Txhua lub lim tiam, peb cov kab ke nrhiav malware luam theej ntau txhiab pob khoom tshiab thiab hloov kho tshiab thoob plaws cov npe pej xeem xws li npm thiab PyPI. Lub lim tiam no tsis muaj qhov tshwj xeeb.
Peb tau lees paub ntau dua 200 pob khoom phem ntawm lub Rau Hli 12t thiab Lub Rau Hli 19th, 2026, feem ntau hla npm, nrog rau cov neeg mob ntxiv hauv PyPI. Ntau tus tau tshwm sim hauv cov pawg sib koom ua ke, rov ua dua cov ntawv tshaj tawm phem luam tawm hauv tib lub npe lossis hla cov tsev neeg pob khoom sib ze.
Qhov teeb meem tseem ceeb tshaj plaws lub lim tiam no yog sensivity, uas tau ua rau npm muaj ntau tshaj 70 qhov kev tso tawm versioned thoob plaws 2.5.x, tau lees paub thoob plaws ntau hnub. Lwm cov pawg tseem ceeb suav nrog nthwv dej ntawm @solana-labs cov typosquats uas tsom mus rau Solana ecosystem (web3.js, web3-js, etherjs, spl-toke, ancor, web3js — hla ob qhov kev tshaj tawm sib cais rau lub Rau Hli 7 thiab Lub Rau Hli 8), tus @nstrlabs tsev neeg (sdk, ixel, utils, shared-components, api-client, auth — kev tawm tsam tsis meej pem ntawm kev vam khom tawm tsam lub npe pob khoom sab hauv), @klapp-login-platform pawg (native-sdk, oidc, routes — ua txuj ua ib lub platform lees paub), internallib_v557 thiab internallib_v984 (ntau hom ntawm cov tsev qiv ntawv sab hauv uas tsis meej pem), pocteszep (6 versions luam tawm rau lub Rau Hli 11), thiab ib pawg ntawm crypto thiab Web3 utilities suav nrog blockchain-helper-0, ethereum-kit-1, ethereum-kit-9, crypto-utils-7, wallet-sdk-9, defi-tools-39, swap-sdk-87, Thiab farming-tools-12. cov morningstar-design-system pob khoom tau tshwm sim hauv peb hom rau lub Rau Hli 10, ua txuj ua ib lub kaw lus tsim nyiaj txiag uas paub zoo.
Txij li thaum Lub Rau Hli 13 mus, qhov kev nrawm nrawm zuj zus. houzidawang806 ib pawg neeg xwb suav nrog ntau dua 25 qhov luam tawm hauv ib hnub, koom nrog los ntawm cov kwv tij houzidawang807 thiab houzidawang808. cov metrics-pipeline-d8k2 pob khoom tau rov luam tawm tas li thoob plaws 21 versions ntawm Lub Rau Hli 15 thiab Lub Rau Hli 18 - ib qho kev tawm tsam kom tsis txhob raug tsim los kom nyob ua ntej ntawm cov npe thaiv. friendly-greeter-demo pob khoom pheej rov tshwm sim thoob plaws hauv cov qauv thoob plaws lub lim tiam. Kev sim ua kom tsis meej pem tshiab tau tshwm sim hauv qab xy-shared, axl-ui, loadninja-shared, carousel-controller-mixin, token-prices-cron, hemi-supply-cron, portal-backend, vault-strategies, thiab ntau lwm tus - txhua tus nqa cov lej version inflated hauv 999.x ntau yam. Ib pawg tshiab ntawm cov npe siv hluav taws xob nrog cov cim hex random (color-utils-dee0, data-utils-d703, string-tools-be6c, type-check-816d, fmt-helpers-794b, metrics-probe-*) tau tshwm sim rau lub Rau Hli 18–19, sib xws nrog kev sau npe ua pawg. Lub lim tiam kaw nrog trimprompt, trimprompt-hub, claude-cup, Thiab web3-crypto-address-utils tau lees paub rau lub Rau Hli 19. Hauv PyPI, neuralbridge-sdk (tsib hom thoob plaws 4.5.x–5.1.x), deepstrain, teambot-ai, hello-test-s1, Thiab aiaddin-agent tau lees paub thoob plaws lub lim tiam.
Cov no tsis yog qhov txawv txav uas cais tawm. Qhov uas sawv tawm lub lim tiam no yog qhov kev sib sau ua ke ntawm kev tawm tsam tsis meej pem ntawm cov npe pob khoom sab hauv, cov phiaj xwm tshaj tawm ntau hnub uas tsim los kom kav ntev dua li kev tshem tawm, kev tsom mus rau Web3 thiab DeFi tooling (tus qauv uas tau nrawm dua hauv xyoo 2026), thiab kev siv cov npe pob khoom dav dav, zoo li suab nrov uas tsim los zam kev kuaj pom los ntawm kev sib xyaw ua ke rau hauv cov ntoo vam khom ib txwm muaj.
Daim duab thaij txhua lub lim tiam no yog ib feem ntawm peb qhov Malicious Code Digest uas tab tom ua, qhov chaw uas peb lees paub cov kev hem thawj tshiab thiab muab cov ntaub ntawv txawj ntse uas ua tau los pab DevSecOps cov pab pawg tiv thaiv lawv pipelineua ntej muaj kev puas tsuaj. Cia peb piav qhia txog yam peb pom lub lim tiam no thiab vim li cas nws thiaj tseem ceeb.
Tsis txhob cia cov phiaj xwm sib koom tes ncav cuag koj Pipelines
Cov ntawv xov xwm lub lim tiam no tsis yog hais txog ib qho kev hem thawj xwb; nws yog hais txog qhov loj me. Muaj ntau tshaj 200 pob khoom uas tau lees paub, cov version uas muaj ntau dhau ntau hnub, thiab cov phiaj xwm sau npe ua ntau yam uas tau sau ua ntawv khiav sai dua li kev tshuaj xyuas tes tuaj yeem taug qab. Cov neeg tawm tsam tsis tos koj kom ntes tau.
Kev Tshawb Pom Malware Thaum Ntxov ntawm Xygeni saib xyuas npm, PyPI, thiab lwm yam kev sau npe tsis tu ncua, cim cov kev hem thawj thaum lub sijhawm tshaj tawm, tsis yog tom qab lawv tau tsaws rau hauv ib qho kev tsim. Thaum ib qho kev sib tw tshaj tawm 21 versions ntawm tib lub pob phem thoob plaws plaub hnub, kev tshuaj xyuas txhua lub lim tiam ntes tsis muaj dab tsi raws sijhawm.
Xygeni's Open Source Security kev daws teeb meem muab rau koj cov pab pawg DevSecOps qhov pom tseeb thiab qhov tseem ceeb uas lawv xav tau kom nyob ua ntej ntawm hom kev sib koom tes no, yog li koj pipelines nyob huv si yam tsis ua rau koj cov pab pawg qeeb.
