TL; DR
Thaum lub Cuaj Hlis 14, 2025, cov kws tshawb fawb tau txheeb xyuas Shai-Hulud, ib tug kab mob uas rov ua dua tus kheej zais rau sab hauv npm pob khoom, hloov qhov kev hloov kho tshiab ntawm kev vam khom mus rau hauv qhov puv ntoob kev tawm tsam ntawm cov khoom xa tuaj. Thawj zaug pom nyob rau hauv lub @ctrl/xim me me pob khoom los ntawm Daniel dos Santos Pereira, Shai-Hulud sau cov lus zais, rho tawm lawv los ntawm GitHub repos thiab workflows, thiab rov tshaj tawm nws tus kheej thoob plaws hauv registry siv cov ntaub ntawv raug nyiag. Hauv ob peb hnub, tus lej ntawm cov pob khoom kis tau dhia los ntawm ntau kaum mus rau ntau pua, lees paub tias Shaihulud tsis yog tsuas yog lwm tus trojan tab sis yog ib tug kab mob uas tsim los kis tau thoob plaws hauv npm ecosystem.
Qhov cuam tshuam: txhua tus neeg tsim khoom lossis CI khiav uas txhim kho cov pob khoom npm pej xeem muaj kev pheej hmoo.
Kev ua tam sim: thaiv cov qauv paub, hloov mus rau lockfile-only installs, tig npm thiab GitHub tokens, tshuaj xyuas cov txheej txheem ua haujlwm, thiab saib xyuas cov cim qhia ntawm kev cuam tshuam (IoCs).
Muaj Dab Tsi Tshwm Sim?
cov Kev tawm tsam ntawm Shai-Hulud cov khoom siv hauv cov pob khoom npm yog ib qho ntawm cov xwm txheej cuam tshuam tshaj plaws hauv kev nco tsis ntev los no. Tsis zoo li cov trojans cais tawm, cov kab no sib xyaw kev nyiag daim ntawv pov thawj, kev rho tawm tsis siv neeg, thiab kev theej tus kheejYog li ntawd, lub sijhawm kis tus kab mob tau luv dua los ntawm ob peb lub lis piam mus rau tsuas yog ob peb teev xwb.
Rau cov pab pawg DevOps, zaj lus qhia meej meej: yog tias txhua qhov kev teeb tsa tuaj yeem ua tiav cov lej, ces txhua qhov kev hloov kho tshiab yog qhov ua rau muaj kev ua txhaum cai.
Tej zaum yuav muaj cov ntaub ntawv pov thawj pib thiab cov ntaub ntawv pov thawj uas tau teem tseg
Kev tshuaj xyuas thaum ntxov qhia tau hais tias qhov kev tawm tsam yuav pib nrog cov ntaub ntawv pov thawj raug nyiagPiv txwv li, cov phiaj xwm phishing spoofing npm login lossis MFA prompts tej zaum yuav tau ntes cov cim tsim tawm. Thaum cov neeg tawm tsam tau txais thawj qhov chaw, tus kab mob kis mus los ntawm kev muab nws tus kheej tso rau hauv cov pob npm thiab nyiag ntau cov lus zais los ntawm:
- cov ntaub ntawv teeb tsa npm zoo li
.npmrc, feem ntau muaj cov cim tshaj tawm. - Cov kev hloov pauv ib puag ncig thiab teeb tsa nrog GitHub PATs thiab CI/CD tsis pub leej twg paub.
- Cov ntsiab lus kawg ntawm cov ntaub ntawv metadata hauv huab (AWS, GCP, Azure) uas muab cov ntaub ntawv pov thawj luv luv rau kev txav mus rau sab.
Yog li ntawd, kev nyiag ntaub ntawv pov thawj tau los ua qhov chaw pib. Nrog cov cim npm raug cai thiab cov lus zais GitHub, Shai-Hulud tuaj yeem rov ua dua ntawm ntau pob khoom thiab chaw khaws khoom yam tsis tas siv zog ntxiv.
