Pulogalamu yaumbanda ya Npm lero ikupitirirabe kusintha, ndi owukira akufalitsa khodi yoipa, mapaketi a npm oipandipo Ma phukusi oipa a PyPI yopangidwa kuti ikwaniritse ntchito zopititsa patsogolo chitukuko, CI/CD pipelines, ndi zachilengedwe zomwe zimapezeka mosavuta. Chidule cha Ma Code Oyipa ndi lipoti la kafukufuku lomwe Xygeni ikupitilira lomwe limatsata ndikutsimikizira ma phukusi enieni oyipa kudutsa npm, PyPI, Code la VSndipo OpenVSX, kuphatikizapo kutsimikizira kuti pali anthu obisala kumbuyo, kuba deta, kufalitsa ma credit exfiltration payloads, ndi ma multi-version malware campaigns odzichitira okha.
Gulu lathu lofufuza limasintha tsamba lino nthawi zonse ndi zomwe zapezeka zotsimikizika, zizindikiro za mgwirizano (IOCs), machitidwendipo kusanthula lusoZotsatira zake, opanga mapulogalamu, Magulu a AppSecndipo mainjiniya achitetezo akhoza kukhala patsogolo pa pulogalamu yaumbanda ya npm lero ndi zochitika zatsopano za phukusi loipa zomwe zikukhudza maunyolo amakono operekera mapulogalamu.
NPM Malware Lero: Chidule cha Sabata 24–29 Epulo 2026
Ofufuza atsimikizira Maphukusi 97 oipa m'malo olembetsera anthu onse m'nthawi ino.
Kuwona kwa deta
- Maphukusi ambiri otsimikizika adasindikizidwa mu npm
- Milandu ina yomwe yakhudzidwa PyPI, OpenVSXndipo Wopeka
- Kufalitsa nkhani zoipa mobwerezabwereza m'mabanja omwewo a phukusi ndi mayina ena ofanana nawo
- Maonekedwe apamwamba kapena osazolowereka monga 99.x, 99.9.xndipo 1.0.x
- Kugwiritsa ntchito mwamphamvu kulipira ndi kulipira, enterprise-style, pulogalamu yapaintaneti, analytics, Maziko a UI, chida chopangira mapulogalamu, yokhala ndi mutu wa mtambondipo zokhudzana ndi zigawo kutchula mayina
- Ma bursts angapo ogwirizana omwe adapangidwa kuti agwirizane ndi zosintha zovomerezeka za phukusi
Onani lipoti lonse la pulogalamu yaumbanda ya sabata iliyonse →
Lipoti la Mwezi Wonse la Malware: Maphukusi Otsimikizika a npm Oyipa mu Epulo 2026
Takulandirani ku kope laposachedwa la Xygeni Malicious Code Digest (Kope la Mwezi uliwonse), mu April 2026, gulu lathu lofufuza latsimikizira ma phukusi opitilira 250 oyipa, makamaka kudutsa npm, ndi milandu ina yomwe imakhudza PyPI, VS Code, OpenVSX, ndi Wolemba.
Epulo sanali wokhudza kuchuluka kwa zinthu zokha. mafunde ofalitsa oyendetsedwa ndi automation, kampeni yokhudza kukwera kwa mitengo mwankhanza, kusonkhanitsa mabanja a phukusindipo kutsanzira chida chamkati, tawona zina mwa njira zodziwika bwino kwambiri mwezi uno mu kufalitsa kogwirizana kwa njiru m'magawo onse:
zida zabodza zamkati, ma phukusi okhala ndi mutu wa AI, ma module olipira ndi olipira, makasitomala owunikira, zigawo za frontend, zida zopangira mapulogalamu, zida za Kubernetes ndi cloud, zowonjezera za VS Code ndi OpenVSX, ndi mayina odalirika a ma phukusi omwe adapangidwa kuti agwirizane ndi kutumiza mapulogalamu enieni. pipelines.
Izi sizinali zochitika zophweka zolembera. April deta, tinaona njira zogwiritsira ntchito molakwika ziphaso, kusintha kwa unyolo woperekera zinthu, kugwiritsanso ntchito malo osungira mayina mobwerezabwerezandipo kufalitsa kolakwika kogwirizana yopangidwa kuti igwirizane ndi malo enieni opanga mapulogalamu ndi kuperekedwa kwa mapulogalamu pipelines.
Kudzera mu deta yonse, tinapitiriza kuona kusindikiza kwamitundu yambiri kolembedwa, njira zowonjezerera mitundu, malipiro ndi enterprise- mayina a mutu, Mayina a phukusi okhala ndi mutu wa AI ndi agent, SDK ndi kutsanzira kwa gawo la frontend, kutsanzira zida zamkati, ndi njira zakale monga chisokonezo chodalira ndi kuchotsera deta.
