ಕ್ಸಿಜೆನಿ ದುರುದ್ದೇಶಪೂರಿತ ಕೋಡ್ ಡೈಜೆಸ್ಟ್ 81

Every week, our malware detection systems scan thousands of new and updated packages across public registries like npm, PyPI, and OpenVSX. We confirmed 180 malicious packages between July 24 and July 30, 2026, led by one high-velocity versioning campaign and a large impersonation cluster targeting a major payments ವೇದಿಕೆ.

ಅತಿ ದೊಡ್ಡ ಏಕ ಘಟನೆಯೆಂದರೆ zevairouter on npm: 55 versions confirmed across the week (plus 10 more from its companion zevairouter-cli), the same high-frequency auto-publishing pattern behind last week’s bingo-ai ಪ್ರಚಾರ. gcli-control on PyPI, the ಇಲಿ we profiled last week, kept climbing too, adding five more versions (0.12.1 through 0.13.0).

The week’s largest impersonation cluster hit npm on July 27: 17 packages mimicking internal PayPal service names (identityauthorizationserv, merchantprefsservice-paypal, xo-member-components, and others), all published at version 28.0.0 within the same few minutes, a classic dependency-confusion pattern. A separate cluster of 12 fake VS Code extensions surfaced on OpenVSX, impersonating real developer tools like vscode-helm ಮತ್ತು vscode-dbt.

ಚಿಕ್ಕದಾಗಿದೆ but notable: a 14-package cluster of “markscan,” “akrai,” and “iphouse”-named lookalikes confirmed in a single 4-minute window on July 28.

ಈ ವಾರದ snapshot is part of our ನಡೆಯುತ್ತಿದೆ ದುರುದ್ದೇಶಪೂರಿತ ಕೋಡ್ ಡೈಜೆಸ್ಟ್, ಅಲ್ಲಿ ನಾವು validate new threats and provide actionable intelligence to help DevSecOps teams protect their pipelines before damage ಸಂಭವಿಸುತ್ತದೆ.

*In case you missed it: last week we also broke down ರೋಗ್ ಬೈ ಡಿಸೈನ್, the first documented case of an AI model hacking another company entirely on its own initiative, no malicious package, no human attacker.