Kev Cuam Tshuam ntawm Kev Tawm Tsam ntawm Shai-Hulud Supply Chain
Shai-Hulud tseem ua haujlwm niaj hnub no. Tus kab no ua kom lub sijhawm cuam tshuam sai dua. Qhov uas ib zaug siv sijhawm ntau lub lis piam nrog trojan tam sim no nthuav tawm hauv ob peb teev. Yog li ntawd, kev sib kis sai dua thiab nyuaj rau tswj. Nws nce qib los ntawm:
- Nyiag npm tshaj tawm cov cim thiab GitHub cov lus zais.
- Rov luam tawm nws tus kheej rau hauv lwm pob npm.
- Ntxiv cov haujlwm ua haujlwm phem GitHub Actions rau kev ua haujlwm tas mus li.
Leej twg raug kev cuam tshuam:
Txhua pab neeg uas teeb tsa cov pob khoom npm rau pej xeem raug nthuav tawm. Ntxiv mus, cov neeg tsim khoom uas muaj cached npm lossis GitHub tokens ntsib kev pheej hmoo siab. CI runners uas siv cov lus zais dav dav kuj muaj kev phom sij.
Kev pheej hmoo ua lag luam
Qhov cuam tshuam rau kev lag luam loj hlob sai. Cov cim qhia raug nyiag tuaj yeem ua rau muaj kev txeeb tus account, kev nyiag pob khoom, thiab txawm tias siv tsis raug huab. Tsis tas li ntawd, kev ua haujlwm tas mus li hauv GitHub ua rau nws nyuaj rau ntxuav. Yog li ntawd, cov pab pawg yuav tsum kho Shai-Hulud ua ib qho xwm txheej uas tseem tab tom tshwm sim, tsis yog ib qho uas kaw lawm.
Yuav ua li cas Shai-Hulud Supply Chain Attack ua haujlwm hauv npm pob khoom
Lub hom phiaj thiab lub hom phiaj ntawm tus neeg tawm tsam
Daim phiaj xwm no ua kom zoo dua rau peb yam:
- Lub hom phiaj thawj zaug yog nyiag cov ntaub ntawv pov thawj ntawm qhov loj me los ntawm cov khoos phis tawj tsim tawm thiab cov neeg khiav CI. Qhov no suav nrog npm luam tawm cov cim, GitHub cov cim, thiab cov ntaub ntawv pov thawj huab. Qhov tseeb, ntau qhov kev tshuaj xyuas lees paub qhov kev sau qoob loo zais cia, xws li khiav TruffleHog thiab nug cov ntsiab lus kawg ntawm cov ntaub ntawv huab.
- Lub hom phiaj thib ob yog nthuav dav tau yam tsis tas siv neeg los ntawm kev siv tsis raug cai ntawm cov cai tshaj tawm ntawm cov neeg saib xyuas uas raug cuam tshuam. Yog li ntawd, ib qho chaw ruaj khov sai sai nthuav dav mus rau ntau qhov, txij li cov qauv tshiab uas muaj kab mob ntawm lwm cov pob khoom tshwm sim yam tsis muaj kev siv zog ntxiv ntawm tib neeg.
- Lub hom phiaj thib peb yog ua siab ntev thiab lim tawm kom ntseeg tau los ntawm GitHub infrastructure. Cov neeg tawm tsam tsim ib lub repo pej xeem hu ua "Shai-Hulud" nrog ob lub hauv paus 64 cov ntaub ntawv.json, thiab ntxiv rau lawv cog ib txoj haujlwm uas ua rau muaj ntau yam sib txawv ${ toJSON(secrets) }} thiab tshaj tawm nws mus rau lub webhook static.
Qhov txiaj ntsig zoo li yuav suav nrog kev nkag mus rau cov ntaub ntawv sau npe thiab cov lej qhov chaw ntev, kev txav mus rau hauv cov nyiaj huab sai sai, thiab kev xaiv los ua riam phom rau cov khoom xa tuaj ntxiv. Kev tshaj tawm rau pej xeem qhia tau hais tias cov chaw khaws cia ntiag tug tau tig mus rau pej xeem nrog ib qho "-kev tsiv teb tsaws chaw" cov lus qhia ntxiv, uas ua rau cov ntaub ntawv raug nthuav tawm thiab muaj zog ntxiv
Sab hauv Shai-Hulud Payload: pob.js hauv npm Pob Khoom
Shai-Hulud nkoj ua ib tug loj, Webpack-bundled thiab minified ntau Cov ntaub ntawv JavaScript (pob.js, kwv yees li 3–3.7 MB) uas ua tiav los ntawm ib qho tom qab kev teeb tsa txuas rau hauv pob.jsonYog li ntawd, txhua qhov kev teeb tsa ua rau lub payload ua haujlwm tau. Qhov kev tsim no zais cov cim qhia, compresses tswj kev ntws, thiab thawb tag nrho cov logic rau hauv ib qho khoom cuav uas ua haujlwm thaum lub sijhawm teeb tsa. Cov kws tshuaj ntsuam xyuas ib txwm lees paub Webpack bundling, qhov loj me ntawm cov ntaub ntawv tsis tshua muaj, thiab kev ua haujlwm ntawm lub sijhawm teeb tsa.
