Nā polokalamu ʻino Npm i kēia lā ke hoʻomau nei i ka ulu ʻana, me ka hoʻopuka ʻana o nā mea hoʻouka code ʻino, nā pūʻolo npm ʻino, a Nā pūʻolo ʻino PyPI i hoʻolālā ʻia e kuhikuhi i nā kaʻina hana hoʻomohala, CI/CD pipelines, a me nā ʻōnaehana ola honua hāmama. ʻO ka Hōʻuluʻulu Manaʻo Koda ʻIno ʻo ia ka hōʻike noiʻi e hoʻomau nei a Xygeni e hahai ana a hōʻoia i nā pūʻolo ʻino maoli ma waena npm, ʻO PyPI, Kānāwai VS, a OpenVSX, me nā backdoors i hōʻoia ʻia, nā mea ʻaihue ʻikepili, nā ukana exfiltration hōʻoia, a me nā hoʻolaha polokalamu ʻino multi-version automated.
Hoʻopou hou kā mākou hui noiʻi i kēia ʻaoʻao i nā manawa a pau me nā ʻike i hōʻoia ʻia, nā hōʻailona o ka hoʻokuʻikahi (IOC), lauana ʻaʻano, a oaoieei-Ka IkepiliʻO ka hopena, nā mea hoʻomohala, Nā hui AppSec, a hiki i nā ʻenekinia palekana ke noho i mua o polokalamu ʻino npm i kēia lā a me ka hana pūʻolo ʻino e kū mai ana e hoʻopilikia ana i nā kaulahao hoʻolako polokalamu hou.
ʻO ka polokalamu ʻino NPM i kēia lā: Hōʻuluʻulu Manaʻo Pule 24–29 ʻApelila 2026
Ua hōʻoia nā mea noiʻi 97 mau pūʻolo ʻino ma nā papa inoa lehulehu i loko o kēia wā.
Nā nānā ʻana o ka ʻikepili
- Ua paʻi ʻia ka hapa nui o nā pūʻolo i hōʻoia ʻia ma npm
- Nā hihia hou aʻe i hoʻopilikia ʻia ʻO PyPI, OpenVSX, a haku mele
- Hoʻopuka hou ʻia nā hoʻopuka ʻino ma nā ʻohana pūʻolo like a me nā inoa pili
- Nā ʻano hoʻohālikelike kiʻekiʻe a ʻano ʻole paha e like me 99.x, 99.9.x, a 1.0.x
- Ka hoʻohana ikaika ʻana i uku a me ka nānā ʻana, enterprise-liko, polokalamu pūnaewele kūloko, analytics, Hoʻokumu UI, mea hana hoʻomohala, kumuhana ao, a pili i nā ʻāpana nā ʻano inoa
- Nā pahū mana i hoʻonohonoho ʻia he nui i hoʻolālā ʻia e hoʻohālike i nā mea hou o ka pūʻolo kūpono
E nānā i ka hōʻike piha o ka polokalamu ʻino i kēlā me kēia pule →
Hōʻike Malware Mahina: Nā Pūʻolo npm ʻino i hōʻoia ʻia i ʻApelila 2026
Welina mai i ka paʻi hou loa o ka ʻŌlelo Hōʻuluʻulu Manaʻo o Xygeni Malicious Code (Paʻi Mahina). i April 2026, ua hōʻoia kā mākou hui noiʻi ʻoi aku ma mua o 250 mau pūʻolo ʻino, ma ke ʻano nui ma waena npm, me nā hihia hou aʻe e pili ana ʻO PyPI, VS Code, OpenVSX, a me Composer.
ʻAʻole wale ʻo ʻApelila e pili ana i ka nui. nā nalu paʻi i hoʻokele ʻia e ka hana aunoa, nā hoʻolaha hoʻonui mana hoʻouka kaua, ka hui ʻana o ka ʻohana pūʻolo, a hoʻohālike mea hana kūloko, ua ʻike mākou i kekahi o nā ʻano i ʻike nui ʻia o ka mahina i ka hoʻopuka ʻino i hoʻonohonoho ʻia ma waena o:
nā mea hana kūloko hoʻopunipuni, nā pūʻolo AI-themed, nā modula uku a me ka nānā ʻana, nā mea kūʻai aku analytics, nā ʻāpana frontend, nā pono hana hoʻomohala, Kubernetes a me nā mea hana kapuaʻi, VS Code a me OpenVSX extensions, a me nā inoa pūʻolo e like me ka brand hilinaʻi i hoʻolālā ʻia e hoʻohui i ka lawe ʻana i nā polokalamu maoli. pipelines.