Lipotili ndi gawo la zomwe tikupitiliza kuchita Chidule cha Ma Code Oyipa, komwe timatsimikizira ziwopsezo zatsopano ndikupereka luntha lotheka kuchita kuthandiza Magulu a DevSecOps khalani patsogolo pa chiopsezo cha unyolo woperekera mapulogalamu.
| Makhalidwe | phukusi | Date |
|---|---|---|
| npm | chizindikiro cha pa:99.1.10 | Apr 27, 2026 |
| pypi | moonbit-locale-compat:0.2.3 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.13 | Apr 27, 2026 |
| npm | @sbt_gitverse/kasitomala-wakusanthula:99.0.1 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.33.1 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.14 | Apr 27, 2026 |
| npm | @tochka-ui/foundation:99.0.2 | Apr 27, 2026 |
| openvsx | arcane-spark/ubel:0.1.0 | Apr 28, 2026 |
| npm | @2011-08-19/n:99.9.9 | Apr 28, 2026 |
| npm | @frengki0707/google-cloud-clone:1.38.0 | Apr 27, 2026 |
Momwe Timapezera Khodi Yoyipa mu npm Malware ndi PyPI Malware
Xygeni imagwiritsa ntchito njira zambiri zoletsa ma code oipa asanayambe kufalikira. Choyamba, kusanthula ma code osasinthika kumazindikira mawonekedwe obisika, zolipira zobisika, ndi kugwiritsa ntchito molakwika ma script. Kuphatikiza apo, kusanthula kwa sandboxing ya khalidwe kumayika hooks, malamulo a nthawi yogwiritsira ntchito, ndi machenjerero opitilira. Kuphatikiza apo, kuzindikira makina ophunzirira kumazindikira mitundu ya pulogalamu yaumbanda ya npm ya zero-day ndi pypi malware yomwe siigwiritsidwa ntchito ndi ma signature scanners. Pomaliza, Early Warning System imayang'anira malo osungira anthu nthawi yeniyeni, kutsimikizira zomwe zapezeka, ndikuchenjeza magulu a DevOps nthawi yomweyo.
Zotsatira zake, kuphatikiza kumeneku kumatsimikizira kuti opanga mapulogalamu amalandira nzeru zachangu komanso zogwira ntchito zomwe zimaphatikizidwa mwachindunji mu CI/CD kugwira ntchito.
Chifukwa Chake Opanga Mapulogalamu Ayenera Kusamala ndi Ma Package Oyipa a npm
Ziwopsezo zamakono sizimayembekezera nthawi yogwirira ntchito. Mwachitsanzo, ma phukusi a npm oopsa nthawi zambiri amachitidwa panthawi yokhazikitsa, pomwe ma phukusi a pypi oopsa amabisa kutuluka kwa ma token kapena zitseko zakumbuyo. Owukira:
- Sinthani ma repo achinsinsi a GitHub kukhala a anthu onse kuti muwakopenso.
- Tulutsani ziphaso ndi zinsinsi pogwiritsa ntchito zolipira zobisika.
- Gwiritsani ntchito zida zosungira za JavaScript zobisika kuti mugwiritse ntchito ransomware kapena botnets.
Ndipotu, ma phukusi otseguka owopsa adakwera ndi 156% m'chaka chimodzi. Chifukwa chake, magulu omwe amadalira ma feed ochedwa kapena ma scanner oyambira amatsalira.
Zimene Lipoti la Malware Ili Likutsata mu npm ndi PyPI
Kuwerenga uku ndiye maziko a:
- Ma phukusi a npm otsimikizika
- Ma phukusi otsimikizika a pypi owopsa
- Kuzindikira ma code oyipa pogwiritsa ntchito khalidwe
- Zochitika zotsimikiziridwa ndi kaundula
- Chidule cha malipoti a pulogalamu yaumbanda ya mlungu ndi mlungu komanso mwezi uliwonse
- Kusintha kwa mbiri yakale kwa zomwe zapezeka pa pulogalamu yaumbanda ya npm ndi pulogalamu yaumbanda ya pypi
Mwa kuyankhula kwina, imapereka mfundo imodzi yokha yofotokozera. Gulu lofufuza ku Xygeni limasintha tsamba lino sabata iliyonse ndi maulalo opita ku kusanthula kwathunthu kwaukadaulo ndi ma IOC a GitHub.
Momwe Mungatetezere ku Mapaketi Oyipa a npm ndi Malware a PyPI
Chifukwa cha chiopsezo chomwe chikukulirakulirachi, mabungwe amafunikira zambiri kuposa kungoyang'ana kudalira kwawo. Chitetezo champhamvu ku ma phukusi oipa a npm ndi ma phukusi oipa a pypi chimafuna njira zodzitetezera komanso kutsata malamulo ogwiritsira ntchito nthawi yogwiritsira ntchito:
Konzani Kukhazikitsa kwa Lockfile-Kokha Polimbana ndi Ma Packages a Npm Oyipa
ntchito npm ci or pip install --require-hashes in CI/CD.
