Pūmanawa kino Npm i tēnei rā kei te whanake tonu, me te whakaputa a ngā kaiwhakaeke waehere kino, ngā mōkihi npm kino, a Ngā mōkihi kino PyPI i hangaia hei arotahi ki ngā rerengamahi whanaketanga, CI/CD pipelines, me ngā pūnaha rauropi tuwhera. Ko te Whakarāpopototanga Waehere Kino ko te pūrongo rangahau tonu a Xygeni e whai ana, e manatoko ana hoki i ngā mōkihi kino tūturu puta noa i npm, PyPI, Waehere VS, a OpenVSX, tae atu ki ngā tatau muri kua whakaūtia, ngā tahae raraunga, ngā kawenga tango tohu tuakiri, me ngā kaupapa pūmanawa maha-putanga aunoa.
Ka whakahōu tonu tā mātou tīma rangahau i tēnei whārangi me ngā kitenga kua whakamanahia, ngā tohu o te whakararuraru (IOC), ngā tauira whanonga, a tātari hangarau. Nō reira, ko ngā kaiwhakawhanake, Ngā tīma AppSec, ā, ka taea e ngā miihini haumarutanga te noho ki mua i te pūmanawa kino npm i tēnei rā me ngā mahi kino e puta ake ana mōkihi e pā ana ki ngā mekameka tuku pūmanawa hou.
Pūmanawa Kino NPM I Tēnei Rā: Whakarāpopototanga ā-Wiki 24–29 Paenga-whāwhā 2026
I whakaū ngā kairangahau 97 ngā mōkihi kino puta noa i ngā rēhita tūmatanui i tēnei wā.
Ngā kitenga huinga raraunga
- Ko te nuinga o ngā mōkihi kua whakaūtia i whakaputaina i roto i npm
- Ētahi atu kēhi kua pāngia PyPI, OpenVSX, a kaitito
- Te whakaputa kino i ngā whānau mōkihi kotahi me ngā ingoa e pā ana
- Ngā tauira putanga teitei, kāore rānei i te tino ōrite pērā i 99.x, 99.9.x, a 1.0.x
- Te whakamahinga kaha o utu me te utunga, enterprise-e tino, taupānga tukutuku ā-roto, tātaritanga, Te turanga o te UI, taputapu kaiwhakawhanake, kaupapa kapua, a e pā ana ki ngā wāhanga ngā tauira whakaingoa
- He maha ngā putanga kua whakaritea kia rite ki ngā whakahōunga mōkihi tika
Pūrongo Pūmanawa Kino o te Marama: Ngā Mōkihi npm Kino kua Whakaūtia i te Paenga-whāwhā 2026
Nau mai ki te putanga hou o te Whakarāpopototanga o te Waehere Kino a Xygeni (Putanga Marama), i roto i April 2026, i whakaūtia e tā mātou tīma rangahau neke atu i te 250 ngā mōkihi kino, puta noa i te nuinga npm, me ētahi atu kēhi e pā ana ki PyPI, VS Code, OpenVSX, me te Composer.
Ehara i te mea ko te nui anake te kaupapa o Āperira. ngā ngaru whakaputa e whakahaerehia ana e te aunoatanga, ngā kaupapa pikinga putanga kaha, te whakarōpūtanga whānau mōkihi, a te whakataruna taputapu ā-roto, i kitea e mātou ētahi o ngā tauira tino kitea o te marama i roto i ngā whakaputanga kino kua whakaritea puta noa i:
ngā taputapu ā-roto rūpahu, ngā mōkihi kaupapa AI, ngā kōwae utu me te utu, ngā kiritaki tātari, ngā wāhanga o mua, ngā taputapu kaiwhakawhanake, ngā taputapu Kubernetes me te kapua, ngā toronga VS Code me OpenVSX, me ngā ingoa mōkihi rite ki te waitohu pono i hangaia hei whakakotahi ki te tuku pūmanawa tūturu. pipelines.
Ehara i te mea he mahi patopato noa iho ēnei. I te whānuitanga whānui April huinga raraunga, i kitea e mātou ngā tauira tukino tohu, te whakahaere i te mekameka tuku, te whakamahi anō i te mokowā ingoa, a te whakaputa kino kua whakaritea kua hangaia kia hanumi ki ngā taiao kaiwhakawhanake tūturu me te tuku pūmanawa pipelines.
I haere tonu mātou ki te tirotiro i te whānuitanga o ngā huinga raraunga te whakaputanga putanga maha kua tuhia, ngā kaupapa putanga kua whakanuia, utu- me enterprisewhakaingoatanga kaupapa-kaupapa, Ngā ingoa mōkihi kaupapa AI me te kaupapa ā-kaiwhakahaere, Te whakahāngaitanga o te SDK me te wāhanga o mua, te whakatauira taputapu ā-roto, me ngā rautaki tawhito pērā i te te pōhēhētanga o te whakawhirinakitanga a te tango raraunga.
