Aloha i ka Ka paʻi ʻana o Iune o ka Xygeni Malicious Code DigestI kēia mahina, ua hōʻoia kā mākou hui noiʻi palekana ma mua o 645 mau pūʻolo ʻino ma o npm, PyPI, a (no ka manawa mua) ka mākeke hoʻonui VSCode.
Ua wehewehe ʻia ʻo Iune e ʻekolu mau ʻano hui pū: nā hoʻolaha hoʻonui mana i hoʻolālā ʻia e ola ma mua o nā papa inoa poloka, kahi wikiwiki koke i nā hoʻouka kaua e kuhikuhi ana i nā hana hana AI a me nā kahe hana hoʻomohala agentic, a me nā hoʻouka kaua huikau hilinaʻi i hoʻonohonoho ʻia e kūʻē i nā inoa inoa monorepo kūloko.
Ma waena o nā hoʻolaha kaulana loa i hoʻopaʻa ʻia i kēia mahina:
- ʻike naʻau ua hoʻopiha i ka npm me nā mana he 70 ma waena o ka pae 2.5.x, kahi hoʻolaha pale hoʻomau e hoʻopuka hou ana e noho i mua o nā takedowns.
- A hoʻolaha typosquat Solana ʻelua nalu (Iune 7–8) ua paʻi ʻia he 15 mau pūʻolo e hoʻohālike ana
@solana-labsnā mea hana ʻōnaehana, e kuhikuhi pololei ana i nā mea hoʻomohala Web3 a me DeFi. - houzidawang806 ua helu ʻia ma mua o 25 mau mana i hoʻokahi lā (Iune 13), i hui pū ʻia e nā anapipeline-d8k2 ua paʻi hou ʻia ma 21 mau mana ma waena o Iune 15-18.
- ka Ka Huikau CryptoDAO ua paʻi ka hoʻolaha (Iune 17) i 11 mau pūʻolo ma ka mana 99.99.99, e lawe ana kēlā me kēia i kahi ukana ukana postinstall like CI/CD nā hōʻailona, nā palapala hōʻoia ao, a me nā mea huna o ka ʻeke kālā crypto.
- ʻO ka pule o Iune 20-26 i lawe mai i ka hoʻolālā ʻana i nā mea hana AI i kālele nui ʻia o ka mahina: nā mea kōkua ollama (20 mau mana), nā mea kōkua-ākena-openai (23 mau mana), monoclaude, nā mea kōkua ai-sdk, a @langgraphjs/kit mea hana, ua hōʻoia ʻia nā mea a pau i hoʻokahi pule, e kuhikuhi pololei ana iā Ollama, nā mea hana OpenAI SDK, LangGraph, a me nā hoʻohui ʻana o Claude API.
- ʻElua i hōʻoia ʻia nā hoʻonui VSCode ʻino i kēia mahina, e hōʻike ana e hoʻonui ana nā mea hoʻouka ma mua o nā papa inoa pūʻolo i loko o ke kaiapuni hoʻomohala ponoʻī.
ʻO ke ʻano wehewehe o Iune: ke neʻe nei nā hoʻouka kaua i nā hoʻonui IDE, nā mea hana ʻākena AI, a me nā kahe hana ʻākena kahi i hoʻokomo pono ʻia ai kahi pūʻolo ʻino me ka ʻole o kahi loiloi kanaka ma waena o ka maʻi a me ka hoʻokō ʻana.
ʻO kēia hōʻano hou o kēlā me kēia mahina kekahi ʻāpana o ka hana noiʻi hoʻoweliweli malware a me ke kaulahao lako a Xygeni. No ka ʻike piha ma waena o kēlā me kēia pūʻolo ʻino i hōʻoia ʻia i kēia mahina, e ʻimi i ka Malicious Code Digest piha o Iune a me ka noiʻi pili mai ka Xygeni Security Team.
