Gyara, 4 ga Agusta 2026. Wannan kundin bayanai ya fara lissafa tsawo na Open VSX arcane-spark/ubel:0.1.0 a matsayin mugunta. Wannan rarrabuwar ba daidai ba ce kuma an janye ta.
Bayan sake nazarin sigar da muka tantance, ba mu ga wani mummunan hali ba. Kunshin na'urar daukar hoto ce ta tsaro ta sarkar samar da kayayyaki, kuma buƙatunta na fita kawai suna zuwa ga rumbun adana bayanai na raunin jama'a da kuma sabis na IP-echo na jama'a.
An cire shigarwar daga teburin da ke ƙasa da kuma daga bayanan gano mu.
Kowace mako, tsarin gano ƙwayoyin cuta namu yana duba dubban sabbin fakiti da aka sabunta a cikin rajistar jama'a kamar npm da PyPI.
Wannan makon ya kasance mai aiki sosai.
Mun tabbatar Fakiti 92 na cutarwa, musamman a fadin npm, tare da ƙarin shari'o'i a cikin PyPI, OpenVSX, Da kuma mawakiDa dama sun bayyana a cikin ƙungiyoyi masu haɗin gwiwa, tare da sake buga munanan bayanai da aka maimaita a ƙarƙashin sunaye iri ɗaya ko kuma a cikin iyalai masu alaƙa da juna. Da yawa sun kwaikwayi tsarin biyan kuɗi da biyan kuɗi, enterprise da kuma fakitin yanar gizo na ciki, abokan ciniki na nazari, Tushen UI, kayan aikin masu haɓaka, masu binciken sassan, Fakitin girgije da jigogi na Google, da sauran kayayyaki da aka fi amincewa da su a cikin ayyukan ci gaba na zamani.
Waɗannan ba wasu abubuwa ne da ba a saba gani ba. Abin da ya fito fili a wannan makon shi ne yawan bugawa da aka yi a gidajen fakiti ɗaya, sake amfani da tsarin suna, da kuma yadda aka ɓoye fakitin da ba su dace ba don su yi kama da dogaro na gaskiya a cikin isar da software na gaske. pipelines.
Wannan hoton mako-mako wani ɓangare ne na ci gaba da muke yi Tsarin Lambobin Mugunta, inda muke tabbatar da sabbin barazanar da kuma samar da bayanan sirri masu amfani don taimakawa Ƙungiyoyin DevSecOps kare su pipelinekafin lalacewa ta faru.
Bari mu bayyana abin da muka samu a wannan makon da kuma dalilin da ya sa yake da muhimmanci.
| Kayan daji | Package | Rana |
|---|---|---|
| npm | alamar pa:99.1.10 | Apr 27, 2026 |
| pypi | moonbit-locale-compat:0.2.3 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.13 | Apr 27, 2026 |
| npm | @sbt_gitverse/analytics-client:99.0.1 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.33.1 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.14 | Apr 27, 2026 |
| npm | @tochka-ui/tushen:99.0.2 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.38.0 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.38.1 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.39.0 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.43.0 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.44.0 | Apr 27, 2026 |
| npm | google-logging-utils-internal:9.9.9 | Apr 27, 2026 |
| npm | google-logging-utils-internal:1.1.4 | Apr 27, 2026 |
| npm | js-component-explorer:99.9.16 | Apr 27, 2026 |