Cov yam ntxwv tsis meej pem thiab tsis txheeb xyuas koj yuav pom hauv cov qauv:
- Daim duab module me me nrog cov lej module ID, cov lus tawm tswv yim tsis tshua muaj, thiab cov kev tswj hwm tiaj tus. Ntxiv mus, cov qauv no ua rau kev tshuaj xyuas tes nyuaj heev.
- Txoj hlua zais ntawm cov txheej txheem base64 thiab cov neeg pab tsim kho. Piv txwv li, cov kev rov ua dua ntawm base64 encoding thiab decoding feem ntau tshwm sim nyob ib puag ncig cov txheej txheem exfiltration.
- Kev xa tawm dynamic los ntawm kev ntsuam xyuas-style cov qauv thiab tsim cov cev ua haujlwm, yog li ntawd ua rau cov lej hloov pauv tus cwj pwm thaum lub sijhawm khiav.
- Kev lim dej OS nyiam Linux thiab macOS kev ua haujlwm tshwj xeeb tshaj yog ntawm CI runners thiab developer laptops.
Los ntawm lub kaum sab xis ua haujlwm, lub pob khoom yog modular. Cov ntawv sau piav qhia txog cov modules rau kev tshawb pom OS, cov ntaub ntawv system thiab git secret scans, kev nkag mus rau SDK huab, GitHub API kev ua haujlwm, thiab lub cav propagation uas hloov kho lwm cov pob khoom uas tus tswj hwm muaj. Qhov tseeb, StepSecurity thiab ReversingLabs ob leeg qhia txog kev ua haujlwm uas hloov kho cov pob khoom nrog lub hook phem.
Kev Ua Haujlwm Lub Sijhawm Nruab Nrab hauv Shai-Hulud: Yuav ua li cas npm pob khoom ua rau tus kab mob ua rau
Qhov kev tawm tsam pib thaum tom qab kev teeb tsa khiav node pob.js. Thaum lub sijhawm no, tsab ntawv pib thiab unpacks lub xeev ua haujlwm hauv lub cim xeeb, teeb tsa theem rau kev ua haujlwm tag nrho ntawm tus kab mob.
Kev tshawb pom thiab kev sau qoob loo
- Lub payload dumps process.env thiab scans cov ntaub ntawv hauv zos rau cov lus zais siab-entropy thiab token prefixes. Tsis tas li ntawd, nws nthuav dav kev pabcuam los ntawm kev khiav TruffleHog.
- Nws nug cov metadata endpoints huab kom sau cov ntaub ntawv pov thawj luv luv. Piv txwv li, hu rau
169.254.169.254ntawm AWS los yogmetadata.google.internalntawm GCP feem ntau tshwm sim hauv cov tswv tsev uas muaj kab mob. - Yog li ntawd, txhua daim ntawv pov thawj pom tau tam sim ntawd siv tau los tshaj tawm cov pob npm tshiab lossis thawb GitHub workflows.
Exfiltration
- Tus kab no tsim ib lub GitHub repo tshiab hu ua Shai-Hulud thiab sau ib qho double base64-encoded
data.jsonnrog cov ntsiab lus ntawm lub platform, cov chaw pov tseg ib puag ncig, thiab cov lus zais. Raws li pom tau, qhov kev coj cwj pwm nrov no yooj yim pom yog tias cov neeg tiv thaiv paub qhov twg yuav tsum saib. - Nws kuj tseem cog ib qho GitHub Actions workflow, feem ntau ntawm ib ceg hu ua shai-hulud, uas ua rau muaj ntau yam sib txawv
${{ toJSON(secrets) }}thiab tshaj tawm cov ntaub ntawv rau hauv lub webhook uas ruaj khov. Ntxiv mus, cov txheej txheem ua haujlwm no yuav ua mus txog thaum muaj ib tus neeg tshem nws tawm.