Izi zikutsimikizira kuti mtengo weniweni wodalira womwe wafotokozedwa mu ma lockfiles ukugwiritsidwa ntchito. Zotsatira zake, owukira sangalowe m'mitundu yosinthidwa kapena yolembedwa ya mapaketi oipa a npm.
Kuyika Kusanthula Pasadakhale kwa NPM Malware ndi PyPI Malware
Phatikizani Xygeni's Early Warning Engine kuti mufufuze mapulogalamu a npm malware ndi mapulogalamu a pypi musanafikire malo anu.
Komanso, pezani zokayikitsa postinstall zolemba, zoyika zobisika, kapena ma URL a C2 okhazikika.
Guardrails Kuletsa Zomanga ndi Khodi Yoyipa
Khalani guardrails kulephera kumanga zokha ngati ma phukusi otsimikizika a npm oipa kapena ma phukusi olakwika a pypi apezeka.
Mwachitsanzo, kusweka kumapangidwa pamaphukusi okhala ndi ma maintainer osasindikizidwa, ma obfuscation patterns, kapena ma IOC matches. Chifukwa chake, ma code oipa sapita osadziwika.
Pangani ndi Kutsimikizira SBOMs Against Malicious npm Packages ndi PyPI Malware
Pangani SBOMs (CycloneDX, SPDX) pa kapangidwe kalikonse.
Pambuyo pake, yerekezerani ndi ma phukusi odziwika bwino a npm ndi ma pypi malware feeds kuti mutsatire kudalira mwachindunji komanso kosinthika.
Chitetezo cha Chitsimikizo ndi Chizindikiro ku npm Malware ndi PyPI Malware
Maphukusi ambiri oipa a npm amayesa kuwerenga .npmrc, .pypirc, kapena zinthu zosinthika zachilengedwe.
Chifukwa chake, yendetsani zomangira m'mabokosi olimba omwe zinsinsi zochepa zimawululidwa. Kuphatikiza apo, gwiritsani ntchito oyang'anira zinsinsi m'malo mwa zosintha zachilengedwe kuti muletse kugwiritsa ntchito molakwika ma code oyipa.
Yang'anirani Kusintha kwa Registry ndi Maintainer mu Malicious npm Packages
Owukira nthawi zambiri amaba mapulojekiti omwe atsala.
Makamaka, yang'anirani kusinthana kwadzidzidzi kwa ma maintainer, kusinthasintha kwachilendo kwa ma version, kapena kufalitsa mopitirira muyeso mu npm malware ndi pypi maniace package.
Maphunziro a Opanga Mapulogalamu pa Kuzindikira Khodi Yoyipa mu npm ndi PyPI
Phunzitsani magulu kuti azindikire zizindikiro zofiira monga:
- Mayina a phukusi okhala ndi zolakwika zolembedwa (
reqeustm'malo mwarequest). - zachilendo
installorpreparezolemba. - Ma phukusi omwe apangidwa posachedwapa omwe ali ndi manambala ambiri okayikitsa.
Koposa zonse, chidziwitsochi chimathandiza kuzindikira ma code oyipa msanga.
Kuzindikira Kusakhazikika kwa Runtime kwa Ma Package a npm Oyipa ndi PyPI Malware
Ngakhale pulogalamu yaumbanda italephera kuyang'ana mokhazikika, kuzindikira nthawi yogwirira ntchito mkati CI/CD akhoza kugwira:
- Kulumikizana kwa netiweki kosayembekezereka.
- Kusintha kwa mafayilo kunja kwa ma directories omwe amayembekezeredwa.
- Kuyesera kosalekeza pantchito zonse.
Pomaliza, izi zikutsimikizira kuti ziwopsezo za npm malware ndi pypi malware zimayimitsidwa ngakhale mutakhazikitsa.
Mwa kuphatikiza zowongolera izi, magulu amaletsa ma phukusi oipa a npm ndi ma phukusi oipa a pypi kuti asafike popanga pipelines.
Yesani Zida Zozindikira Malware a Xygeni
Xygeni imapereka:
- Kuzindikira nthawi yeniyeni ma code oyipa, kuphatikizapo zitseko zakumbuyo, mapulogalamu aukazitape, ndi ransomware.
- Mosiyana ndi ma scanner oyambira, kusanthula kwa npm, PyPI, Maven, NuGet, RubyGems, ndi zina zambiri.
- Kuletsa kumanga kokha pamene lipoti la pulogalamu yaumbanda likuwonetsa zoopsa.
- Kuzindikira momwe zinthu zingagwiritsidwire ntchito, kufufuza mbiri ya wosamalira, ndi kuzindikira zolakwika.
Khalani Odziwika
Gulu lathu limasintha tsamba lino sabata iliyonse. Kuti mulandire machenjezo ndi malipoti atsatanetsatane:
- Tumizani kwa athu Kalatayi
- kutsatira @XygeniSecurity pa Linkedin
- Sungani tsamba ili kuti mutsatire zatsopano pulogalamu yaumbanda ya npm ndi pulogalamu yaumbanda ya pypi zoopseza