ʻAʻole kēia he mau hanana typosquatting maʻalahi. Ma waena o ka laulā ʻApelila ʻikepili, ua nānā mākou nā ʻano hana hōʻino palapala hōʻoia, ka hoʻoponopono ʻana i ke kaulahao lako, hoʻohana hou ʻana i ka inoa wahi i hana hou ʻia, a hoʻolaha ʻino i hoʻonohonoho ʻia i hoʻolālā ʻia e hui pū me nā wahi hoʻomohala maoli a me ka hoʻouna ʻana i nā polokalamu pipelines.
Ma waena o ka ʻikepili ākea, ua hoʻomau mākou i ka nānā ʻana ka paʻi ʻana i nā mana he nui i kākau ʻia, nā papahana mana i hoʻonui ʻia, uku- a me enterpriseinoa kumuhana, Nā inoa pūʻolo me ke kumumanaʻo AI a me nā ʻelele, Hoʻohālike ʻana o SDK a me nā ʻāpana frontend, hoʻohālike mea hana kūloko, a me nā hana maʻamau e like me huikau hilinaʻi a ka hoʻokaʻawale ʻikepili.
ʻO kēia hōʻike kekahi ʻāpana o kā mākou hana e hoʻomau nei Hōʻuluʻulu Manaʻo Koda ʻIno, kahi a mākou e hōʻoia ai i nā hoʻoweliweli hou a hāʻawi akamai hana e kokua Nā hui DevSecOps e noho ma mua o pilikia kaulahao lako polokalamu.
| Ke kaiaola | pūʻolo | lā |
|---|---|---|
| npm | pa-hōʻailona:99.1.10 | Apr 27, 2026 |
| pypi | moonbit-locale-compat:0.2.3 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.13 | Apr 27, 2026 |
| npm | @sbt_gitverse/analytics-client:99.0.1 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.33.1 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.14 | Apr 27, 2026 |
| npm | @tochka-ui/kumuhana:99.0.2 | Apr 27, 2026 |
| openvsx | arcane-spark/ubel:0.1.0 | Apr 28, 2026 |
| npm | @2011-08-19/n:99.9.9 | Apr 28, 2026 |
| npm | @frengki0707/google-cloud-clone:1.38.0 | Apr 27, 2026 |
Pehea mākou e ʻike ai i ke code ʻino i ka npm Malware a me PyPI Malware
Hoʻohana ʻo Xygeni i nā ʻano hana he nui-papa e hoʻōki i ke code ʻino ma mua o ka laha ʻana. ʻO ka mea mua, ʻike ka loiloi code static i nā ʻano obfuscation, nā ukana huna, a me ka hana ʻino script. Eia kekahi, loiloi ka behavioral sandboxing i ka hoʻonohonoho ʻana hooks, nā kauoha runtime, a me nā hana hoʻomau. Eia kekahi, ʻike ka ʻike ʻana i ka mīkini aʻo i nā ʻano malware npm zero-day a me nā ʻano malware pypi i hala ʻole e nā scanner pūlima. ʻO ka hope loa, nānā ka ʻōnaehana hoʻomaopopo mua i nā waihona lehulehu i ka manawa maoli, hōʻoia i nā ʻike, a hoʻomaopopo koke i nā hui DevOps.
ʻO ka hopena, hōʻoia kēia hui pū ʻana e loaʻa i nā mea hoʻomohala ka ʻike wikiwiki a hiki ke hana ʻia i hoʻohui pololei ʻia i loko CI/CD Kahe manawahana.
No ke aha e pono ai i nā mea hoʻomohala ke mālama e pili ana i nā pūʻolo npm ʻino
ʻAʻole kali pinepine nā hoʻoweliweli hou i ka manawa holo. No ka laʻana, hoʻokō pinepine nā pūʻolo npm ʻino i ka wā o ke kau ʻana, ʻoiai ʻo nā pūʻolo ʻino pypi e hūnā i ka exfiltration token a i ʻole nā backdoors.
