Kusan kowane mako, tsarin gano ƙwayoyin cuta namu yana duba dubban sabbin fakiti da aka sabunta a cikin rajistar jama'a kamar npm da PyPI. Wannan makon ba banda bane.
Mun tabbatar da fakitin cutarwa sama da 130 tsakanin 7 ga Yuni da 12 ga Yuni, 2026, galibi a cikin npm, tare da ƙarin shari'o'i a cikin PyPI. Da yawa sun bayyana a cikin rukuni masu haɗin gwiwa, sake-sake na cutarwa da aka buga a ƙarƙashin sunaye iri ɗaya ko kuma a cikin iyalai masu alaƙa da fakiti.
Babban lamarin a wannan makon shine sensivity, wanda ya mamaye npm tare da fitowar sama da sigar 40 a cikin kewayon 2.5.x, an tabbatar da shi a cikin kwanaki da yawa. Sauran manyan rukuni sun haɗa da raƙuman ruwa na @solana-labs typosquats da ke kai hari ga yanayin Solana (web3.js, web3-js, etherjs, spl-toke, ancor, web3js — a cikin kamfen guda biyu daban-daban na wallafe-wallafe a ranar 7 ga Yuni da 8 ga Yuni), @nstrlabs iyali (sdk, ixel, utils, shared-components, api-client, auth — harin rikicewar dogaro akan wani namespace na cikin kunshin), @klapp-login-platform rukuni (native-sdk, oidc, hanyoyi — yin kwaikwayon dandamalin tantancewa), internallib_v557 da kuma internallib_v984 (nau'ikan da yawa na masu ruɗin ɗakin karatu na ciki da aka ɓoye), pocteszep (sigogi 6 da aka buga a ranar 11 ga Yuni), da kuma tarin ayyukan crypto da Web3 ciki har da blockchain-helper-0, ethereum-kit-1, ethereum-kit-9, crypto-utils-7, wallet-sdk-9, defi-tools-39, swap-sdk-87, Da kuma farming-tools-12. The morningstar-design-system Kunshin ya bayyana a cikin sigar uku a ranar 10 ga Yuni, yana kwaikwayon wani sanannen tsarin ƙirar kuɗi. A cikin PyPI, helixagentai, telegramlite, Da kuma cdjeez an tabbatar da su a tsawon mako guda.
Waɗannan ba wasu abubuwa ne da ba a saba gani ba. Abin da ya fito fili a wannan makon shi ne yawan hare-haren rikice-rikicen dogaro da kai a kan wuraren suna na ciki, da kuma ci gaba da buga littattafan kwanaki da yawa na sensivity rukuni, da kuma ci gaba da kai hari ga kayan aikin Web3 da Solana, wani tsari wanda ya hanzarta sosai a cikin 2026.
Wannan hoton mako-mako wani ɓangare ne na ci gaba da ake yi da Mummunan Lambobin Yaƙi, inda muke tabbatar da sabbin barazanar da kuma samar da bayanan sirri masu amfani don taimakawa ƙungiyoyin DevSecOps don kare su. pipelinekafin lalacewa ta faru.
Bari mu bayyana abin da muka samu a wannan makon da kuma dalilin da ya sa yake da muhimmanci.
Kada Ka Bari Fakitin Mugunta Su Kai Ga Samarwa
Ana ƙara amfani da fakitin da ƙungiyoyin ku ke dogara da su a matsayin wurin shiga. Gano Malware na Farko na Xygeni yana sa ido kan rajista a ainihin lokaci, don haka barazanar kamar waɗanda ke cikin wannan makon za a toshe su kafin su isa ga ginin ku.
Sakamakon wannan makon tunatarwa ce cewa dabarun suna ƙara zama da gangan. Yawan ambaliya, kwaikwayon sunan fili, da kuma kamfen ɗin da aka tsara na kwanaki da yawa ba su da wani tasiri a yanzu, suna da yawa. standard Littafin wasan kai hari. Dubawa sau ɗaya da kuma binciken hannu ba za su iya yin daidai da kamfen ɗin da ke buga nau'ikan da yawa a cikin kwanaki da yawa da rajista a lokaci guda ba.
Xygeni's Open Source Security mafita tana ba wa ƙungiyar DevSecOps ɗinku damar gani a ko'ina cikin npm, PyPI, da kuma sama da haka, gano fakiti masu haɗari a lokacin da aka buga su, fifita abin da ke haifar da haɗari mai haɗari, da kuma rage hanyar daga ganowa zuwa gyara. Don haka ƙungiyoyinku za su iya jigilar kaya da sauri ba tare da yin sakaci kan tsaro ba.