Pule 4: Ua ʻike ʻia ma luna o 201 mau pūʻolo
| Ke kaiaola | pūʻolo | lā |
|---|---|---|
| June 20, 2026 | ||
| npm | panrouter:5.0.2 + 30 mau mana ma waena o 5.x–6.x a hiki i Iune 22 — hoʻolaha koʻikoʻi o ka pule | May 20, 2026 |
| npm | trimprompt:1.0.5 + 4 mau mana — hoʻomau ʻia mai ka pule i hala, hana mau ʻia | May 20, 2026 |
| npm | monoclaude:1.0.1 + 2 mana — Hoʻohālike ʻana o ka mea hana Claude API | May 20, 2026 |
| vscode | ka papahana pālua-ʻoihana-orbit-no-ka kamaʻilio liʻiliʻi:1.206.0 + 1 mana — hoʻonui VSCode ʻino e kuhikuhi ana i ka hoʻomohala ʻana o nā mea hana | May 20, 2026 |
| npm | simplisafe-gatsby:1.0.1 Hoʻohālike i ka inoa kahua home akamai | May 20, 2026 |
| June 21, 2026 | ||
| npm | atlasora-kaʻana like:1.0.0 + 6 mau pūʻolo — huikau hilinaʻi monorepo i hoʻonohonoho ʻia: atlasora-api, -client, -sdk, -types, -utils, -config | May 21, 2026 |
| npm | pou hoʻohui api:4.0.2 + 6 mau mana - nā mea hana hoʻohui hoʻolaha kuhi hewa i manaʻo ʻia | May 21, 2026 |
| npm | llm-traces-app:1.0.1 Ua kuhikuhi ʻia nā mea hana nānā LLM | May 21, 2026 |
| pypi | d0rk3r-telemetry:1.0.0 Pūʻolo telemetry i hoʻopaʻa ʻia ma PyPI | May 21, 2026 |
| June 22, 2026 | ||
| pypi | tm-ai:2.91.75 + 7 mau mana — hoʻomau ʻia ka hoʻolaha kahe ʻana o ka mana PyPI | May 22, 2026 |
| pypi | noi-cache-py:1.0.4 + 6 mau mana — ke kahe nei ka mana PyPI | May 22, 2026 |
| pypi | corvinos:0.17.0 + 6 mau mana — Hoʻolaha hoʻopaʻa inoa nui ʻo PyPI | May 22, 2026 |
| June 23, 2026 | ||
| npm | kōkua-hōʻailona-web3:1.1.1 + 2 mana — Ke kuhikuhi ʻana i ka pono hana hōʻailona Web3 | May 23, 2026 |
| npm | monocross:1.0.1 + 1 mana — mono-* hui inoa me monoclaude a me monotacos | May 23, 2026 |
| June 24, 2026 | ||
| npm | nā mea kōkua ollama:0.1.0 + 19 mau mana - ka hoʻolaha hana AI nui loa o ka mahina, e kuhikuhi ana i ka manawa hana AI kūloko ʻo Ollama | May 24, 2026 |
| npm | nā mea kōkua-openai-agents:0.1.1 + 22 mau mana — hoʻolaha i hoʻonohonoho ʻia e kuhikuhi ana i ka ʻōnaehana SDK o nā mea hana OpenAI | May 24, 2026 |
| June 25, 2026 | ||
| npm | ai-sdk-kōkua:1.4.3 Ua kuhikuhi ʻia nā mea hana AI SDK me @langgraphjs/toolkit:1.2.11 | May 25, 2026 |
| npm | hoʻopaʻa inoa-hoʻokomo:99.99.99-poc3 + hs-locale-management — huikau ka hilinaʻi kūloko o HubSpot i ka namespace, hōʻoia ka hope poc i ka hoʻolaha noiʻi hana | May 25, 2026 |
| June 26, 2026 | ||
| npm | pahu-kaula-maʻalahi:1.0.1 + 8 mau mana me ka ʻano like ʻole easy-string-kit232 — hoʻopaʻa inoa nui ma lalo o ka inoa pono hana maʻamau | May 26, 2026 |