Ko tēnei pūrongo he wāhanga o tā mātou mahi tonu Whakarāpopototanga Waehere Kino, te wāhi e whakamanahia ai e mātou ngā tūmomo riri hou, ā, e whakarato ana hoki matauranga mahi kia awhinatia Ngā tīma DevSecOps noho ki mua i te mōrearea mekameka tuku pūmanawa.
| Te haukori | mōkī | Te rā |
|---|---|---|
| npm | tohu-pā:99.1.10 | Apr 27, 2026 |
| pīpi | moonbit-locale-hototahi:0.2.3 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.13 | Apr 27, 2026 |
| npm | @sbt_gitverse/analytics-client:99.0.1 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.33.1 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.14 | Apr 27, 2026 |
| npm | @tochka-ui/turanga:99.0.2 | Apr 27, 2026 |
| openvsx | arcane-spark/ubel:0.1.0 | Apr 28, 2026 |
| npm | @2011-08-19/n:99.9.9 | Apr 28, 2026 |
| npm | @frengki0707/google-cloud-clone:1.38.0 | Apr 27, 2026 |
Me pēhea tā mātou kimi i te waehere kino i roto i te pūmanawa kino npm me te pūmanawa kino PyPI
Ka whakamahia e Xygeni ngā tikanga maha-paparanga hei aukati i te waehere kino i mua i te horapa. Tuatahi, ka kitea e te tātari waehere tūmau ngā tauira whakapōrearea, ngā kawenga huna, me te tukino i te tuhinga. Hei tāpiri, ka tātarihia e te pouaka onepu whanonga te tāutanga hooks, ngā whakahau wā-oma, me ngā mahi tinihanga pumau. Hei tāpiri, ka tautuhia e te kimi ako mīhini ngā momo pūmanawa kino npm kore-rā me ngā pūmanawa kino pypi i ngaro i ngā matawai waitohu. Hei whakamutunga, ka aroturukihia e te Pūnaha Whakatūpato Moata ngā putunga tūmatanui i te wā tūturu, ka whakamana i ngā kitenga, ā, ka whakatūpato tonu i ngā tīma DevOps.
Nā tēnei huinga, ka whakarite kia whiwhi ngā kaiwhakawhanake i ngā mōhiohio tere, whai hua hoki kua whakauruhia tika ki roto CI/CD nga mahi mahi.
He aha ngā take me aro nui ai ngā kaiwhakawhanake ki ngā mōkihi npm kino
Kāore e roa ka tatari ngā tūmomo riri hou mō te wā whakahaere. Hei tauira, he maha ngā wā ka whakahaerehia ngā mōkihi npm kino i te wā tāutanga, engari ko ngā mōkihi kino pypi e huna ana i te putanga tohu, i ngā tatau muri rānei. Ngā Kaiwhakaeke:
- Tahurihia ngā putunga tūmataiti GitHub ki te tūmatanui hei tārua i a rātou.
- Wetewetehia ngā taipitopito tuakiri me ngā mea ngaro mā te whakamahi i ngā kawenga kua whakamunatia.
- Whakamahia ngā uta JavaScript kua huna hei whakatinana i te ransomware, i ngā whatunga karetao rānei.
Ina hoki, i piki ake ngā mōkihi pūmanawa tuwhera kino mā te 156% i roto i te tau kotahi. Nō reira, ka hinga ngā tīma e whakawhirinaki ana ki ngā whāngai whakaroa, ki ngā matawai taketake rānei ki muri.
Ngā mea e aroturukihia ana e tēnei Pūrongo Pūmanawa Kino i roto i te npm me te PyPI
Ko tēnei whakarāpopototanga te pokapū matua mō:
- Ngā mōkihi npm kino kua whakaūngia
- Ngā mōkihi kino pypi kua whakaūtia
- Te kimi i ngā waehere kino e hangai ana ki ngā whanonga
- Ngā aituā kua whakaūtia e te rēhita
- Ngā whakarāpopototanga o ngā pūrongo mō ngā pūmanawa kino ia wiki, ia marama hoki
- Te rārangi huringa hītori o ngā kitenga katoa o ngā pūmanawa kino npm me ngā pūmanawa kino pypi
Arā, he tohutoro kotahi tēnei. Ka whakahōu te tīma rangahau i Xygeni i tēnei whārangi ia wiki me ngā hononga ki ngā tātaritanga hangarau katoa me ngā IOC GitHub.
Me pēhea te tiaki i ngā mōkihi npm kino me te pūmanawa kino PyPI
Nā te tipu haere o tēnei mōrearea, me nui atu i ngā tirotiro whakawhirinakitanga taketake ngā mahi a ngā whakahaere. Ko ngā parenga kaha ki ngā mōkihi npm kino me ngā mōkihi kino pypi me whai mana ārai me te whakatinana i te wā whakahaere:
Whakaūtia ngā Tāutanga Lockfile-Anake ki ngā Mōkihi npm Kino
whakamahi npm ci or pip install --require-hashes in CI/CD.
Mā tēnei ka whakarite kia whakamahia te rākau whakawhirinakitanga tuturu i tautuhia i roto i ngā kōnae maukati. Nō reira, kāore e taea e ngā kaiwhakaeke te kuhu ki roto i ngā putanga kua whakarerekētia, kua hapa rānei o ngā mōkihi npm kino.