| npm | js-component-explorer:99.9.17 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.15 | Apr 27, 2026 |
| npm | @tochka-ui/tushen:99.0.3 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.16 | Apr 27, 2026 |
| npm | @sbt_gitverse/analytics-client:99.0.4 | Apr 27, 2026 |
| npm | @tochka-ui/tushen:99.0.4 | Apr 27, 2026 |
| npm | kl-b2c-ui-kit:99.0.1 | Apr 27, 2026 |
| npm | @tw-utils/static:99.0.1 | Apr 27, 2026 |
| npm | @tw-models/ma'aji:99.0.1 | Apr 27, 2026 |
| npm | @tw-marionette/clipboard:99.0.1 | Apr 27, 2026 |
| npm | @tw-marionette/shigarwa:99.0.1 | Apr 27, 2026 |
| npm | @ozon-complt/split:99.0.1 | Apr 27, 2026 |
| npm | @apple-pay-trust/destroy:99.0.1 | Apr 27, 2026 |
| npm | @apple-pay-trust/term-merchant:99.0.1 | Apr 27, 2026 |
| npm | @apple-pay-trust/start:99.0.1 | Apr 27, 2026 |
| npm | @google-pay-trust/finish:99.0.1 | Apr 27, 2026 |
| npm | @apple-pay-trust/finish:99.0.1 | Apr 27, 2026 |
| npm | @apple-pay-trust/validate-merchant:99.0.1 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.17 | Apr 27, 2026 |
| npm | @zirutan/utils:1.0.2 | Apr 27, 2026 |
| npm | @zirutan/utils:1.0.4 | Apr 27, 2026 |
| npm | rahoto-ng:1.0.2 | Apr 27, 2026 |
| npm | kl-b2c-ui-kit:99.0.2 | Apr 27, 2026 |
| npm | @apple-pay-trust/authorize-payment:99.0.2 | Apr 27, 2026 |
| npm | @google-pay-trust/authorize-payment:99.0.2 | Apr 27, 2026 |
| npm | @ozon-complt/antibot-handler:99.0.2 | Apr 27, 2026 |
| npm | @sbt_gitverse/analytics-client:99.0.5 | Apr 27, 2026 |
| npm | @tw-models/ma'aji:99.0.2 | Apr 27, 2026 |
| npm | frank-bot-gogle-cloning:1.1.0 | Apr 27, 2026 |
| npm | frank-research-pock-apple:1.1.4 | Apr 27, 2026 |
| npm | @google-pay-trust/init-google-pay-result:99.0.2 | Apr 27, 2026 |
| npm | @google-pay-trust/start:99.0.2 | Apr 27, 2026 |
| npm | @b2b_blocker/nuna_kunna_kuskure:99.0.2 | Apr 27, 2026 |
| npm | @business_promocode/soke_promocode:99.0.2 | Apr 27, 2026 |
| npm | @business_promocode/apply_promocode:99.0.2 | Apr 27, 2026 |
| npm | @b2b_blocker/ɓoye_activation_error:99.0.2 | Apr 27, 2026 |
| npm | apple-internal-pki-utils:1.0.1 | Apr 27, 2026 |
| npm | apple-internal-pki-trust-v5:1.0.0 | Apr 27, 2026 |
| npm | @2011-08-19/n:99.9.9 | Apr 28, 2026 |
| npm | @combinezone/jigo:99.9.10 | Apr 28, 2026 |
| npm | Maninos:1.3.0 | Apr 28, 2026 |
| npm | @inheritdoc/n:99.9.9 | Apr 28, 2026 |
| npm | @mts-pay/web-sdk:99.9.9 | Apr 28, 2026 |
| npm | @cashback/yadda-yake-aiki-widget:99.9.9 | Apr 28, 2026 |
| npm | @cashback/postal-premium: 99.9.9 | Apr 28, 2026 |
| npm | @toprimitive/nif:99.9.9 | Apr 28, 2026 |
| npm | @tostringtag/nsettostringtag:99.9.9 | Apr 28, 2026 |
| npm | manajan rtms: 1.4.0 | Apr 28, 2026 |
| npm | mai binciken vscode-component:99.9.15 | Apr 28, 2026 |
