Yuav luag txhua lub lim tiam, peb cov kab ke nrhiav malware luam theej ntau txhiab pob khoom tshiab thiab hloov kho tshiab thoob plaws cov npe pej xeem xws li npm thiab PyPI. Lub lim tiam no tsis muaj qhov tshwj xeeb.
Peb tau lees paub ntau dua 130 pob khoom phem ntawm lub Rau Hli 7 thiab Lub Rau Hli 12, 2026, feem ntau thoob plaws npm, nrog rau cov xwm txheej ntxiv hauv PyPI. Ntau tus tau tshwm sim hauv cov pawg sib koom ua ke, rov ua dua cov ntawv tshaj tawm phem luam tawm hauv tib lub npe lossis thoob plaws cov tsev neeg pob khoom sib ze.
Qhov teeb meem tseem ceeb tshaj plaws lub lim tiam no yog sensivity, uas tau ua rau npm muaj ntau tshaj 40 qhov kev tso tawm versioned thoob plaws 2.5.x, tau lees paub thoob plaws ntau hnub. Lwm cov pawg tseem ceeb suav nrog nthwv dej ntawm @solana-labs cov typosquats uas tsom mus rau Solana ecosystem (web3.js, web3-js, etherjs, spl-toke, ancor, web3js - hla ob qhov kev tshaj tawm sib cais rau lub Rau Hli 7 thiab Lub Rau Hli 8), tus @nstrlabs tsev neeg (sdk, ixel, utils, shared-components, api-client, auth - kev tawm tsam tsis meej pem ntawm kev tawm tsam tawm tsam lub npe pob khoom sab hauv), tus @klapp-login-platform pawg (native-sdk, oidc, routes - ua txuj ua ib lub platform authentication), internallib_v557 thiab internallib_v984 (ntau hom ntawm cov tsev qiv ntawv sab hauv uas tsis meej pem), pocteszep (6 versions luam tawm rau lub Rau Hli 11), thiab ib pawg ntawm crypto thiab Web3 utilities suav nrog blockchain-helper-0, ethereum-kit-1, ethereum-kit-9, crypto-utils-7, wallet-sdk-9, defi-tools-39, swap-sdk-87, Thiab farming-tools-12. cov morningstar-design-system pob khoom tau tshwm sim hauv peb qhov versions rau lub Rau Hli 10, ua txuj ua ib lub tshuab tsim nyiaj txiag uas paub zoo. Hauv PyPI, helixagentai, telegramlite, Thiab cdjeez tau lees paub thoob plaws lub lim tiam.
Cov no tsis yog qhov txawv txav uas cais tawm. Qhov uas sawv tawm lub lim tiam no yog qhov kev sib sau ua ke ntawm kev tawm tsam tsis meej pem tawm tsam cov npe pob khoom sab hauv, kev tshaj tawm ntau hnub ntawm sensivity pawg, thiab kev txuas ntxiv tsom mus rau Web3 thiab Solana cov cuab yeej, tus qauv uas tau nrawm dua hauv xyoo 2026.
Daim duab thaij txhua lub lim tiam no yog ib feem ntawm peb qhov Malicious Code Digest uas tab tom ua, qhov chaw uas peb lees paub cov kev hem thawj tshiab thiab muab cov ntaub ntawv txawj ntse uas ua tau los pab DevSecOps cov pab pawg tiv thaiv lawv pipelineua ntej muaj kev puas tsuaj.
Cia peb piav qhia txog yam peb pom lub lim tiam no thiab vim li cas nws thiaj tseem ceeb.
Tsis txhob cia cov pob khoom phem ncav cuag kev tsim khoom
Cov pob khoom uas koj cov pab pawg vam khom rau tau siv ntau zuj zus los ua qhov chaw nkag. Kev Tshawb Pom Malware Thaum Ntxov ntawm Xygeni saib xyuas cov npe sau npe hauv lub sijhawm tiag tiag, yog li cov kev hem thawj zoo li cov uas nyob hauv cov ntawv qhia zaub mov lub lim tiam no raug thaiv ua ntej lawv mus txog koj cov kev tsim kho.
Cov kev tshawb pom ntawm lub lim tiam no yog ib qho kev ceeb toom tias cov tswv yim tau ua tib zoo xav ntau dua. Kev siv cov version flooding, namespace impersonation, thiab ntau hnub sib koom tes ua haujlwm tsis yog cov teeb meem ntxiv lawm, lawv yog standard phau ntawv qhia txog kev ua si ntawm tus neeg tawm tsam. Kev tshuaj xyuas ib zaug thiab kev tshuaj xyuas tes tsis tuaj yeem ua raws li cov phiaj xwm uas tshaj tawm ntau ntau cov qauv thoob plaws ntau hnub thiab cov npe sau npe tib lub sijhawm.
Xygeni's Open Source Security kev daws teeb meem muab rau koj cov pab pawg DevSecOps pom kev tas mus li thoob plaws npm, PyPI, thiab dhau mus, nrhiav pom cov pob khoom tsis zoo thaum lub sijhawm tshaj tawm, txiav txim siab qhov tseem ceeb ntawm qhov muaj kev pheej hmoo tiag tiag, thiab ua kom txoj kev luv luv los ntawm kev tshawb pom mus rau kev kho. Yog li koj cov pab pawg tuaj yeem xa khoom sai yam tsis muaj kev cuam tshuam rau kev ruaj ntseg.
