Mwalandiridwa Kope la June la Xygeni Malicious Code DigestMwezi uno, gulu lathu lofufuza zachitetezo latsimikizira zambiri kuposa Maphukusi 645 oipa kudutsa npm, PyPI, ndi (kwa nthawi yoyamba) msika wowonjezera wa VSCode.
June idafotokozedwa ndi zochitika zitatu zomwe zimagwirizanitsidwa: ma kampeni opitilira kusefukira kwa mitundu omwe adapangidwa kuti apitirire mndandanda wa blocklists, kufulumira kwakukulu kwa ziwopsezo zomwe zimayang'ana kugwiritsa ntchito zida za AI ndi ntchito zopititsa patsogolo chitukuko, komanso kuukira kogwirizana kwa kudalirana motsutsana ndi malo osungira mayina amkati mwa monorepo.
Pakati pa kampeni zodziwika bwino zomwe zalembedwa mwezi uno:
- kukhudzidwa idadzaza ndi npm yokhala ndi mitundu yoposa 70 pamitundu yonse ya 2.5.x, kampeni yopitilizabe yopewera kufalitsanso mosalekeza kuti ikhale patsogolo pa kuchotsedwa.
- A kampeni ya Solana yolemba typosquat ya mawave awiri (June 7–8) adafalitsa maphukusi 15 otsanzira
@solana-labskugwiritsa ntchito zida za ecosystem, kulunjika mwachindunji kwa opanga Web3 ndi DeFi. - houzidawang806 adalemba mitundu yoposa 25 patsiku limodzi (June 13), ophatikizidwa ndi miyezo-pipeline-d8k2 inasindikizidwanso m'mabaibulo 21 pakati pa 15–18 Juni.
- The Kusokonezeka kwa CryptoDAO kampeni (June 17) inafalitsa ma phukusi 11 pa mtundu 99.99.99, lililonse lili ndi katundu wofanana woyikidwa pambuyo pokhazikitsa CI/CD zizindikiro, ziphaso za mtambo, ndi zinsinsi za chikwama cha crypto.
- Sabata ya June 20-26 inabweretsa cholinga chachikulu cha zida za AI mwezi uno: othandizira a ollama (Mabaibulo 20), othandizira-openai-agents (Mabaibulo 23), monoclaude, othandizira ai-sdkndipo @langgraphjs/zida, zonse zatsimikiziridwa mkati mwa sabata imodzi, zomwe zikuyang'ana mwachindunji Ollama, OpenAI agents SDK, LangGraph, ndi Claude API integrations.
- Awiri atsimikiziridwa zowonjezera za VSCode zoyipa idawonekera mwezi uno, zomwe zikusonyeza kuti owukira akukulirakulira kupitirira malo olembetsera ma phukusi kupita kumalo opanga mapulogalamu okha.
Kachitidwe kodziwika bwino ka mwezi wa June: ziwopsezo zikupitirira kukhala zowonjezera za IDE, zida za AI agent, ndi ntchito zogwirira ntchito komwe phukusi loipa lomwe limayikidwa palokha lilibe wowunikira pakati pa matenda ndi kuphedwa.
Zosintha za mwezi uliwonse izi ndi gawo la kafukufuku wa Xygeni wokhudza mapulogalamu a pulogalamu yaumbanda ndi zoopsa zogulira. Kuti mudziwe zambiri za phukusi lililonse la mapulogalamu oipa lomwe latsimikiziridwa mwezi uno, onani June Malicious Code Digest yonse ndi kafukufuku wokhudzana ndi izi kuchokera ku Xygeni Security Team.
