Meh saben minggu, sistem deteksi malware kita mindhai ewonan paket anyar lan sing dianyari ing registri umum kaya npm lan PyPI. Minggu iki aktif banget.
Kita ngonfirmasi 198 paket jahat, utamane ing npm, kanthi kasus tambahan ing ekstensi PyPI, OpenVSX, Composer, lan VS Code. Sawetara muncul ing kluster sing terkoordinasi, kanthi rilis jahat sing bola-bali diterbitake kanthi jeneng sing padha utawa ing kulawarga paket sing raket banget. Kasus sing paling menonjol yaiku sensivity paket, sing mbanjiri npm kanthi luwih saka 60 rilis versi ing kisaran 2.5.x. Kluster penting liyane kalebu ai-sdk-helpers (8 versi sing nargetake para pangembang AI), @antoncallahan/aws-user-helper (7 versi sing nyamar dadi utilitas AWS), @apple-pay-trust lan @google-pay-trust kulawarga (niru modul pambayaran), @frengki0707/google-cloud-clone (5 versi sing ngapusi Google Cloud), lan cms-storehub, cms-helpgit, Lan cms-github (nargetake CMS pipelines). Akeh paket sing niru modul pambayaran lan checkout, enterprise lan paket web internal, klien analitik, pondasi UI, utilitas pangembang, penjelajah komponen, paket bertema cloud lan Google, lan modul liyane sing umum dipercaya ing alur kerja pangembangan modern.
Iki dudu anomali sing kapisah. Sing paling narik kawigaten minggu iki yaiku skala penerbitan bola-bali ing antarane kulawarga paket sing padha, panggunaan maneh pola penamaan, lan cara paket jahat disamarkan supaya katon kaya dependensi sing sah ing njero pangiriman piranti lunak nyata. pipelines.
Cuplikan minggon iki minangka bagéan saka Intisari Kode Malicious sing lagi ditindakake, ing ngendi kita ngevalidasi ancaman anyar lan nyedhiyakake intelijen sing bisa ditindakake kanggo mbantu tim DevSecOps nglindhungi pipelines sadurunge karusakan kedadeyan.
Ayo padha ngrembug apa sing wis ditemokake minggu iki lan kenapa iku penting.
| Ekosistem | paket | tanggal |
|---|---|---|
| npm | @cloudplatform-single-spa/administrasi:99.99.100 | Muga 30, 2026 |
| npm | @cloudplatform-single-spa/svp-s3-storage:99.99.100 | Muga 30, 2026 |
| npm | @maximvs1538/os-npm:99.0.0 | Muga 30, 2026 |
| npm | @ease-entry/landing-routes:99.9.5 | Muga 30, 2026 |
| npm | @entri-gampang/pendaftaran-njaba-navigator-fop:99.9.5 | Muga 30, 2026 |
| npm | @ease-entry/rute:99.9.5 | Muga 30, 2026 |
| npm | @t-in-one/form_product_token:5.7.1 | Muga 30, 2026 |
| npm | @capibar.chat/ui-kit:99.5.7 | Muga 30, 2026 |
| vscode | xampp-manager:5.1.3 | Muga 30, 2026 |
| npm | @template-obrolan/auth:1.0.0 | Muga 31, 2026 |
| npm | json-to-simple-graphql-schema:1.0.0 | Jun 1, 2026 |
| npm | @gs-select/aplikasi-klien-tabungan:99.0.0 | Jun 1, 2026 |
| npm | nemo-reporter:1.8.2 | Jun 1, 2026 |
| npm | cms-github:4.2.4 | Jun 1, 2026 |
| npm | cms-helpgit:4.2.6 | Jun 1, 2026 |
| npm | cms-helpgit:4.2.8 | Jun 1, 2026 |
| npm | cms-storehub:1.3.4 | Jun 1, 2026 |
| npm | cms-storehub:1.3.5 | Jun 1, 2026 |
| npm | cms-storehub:1.3.6 | Jun 1, 2026 |
| pypi | simtooreal-cli:0.3.0 | Jun 1, 2026 |
| npm | strategi-lokasi-ritel-frontend:1.1.1 | Jun 1, 2026 |
| npm | strategi-lokasi-ritel-frontend:1.1.2 | Jun 1, 2026 |
| npm | conversa-sdk:2.0.2 | Jun 1, 2026 |
| npm | veltrix:9.0.0 | Jun 1, 2026 |
| npm | veltrix:9.0.1 | Jun 1, 2026 |
| npm | jingmeideshishi: 1.0.4 | Jun 1, 2026 |
| npm | jingmeideshishi: 1.0.5 | Jun 1, 2026 |
| npm | @tse-digital/inti:99.0.0 | Jun 1, 2026 |
| npm | @telenor-se/core:99.0.0 | Jun 1, 2026 |
| npm | @ownit/inti:99.0.0 | Jun 1, 2026 |
| npm | dokumen pasien:75.0.0 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.69 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.68 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.82 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.80 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.81 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.83 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.3 | Jun 1, 2026 |
| npm | @emcd-vue/auth:6.4.9 | Jun 1, 2026 |
| npm | @emcd-vue/b2b-payform:5.7.4 | Jun 1, 2026 |