| npm | pūʻolo-ʻino-palekana:1.0.0 + 5 mau mana — pūʻolo i kapa pono ʻia he ʻino, uku i hōʻoia ʻia, hoʻāʻo paha a hoʻoulu paha i ka hoʻolaha | May 26, 2026 |
| npm | @vpms/ʻōnaehana-hoʻolālā:1.1.2 + 2 mana — hoʻohālike ʻana i ka inoa ʻōnaehana hoʻolālā | May 26, 2026 |
Pule 3: Ua ʻike ʻia ma luna o 200 mau pūʻolo
| Ke kaiaola | pūʻolo | lā |
|---|---|---|
| June 13, 2026 | ||
| npm | houzidawang806:1.0.0 + 25 mau mana ma waena o 1.0.x–1.2.x me nā kaikaina houzidawang807 lāua ʻo houzidawang808 — kahi hoʻolaha koʻikoʻi o ka pule | May 13, 2026 |
| npm | hōʻike-aloha-hoʻokipa:1.0.2 + 4 mau mana - hoʻolaha mau e ʻike hou ʻia ana i nā lā he nui | May 13, 2026 |
| npm | tsc-ai:1.2.0 tsc-* cluster: tsc-ai, tsc-mesh, tsc-lotl — Hoʻohālike ʻana i ka inoa hana CI | May 13, 2026 |
| pypi | neuralbridge-sdk:4.5.4 + 6 mau mana ma waena o 4.5.x–5.1.x — hoʻolaha PyPI mau lā he nui i hoʻomau ʻia | May 13, 2026 |
| June 15, 2026 | ||
| npm | nā kumukūʻai-hōʻailona-cron:999.0.0 + 6 mau pūʻolo — hui pūʻulu huikau hilinaʻi ʻo DeFi e kuhikuhi ana i ka cron kūloko a me nā mea hana vault | May 15, 2026 |
| June 16, 2026 | ||
| npm | hale-sdk:9.9.9 + 8 mau pūʻolo — DeFi lending a me ka hui ʻōnaehana Cardano: flow-lending, surf-lending, janus-*, flowcardano, flowdefi | May 16, 2026 |
| npm | nā ana hanana-q3x7:1.0.0 + 8 mau mana — pūʻolo hex-suffix maʻamau e hoʻopaʻa inoa ana i nā inoa kumuhana nānā nui | May 16, 2026 |
| npm | nic-datagov:1.0.0 + 3 mau pūʻolo — hoʻohālike ʻana i ka inoa kahua ʻikepili aupuni: ogd-analytics, ogd-platform, dms-backend | May 16, 2026 |
| June 17, 2026 | ||
| npm | nā ʻaelike cryptodao:99.99.99 + 10 mau pūʻolo — huikau hilinaʻi CryptoDAO: core, sdk, bot, config, utils, deploy, signer, backend, types | May 17, 2026 |
| pypi | teambot-ai:1.48.0 Nā mea hana ʻelele AI i kuhikuhi ʻia ma PyPI | May 17, 2026 |
| June 18, 2026 | ||
| npm | nā anapipeline-d8k2:1.0.0 + 20 mau mana ma Iune 18 - hoʻomau ʻia ka hoʻolaha pale ʻana i hoʻokahi lā, e hoʻopuka hou ana i nā papa inoa poloka. | May 18, 2026 |
| npm | scan-wale nō:0.4.5 + 6 mana — hoʻolaha hoʻolaha mana | May 18, 2026 |
| npm | kala-ʻoihana-dee0:1.0.0 + 5 mau pūʻolo hex-suffix maʻamau: data-utils, string-tools, type-check, fmt-helpers, metrics-probe — hoʻopaʻa inoa nui i kākau ʻia | May 18, 2026 |
| npm | @azure-lab-services/ml-ts:99.0.0 Hoʻopunipuni inoa Azure ML | May 18, 2026 |
| June 19, 2026 | ||
| npm | trimprompt:1.0.2 + trimprompt-hub — nā mea hana ʻenekinia wikiwiki i kuhikuhi ʻia | May 19, 2026 |