| mawaki | dot-env-it/laravel-core-helper:v1.0.0 | Apr 28, 2026 |
| npm | widgets na uipath-ui:1.0.1 | Apr 28, 2026 |
| npm | manhajoji masu zaman kansu:1.0.1 | Apr 28, 2026 |
| npm | saukar apollo:1.0.1 | Apr 28, 2026 |
| npm | aikin aiwatar-aikace-aikace:1.0.1 | Apr 28, 2026 |
| npm | Apollo-vertex:1.0.1 | Apr 28, 2026 |
| npm | @taxmoninor/taxmon:99.0.6 | Apr 28, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.19 | Apr 28, 2026 |
| npm | @apiary-annex/meta:99.0.4 | Apr 28, 2026 |
| npm | @apple-pay-trust/an soke:99.0.3 | Apr 28, 2026 |
| npm | @apple-pay-trust/check-apple-pay:99.0.3 | Apr 28, 2026 |
| npm | @apple-pay-trust/check-apple-pay:99.0.4 | Apr 28, 2026 |
| npm | @apple-pay-trust/finish:99.0.3 | Apr 28, 2026 |
| npm | @apple-pay-trust/term-merchant:99.0.4 | Apr 28, 2026 |
| npm | @apple-pay-trust/term-merchant:99.0.3 | Apr 28, 2026 |
| npm | @apple-pay-trust/finish:99.0.4 | Apr 28, 2026 |
| npm | @apple-pay-trust/destroy:99.0.4 | Apr 28, 2026 |
| npm | @apple-pay-trust/destroy:99.0.3 | Apr 28, 2026 |
| npm | @pyme-web/web-api:99.0.4 | Apr 28, 2026 |
| npm | @google-pay-trust/authorize-payment:99.0.4 | Apr 28, 2026 |
| npm | @google-pay-trust/finish:99.0.3 | Apr 28, 2026 |
| npm | @google-pay-trust/init-google-pay:99.0.4 | Apr 28, 2026 |
| npm | @google-pay-trust/start:99.0.4 | Apr 28, 2026 |
| npm | kl-b2c-ui-kit:99.0.3 | Apr 28, 2026 |
| npm | @ozon-complt/antibot-handler:99.0.3 | Apr 28, 2026 |
| npm | @ozon-complt/antibot-handler:99.0.4 | Apr 28, 2026 |
| npm | @tw-models/ma'aji:99.0.3 | Apr 28, 2026 |
| npm | @w3m-app/is_connected:99.0.4 | Apr 28, 2026 |
| npm | @w3m-frame/zaman_sabuntawa:99.0.4 | Apr 28, 2026 |
| npm | accesso-angular-cache-buster:99.9.0 | Apr 29, 2026 |
| npm | accesso-angular-cache-buster:99.0.0 | Apr 29, 2026 |
| npm | saitin hps:2.0.0 | Apr 29, 2026 |
Kare Dogayen Tushenka na Buɗaɗɗen Bayani daga Rauni da Lambobin Mugunta
Rage haɗari kuma kare aikace-aikacenku daga fakitin cutarwa tare da Gano Malware na Farko na Xygeni. Ba da fifiko kuma magance raunin da ya fi muhimmanci. Cikakken mafitarmu tana ba da sa ido kan abubuwan da kake dogaro da su a ainihin lokaci don gano da rage barazanar kafin su shafi software ɗinka.
Gudanar da abubuwan da ke cikin tushen buɗewa a cikin yanayin haɓaka software na yanzu yana da mahimmanci saboda ƙaruwar rauni da barazanar lambar mugunta. Open Source Security Yana duba da kuma toshe fakiti masu cutarwa bayan an buga su, yana rage haɗarin malware da rauni da ke shiga tsarin ku sosai. Cikakken sa ido namu ya shafi rajistar jama'a da yawa, yana tabbatar da cewa an bincika duk abubuwan da suka dogara da su don aminci da mutunci. Xygeni yana haɓaka ikon ƙungiyar ku na kula da ayyukan software masu aminci da inganci ta hanyar fifita mahimman batutuwa a cikin mahallin da kuma sauƙaƙe hanyoyin gyarawa.