| npm | @ccrm/user-storage-api-axios:5.0.1 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.8 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.12 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.16 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.17 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.18 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.19 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.20 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.21 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.22 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.23 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.24 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.25 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.26 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.27 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.28 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.29 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.30 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.31 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.32 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.41 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.42 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.43 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.44 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.45 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.46 | Jun 2, 2026 |
| npm | meoo-ui-helpers:1.0.1 | Jun 2, 2026 |
| npm | @langgraphjs/toolkit:1.2.10 | Jun 2, 2026 |
| npm | eyevox:9.0.1 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.53 | Jun 3, 2026 |
| npm | sensitivitas: 2.5.54 | Jun 3, 2026 |
| npm | sensitivitas: 2.5.55 | Jun 3, 2026 |
| npm | sensitivitas: 2.5.56 | Jun 3, 2026 |
| npm | sensitivitas: 2.5.57 | Jun 3, 2026 |
| npm | sensitivitas: 2.5.61 | Jun 3, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.1 | Jun 4, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.2 | Jun 4, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.5 | Jun 4, 2026 |
| npm | layanan pengumpulan dana:1.0.0 | Jun 4, 2026 |
| npm | sensitivitas: 2.5.67 | Jun 4, 2026 |
| npm | sensitivitas: 2.5.68 | Jun 4, 2026 |
| npm | model-interaksi-vg:40.0.5 | Jun 4, 2026 |
| npm | internallib_v346:1.0.3 | Jun 4, 2026 |
| npm | internallib_v346:1.0.5 | Jun 4, 2026 |
| npm | internallib_v346:1.0.9 | Jun 4, 2026 |
| npm | ai-sdk-helpers:0.2.1 | Jun 4, 2026 |
| npm | ai-sdk-helpers:0.3.0 | Jun 4, 2026 |
| npm | ai-sdk-helpers:0.3.1 | Jun 4, 2026 |
| npm | ai-sdk-helpers:1.1.0 | Jun 4, 2026 |
| npm | ai-sdk-helpers:1.1.1 | Jun 4, 2026 |
| npm | ai-sdk-helpers:1.3.0 | Jun 4, 2026 |
| npm | ai-sdk-helpers:1.4.0 | Jun 4, 2026 |
| npm | ai-sdk-helpers:1.4.2 | Jun 4, 2026 |
| npm | @achuthvp/postinstall-poc:1.0.3 | Jun 4, 2026 |
| npm | sensitivitas: 2.5.0 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.1 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.2 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.3 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.4 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.5 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.13 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.14 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.15 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.33 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.34 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.35 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.36 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.37 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.38 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.58 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.59 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.60 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.62 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.63 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.64 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.65 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.66 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.69 | Jun 5, 2026 |
Amanake Ketergantungan Sumber Terbuka Sampeyan saka Kerentanan lan Kode Berbahaya
Aja nganti paket jahat tekan sampeyan pipelines. Deteksi Malware Awal Xygeni menehi tim sampeyan visibilitas wektu nyata babagan ancaman sing paling penting, nyekel dependensi sing mbebayani sadurunge ndemek piranti lunak sampeyan.
Kaya sing wis dijlentrehake ing ringkesan minggu iki, volume lan kecanggihan kampanye paket jahat ora saya suda. Banjir versi terkoordinasi, peniruan modul pembayaran, lan jeneng paket sing muni internal mung sawetara taktik sing digunakake para penyerang kanggo nglewati. standard pertahanan. Tetep unggul saka ancaman kasebut mbutuhake luwih saka mung audit berkala, nanging uga mbutuhake pemantauan terus-terusan ing saben registri sing dadi andalan tim sampeyan.
Xygeni's Open Source Security Solusi iki mindhai lan mblokir paket-paket sing mbebayani ing titik publikasi, ing npm, PyPI, lan liya-liyane. Kanthi menehi prioritas kontekstual marang kerentanan sing nduweni risiko paling gedhe ing jagad nyata (lan nyepetake jalur remediasi kanggo tim DevSecOps sampeyan) Xygeni mbantu sampeyan njaga pangiriman piranti lunak sing aman lan dipercaya tanpa ngalangi pangembangan.