| npm | kīʻaha-claude:0.8.6 Hoʻohālike ʻana i nā mea hana API Claude | May 19, 2026 |
| pypi | ʻākena-aiadin:0.1.0 Nā mea hana ʻelele AI i kuhikuhi ʻia ma PyPI | May 19, 2026 |
| npm | web3-crypto-address-utils:0.1.0 Ke kuhikuhi ʻana i ka pono hana Web3 | May 19, 2026 |
Pule 2: Ua ʻike ʻia ma luna o 135 mau pūʻolo
| Ke kaiaola | pūʻolo | lā |
|---|---|---|
| June 7, 2026 | ||
| npm | @solana-labs/web3.js:1.0.0 + 5 mau ʻano like ʻole — Solana ecosystem typosquat campaign, nalu mua | May 7, 2026 |
| npm | @jisan901/teamfocus:1.0.0 + 2 mau mana | May 7, 2026 |
| npm | @sflyinc-knapsack/shutterfly-react:999.0.0 Ka huikau hilinaʻi, ka mana i hoʻonui ʻia | May 7, 2026 |
| June 8, 2026 | ||
| npm | @solana-labs/web3.js:1.98.102 + 9 mau ʻano like ʻole — Solana ecosystem typosquat campaign, nalu ʻelua | May 8, 2026 |
| pypi | helixagentai:0.1.3 Nā mea hana ʻelele AI i kuhikuhi ʻia ma PyPI | May 8, 2026 |
| June 9, 2026 | ||
| npm | @nstrlabs/sdk:99.0.0 + 7 mau pūʻolo — huikau hilinaʻi e kūʻē i ka namespace monorepo kūloko | May 9, 2026 |
| npm | @klapp-login-platform/native-sdk:99.0.0 + 9 mau pūʻolo — hoʻohālike kahua hōʻoia ma nā wahi inoa klapp he nui | May 9, 2026 |
| npm | blockchain-kōkua-0:1.0.0 + 7 mau pūʻolo — hui pono crypto/DeFi e kuhikuhi ana i nā mea hoʻomohala Web3 | May 9, 2026 |
| npm | @kāleka-pci-ʻikepili/hale kūʻai:99.0.0 Inoa wahi ʻikepili kāleka uku i kuhikuhi ʻia | May 9, 2026 |
| June 10, 2026 | ||
| npm | ʻōnaehana hoʻolālā-hōkū-morning:99.0.0 + 2 mana — hoʻohālike ʻōnaehana hoʻolālā kālā | May 10, 2026 |
| June 11, 2026 | ||
| npm | pocteszep:1.0.1 + 5 mau mana i paʻi ʻia i ka lā hoʻokahi | May 11, 2026 |
| npm | @coze-maʻamau/wahi-kamaʻilio:99.1.1 Hoʻopunipuni inoa kahua kamaʻilio AI | May 11, 2026 |
| pypi | telegramlite:1.0.0 + 1 mana — hoʻohālike kahua leka ma PyPI | May 11, 2026 |
| June 12, 2026 | ||
| npm | ʻEcto-corsair-whisper-6f3b9:1.0.18 + 7 mau ʻano like ʻole ecto-* — hui inoa i hoʻopōʻeleʻele ʻia | May 12, 2026 |
| npm | internallib_v984:1.0.3 + internallib_v557 cluster — 13 mau mana o nā mea hoʻopunipuni waihona puke kūloko | May 12, 2026 |
| npm | pūnaewele-holomua:999.0.0 Ka huikau hilinaʻi, ka mana i hoʻonui ʻia | May 12, 2026 |
| pypi | cdjeez:0.32.0 | May 12, 2026 |
Pule 1: Ua ʻike ʻia ma luna o 118 mau pūʻolo
| Ke kaiaola | pūʻolo | lā |
|---|---|---|
| E 30, 2026 | ||
| npm | @cloudplatform-single-spa/hoʻokele:99.99.100 Ka huikau hilinaʻi, ka mana i hoʻonui ʻia | E 30, 2026 |
| vscode | luna-xampp:5.1.3 Hoʻonui VSCode - hoʻohālike mea hana hoʻomohala | E 30, 2026 |