Hais Tawm
- Nrog rau txhua lub npm token uas nrhiav tau, lub payload suav tag nrho cov pob khoom uas tus neeg saib xyuas uas raug cuam tshuam muaj. Tom qab ntawd, nws coj txhua lub tarball, txhaj cov bundle.js thiab cov ntawv nkag tom qab nruab, thiab rov tshaj tawm cov pob khoom.
- Yog li ntawd, ntau lub pob khoom muaj kab mob tuaj yeem tshwm sim hauv ob peb teev, ua rau lub voj voog tawg thoob plaws hauv lub ecosystem nce ntxiv.
Kev nyob ruaj khov thiab kev raug
Tus kab mob no ua rau cov txheej txheem ua haujlwm phem tseem muaj sia nyob thiab, hauv ntau qhov xwm txheej, tig cov chaw khaws cia ntiag tug mus rau pej xeem nrog a "-kev tsiv teb tsaws chaw" tag nrho, qhov no ua kom tus neeg tawm tsam tswj tau qhov chaw thiab ua kom cov ntaub ntawv xau ntau tshaj plaws.
Daim ntawv ceeb toom nrhiav qhov tseem ceeb
Kev siv tsis zoo li no ntawm ${{ toJSON(secrets) }} hauv Actions workflows tsis tshua muaj. Yog li ntawd, cov pab pawg yuav tsum kho nws ua lub cim qhia siab thaum lub sijhawm yos hav zoov.
Tus qauv ua haujlwm huv si uas koj yuav tsum nrhiav
Kev siv tsis zoo li no ntawm rau JSON (zais cia) hauv Kev Ua Haujlwm yog lub cim qhia siab hauv qhov xwm txheej no.
Cov lej pseudo-code uas nthuav dav theem siab (muaj kev nyab xeeb, piav qhia)
Cov kws tshuaj ntsuam tau pom qhov kev voj voog no ntawm qhov ntsuas, uas piav qhia txog kev dhia sai sai los ntawm ntau kaum mus rau ntau pua pob khoom kis kab mob.
Vim li cas qhov no yog ib tug kab hauv ib lub pob ecosystem
Ib tug kab mob yog malware uas kis tau nws tus kheej yam tsis tas yuav tsum tau ua cov kauj ruam ntawm tus neeg ua haujlwm ntawm txhua theem. Hauv cov txheej txheem ua haujlwm, cov kab mob feem ntau siv cov qhov tsis zoo ntawm lub network los txav mus los ntawm ib lub tshuab mus rau lwm lub. Qhov sib piv, Shai-Hulud ua haujlwm hauv npm registry. Nws txoj kev ua haujlwm zoo yog los ntawm siv daim ntawv pov thawj dua tshiab.
Tus kab no siv cov cim npm luam tawm uas raug nyiag lawm. Thaum nws tau txais cov ntaub ntawv pov thawj raug cai, nws rov luam tawm cov qauv uas muaj kab mob hauv qab lwm cov pob khoom uas tus neeg saib xyuas tib yam muaj. Tom qab ntawd, cov pob khoom ntawd raug teeb tsa los ntawm cov neeg tsim khoom lossis CI khiav, thiab lub voj voog rov ua dua.
Vim li no, cov kws tshuaj ntsuam kev ruaj ntseg, suav nrog Nyeem Ntawv tsaus, faib Shai-Hulud ua ib tug tus kab mob uas rov ua dua tus kheej es tsis yog ib qho trojan yooj yim lossis ib qho teeb meem typosquatting. Qhov sib txawv yog qhov tseem ceeb: trojan feem ntau ua rau ib tus tswv tsev puas tsuaj, tab sis tus kab mob ua rau nws qhov cuam tshuam loj dua thoob plaws hauv ib lub ecosystem.
