Pafupifupi sabata iliyonse, makina athu ozindikira mapulogalamu a pulogalamu yaumbanda amasanthula ma phukusi ambiri atsopano komanso atsopano m'ma registry a anthu onse monga npm ndi PyPI. Sabata ino sizinali zosiyana.
Tatsimikizira ma phukusi owopsa oposa 130 pakati pa June 7 ndi June 12, 2026, makamaka nthawi yonse ya npm, ndi milandu ina mu PyPI. Ambiri adawonekera m'magulu ogwirizana, kutulutsidwa kobwerezabwereza kwa ma phukusi owopsa omwe adasindikizidwa ndi mayina omwewo kapena m'mabanja ofanana kwambiri a ma phukusi.
Nkhani yodziwika bwino sabata ino inali sensivity, yomwe idadzaza ndi ma npm ndi ma version opitilira 40 otulutsidwa pamtundu wa 2.5.x, zomwe zatsimikiziridwa kwa masiku angapo. Magulu ena odziwika bwino anali ndi mafunde a @solana-labs ma typosquats omwe akuyang'ana chilengedwe cha Solana (web3.js, web3-js, etherjs, spl-toke, ancor, web3js — m'ma kampeni awiri osiyana ofalitsa pa Juni 7 ndi Juni 8), @nstrlabs banja (sdk, ixel, utils, shared-components, api-client, auth — kuukira kwa kudalirana motsutsana ndi namespace yamkati ya phukusi), @klapp-login-platform gulu (native-sdk, oidc, routes — kutsanzira nsanja yotsimikizira), internallib_v557 ndi internallib_v984 (mitundu yambiri ya anthu onyenga amkati mwa laibulale), pocteszep (Mabaibulo 6 ofalitsidwa pa Juni 11), ndi gulu la mautumiki a crypto ndi Web3 kuphatikizapo blockchain-helper-0, ethereum-kit-1, ethereum-kit-9, crypto-utils-7, wallet-sdk-9, defi-tools-39, swap-sdk-87ndipo farming-tools-12. The morningstar-design-system phukusili linawonekera m'mabaibulo atatu pa Juni 10, likutsanzira njira yodziwika bwino yopangira ndalama. Mu PyPI, helixagentai, telegramlitendipo cdjeez zatsimikiziridwa sabata yonse.
Izi sizinali zachilendo zokha. Chomwe chinaonekera kwambiri sabata ino chinali kuchuluka kwa ziwopsezo zodalirana motsutsana ndi malo osungiramo ma phukusi, kufalitsa kwa masiku ambiri kwa sensivity cluster, ndi kupitiliza kuyang'aniridwa kwa Web3 ndi Solana tooling, njira yomwe yakula kwambiri mu 2026.
Chithunzichi cha sabata iliyonse ndi gawo la Malicious Code Digest yathu yomwe ikupitilira, komwe timatsimikizira ziwopsezo zatsopano ndikupereka nzeru zothandiza magulu a DevSecOps kuteteza awo pipelines isanachitike kuwonongeka.
Tiyeni tifotokoze zomwe tapeza sabata ino komanso chifukwa chake zili zofunika.
Musalole kuti Mapaketi Oipa Afike Pakupanga
Maphukusi omwe magulu anu amadalira akugwiritsidwa ntchito kwambiri ngati malo olowera. Kuzindikira Malware Oyambirira a Xygeni imayang'anira ma registry nthawi yeniyeni, kotero ziwopsezo ngati zomwe zili mu gawo la sabata ino zimatsekedwa zisanafike pa zomangamanga zanu.
Zomwe zapezeka mlungu uno zikukumbutsa kuti njirazi zikukonzedwa bwino. Kusefukira kwa mabaibulo, kutsanzira malo opezera dzina, ndi misonkhano yokonzedwa masiku ambiri si nkhani zovuta kwenikweni, ndi nkhani zovuta kwambiri. standard Buku losewerera la owukira. Kusanthula kamodzi kokha ndi kuwunika pamanja sikungagwirizane ndi makampeni omwe amafalitsa mitundu yambirimbiri masiku angapo ndi ma registry nthawi imodzi.
Xygeni's Open Source Security Yankho limapatsa magulu anu a DevSecOps kuwonekera mosalekeza kudutsa npm, PyPI, ndi zina zotero, kuzindikira ma phukusi owopsa panthawi yofalitsa, kuyika patsogolo zomwe zimayambitsa chiopsezo chenicheni, ndikufupikitsa njira kuyambira pakuzindikira mpaka kukonza. Kuti magulu anu athe kutumiza mwachangu popanda kusokoneza chitetezo.
