugu da ƙari, yin amfani da sandar halayya yana nazarin shigarwa. hooks, umarnin lokacin aiki, da dabarun juriya. Bugu da ƙari, gano koyo na na'ura yana gano nau'ikan malware na npm na rana da pypi da na'urorin daukar hoto na sa hannu suka rasa. A ƙarshe, Tsarin Gargaɗi na Farko yana sa ido kan ma'ajiyar jama'a a ainihin lokaci, yana tabbatar da sakamakon, kuma yana sanar da ƙungiyoyin DevOps nan take.
Sakamakon haka, wannan haɗin yana tabbatar da cewa masu haɓakawa suna samun saurin bayanai masu aiki waɗanda aka haɗa kai tsaye cikin CI/CD workflows.
Dalilin da Ya Sa Masu Haɓaka Ya Kamata Su Kula da Mummunan Kunshin NPM
Barazanar zamani ba kasafai take jiran lokacin aiki ba. Misali, fakitin npm masu cutarwa galibi suna aiki yayin shigarwa, yayin da fakitin pypi masu cutarwa ke ɓoye fitar da alamun ko ƙofofin baya. Masu kai hari:
- Juya bayanan GitHub na sirri zuwa ga jama'a don kwafi su.
- Tattara bayanan sirri da sirri ta amfani da kayan aikin da aka ɓoye.
- Yi amfani da na'urorin loda JavaScript masu ɓoye don aika ransomware ko botnets.
A gaskiya ma, fakitin buɗe tushen mugunta ya karu da kashi 156% a cikin shekara guda. Saboda haka, ƙungiyoyin da suka dogara kawai akan ciyarwar da aka jinkirta ko na'urorin ɗaukar hoto na asali suna faɗuwa a baya.
Abin da Wannan Rahoton Malware Yake Bin Diddiginsa a cikin npm da PyPI
Wannan bincike shine babban cibiyar bincike:
- An tabbatar da fakitin npm mara kyau
- An tabbatar da fakitin pypi masu cutarwa
- Gano lambar cutarwa bisa ga ɗabi'a
- Abubuwan da suka faru da aka tabbatar da rajista
- Takaitattun rahotannin malware na mako-mako da na wata-wata
- Tarihin canjin duk abubuwan da aka gano na malware na npm da pypi
A wata ma'anar, yana ba da ma'ana ɗaya tilo. Ƙungiyar bincike a Xygeni tana sabunta wannan shafin kowane mako tare da hanyoyin haɗi zuwa cikakkun nazarin fasaha da GitHub IOCs.
Yadda Ake Kare Kariya Daga Fakitin npm Masu Lalacewa da Malware na PyPI
Saboda wannan haɗarin da ke ƙaruwa, ƙungiyoyi suna buƙatar kariya mai ƙarfi:
- Tilasta shigarwar fayil ɗin makulli kawai (
npm ci) a cikin CI/CD. - Bugu da ƙari, shigar da abubuwan da suka dogara da na'urar Xygeni kafin amfani da injin gargaɗi na farko.
- Bugu da ƙari, toshe yana ginawa akan siginar lambar cuta ta amfani da Guardrails.
- Generate SBOMs don bin diddigin dogaro kai tsaye da kuma amfani da manufofi.
- Fiye da komai, horar da masu haɓaka software don gano kuskuren rubutu, ɓoyewa, da kuma rubutun shigarwa da ake zargi.
Gwada Kayan Aikin Gano Malware na Xygeni
Xygeni yana bayarwa:
- Gano lambobin cutarwa a ainihin lokaci, gami da ƙofofin baya, kayan leƙen asiri, da kuma na'urar ransomware.
- Sabanin na'urorin daukar hoto na asali, analysis a fadin npm, PyPI, Maven, NuGet, rubygems, Kuma mafi.
- Toshewar ginin ta atomatik lokacin da rahoton malware ya gano haɗari.
- Fahimtar amfani da abubuwan da ba su dace ba, duba suna da kuma gano abubuwan da ba su dace ba.