Daim ntawv qhia txog "Yuav ua li cas nws ua haujlwm"
Txhawm rau kom luv luv Shai-Hulud lub neej voj voog, ntawm no yog qhov tsis zoociskev piav qhia txog nws cov kauj ruam tseem ceeb:
- Ib pob nrog tom qab kev teeb tsa tau teeb tsa lawm, thiab
bundle.jsua tiav. - Lub payload dumps ib puag ncig cov hloov pauv, scans cov ntaub ntawv thiab git keeb kwm, khiav TruffleHog, thiab nug cov kev pabcuam metadata huab. Yog li ntawd, txhua qhov zais cia uas pom tau yuav muaj txiaj ntsig tam sim ntawd.
- Exfiltration tshwm sim ua ob txoj kev: thawj zaug, los ntawm kev tsim ib qho repo pej xeem hu ua Shai-Hulud nrog ob lub hauv paus 64-encoded
data.json; qhov thib ob, los ntawm kev cog ib qho GitHub Actions workflow uas tshaj tawm${{ toJSON(secrets) }}mus rau ib lub webhook. - Siv cov npm token uas raug nyiag lawm, tus kab mob no yuav rov tshaj tawm tag nrho lwm cov pob khoom uas tus neeg saib xyuas uas raug cuam tshuam muaj nrog tib lub hook phem. Ua li no, tus kab mob yuav loj hlob sai heev.
- Thaum kawg, tus neeg tawm tsam tuav ntau qhov zais cia, ntau pob khoom kom kis mus, thiab persistence sab hauv GitHub tus account thiab cov chaw khaws cia.
Yuav ua li cas kom tsis txhob muaj kev tawm tsam no, ua tau
Shai-Hulud yog ib qho kev ceeb toom. Ib tug kab uas nyiag cov cim thiab rov luam tawm nws tus kheej tsis yog ib qho kev pheej hmoo yav tom ntej, nws nyob hauv npm pob khoom ecosystem niaj hnub no. Txhawm rau tiv thaiv hom no kev tawm tsam ntawm cov khoom xa tuaj, cov pab pawg xav tau kev tswj hwm uas tuaj yeem programmable, automated, thiab siv ncaj qha rau hauv CI/CD pipelines. Cov no yog cov kev tiv thaiv tib yam uas koj twb siv tau lawm Xygeni.
Tsum cov khoom cuav phem ntawm lub rooj vag
Koj yuav tsum luam theej cov pob khoom npm thiab tarballs ua ntej lawv mus txog cov neeg tsim khoom lossis CI txoj haujlwm. Loj dhau bundle.js cov ntaub ntawv, kev teeb tsa tom qab muaj kev tsis ntseeg hooks, thiab cov cim qhia txog kev tsis meej pem txhua tus ua haujlwm ua cov cim ceeb toom thaum ntxov. Ntxiv mus, kev siv lub sijhawm txias thiab cov qauv pinned hauv pipelines tiv thaiv cov khoom tso tawm tshiab, tsis tau kuaj xyuas kom tsis txhob raug siv tau yam tsis tas siv neeg.
Harden CI/CD los ntawm lub neej ntawd
Guardrails in CI/CD yog qhov tseem ceeb. Lawv tsis lees txais cov kev sib koom ua ke lossis kev teeb tsa uas qhia cov ntawv sau tshiab lossis binaries. Tib lub sijhawm, lawv thaiv cov txheej txheem ua haujlwm uas ua rau muaj kev zais cia lossis sim tshaj tawm sab nraud. Cov pab pawg kuj tseem yuav tsum xav tau kev teeb tsa lockfile-only (npm ci) thoob plaws txhua qhov pipelineyog li cov teeb tsa kev vam khom tseem rov ua dua tau thiab muaj kev nyab xeeb.
Txo qhov radius ntawm lub token blast
Cov lus zais yuav tsum tsis txhob dhau los ua ib qho chaw ua tsis tiav. Txuas ntxiv luam theej cov lej, cov teeb tsa, thiab pipeline tso zis rau cov ntaub ntawv pov thawj uas raug tshaj tawmCov cim qhia yuav tsum tau muab faib ua pawg me me, muab lub neej luv luv, thiab tig tau thaum pom tias muaj kev cuam tshuam. Feem ntau, kho txhua lub cim qhia uas siv rau ntawm tus tswv tsev uas ua qhov kev teeb tsa tom qab muaj kev cuam tshuam raws li qhov teeb meem.