| June 1, 2026 | ||
| npm | @tse-digital/core:99.0.0 Ka huikau hilinaʻi - ua pā pū ʻo @telenor-se lāua ʻo @ownit | May 1, 2026 |
| npm | cms-storehub:1.3.4 + 2 mau mana, hui inoa CMS | May 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.69 + 6 mau mana, nā helu mana i hoʻonui ʻia e pili ana i nā hōʻoia AWS | May 1, 2026 |
| npm | nā palapala maʻi:75.0.0 Pahuhopu inoa mālama ola kino | May 1, 2026 |
| npm | @emcd-vue/auth:6.4.9 Hoʻopunipuni inoa kikowaena hoʻololi crypto | May 1, 2026 |
| pypi | simtooreal-cli:0.3.0 | May 1, 2026 |
| June 2, 2026 | ||
| npm | ʻike: 2.5.8 + 70 mau mana ma ka laulā 2.5.x, Iune 2–5 — hoʻolaha koʻikoʻi o ka wā | May 2, 2026 |
| npm | @langgraphjs/kit mea hana:1.2.10 Ua kuhikuhi ʻia nā mea hana LangGraph | May 2, 2026 |
| June 4, 2026 | ||
| npm | @sentry-browser-sdk/profiling-node:1.0.1 + 2 mau mana, hoʻohālike inoa Sentry | May 4, 2026 |
| npm | internallib_v346:1.0.3 + 2 mau mana, mea hoʻopunipuni waihona puke kūloko | May 4, 2026 |
| npm | ai-sdk-kōkua:0.2.1 + 7 mau mana, e kuhikuhi ana i nā mea hana AI SDK | May 4, 2026 |
E Hoʻōki i ke Code Malicious ma mua o kona Hōʻea ʻana i kāu Pipeline
Ua neʻe aku nā hoʻoweliweli kaulahao lako polokalamu ma mua o ke kumumanaʻo. ʻO nā hoʻouka kaua huikau hilinaʻi, nā mea ʻaihue palapala hōʻoia, nā polokalamu ʻino i kuhikuhi ʻia e AI, a me nā mea hana hoʻomohala i hoʻomake ʻia e pā nei i nā hui maoli ma ke ʻano maoli. SDLCi kēlā me kēia pule.
ʻO Xygeni ka ʻike ʻana i nā polokalamu ʻino a kahua palekana kaulahao lako hāʻawi i nā hui i ka ʻike e hopu i nā hilinaʻi ʻino ma mua o ko lākou hoʻokō ʻana ma kahi mīkini hoʻomohala, komo i kahi ʻōnaehana kūkulu, a i ʻole hiki i ka hana ʻana. Hoʻopili ka uhi ʻana iā npm, PyPI, VSCode, a ma waho aku, ka nānā ʻana no nā ʻano hoʻopuka kānalua, ka hana ʻino namespace, typosquatting, a me nā ʻano hana hoʻouka kaua AI-native i ko lākou puka ʻana mai.
Hoʻonohonoho pono ʻia kēlā me kēia ʻike e ka hiki ke hoʻohana ʻia, ka hiki ke hiki ke hoʻokokoke ʻia, a me ka hopena o ka ʻoihana, no laila e nānā ana kāu hui i nā mea e pono ai ke hoʻoponopono, ʻaʻole i ka walaʻau.
Inā paha he pūʻolo open-source ʻino, kahi mea hana hoʻomohala i hoʻopilikia ʻia, a i ʻole kahi pilikia code i hana ʻia e AI, mālama ʻo Xygeni i nā hui palekana a me nā ʻenekinia i hoʻokahi kapuaʻi i mua o ka ʻāina hoʻoweliweli kaulahao lako.
E ʻimi i kēlā me kēia pūʻolo ʻino a me ka hoʻolaha i hōʻoia ʻia e ka Xygeni Security Team ma ka Hōʻuluʻulu Manaʻo Koda ʻIno.
E noho palekana. E noho wikiwiki. E noho mana me Xygeni.
