Yuav luag txhua lub lim tiam, peb cov kab ke nrhiav malware luam theej ntau txhiab pob khoom tshiab thiab hloov kho tshiab thoob plaws cov npe pej xeem xws li npm thiab PyPI. Lub lim tiam no muaj kev ua ub ua no heev.
Peb tau lees paub 198 pob khoom phem, feem ntau hla npm, nrog rau cov rooj plaub ntxiv hauv PyPI, OpenVSX, Composer, thiab VS Code extensions. Muaj ntau qhov tshwm sim hauv cov pawg sib koom ua ke, nrog rau cov kev tso tawm phem rov ua dua luam tawm hauv tib lub npe lossis hla cov tsev neeg pob khoom sib ze. Ib rooj plaub sawv cev yog sensivity pob khoom, uas tau ua rau npm muaj ntau dua 60 qhov kev tso tawm versioned thoob plaws 2.5.x. Lwm cov pawg tseem ceeb suav nrog ai-sdk-helpers (8 hom phiaj rau cov neeg tsim khoom AI), @antoncallahan/aws-user-helper (7 versions ua txuj ua ib qho AWS utility), @apple-pay-trust thiab @google-pay-trust tsev neeg (ua raws li cov qauv them nyiaj), @frengki0707/google-cloud-clone (5 versions spoofing Google Cloud), thiab cms-storehub, cms-helpgit, Thiab cms-github (kev tsom mus rau CMS pipelines). Ntau pob khoom ua raws li cov qauv them nyiaj thiab them nqi, enterprise thiab cov pob khoom sab hauv web, cov neeg siv khoom analytics, UI foundations, developer utilities, component explorers, cloud- thiab Google-themed packages, thiab lwm yam modules uas feem ntau ntseeg siab rau hauv cov txheej txheem kev txhim kho niaj hnub.
Cov no tsis yog qhov txawv txav uas cais tawm. Qhov uas sawv tawm lub lim tiam no yog qhov ntsuas ntawm kev tshaj tawm rov ua dua thoob plaws tib tsev neeg pob khoom, kev siv dua ntawm cov qauv kev teev npe, thiab txoj kev uas cov pob khoom phem tau raug zais kom zoo li kev vam khom raug cai hauv kev xa khoom software tiag tiag. pipelines.
Daim duab thaij txhua lub lim tiam no yog ib feem ntawm peb qhov Malicious Code Digest uas tab tom ua, qhov chaw uas peb lees paub cov kev hem thawj tshiab thiab muab cov ntaub ntawv txawj ntse uas ua tau los pab DevSecOps cov pab pawg tiv thaiv lawv pipelineua ntej muaj kev puas tsuaj.
Cia peb piav qhia txog yam peb pom lub lim tiam no thiab vim li cas nws thiaj tseem ceeb.
| ecosystem | pob | Hnub |
|---|---|---|
| npm | @cloudplatform-single-spa/kev tswj hwm:99.99.100 | Tej zaum 30, 2026 |
| npm | @cloudplatform-single-spa/svp-s3-cia:99.99.100 | Tej zaum 30, 2026 |
| npm | @maximvs1538/os-npm:99.0.0 | Tej zaum 30, 2026 |
| npm | @kev nkag yooj yim/kev tsaws:99.9.5 | Tej zaum 30, 2026 |
| npm | @easy-nkag/sab nraud-sau npe-fop-navigator:99.9.5 | Tej zaum 30, 2026 |
| npm | @nkag tau yooj yim/kev:99.9.5 | Tej zaum 30, 2026 |
| npm | @t-in-one/form_product_token:5.7.1 | Tej zaum 30, 2026 |
| npm | @capibar.chat/ui-kit:99.5.7 | Tej zaum 30, 2026 |
| vscode | xampp-tus thawj tswj: 5.1.3 | Tej zaum 30, 2026 |
| npm | @chat-template/auth:1.0.0 | Tej zaum 31, 2026 |
| npm | json-rau-simple-graphql-schema:1.0.0 | Jun 1, 2026 |
| npm | @gs-select/kev txuag-tus-neeg-daim ntawv thov:99.0.0 | Jun 1, 2026 |
| npm | nemo-tus neeg sau xov xwm: 1.8.2 | Jun 1, 2026 |
| npm | cms-github:4.2.4 | Jun 1, 2026 |
| npm | cms-helpgit:4.2.6 | Jun 1, 2026 |
| npm | cms-helpgit:4.2.8 | Jun 1, 2026 |
| npm | cms-storehub:1.3.4 | Jun 1, 2026 |
| npm | cms-storehub:1.3.5 | Jun 1, 2026 |
| npm | cms-storehub:1.3.6 | Jun 1, 2026 |
| pypi | simtooreal-cli:0.3.0 | Jun 1, 2026 |
| npm | kev npaj qhov chaw muag khoom pem hauv ntej: 1.1.1 | Jun 1, 2026 |
| npm | kev npaj qhov chaw muag khoom pem hauv ntej: 1.1.2 | Jun 1, 2026 |
| npm | conversa-sdk:2.0.2 | Jun 1, 2026 |
| npm | veltrix:9.0.0 | Jun 1, 2026 |
| npm | veltrix:9.0.1 | Jun 1, 2026 |
| npm | jingmeideshishi: 1.0.4 | Jun 1, 2026 |
| npm | jingmeideshishi: 1.0.5 | Jun 1, 2026 |
| npm | @tse-digital/core:99.0.0 | Jun 1, 2026 |
| npm | @telenor-se/core:99.0.0 | Jun 1, 2026 |
| npm | @ownit/core:99.0.0 | Jun 1, 2026 |
| npm | cov ntaub ntawv ntawm tus neeg mob: 75.0.0 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.69 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.68 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.82 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.80 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.81 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.83 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.3 | Jun 1, 2026 |
| npm | @emcd-vue/auth:6.4.9 | Jun 1, 2026 |
| npm | @emcd-vue/b2b-them-daim ntawv:5.7.4 | Jun 1, 2026 |
