Kowace mako, tsarin gano ƙwayoyin cuta namu yana duba dubban sabbin fakiti da aka sabunta a cikin rajistar jama'a kamar npm da PyPI. Wannan makon ba banda bane.
Mun tabbatar da fakitin cutarwa sama da 200 tsakanin 12t ga Yuni zuwa 19 ga Yuni, 2026, galibi a cikin npm, tare da ƙarin shari'o'i a cikin PyPI. Da yawa sun bayyana a cikin rukuni masu haɗin gwiwa, sake-sake na cutarwa da aka buga a ƙarƙashin suna ɗaya ko kuma a cikin iyalai masu alaƙa da fakiti.
Babban lamarin a wannan makon shine sensivity, wanda ya mamaye npm tare da fitowar sama da sigar 70 a cikin kewayon 2.5.x, an tabbatar da shi a cikin kwanaki da yawa. Sauran manyan rukuni sun haɗa da raƙuman ruwa na @solana-labs typosquats da ke kai hari ga yanayin Solana (web3.js, web3-js, etherjs, spl-toke, ancor, web3js — a cikin kamfen ɗin bugawa guda biyu daban-daban a ranar 7 ga Yuni da 8 ga Yuni), @nstrlabs iyali (sdk, ixel, utils, shared-components, api-client, auth - harin rikicewar dogaro akan sararin suna na ciki na kunshin), @klapp-login-platform ƙungiyar (native-sdk, oidc, routes - yin kwaikwayon wani dandamalin tantancewa), internallib_v557 da kuma internallib_v984 (nau'ikan da yawa na masu ruɗin ɗakin karatu na ciki da aka ɓoye), pocteszep (sigogi 6 da aka buga a ranar 11 ga Yuni), da kuma tarin ayyukan crypto da Web3 ciki har da blockchain-helper-0, ethereum-kit-1, ethereum-kit-9, crypto-utils-7, wallet-sdk-9, defi-tools-39, swap-sdk-87, Da kuma farming-tools-12. The morningstar-design-system Kunshin ya bayyana a cikin sigar uku a ranar 10 ga Yuni, yana kwaikwayon wani sanannen tsarin ƙirar kuɗi.
Daga ranar 13 ga Yuni zuwa gaba, saurin ya yi sauri. houzidawang806 Ƙungiyar kaɗai ta ƙunshi fiye da nau'ikan 25 da aka buga a cikin kwana ɗaya, tare da 'yan'uwa mata da yawa. houzidawang807 da kuma houzidawang808. The metrics-pipeline-d8k2 An sake buga fakitin akai-akai a cikin sigar 21 tsakanin 15 ga Yuni da 18 ga Yuni - wani kamfen mai ɗorewa wanda aka tsara don ci gaba da kasancewa a gaba da jerin toshewa. friendly-greeter-demo Kunshin ya ci gaba da bayyana a cikin sigar a duk tsawon makon. Sabbin yunƙurin ruɗani na dogaro sun bayyana a ƙarƙashin xy-shared, axl-ui, loadninja-shared, carousel-controller-mixin, token-prices-cron, hemi-supply-cron, portal-backend, vault-strategies, da wasu da dama - duk suna ɗauke da lambobin sigar da aka ƙaru a cikin kewayon 999.x. Sabon rukuni na sunayen amfani na gama gari tare da ƙarin haruffan hex bazuwar (color-utils-dee0, data-utils-d703, string-tools-be6c, type-check-816d, fmt-helpers-794b, metrics-probe-*) ya bayyana a ranakun 18-19 ga Yuni, daidai da rajistar da aka rubuta da yawa. Makon ya rufe da trimprompt, trimprompt-hub, claude-cup, Da kuma web3-crypto-address-utils an tabbatar a ranar 19 ga Yuni. A cikin PyPI, neuralbridge-sdk (sigogi biyar a fadin 4.5.x–5.1.x), deepstrain, teambot-ai, hello-test-s1, Da kuma aiaddin-agent an tabbatar da su a tsawon mako guda.
Waɗannan ba wasu abubuwa ne da ba a saba gani ba. Abin da ya fito fili a wannan makon shi ne yawan hare-haren rikice-rikicen dogaro da kai a kan wuraren suna na cikin kunshin, ci gaba da kamfen ɗin wallafe-wallafe na kwanaki da yawa waɗanda aka tsara don wuce ƙarshen cirewa, ci gaba da kai hari ga kayan aikin Web3 da DeFi (wani tsari da ya hanzarta sosai a cikin 2026), da kuma ƙaruwar amfani da sunayen fakiti na gama gari, masu kama da hayaniya waɗanda aka ƙera don guje wa ganowa ta hanyar haɗawa zuwa bishiyoyin dogaro na yau da kullun.
Wannan hoton mako-mako wani ɓangare ne na ci gaba da ake yi da Mummunan Lambobin Yaƙi, inda muke tabbatar da sabbin barazanar da kuma samar da bayanan sirri masu amfani don taimakawa ƙungiyoyin DevSecOps don kare su. pipelinekafin lalacewa ta faru. Bari mu bayyana abin da muka gano a wannan makon da kuma dalilin da ya sa yake da muhimmanci.
Kada Ka Yi Yaƙin Neman Zaɓe Mai Kyau Ya Isa Gare Ka Pipelines
Takaitaccen bayani na wannan makon ba game da barazana ɗaya ba ne; ya shafi girma ne kawai. An tabbatar da fakiti sama da 200, ci gaba da kwararar sigar a cikin kwanaki da yawa, da kuma kamfen ɗin rajista da aka rubuta da sauri fiye da yadda bita da hannu za su iya bi. Maharan ba sa jiran ku don ku cim ma hakan.
Gano Malware na Farko na Xygeni Yana sa ido kan npm, PyPI, da sauran rajista akai-akai, yana nuna barazanar a lokacin da aka buga su, ba bayan sun faɗi a cikin gini ba. Lokacin da wani kamfen ya buga nau'ikan fakitin mugunta guda 21 a cikin kwanaki huɗu, binciken mako-mako ba ya kama komai a kan lokaci.
Xygeni's Open Source Security mafita tana ba wa ƙungiyoyin DevSecOps ɗinku hangen nesa na ainihin lokaci da fifikon da suke buƙata don ci gaba da kasancewa a gaba da irin wannan matsin lamba mai daidaitawa, don haka ku pipelineKu kasance cikin tsafta ba tare da rage gudu a cikin ƙungiyoyinku ba.