- E hoʻohuli i nā repos GitHub pilikino i ka lehulehu e kope iā lākou.
- E hoʻokaʻawale i nā hōʻoia a me nā mea huna me ka hoʻohana ʻana i nā ukana i hoʻopili ʻia.
- E hoʻohana i nā mea hoʻouka JavaScript i hoʻopaʻa ʻia e hoʻolaha i ka ransomware a i ʻole nā botnets.
ʻO ka ʻoiaʻiʻo, ua piʻi aʻe nā pūʻolo open-source ʻino i ka 156% i hoʻokahi makahiki. No laila, ʻo nā hui e hilinaʻi wale ana i nā hānai i hoʻopaneʻe ʻia a i ʻole nā mea nānā maʻamau e hāʻule ana ma hope.
ʻO ka mea a kēia hōʻike malware e hahai ai ma npm a me PyPI
ʻO kēia hōʻuluʻulu manaʻo ke kikowaena no:
- Nā pūʻolo npm ʻino i hōʻoia ʻia
- Nā pūʻolo ʻino pypi i hōʻoia ʻia
- Ka ʻike ʻana i ke code ʻino ma muli o ka hana
- Nā hanana i hōʻoia ʻia e ka papa inoa
- Nā hōʻuluʻulu manaʻo hōʻike malware hebedoma a me kēlā me kēia mahina
- ʻO ka changelog mōʻaukala o nā ʻike malware npm a me nā malware pypi āpau
ʻO ia hoʻi, hāʻawi ia i hoʻokahi kiko kuhikuhi. Hoʻopou hou ka hui noiʻi ma Xygeni i kēia ʻaoʻao i kēlā me kēia pule me nā loulou i nā loiloi loea piha a me nā GitHub IOC.
Pehea e pale aku ai i nā pūʻolo npm ʻino a me ka polokalamu PyPI Malware
Ma muli o kēia pilikia e ulu nei, pono nā hui i nā mea ʻoi aku ma mua o nā nānā hilinaʻi maʻamau. Pono nā pale ikaika e kūʻē i nā pūʻolo npm ʻino a me nā pūʻolo ʻino pypi i nā kaohi pale a me ka hoʻokō ʻana i ka runtime:
Hoʻokō i nā hoʻonohonoho Lockfile-wale nō e kūʻē i nā pūʻolo npm ʻino
hoʻohana npm ci or pip install --require-hashes in CI/CD.
Hōʻoia kēia i ka hoʻohana ʻia ʻana o ka lāʻau hilinaʻi pololei i wehewehe ʻia i loko o nā faila laka. ʻO ka hopena, ʻaʻole hiki i nā mea hoʻouka ke komo i loko o nā mana i hoʻololi ʻia a i ʻole typosquatted o nā pūʻolo npm ʻino.
Ke hoʻouka mua ʻana i ka scan no ka npm Malware a me ka PyPI Malware
E hoʻohui i ka ʻenekini hoʻomaopopo mua o Xygeni e nānā i ka malware npm a me ka malware pypi ma mua o ka hiki ʻana o nā pūʻolo i kou wahi.
Eia kekahi, e ʻike i nā mea kānalua postinstall nā palapala hoʻoiho, nā mea hoʻouka i hoʻopōʻino ʻia, a i ʻole nā URL C2 i hoʻopaʻa ʻia.
Guardrails e ālai i nā kūkulu me ke code ʻino
hoʻonoho guardrails ʻO ka hāʻule ʻana e kūkulu ponoʻī inā ʻike ʻia nā pūʻolo npm ʻino a i ʻole nā pūʻolo ʻino pypi.
Eia kekahi laʻana, kūkulu ʻia ka haki ma luna o nā pūʻolo me nā mea mālama i paʻi ʻole ʻia, nā ʻano obfuscation, a i ʻole nā hoʻokūkū IOC. No laila, ʻaʻole loa e hala ka code ʻino me ka ʻike ʻole ʻia.
Hoʻoulu a hōʻoia SBOMs E kūʻē i nā pūʻolo npm ʻino a me ka polokalamu ʻino PyPI
Hoʻoulu SBOMs (CycloneDX, SPDX) no kēlā me kēia kūkulu ʻana.