Sabata Lachiwiri: Maphukusi Opitilira 201 Apezeka
| Makhalidwe | phukusi | Date |
|---|---|---|
| June 20, 2026 | ||
| npm | panrouter: 5.0.2 + Mabaibulo 30 pa 5.x–6.x amayambira pa 22 Juni — kampeni yayikulu kwambiri ya sabata ino | Jun 20, 2026 |
| npm | trimprompt:1.0.5 + Mabaibulo 4 — kupitiriza kwa sabata yapitayi, akadali kugwira ntchito | Jun 20, 2026 |
| npm | monoclaude:1.0.1 + Mabaibulo awiri — Claude API tooling sessionate | Jun 20, 2026 |
| vs kodi | mapulogalamu-a-orbit-agent-pair-programming-for-smalltalk:1.206.0 + Mtundu umodzi — chiwonjezeko cha VSCode choipa chomwe chikuyang'ana chitukuko cha othandizira | Jun 20, 2026 |
| npm | simplisafe-gatsby:1.0.1 Kutsanzira malo osungira mayina a nsanja yanzeru ya nyumba | Jun 20, 2026 |
| June 21, 2026 | ||
| npm | atlasora-shared:1.0.0 + ma phukusi 6 — chisokonezo chogwirizana cha monorepo dependency: atlasora-api, -client, -sdk, -types, -utils, -config | Jun 21, 2026 |
| npm | chithunzi cha apintergration:4.0.2 + Mabaibulo 6 — kugwiritsa ntchito njira yolakwika yolembera kampeni pofuna kulumikiza zida | Jun 21, 2026 |
| npm | llm-traces-app:1.0.1 Zida zowonera za LLM zomwe zimayang'aniridwa | Jun 21, 2026 |
| pypi | d0rk3r-telemetry:1.0.0 Phukusi la telemetry lobisika mu PyPI | Jun 21, 2026 |
| June 22, 2026 | ||
| pypi | tm-ai:2.91.75 + Mabaibulo 7 — kampeni yopitilira ya kusefukira kwa madzi ya mtundu wa PyPI | Jun 22, 2026 |
| pypi | pempho-cache-py:1.0.4 + Mabaibulo 6 — Mabaibulo a PyPI odzaza ndi madzi | Jun 22, 2026 |
| pypi | corvinos:0.17.0 + Mabaibulo 6 — Kampeni yolembetsa anthu ambiri ya PyPI | Jun 22, 2026 |
| June 23, 2026 | ||
| npm | wothandizira-token-web3:1.1.1 + Mabaibulo awiri — Web3 token utility targeting | Jun 23, 2026 |
| npm | mtanda umodzi:1.0.1 + Mtundu 1 — gulu la mayina la mono-* pamodzi ndi monoclaude ndi monotacos | Jun 23, 2026 |
| June 24, 2026 | ||
| npm | othandizira a ollama:0.1.0 + Mitundu 19 — kampeni yayikulu kwambiri yogwiritsira ntchito zida za AI ya mwezi uno, yolunjika ku nthawi yogwiritsira ntchito AI ya Ollama | Jun 24, 2026 |
| npm | othandizira-openai:0.1.1 + Mabaibulo 22 — kampeni yolumikizidwa yolunjika kuzinthu zachilengedwe za OpenAI agents SDK | Jun 24, 2026 |
| June 25, 2026 | ||
| npm | othandizira ai-sdk:1.4.3 Zida za AI SDK zikuyang'aniridwa pamodzi ndi @langgraphjs/toolkit:1.2.11 | Jun 25, 2026 |
| npm | kulembetsa-kuyika: 99.99.99-poc3 + hs-locale-management — Kusokonezeka kwa malo osungiramo mayina amkati mwa HubSpot, poc suffix ikutsimikizira kampeni yofufuza yogwira ntchito | Jun 25, 2026 |
| June 26, 2026 | ||
| npm | zida zosavuta kugwiritsa ntchito:1.0.1 + Mabaibulo 8 kuphatikiza mitundu yosiyanasiyana ya easy-string-kit232 — kulembetsa kwakukulu pansi pa dzina la generic utility | Jun 26, 2026 |