| npm | @ccrm/user-storage-api-axios:5.0.1 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.8 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.12 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.16 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.17 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.18 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.19 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.20 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.21 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.22 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.23 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.24 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.25 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.26 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.27 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.28 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.29 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.30 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.31 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.32 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.41 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.42 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.43 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.44 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.45 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.46 | Jun 2, 2026 |
| npm | meoo-ui-helpers:1.0.1 | Jun 2, 2026 |
| npm | @langgraphjs/toolkit:1.2.10 | Jun 2, 2026 |
| npm | eyevox:9.0.1 | Jun 2, 2026 |
| npm | kev rhiab heev: 2.5.53 | Jun 3, 2026 |
| npm | kev rhiab heev: 2.5.54 | Jun 3, 2026 |
| npm | kev rhiab heev: 2.5.55 | Jun 3, 2026 |
| npm | kev rhiab heev: 2.5.56 | Jun 3, 2026 |
| npm | kev rhiab heev: 2.5.57 | Jun 3, 2026 |
| npm | kev rhiab heev: 2.5.61 | Jun 3, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.1 | Jun 4, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.2 | Jun 4, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.5 | Jun 4, 2026 |
| npm | kev pabcuam nrhiav nyiaj txiag:1.0.0 | Jun 4, 2026 |
| npm | kev rhiab heev: 2.5.67 | Jun 4, 2026 |
| npm | kev rhiab heev: 2.5.68 | Jun 4, 2026 |
| npm | vg-kev sib cuam tshuam-qauv:40.0.5 | Jun 4, 2026 |
| npm | internallib_v346:1.0.3 | Jun 4, 2026 |
| npm | internallib_v346:1.0.5 | Jun 4, 2026 |
| npm | internallib_v346:1.0.9 | Jun 4, 2026 |
| npm | ai-sdk-helpers:0.2.1 | Jun 4, 2026 |
| npm | ai-sdk-helpers:0.3.0 | Jun 4, 2026 |
| npm | ai-sdk-helpers:0.3.1 | Jun 4, 2026 |
| npm | ai-sdk-helpers:1.1.0 | Jun 4, 2026 |
| npm | ai-sdk-helpers:1.1.1 | Jun 4, 2026 |
| npm | ai-sdk-helpers:1.3.0 | Jun 4, 2026 |
| npm | ai-sdk-helpers:1.4.0 | Jun 4, 2026 |
| npm | ai-sdk-helpers:1.4.2 | Jun 4, 2026 |
| npm | @achuthvp/postinstall-poc:1.0.3 | Jun 4, 2026 |
| npm | kev rhiab heev: 2.5.0 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.1 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.2 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.3 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.4 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.5 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.13 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.14 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.15 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.33 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.34 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.35 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.36 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.37 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.38 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.58 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.59 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.60 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.62 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.63 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.64 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.65 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.66 | Jun 5, 2026 |
| npm | kev rhiab heev: 2.5.69 | Jun 5, 2026 |
Ruaj Ntseg Koj Qhov Kev Pab Cuam Qhib Rau Qhov Qhib Tiv Thaiv Kev Tsis Muaj Zog thiab Cov Code Ua Phem
Tsis txhob cia cov pob khoom phem mus txog koj pipelines. Kev Tshawb Pom Malware Thaum Ntxov ntawm Xygeni muab rau koj pab neeg pom kev tiag tiag rau cov kev hem thawj uas tseem ceeb tshaj plaws, ntes cov kev vam khom ua ntej lawv kov koj cov software.
Raws li cov ntsiab lus ntawm lub lim tiam no qhia meej, qhov ntim thiab kev txawj ntse ntawm cov phiaj xwm pob khoom phem tsis qeeb qeeb. Kev sib koom ua ke ntawm cov qauv sib txawv, kev ua txuj ua li module them nyiaj, thiab cov npe pob khoom sab hauv tsuas yog qee qhov kev tawm tsam uas cov neeg tawm tsam siv los hla dhau. standard kev tiv thaiv. Kev nyob ua ntej ntawm cov kev hem thawj no xav tau ntau dua li kev tshuaj xyuas tsis tu ncua, nws xav tau kev saib xyuas tas mus li thoob plaws txhua qhov chaw sau npe uas koj cov pab pawg vam khom.
Xygeni's Open Source Security Kev daws teeb meem luam theej thiab thaiv cov pob khoom tsis zoo ntawm qhov chaw tshaj tawm, hla npm, PyPI, thiab dhau mus. Los ntawm kev txiav txim siab qhov tseem ceeb ntawm qhov tsis muaj zog uas ua rau muaj kev pheej hmoo loj tshaj plaws hauv ntiaj teb (thiab ua kom txoj kev kho kom zoo rau koj cov pab pawg DevSecOps yooj yim dua) Xygeni pab koj tswj kev xa khoom software kom ruaj ntseg, txhim khu kev qha yam tsis ua rau kev txhim kho qeeb.
