Kowace mako, tsarin gano ƙwayoyin cuta namu yana duba dubban sabbin fakiti da aka sabunta a cikin rajistar jama'a kamar npm da PyPI. Wannan makon ba banda bane.
Mun tabbatar da sama da fakiti 90 na ɓarna tsakanin 26 ga Yuni da 3 ga Yuli, 2026, a faɗin npm da PyPI, tare da ci gaba da kamfen da dama daga makonnin da suka gabata da kuma sabbin da suka fito.
The nolimit-agent kamfen ɗin ya ci gaba da buga sabbin sigogi (1.0.306, 1.0.315, 1.0.316), yana faɗaɗa tsarin phishing na na'urar Microsoft 365 da muka rubuta dalla-dalla a cikin namu. Rahoton Ƙofar Na'ura. The anthropic-toolkit ƙungiyar ita ce sabuwar kamfen ɗin da ta fi yin fice, inda aka tabbatar da nau'ikan guda 20 a ranar 30 ga Yuni kaɗai - waɗanda suka kai hari kai tsaye kan fakitin da ke da alaƙa da kayan aikin haɓaka Anthropic. cursed-modules iyali sun buga fiye da bugu 15 tsakanin 1 ga Yuli da 2 ga Yuli a duka biyun standard da kuma lambobin sigar da aka ƙaru (999.x), bayan littafin rikitar dogaro. date-fns-lite rukuni (nau'ikan 5, 2 ga Yuli) ya ci gaba da yin kwaikwayon fakitin amfani na halal, waɗanda aka yi amfani da su sosai.
Tsarin niyya na kayan aikin AI da aka kafa a makon da ya gabata tare da ollama-helpers da kuma openai-agents-helpers ya tsawaita zuwa wannan lokacin tare da ai-explain, ai-sdk-helpers, Da kuma @langgraphjs/toolkit, duk an tabbatar da su tsakanin 28 ga Yuni da 30 ga Yuni. @szc-ft/mcp-szcd-client kunshin (sigogi 0.38.0 da 0.39.0, an tabbatar da shi a ranar 2 ga Yuli) ya gabatar da sabon tsari da muke bi a matsayin SkillLeak: na'urar warware bayanai ta sirri da aka ɓoye a cikin ƙwarewar MCP maimakon ƙugiya ta shigarwa, ba a iya ganinta ga na'urorin daukar hoto waɗanda ke tsayawa bayan shigarwa. Mun buga cikakken nazarin SkillLeak a nan.
Wannan hoton mako-mako wani ɓangare ne na ci gaba da muke yi Tsarin Lambobin Muguntainda muke tabbatar da sabbin barazanar da kuma samar da bayanan sirri masu amfani don taimakawa ƙungiyoyin DevSecOps su kare su pipelinekafin lalacewa ta faru. Bari mu bayyana abin da muka gano a wannan makon da kuma dalilin da ya sa yake da muhimmanci.
Fakiti 90+. Mako ɗaya. Pipeline Shine Manufa.
Ra'ayin wannan makon ya nuna sauyi a yadda masu kai hari ke mayar da hankali, ba kawai a kan girma ba, har ma a kan lokaci.cision. Ambaliyar sigar da ta ci gaba, tarin kayan aikin AI, satar bayanan MCP-layer, da hare-haren rikice-rikicen dogaro kan wuraren suna na ciki na monorepo. Yaƙin neman zaɓen yana aiki ta atomatik kuma yana ci gaba. Dubawa na mako-mako ba kariya ba ne.
Gargaɗin Malware na Farko na Xygeni Yana sa ido kan npm, PyPI, da sauran rajista a ainihin lokaci, yana nuna barazanar a lokacin da aka buga su, kafin su isa ga gini, kafin wakilin AI ya shigar da su kai tsaye, kuma kafin nauyin da aka ɗora masa irin na SkillLeak ya sami damar aiwatarwa. anthropic-toolkit yana buga siga 20 a cikin kwana ɗaya ko cursed-modules ambaliyar npm tare da sigar 999.x tsawon kwana biyu, ganowar da ke gudana bayan gaskiyar ta riga ta yi latti.
Xygeni's Open Source Security dandamali yana ba ƙungiyoyin DevSecOps damar ganowa da fifita abubuwan da ake buƙata a ainihin lokaci don ci gaba da kasancewa a gaba da matsin lamba na sarkar samar da kayayyaki, don haka naku pipelineKu kasance cikin tsafta ba tare da rage gudu a cikin ƙungiyoyinku ba.