| npm | phukusi losatetezeka-loipa:1.0.0 + Mabaibulo 5 — phukusi lotchulidwa momveka bwino kuti ndi loipa, lotsimikizika kuti lili ndi katundu wolipidwa, mwina loyesa kapena loyambitsa kampeni | Jun 26, 2026 |
| npm | @vpms/design-system:1.1.2 + Mabaibulo awiri — njira yopangira malo osungira mayina a makina | Jun 26, 2026 |
Sabata Lachiwiri: Maphukusi Opitilira 200 Apezeka
| Makhalidwe | phukusi | Date |
|---|---|---|
| June 13, 2026 | ||
| npm | houzidawang806:1.0.0 + Mabaibulo 25 pa 1.0.x–1.2.x kuphatikiza abale ndi alongo houzidawang807 ndi houzidawang808 — kampeni yayikulu ya sabata ino | Jun 13, 2026 |
| npm | chiwonetsero cha moni wochezeka:1.0.2 + Mabaibulo 4 — kampeni yopitilira ikuonekeranso kwa masiku angapo | Jun 13, 2026 |
| npm | tsc-ai:1.2.0 tsc-* gulu: tsc-ai, tsc-mesh, tsc-lotl — CI tooling namespace kutsanzira | Jun 13, 2026 |
| pypi | neuralbridge-sdk:4.5.4 + Mabaibulo 6 pa 4.5.x–5.1.x — kampeni ya PyPI ya masiku ambiri yopitilira | Jun 13, 2026 |
| June 15, 2026 | ||
| npm | mitengo ya token-cron:999.0.0 + Maphukusi 6 — Gulu la chisokonezo chodalira zomangamanga za DeFi lomwe limayang'ana kwambiri cron yamkati ndi zida za vault | Jun 15, 2026 |
| June 16, 2026 | ||
| npm | bodega-sdk:9.9.9 + Maphukusi 8 — DeFi lending ndi Cardano ecosystem cluster: flow-lending, surf-lending, janus-*, flowcardano, flowdefi | Jun 16, 2026 |
| npm | zoyezera zochitika-q3x7:1.0.0 + Mabaibulo 8 — phukusi la hex-suffix lodziwika bwino lolembetsa mayina okhala ndi mutu wowunikira zambiri | Jun 16, 2026 |
| npm | nic-datagov:1.0.0 + ma phukusi atatu — malo osungira deta a boma: ogd-analytics, ogd-platform, dms-backend | Jun 16, 2026 |
| June 17, 2026 | ||
| npm | mapangano a cryptodao:99.99.99 + Ma phukusi 10 — Kusokonezeka kwa kudalira kwa CryptoDAO: core, sdk, bot, config, utils, deploy, signer, backend, types | Jun 17, 2026 |
| pypi | teambot-ai:1.48.0 Kugwiritsa ntchito zida za AI mu PyPI | Jun 17, 2026 |
| June 18, 2026 | ||
| npm | miyezo-pipeline-d8k2:1.0.0 + Mabaibulo 20 pa 18 Juni — kampeni yopitilizabe yopewa kufalitsa nkhani tsiku limodzi, kusindikizanso mosalekeza kuti ipitirire mndandanda wa blocklists | Jun 18, 2026 |
| npm | jambulani yokha: 0.4.5 + Mabaibulo 6 — kampeni yokhudza kusefukira kwa madzi | Jun 18, 2026 |
| npm | mitundu-ya-zothandizira-dee0:1.0.0 + Ma phukusi 5 a hex-suffix: data-utils, string-tools, type-check, fmt-helpers, metrics-probe — scripted bulk registration | Jun 18, 2026 |
| npm | @azure-lab-services/ml-ts:99.0.0 Kutsanzira malo a dzina la Azure ML | Jun 18, 2026 |
| June 19, 2026 | ||