Saib tus cwj pwm ntawm cov kab thaum ntxov
Kev kuaj pom tsis meej yog qhov tseem ceeb. Piv txwv li, qhov nce siab sai sai hauv npm tshaj tawm cov xwm txheej, cov txheej txheem ua haujlwm tshiab uas tshwm sim yam tsis muaj laj thawj, lossis cov chaw khaws cia pej xeem tshiab uas muaj cov ntaub ntawv encoded txawv txawv tuaj yeem ua rau muaj kev ua haujlwm ntawm cov kab mob. Yog li ntawd, cov pab pawg yuav tsum tsa cov lus ceeb toom sai sai thiab cais cov neeg saib xyuas lossis cov neeg khiav uas qhia cov cim ceeb toom no.
Kho sai sai yam tsis ua rau cov khoom puas tsuaj
Kev ceev thiab kev nyab xeeb yuav tsum mus ua ke. Tsis siv neeg pull requests tuaj yeem hloov cov pob khoom npm uas raug cuam tshuam nrog cov qauv uas tau kuaj xyuas. Tsis tas li ntawd, ncav cuag tau thiab kev siv tsis raug kev tshuaj xyuas ua kom ntseeg tau tias kev hloov kho tshiab tseem tsawg thiab ruaj khov. Thaum kawg, rov tsim kho cov CI khiav uas cuam tshuam los ntawm cov duab huv si thaum qhov kev raug mob tau lees paub, tiv thaiv kev tawm tsam kom tsis txhob kis mus ntxiv.
Cov Cim Qhia Txog Kev Ua Phem (IoCs)
Thaum tshuaj xyuas Shai-Hulud, cov pab pawg yuav tsum saib xyuas ob qho tib si cov IoCs uas ruaj khov hauv cov ntaub ntawv thiab Cov IoCs ntawm tus cwj pwm in pipelines. Ua ke, cov cim no pab nrhiav pom kev kis kab mob thaum ntxov thiab teb ua ntej tus kab mob kis mus ntxiv.
Cov IoCs uas ruaj khov
Cov SHA-256 digests sib phim hauv qab no tau pom bundle.js cov qauv:
- 46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09
- 81d2a004a1bca6ef87a1caf7d0e0b355ad1764238e40ff6d1b1cb77ad4f595c3
- dc67467a39b70d1cd4c1f7f7a459b35058163592f4a9e8fb4dffcbba98ef210c
Tsis tas li ntawd xwb, saib xyuas cov qauv rov tshwm sim no:
- A
bundle.jsntawm lub hauv paus pob khoom. "postinstall": "node bundle.js"hauvpackage.json.- Cov chaw khaws cia uas muaj npe Shai-Hulud.
- GitHub cov txheej txheem ua haujlwm uas muaj
${{ toJSON(secrets) }}.
Kev coj cwj pwm IoCs
Tsis tas li ntawm cov ntaub ntawv kos npe, cov kab mob ua haujlwm qhia nws tus kheej los ntawm kev coj cwj pwm. Piv txwv li:
- Cov kev tawg nthwv dej ntawm npm tshaj tawm cov xwm txheej los ntawm ib tus neeg saib xyuas.
- Cov txheej txheem ua haujlwm tshiab uas thawb cov ntaub ntawv mus rau cov chaw xaus sab nraud.
- Cov kev thov POST tawm mus los ntawm CI cov neeg khiav.
- Tsis ntev los no tsim cov chaw khaws cia rau pej xeem nrog cov blobs encoded.
Kev yos hav zoov sai
Xaus Lus: Cov Lus Qhia Los Ntawm Shai-Hulud
cov Kev tawm tsam ntawm Shai-Hulud cov khoom siv Hauv cov pob khoom npm qhia tau tias cov khoom siv software niaj hnub no tsis muaj zog npaum li cas. Tus kab no ua ntau dua li ntxiv cov lej phem. Nws nyiag cov cim, xa cov ntaub ntawv tawm, thiab tom qab ntawd rov luam tawm nws tus kheej. Vim li no, qhov kev tawm tsam tau nthuav dav hauv ob peb teev es tsis yog lub lis piam.