Ma hope, e hoʻohālikelike me nā pūʻolo npm ʻino i ʻike ʻia a me nā hānai polokalamu pypi malware e hahai i nā hilinaʻi pololei a me nā transitive.
Ka Palekana Hōʻoia a me ka Hōʻailona mai ka npm Malware a me ka PyPI Malware
Nui nā pūʻolo npm ʻino e hoʻāʻo nei e heluhelu .npmrc, .pypirc, a i ʻole nā loli kaiapuni.
No laila, e holo i nā kūkulu i loko o nā pahu paʻakikī me nā mea huna liʻiliʻi i hōʻike ʻia. Eia kekahi, e hoʻohana i nā luna hoʻokele huna ma kahi o nā loli kaiapuni e ālai i ka hoʻohana ʻino ʻana i nā code.
E nānā i nā hoʻololi o ka Registry a me ka Luna Hoʻomalu i nā pūʻolo npm ʻino
Hoʻopau pinepine nā mea hoʻouka i nā papahana i haʻalele ʻia.
Ma ke ʻano kūikawā, e makaʻala no nā hoʻololi mālama koke, nā lele ʻana o nā mana maʻamau ʻole, a i ʻole nā hoʻolaha nui ʻana i nā polokalamu npm malware a me nā pūʻolo pypi malicious.
Hoʻomaʻamaʻa Hoʻomohala ma ka ʻIke ʻana i ke Code Malicious ma npm a me PyPI
E aʻo i nā hui e ʻike i nā hae ʻulaʻula e like me:
- Nā inoa pūʻolo me nā hewa typo (
reqeustma kahi orequest). - ʻAnoʻole
installorpreparenā palapala. - Nā pūʻolo i hana ʻia nei me nā helu mana kiʻekiʻe loa.
Ma luna o nā mea a pau, kōkua kēia ʻike i ka ʻike mua ʻana i nā code ʻino.
ʻIke ʻana i ka Anomaly Runtime no nā Pūʻolo npm ʻino a me ka Malware PyPI
ʻOiai inā e kāpae nā polokalamu ʻino i nā nānā static, ʻike ʻia ka runtime i loko CI/CD hiki ke hopu:
- Nā pilina pūnaewele i manaʻo ʻole ʻia.
- Nā hoʻololi ʻana o ka ʻōnaehana faila ma waho o nā papa kuhikuhi i manaʻo ʻia.
- Nā hoʻāʻo hoʻomau ma nā hana.
ʻO ka mea hope loa, hōʻoia kēia ua pau nā hoʻoweliweli npm malware a me pypi malware ma hope o ke kau ʻana.
Ma ka hoʻohui ʻana i kēia mau kaohi, pale nā hui i nā pūʻolo npm ʻino a me nā pūʻolo pypi ʻino mai ka hiki ʻana i ka hana. pipelines.
E hoʻāʻo i nā Mea Hana ʻIke Malware a Xygeni
Hāʻawi ʻo Xygeni:
- ʻIke ʻana i nā code ʻino i ka manawa maoli, me nā backdoors, spyware, a me ransomware.
- I ka hoʻohālikelike ʻana i nā scanners maʻamau, ka nānā ʻana ma o npm, PyPI, Maven, NuGet, RubyGems, a me nā mea hou aku.
- Ke ālai ʻakomi ʻana i ke kūkulu ʻana ke ʻike ka hōʻike polokalamu ʻino i ka pilikia.
- Nā ʻike hoʻohana pono ʻole, nā nānā inoa o ka mea mālama, a me ka ʻike ʻana i nā mea ʻē.
Noho Hoʻomaopopo
Hoʻopou hou kā mākou hui i kēia ʻaoʻao i kēlā me kēia pule. No ka loaʻa ʻana o nā leka hoʻomaopopo a me nā hōʻike kikoʻī:
- Hoʻopili iā mākou LekaʻElele
- hahai @XygeniSecurity ma Linkedin
- E hoʻopaʻa i kēia ʻaoʻao e hahai i nā mea hou loa polokalamu ʻino npm a polokalamu ʻino pypi nā mea hoʻoweliweli