| npm | trimprompt:1.0.2 + trimprompt-hub — zida zamakono zowunikira mwachangu | Jun 19, 2026 |
| npm | chikho cha claude:0.8.6 Kutsanzira Claude API tooling | Jun 19, 2026 |
| pypi | aiaddin-agent:0.1.0 Kugwiritsa ntchito zida za AI mu PyPI | Jun 19, 2026 |
| npm | zida za web3-crypto-address:0.1.0 Kuyang'anira mautumiki a Web3 | Jun 19, 2026 |
Sabata Lachiwiri: Maphukusi Opitilira 135 Apezeka
| Makhalidwe | phukusi | Date |
|---|---|---|
| June 7, 2026 | ||
| npm | @solana-labs/web3.js:1.0.0 + Mitundu 5 — kampeni ya Solana ecosystem typosquat, mafunde oyamba | Jun 7, 2026 |
| npm | @jisan901/teamfocus:1.0.0 + Mabaibulo awiri | Jun 7, 2026 |
| npm | @sflyinc-knapsack/shutterfly-react:999.0.0 Kusokonezeka kwa kudalira, mtundu wodzaza | Jun 7, 2026 |
| June 8, 2026 | ||
| npm | @solana-labs/web3.js:1.98.102 + Mitundu 9 — kampeni ya Solana ecosystem typosquat, wave yachiwiri | Jun 8, 2026 |
| pypi | helixagentai:0.1.3 Kugwiritsa ntchito zida za AI mu PyPI | Jun 8, 2026 |
| June 9, 2026 | ||
| npm | @nstrlabs/sdk:99.0.0 + ma phukusi 7 — chisokonezo chodalira motsutsana ndi malo amkati a monorepo | Jun 9, 2026 |
| npm | @klapp-login-pulatifomu/native-sdk:99.0.0 + Ma phukusi 9 — kutsanzira nsanja yotsimikizira m'malo angapo a mayina a klapp | Jun 9, 2026 |
| npm | blockchain-helper-0:1.0.0 + Ma phukusi 7 — gulu la mautumiki a crypto/DeFi likuyang'ana opanga mapulogalamu a Web3 | Jun 9, 2026 |
| npm | @khadi-pci-data/sitolo:99.0.0 Malo osungira dzina la khadi lolipira | Jun 9, 2026 |
| June 10, 2026 | ||
| npm | dongosolo-la-kapangidwe ka morningstar:99.0.0 + Mabaibulo awiri — kutsanzira dongosolo la kapangidwe ka ndalama | Jun 10, 2026 |
| June 11, 2026 | ||
| npm | pocteszep:1.0.1 + Mabaibulo 5 ofalitsidwa tsiku lomwelo | Jun 11, 2026 |
| npm | @coze-common/malo ochezera:99.1.1 Kutsanzira malo ochezera a pa intaneti a AI | Jun 11, 2026 |
| pypi | telegramlite:1.0.0 + 1 mtundu — njira yotsanzira nsanja yotumizira mauthenga mu PyPI | Jun 11, 2026 |
| June 12, 2026 | ||
| npm | ecto-corsair-whisper-6f3b9:1.0.18 + mitundu 7 ya ecto-* — gulu la mayina obisika | Jun 12, 2026 |
| npm | internallib_v984:1.0.3 + gulu la internallib_v557 — mitundu 13 ya anthu onyenga a m'laibulale yamkati | Jun 12, 2026 |
| npm | ulendo-webusaiti:999.0.0 Kusokonezeka kwa kudalira, mtundu wodzaza | Jun 12, 2026 |
| pypi | cdjeez:0.32.0 | Jun 12, 2026 |
Sabata Lachiwiri: Maphukusi Opitilira 118 Apezeka
| Makhalidwe | phukusi | Date |
|---|---|---|
| Mwina 30, 2026 | ||
| npm | @cloudplatform-single-spa/administration:99.99.100 Kusokonezeka kwa kudalira, mtundu wodzaza | Mwina 30, 2026 |
| vs kodi | xampp-manager:5.1.3 Kukulitsa kwa VSCode — kutsanzira chida chopangira mapulogalamu | Mwina 30, 2026 |
