Xygeni Malicious Code Digest 73

Pafupifupi sabata iliyonse, makina athu ozindikira mapulogalamu a pulogalamu yaumbanda amasanthula ma phukusi ambiri atsopano komanso atsopano m'ma registry a anthu onse monga npm ndi PyPI. Sabata ino inali yogwira ntchito kwambiri.

Tatsimikizira Maphukusi 198 oipa, makamaka pa npm, ndi milandu yowonjezera mu PyPI, OpenVSX, Composer, ndi VS Code extensions. Zambiri zidawonekera m'magulu ogwirizana, ndi ma virus obwerezabwereza omwe adasindikizidwa pansi pa mayina omwewo kapena m'mabanja ofanana kwambiri a ma phukusi. Nkhani yodziwika bwino inali sensivity phukusi, lomwe linadzaza ndi npm ndi mabaibulo opitilira 60 osiyanasiyana pa 2.5.x. Magulu ena odziwika bwino akuphatikizapo ai-sdk-helpers (Mabaibulo 8 akuyang'ana opanga mapulogalamu a AI), @antoncallahan/aws-user-helper (Mabaibulo 7 omwe akutsanzira chida cha AWS), @apple-pay-trust ndi @google-pay-trust mabanja (kutsanzira ma module olipira), @frengki0707/google-cloud-clone (Mabaibulo 5 onyenga Google Cloud), ndi cms-storehub, cms-helpgitndipo cms-github (kulunjika ku CMS pipelines). Maphukusi ambiri amatsanzira ma module olipira ndi olipira, enterprise ndi ma phukusi amkati a intaneti, makasitomala owunikira, maziko a UI, mautumiki opanga mapulogalamu, ofufuza zinthu, ma phukusi okhala ndi mitu ya mtambo ndi Google, ndi ma module ena omwe nthawi zambiri amadaliridwa mu ntchito zamakono zopanga.

Izi sizinali zachilendo zokha. Chomwe chinaonekera kwambiri sabata ino chinali kukula kwa kufalitsa mobwerezabwereza m'mabanja omwewo a phukusi, kugwiritsanso ntchito mitundu ya mayina, ndi momwe ma phukusi oipa adabisidwira kuti aziwoneka ngati zinthu zovomerezeka mkati mwa mapulogalamu enieni. pipelines.

Chithunzichi cha sabata iliyonse ndi gawo la Malicious Code Digest yathu yomwe ikupitilira, komwe timatsimikizira ziwopsezo zatsopano ndikupereka nzeru zothandiza magulu a DevSecOps kuteteza awo pipelines isanachitike kuwonongeka.

Tiyeni tifotokoze zomwe tapeza sabata ino komanso chifukwa chake zili zofunika.