Xygeni yana amfani da dabarun da suka kunshi matakai da yawa don dakatar da lambar mugunta kafin ta bazu. Da farko dai, nazarin lambar da ba ta canzawa yana gano tsarin ɓoyewa, ɓoyayyun abubuwan biyan kuɗi, da cin zarafin rubutun. Bugu da ƙari, yin amfani da sandar halayya yana nazarin shigarwa. hooks, umarnin lokacin aiki, da dabarun juriya. Bugu da ƙari, gano koyo na na'ura yana gano nau'ikan malware na npm na rana da pypi da na'urorin daukar hoto na sa hannu suka rasa. A ƙarshe, Tsarin Gargaɗi na Farko yana sa ido kan ma'ajiyar jama'a a ainihin lokaci, yana tabbatar da sakamakon, kuma yana sanar da ƙungiyoyin DevOps nan take.
Sakamakon haka, wannan haɗin yana tabbatar da cewa masu haɓakawa suna samun saurin bayanai masu aiki waɗanda aka haɗa kai tsaye cikin CI/CD workflows.
Dalilin da Ya Sa Masu Haɓaka Ya Kamata Su Kula da Mummunan Kunshin NPM
Barazanar zamani ba kasafai take jiran lokacin aiki ba. Misali, fakitin npm masu cutarwa galibi suna aiki yayin shigarwa, yayin da fakitin pypi masu cutarwa ke ɓoye fitar da alamun ko ƙofofin baya. Masu kai hari:
- Juya bayanan GitHub na sirri zuwa ga jama'a don kwafi su.
- Tattara bayanan sirri da sirri ta amfani da kayan aikin da aka ɓoye.
- Yi amfani da na'urorin loda JavaScript masu ɓoye don aika ransomware ko botnets.
A gaskiya ma, fakitin buɗe tushen mugunta ya karu da kashi 156% a cikin shekara guda. Saboda haka, ƙungiyoyin da suka dogara kawai akan ciyarwar da aka jinkirta ko na'urorin ɗaukar hoto na asali suna faɗuwa a baya.
Abin da Wannan Rahoton Malware Yake Bin Diddiginsa a cikin npm da PyPI
Wannan bincike shine babban cibiyar bincike:
- An tabbatar da fakitin npm mara kyau
- An tabbatar da fakitin pypi masu cutarwa
- Gano lambar cutarwa bisa ga ɗabi'a
- Abubuwan da suka faru da aka tabbatar da rajista
- Takaitattun rahotannin malware na mako-mako da na wata-wata
- Tarihin canjin duk abubuwan da aka gano na malware na npm da pypi
A wata ma'anar, yana ba da ma'ana ɗaya tilo. Ƙungiyar bincike a Xygeni tana sabunta wannan shafin kowane mako tare da hanyoyin haɗi zuwa cikakkun nazarin fasaha da GitHub IOCs.
Yadda Ake Kare Kariya Daga Fakitin npm Masu Lalacewa da Malware na PyPI
Saboda wannan haɗarin da ke ƙaruwa, ƙungiyoyi suna buƙatar kariya mai ƙarfi:
- Tilasta shigarwar fayil ɗin makulli kawai (
npm ci) a cikin CI/CD. - Bugu da ƙari, shigar da abubuwan da suka dogara da na'urar Xygeni kafin amfani da injin gargaɗi na farko.
- Bugu da ƙari, toshe yana ginawa akan siginar lambar cuta ta amfani da Guardrails.
- Generate SBOMs don bin diddigin dogaro kai tsaye da kuma amfani da manufofi.
- Fiye da komai, horar da masu haɓaka software don gano kuskuren rubutu, ɓoyewa, da kuma rubutun shigarwa da ake zargi.
Gwada Kayan Aikin Gano Malware na Xygeni
Xygeni yana bayarwa:
- Gano lambobin cutarwa a ainihin lokaci, gami da ƙofofin baya, kayan leƙen asiri, da kuma na'urar ransomware.
- Sabanin na'urorin daukar hoto na asali, analysis a fadin npm, PyPI, Maven, NuGet, rubygems, Kuma mafi.
- Toshewar ginin ta atomatik lokacin da rahoton malware ya gano haɗari.
- Fahimtar amfani da abubuwan da ba su dace ba, duba suna da kuma gano abubuwan da ba su dace ba.