| June 1, 2026 | ||
| npm | @tse-digital/core:99.0.0 Kusokonezeka kwa kudalira — @telenor-se ndi @ownit nawonso akhudzidwa | Jun 1, 2026 |
| npm | cms-storehub:1.3.4 + Mabaibulo awiri, gulu la malo osungira mayina a CMS | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.69 + Mabaibulo 6, manambala a mitundu yochulukitsidwa omwe akuyang'ana ziyeneretso za AWS | Jun 1, 2026 |
| npm | zikalata za odwala: 75.0.0 Cholinga cha malo osungira mayina azaumoyo | Jun 1, 2026 |
| npm | @emcd-vue/auth:6.4.9 Kusinthana kwa malo a crypto | Jun 1, 2026 |
| pypi | simtooreal-cli:0.3.0 | Jun 1, 2026 |
| June 2, 2026 | ||
| npm | kukhudzidwa: 2.5.8 + Mabaibulo 70 pa 2.5.x range, Juni 2–5 — kampeni yayikulu ya nthawiyo | Jun 2, 2026 |
| npm | @langgraphjs/zida:1.2.10 Kuyang'ana kwambiri zida za LangGraph | Jun 2, 2026 |
| June 4, 2026 | ||
| npm | @sentry-browser-sdk/profiling-node:1.0.1 + Mabaibulo awiri, kutsanzira malo osungira dzina a Sentry | Jun 4, 2026 |
| npm | internallib_v346:1.0.3 + Mabaibulo awiri, wonyenga wa laibulale yamkati | Jun 4, 2026 |
| npm | othandizira ai-sdk:0.2.1 + Mabaibulo 7, olunjika ku zida za AI SDK | Jun 4, 2026 |
Siyani Khodi Yoyipa Isanafike Pakhomo Lanu Pipeline
Ziwopsezo za unyolo wopereka mapulogalamu zapita patsogolo kwambiri kuposa zomwe anthu amaganiza. Ziwopsezo za chisokonezo, kuba ziphaso, pulogalamu yaumbanda yolumikizidwa ndi AI, ndi zida zopangira mapulogalamu zomwe zili ndi poizoni zikukhudza magulu enieni. SDLCs sabata iliyonse.
Xygeni's kuzindikira pulogalamu yaumbanda ndi nsanja yachitetezo cha unyolo woperekera zinthu Zimapatsa mabungwe mwayi woti agwire zinthu zoipa asanagwiritse ntchito makina opanga mapulogalamu, kulowa mu dongosolo lomanga, kapena kufika pakupanga. Kuphimba kumaphatikizapo npm, PyPI, VSCode, ndi zina zotero, kuyang'anira njira zokayikitsa zofalitsa, kugwiritsa ntchito molakwika malo osungiramo mawu, kulemba mawu, ndi njira zowukira za AI pamene zikutuluka.
Kupeza kulikonse kumangoyang'aniridwa ndi momwe bizinesi yanu ingagwiritsire ntchito, momwe ingafikire anthu ambiri, komanso momwe bizinesi yanu ingakhudzire, kotero gulu lanu limayang'ana kwambiri zomwe zikufunika kukonzedwa, osati phokoso.
Kaya ndi phukusi lotseguka loipa, chida chopangidwa ndi opanga mapulogalamu omwe ali ndi vuto, kapena chiopsezo cha ma code opangidwa ndi AI, Xygeni imasunga magulu achitetezo ndi mainjiniya patsogolo kwambiri kuposa momwe zinthu zilili ndi chiopsezo cha unyolo wogulitsa.
Fufuzani phukusi lililonse loipa ndi kampeni yovomerezeka ndi Xygeni Security Team mu Chidule cha Ma Code Oyipa.
Khalani otetezeka. Khalani othamanga. Khalani olamulira ndi Xygeni.