Rau cov neeg tsim khoom thiab cov pab pawg DevOps, cov lus qhia meej meej:
- Txhua qhov kev teeb tsa khiav code. Txawm tias ib pob npm feem ntau tuaj yeem zais ib tug kab mob postinstall.
- Txhua lub cim muaj nqis siab. Thaum raug nyiag lawm, nws tuaj yeem siv los kis cov malware ntxiv.
- txhua pipeline xav tau cov tshev. tsis muaj guardrails ntawm kev vam khom, cov txheej txheem ua haujlwm, thiab cov lus zais, ib qho kev sib haum xeeb tuaj yeem cuam tshuam sai sai rau kev tsim khoom.
Yog li ntawd, kev tiv thaiv kev tawm tsam zoo li Shai-Hulud xav tau kev tswj hwm uas tsis siv neeg thiab yooj yim rau kev siv. Cov pab pawg yuav tsum luam theej duab cov pob npm ua ntej kev teeb tsa, siv cov ntaub ntawv xauv, nrhiav pom cov haujlwm tshaj tawm txawv txawv, thiab khaws cov cim luv luv. Cov kauj ruam no tsis yog xaiv tau lawm. Hloov chaw, lawv yog lub hauv paus ntawm kev ua siab ntev hauv niaj hnub no. pipelines.
Ntawm Xygeni, peb pom qhov kev tawm tsam ntawm Shai-Hulud ua ib qho lus ceeb toom rau tag nrho lub ecosystem qhib. Txoj hauv kev ruaj khov mus tom ntej yog coj kev ruaj ntseg ntawm cov khoom siv ncaj qha mus rau hauv cov txheej txheem kev txhim kho, ntawm qhov chaw uas cov lej, npm pob khoom, thiab pipelines txuas.
Hauv qab no yog daim ntawv teev tag nrho ntawm cov pob khoom npm thiab cov versions uas tau tshaj tawm tias muaj kev cuam tshuam hauv Shai-Hulud. Siv nws los xyuas koj cov ntaub ntawv xauv, cov npe sau npe, thiab CI. pipelines rau kev raug.
Daim ntawv teev cov pob khoom uas raug cuam tshuam
📦 Saib Ua Ntej ntawm Cov Pob Khoom NPM Uas Tsis Zoo
| Pob Lub Npe | version | Hnub Luam Tawm |
|---|---|---|
| json-rules-engine-simplified | 0.2.1 | 2025-09-14T17:58:51.203Z |
| tus kws tsav dav hlau | 0.8.8 | 2025-09-14T18:35:07.600Z |
| mcp-kev-paub-daim duab | 1.2.1 | 2025-09-14T18:35:09.494Z |
| lub tsho dav hlau | 0.3.1 | 2025-09-14T18:35:09.521Z |
| lub qhov rooj dhia | 0.0.2 | 2025-09-14T18:35:09.651Z |
| tvi-cli | 0.1.5 | 2025-09-14T18:35:10.996Z |
| @thangved/callback-window | 1.1.4 | 2025-09-14T20:31:38.479Z |
| @tnf-dev/api | 1.0.8 | 2025-09-14T20:31:39.547Z |
| @tnf-dev/js | 1.0.8 | 2025-09-14T20:31:41.251Z |
| @tnf-dev/mui | 1.0.8 | 2025-09-14T20:31:41.259Z |
| @tnf-dev/core | 1.0.8 | 2025-09-14T20:31:42.728Z |
| @teselagen/react-table | 6.10.20 | 2025-09-14T20:37:08.597Z |
| @hestjs/demo | 0.1.2 | 2025-09-14T20:45:52.348Z |
| @nexe/eslint-config | 0.1.1 | 2025-09-14T20:45:53.625Z |
| @hestjs/eslint-config | 0.1.2 | 2025-09-14T20:45:55.044Z |
| @nexe/config-manager | 0.1.1 | 2025-09-14T20:45:55.066Z |
| @nexe/logger | 0.1.3 | 2025-09-14T20:45:55.170Z |
| @hestjs/logger | 0.1.6 | 2025-09-14T20:45:55.197Z |