Te Matawai i mua i te Tāuta mō te Pūmanawa Kino npm me te Pūmanawa Kino PyPI
Whakauruhia te Mīhini Whakatūpato Moata a Xygeni hei matawai i ngā pūmanawa kino npm me ngā pūmanawa kino pypi i mua i te taenga atu o ngā mōkihi ki tō taiao.
Hei tāpiri, kitea ngā mea whakapae postinstall ngā tuhinga, ngā utauta huna, ngā URL C2 kua whakapūmautia rānei.
Guardrails hei Ārai i ngā Hanganga me te Waehere Kino
whakaturia guardrails Hei kore e angitu, ka hangaia aunoa mēnā ka kitea he mōkihi npm kino kua whakamanahia, he mōkihi pypi kino rānei.
Hei tauira, ka hangaia te pakaru i runga i ngā mōkihi me ngā kaitiaki kāore anō kia whakaputaina, ngā tauira huna, ngā taurite IOC rānei. Nō reira, kāore te waehere kino e ngaro atu i te tirohanga.
Whakaputa me te Whakamana SBOMs Ki ngā Mōkihi npm kino me te Pūmanawa Kino PyPI
Waihanga SBOMs (CycloneDX, SPDX) mō ia hanganga.
Muri iho, whakatairitea ki ngā mōkihi npm kino e mōhiotia ana me ngā whāngai pūmanawa kino pypi hei aroturuki i ngā whakawhirinakitanga tika me ngā whakawhirinakitanga whakawhiti.
Te Tiakitanga Tohu me te Token mai i te Malware npm me te Malware PyPI
He maha ngā mōkihi npm kino e ngana ana ki te pānui .npmrc, .pypirc, ngā taurangi taiao rānei.
Nō reira, whakahaerehia ngā hanganga i roto i ngā ipu whakapakeke me te iti o ngā mea ngaro e huraina ana. Hei tāpiri, whakamahia ngā kaiwhakahaere ngaro hei utu mō ngā taurangi taiao hei aukati i te tukinotanga waehere kino.
Aroturuki i ngā Huringa o te Rēhita me te Kaiwhakahaere i roto i ngā Mōkihi npm Kino
He maha ngā wā ka tahaetia e ngā kaiwhakaeke ngā kaupapa kua whakarērea.
Ina koa, kia tūpato ki ngā whakawhiti ohorere a te kaiwhakahaere, ngā peke putanga rerekē, ngā whakaputanga nui rawa rānei i roto i te pūmanawa kino npm me ngā mōkihi kino pypi.
Whakangungu Kaiwhakawhanake mō te Kimi i te Waehere Kino i roto i te npm me te PyPI
Whakaakona ngā tīma ki te kite i ngā haki whero pēnei i:
- Ngā ingoa mōkihi me ngā hapa tā (
reqeusthei utu mo orequest). - rerekē
installorpreparehōtuhi. - Ngā mōkihi i hangaia tata nei me ngā tau putanga teitei rawa pea.
Heoi anō, mā tēnei mōhiotanga ka kitea wawetia te waehere kino.
Te Kitenga i te Āhuatanga Wā-Oma mō ngā Mōkihi npm Kino me te Pūmanawa Kino PyPI
Ahakoa ka karohia e te pūmanawa kino ngā arowhai tūmau, ka kitea te wā whakahaere i roto i CI/CD ka taea te hopu:
- Ngā hononga whatunga ohorere.
- Ngā whakarerekētanga pūnaha kōnae i waho o ngā whaiaronga e tumanakohia ana.
- Ngā mahi u tonu puta noa i ngā mahi.
Hei whakamutunga, mā tēnei ka mutu ngā tūmomo pūmanawa kino npm me ngā tūmomo pūmanawa kino pypi ahakoa i muri i te tāutanga.
Mā te whakakotahi i ēnei mana whakahaere, ka ārai ngā tīma i ngā mōkihi npm kino me ngā mōkihi pypi kino kia kore rawa e tae ki te whakaputanga. pipelines.
Whakamātauria ngā Utauta Kimi Pūmanawa Kino a Xygeni
Ka tukuna e Xygeni:
- Te kimi wā-tūturu i ngā waehere kino, tae atu ki ngā tatau muri, ngā pūmanawa torotoro, me te pūmanawa utu-kore.
- He rerekē ki ngā matawai taketake, he rerekē te tātaritanga puta noa i te npm, PyPI, Maven, NuGet, RubyGems, me ētahi atu.
- Ārai hanga aunoa ina tautuhia te mōrearea e te pūrongo pūmanawa kino.
- Ngā māramatanga mō te whakamahinga kino, ngā arowhai ingoa o te kaiwhakahaere, me te kimi i ngā āhuatanga rerekē.
Noho Whakapuakihia
Ka whakahōu tā mātou tīma i tēnei whārangi i ia wiki. Hei whiwhi i ngā matohi me ngā pūrongo taipitopito:
- Ohauru ki to maatau Newsletter
- A pee i @XygeniSecurity i runga i a Linkedin
- Tohua tēnei whārangi hei whai i ngā mea hou pūmanawa kino npm a pūmanawa kino pypi paku
