Chidule cha Mwezi uliwonse cha Malicious Code Digest: Meyi

Takulandirani ku kope la Xygeni Malicious Code Digest la mu Meyi. Mwezi uno, gulu lathu lofufuza zachitetezo likupitilizabe kutsatira momwe zinthu zikuyendera pakusintha kwa ziwopsezo za unyolo wa mapulogalamu m'ma registry a anthu onse, zida zopangira mapulogalamu, ntchito zothandizidwa ndi AI, komanso zamakono. CI/CD Mu Meyi yonse, Xygeni idazindikira ndikutsimikizira mazana ambiri a ma phukusi oyipa omwe akuyang'ana npm, PyPI, VS Code, ndi OpenVSX ecosystems.

Koma mwezi wa May sunali wokhudza kuchuluka kokha. Unalinso mwezi womwe owukira adasinthiratu luso lawo kuti ligwirizane ndi malo obadwira a chitukuko cha AI, malingaliro a oyambitsa mapulogalamu, komanso odzipangira okha. pipelines.

Pakati pa kafukufuku wodziwika bwino wofalitsidwa ndi Xygeni Security Team mwezi uno:

• JulesJacker, kampeni ya mapulogalamu a pa intaneti ya npm yomwe imayesa wothandizira wa Google wa Jules AI kuti aba malo osungiramo zinthu, kugwiritsa ntchito molakwika CI/CD malo, ndipo ngakhale kuyang'ana bokosi la mchenga lomwe linkawunika. Kampeniyo inayambitsa ma loaders otetezedwa ndi host, opangidwa mwaluso google-labs-jules[bot] commits, kuba kwa metadata ya mitambo, ndi kufufuza kwa Kubernetes motsutsana ndi zomangamanga zowunikira zokha.
• PhantomBot, kampeni yoipa ya npm yomwe ikugwiritsa ntchito molakwika chikwama chabodza, blockchain, ndi zida za Web3 kuti iba ziphaso, kusokoneza malo opanga mapulogalamu, ndikulunjika ku ntchito zokhudzana ndi crypto kudzera mukugwiritsa ntchito molakwika kudalira komanso kutumiza katundu wolipidwa m'njira yokhazikika.
• Dongosolo lalikulu la npm lomwe limagwiritsa ntchito zinthu zabodza za TypeScript, ma phukusi okhala ndi mutu wa AI, kutsanzira zida zamkati, malaibulale a frontend, othandizira pamtambo, ndi ma builder frameworks kuti apeze zala, kutulutsa ziphaso, kugwiritsa ntchito nthawi zonse, ndikuyika machitidwe opanga mapulogalamu pamavuto.
• Mafunde opitilira a maphukusi oipa omwe amabweretsa chisokonezo chodalira, kulemba mawu molakwika, kugwiritsa ntchito molakwika pambuyo pokhazikitsa, kutsanzira zida za AI, kukwera kwa mtundu, ndi kugwiritsa ntchito molakwika malo osungira mayina mobwerezabwereza komwe cholinga chake ndi kupewa kudalira kwa akatswiri opanga mapulogalamu ndikusokoneza zamakono. SDLC ntchito zisanadziwike.
• Kupezeka kwa ma kampeni a pulogalamu yaumbanda yogwiritsa ntchito nsanja zosiyanasiyana monga @jaggle/resizeobserves hijacker wa clipboard, yemwe adayesa phukusi lovomerezeka pomwe akugwiritsa ntchito Python-based persistence ndi crypto-wallet clipboard m'malo mwa Linux, macOS, ndi Windows systems.

M'mwezi wonsewu, tinaonanso kugwirizana kwakukulu pakati pa kugwiritsa ntchito zida za AI, zachilengedwe zotseguka, ndi kuukira kwa mapulogalamu. Anthu omwe akuwopseza adayang'ana kwambiri ntchito zopititsa patsogolo ntchito zothandizidwa ndi AI, malo ogwirira ntchito, oyendetsa ndege, ndi zomangamanga zomwe zimapezeka mumtambo. pipelinemonga gawo la ntchito zazikulu za kuba ziphaso ndi kusokoneza malo osungiramo zinthu.

Ziwopsezo izi sizilinso nkhani zodziwika bwino za kulemba mawu. Zimaphatikizapo ma kampeni ofalitsa ogwirizana, kuphulika kwa mabaibulo odziyimira pawokha, kuba ma tokeni a pa intaneti, CI/CD kugwiritsa ntchito molakwika, kusunga zinthu zobisika, kupewa kugwiritsa ntchito zinthu zosafunikira, ndi njira zopitilira zochitira zinthu mopanda tsankho zomwe zimapangidwa kuti zigwirizane ndi njira zodalirika zoyendetsera mapulogalamu.

Zosintha za mwezi uliwonse izi ndi gawo la kafukufuku wa Xygeni wokhudza mapulogalamu a pulogalamu yaumbanda ndi ziwopsezo za unyolo wogulira, komwe gulu lathu limapitiliza kutsimikizira ma phukusi oipa, kufufuza njira zatsopano zowukira, ndikufalitsa nzeru zothandiza chitetezo, magulu a AppSec, ndi DevSecOps kuti akhale patsogolo pa chiopsezo cha unyolo wogulira.

Kuti mudziwe zambiri zokhudza phukusi lililonse loipa, kampeni ya pulogalamu yaumbanda, ndi kusanthula ziwopsezo zomwe zafalitsidwa mwezi uno, fufuzani May Malicious Code Digest yonse ndi kafukufuku wofanana ndi umenewu kuchokera ku Xygeni Security Team.