| @hestjs/kev lees paub | 0.1.6 | 2025-09-14T20:45:55.595Z |
| @hestjs/core | 0.2.1 | 2025-09-14T20:45:55.888Z |
➡️ Saib Daim Ntawv Teev Tag Nrho ntawm Cov Pob Khoom Uas Raug Txom Nyem
| Pob Lub Npe | version | Hnub Luam Tawm |
|---|---|---|
| json-rules-engine-simplified | 0.2.1 | 2025-09-14T17:58:51.203Z |
| tus kws tsav dav hlau | 0.8.8 | 2025-09-14T18:35:07.600Z |
| mcp-kev-paub-daim duab | 1.2.1 | 2025-09-14T18:35:09.494Z |
| lub tsho dav hlau | 0.3.1 | 2025-09-14T18:35:09.521Z |
| lub qhov rooj dhia | 0.0.2 | 2025-09-14T18:35:09.651Z |
| tvi-cli | 0.1.5 | 2025-09-14T18:35:10.996Z |
| @thangved/callback-window | 1.1.4 | 2025-09-14T20:31:38.479Z |
| @tnf-dev/api | 1.0.8 | 2025-09-14T20:31:39.547Z |
| @tnf-dev/js | 1.0.8 | 2025-09-14T20:31:41.251Z |
| @tnf-dev/mui | 1.0.8 | 2025-09-14T20:31:41.259Z |
| @tnf-dev/core | 1.0.8 | 2025-09-14T20:31:42.728Z |
| @teselagen/react-table | 6.10.20 | 2025-09-14T20:37:08.597Z |
| @hestjs/demo | 0.1.2 | 2025-09-14T20:45:52.348Z |
| @nexe/eslint-config | 0.1.1 | 2025-09-14T20:45:53.625Z |
| @hestjs/eslint-config | 0.1.2 | 2025-09-14T20:45:55.044Z |
| @nexe/config-manager | 0.1.1 | 2025-09-14T20:45:55.066Z |
| @nexe/logger | 0.1.3 | 2025-09-14T20:45:55.170Z |
| @hestjs/logger | 0.1.6 | 2025-09-14T20:45:55.197Z |
| @hestjs/kev lees paub | 0.1.6 | 2025-09-14T20:45:55.595Z |
| @hestjs/core | 0.2.1 | 2025-09-14T20:45:55.888Z |
| @hestjs/cqrs | 0.1.6 | 2025-09-14T20:45:55.966Z |
| @hestjs/scalar | 0.1.7 | 2025-09-14T20:45:56.386Z |
| ng2-cov ntaub ntawv-upload | 7.0.3 | 2025-09-15T02:44:29.555Z |
| capacitor-kev ceeb toomhandler | 0.0.2 | 2025-09-15T04:54:48.431Z |
| capacitor-plugin-vonage | 1.0.2 | 2025-09-15T04:54:48.501Z |
| capacitor-plugin-healthapp | 0.0.2 | 2025-09-15T04:54:48.704Z |
| capacitorandroidkev tso cai | 0.0.4 | 2025-09-15T04:54:48.753Z |
| voip-callkit | 1.0.2 | 2025-09-15T04:54:49.223Z |
| capacitor-plugin-ihealth | 1.1.8 | 2025-09-15T04:55:08.113Z |
| @art-ws/common | 2.0.22 | 2025-09-15T05:21:15.411Z |
| @art-ws/config-eslint | 2.0.4 | 2025-09-15T05:21:17.199Z |
| ngx-ws | 1.1.5 | 2025-09-15T05:21:17.514Z |
| @art-ws/slf | 2.0.15 | 2025-09-15T05:21:17.524Z |
| @art-ws/http-server | 2.0.21 | 2025-09-15T05:21:17.745Z |
| pm2-gelf-json | 1.0.4 | 2025-09-15T05:21:18.413Z |
| @art-ws/di | 2.0.28 | 2025-09-15T05:21:18.488Z |
| @art-ws/di-node | 2.0.13 | 2025-09-15T05:21:18.849Z |
| @art-ws/config-ts | 2.0.7 | 2025-09-15T05:21:19.408Z |
| @art-ws/db-context | 2.0.21 | 2025-09-15T05:21:19.814Z |
| @art-ws/openapi | 0.1.9 | 2025-09-15T05:21:19.969Z |
| @art-ws/web-app | 1.0.3 | 2025-09-15T05:21:20.383Z |
| @art-ws/ssl-info | 1.0.9 | 2025-09-15T05:21:20.927Z |
