Sabata iliyonse, makina athu ozindikira mapulogalamu a pulogalamu yaumbanda amasanthula ma phukusi ambiri atsopano komanso atsopano m'ma registry a anthu onse monga npm ndi PyPI. Sabata ino sizinali zosiyana.
Tatsimikizira ma phukusi owopsa oposa 200 pakati pa June 12t ndi June 19th, 2026, makamaka nthawi yonse ya npm, ndi milandu ina mu PyPI. Ambiri adawonekera m'magulu ogwirizana, kutulutsidwa kobwerezabwereza kwa malware komwe kudasindikizidwa ndi mayina omwewo kapena m'mabanja ofanana kwambiri a ma phukusi.
Nkhani yodziwika bwino sabata ino inali sensivity, yomwe idadzaza ndi ma npm ndi ma version opitilira 70 otulutsidwa pamtundu wa 2.5.x, zomwe zatsimikiziridwa kwa masiku angapo. Magulu ena odziwika bwino anali ndi mafunde a @solana-labs zilembo zolembedwa zomwe zikuyang'ana chilengedwe cha Solana (web3.js, web3-js, etherjs, spl-toke, ancor, web3js — pa ma kampeni awiri osiyana ofalitsa nkhani pa Juni 7 ndi Juni 8), @nstrlabs banja (sdk, ixel, utils, shared-components, api-client, auth — kuukira kwa chisokonezo chodalirana motsutsana ndi malo amkati a phukusi), @klapp-login-platform gulu (native-sdk, oidc, routes — kutsanzira nsanja yotsimikizira), internallib_v557 ndi internallib_v984 (mitundu yambiri ya anthu onyenga amkati mwa laibulale), pocteszep (Mabaibulo 6 ofalitsidwa pa Juni 11), ndi gulu la mautumiki a crypto ndi Web3 kuphatikizapo blockchain-helper-0, ethereum-kit-1, ethereum-kit-9, crypto-utils-7, wallet-sdk-9, defi-tools-39, swap-sdk-87ndipo farming-tools-12. The morningstar-design-system phukusili linawonekera m'mabaibulo atatu pa Juni 10, likutsanzira njira yodziwika bwino yopangira ndalama.
Kuyambira pa 13 Juni kupita mtsogolo, liwiro linawonjezeka. houzidawang806 Gulu lokhalo linafalitsa mabuku opitilira 25 tsiku limodzi, ndipo abale ndi alongo anagwirizana nawo. houzidawang807 ndi houzidawang808. The metrics-pipeline-d8k2 Phukusili linasindikizidwanso mosalekeza m'mitundu 21 pakati pa Juni 15 ndi Juni 18 — kampeni yopitilira yopewera yomwe idapangidwa kuti ikhale patsogolo pa mndandanda wa blocklists. friendly-greeter-demo phukusili linkawonekeranso m'mabaibulo osiyanasiyana sabata yonse. Kuyesera kwatsopano kosokoneza kudalirana kunaonekera pansi pa xy-shared, axl-ui, loadninja-shared, carousel-controller-mixin, token-prices-cron, hemi-supply-cron, portal-backend, vault-strategies, ndi ena angapo — onse ali ndi manambala amitundu yokwezedwa mu 999.x range. Gulu latsopano la mayina ofunikira omwe ali ndi ma hex suffix osasinthika (color-utils-dee0, data-utils-d703, string-tools-be6c, type-check-816d, fmt-helpers-794b, metrics-probe-*) idawonekera pa Juni 18–19, mogwirizana ndi kulembetsa kwa bulk komwe kunalembedwa. Sabata yatha ndi trimprompt, trimprompt-hub, claude-cupndipo web3-crypto-address-utils zatsimikiziridwa pa Juni 19. Mu PyPI, neuralbridge-sdk (mitundu isanu pa 4.5.x–5.1.x), deepstrain, teambot-ai, hello-test-s1ndipo aiaddin-agent zatsimikiziridwa sabata yonse.
Izi sizinali zachilendo zokha. Chomwe chinaonekera kwambiri sabata ino chinali kuchuluka kwa ziwopsezo zosokoneza anthu omwe amatsatira malamulo okhudzana ndi mayina a ma phukusi, kampeni yofalitsa nkhani ya masiku ambiri yomwe idapangidwa kuti ipitirire kuchotsedwa, kupitiliza kuyang'aniridwa kwa zida za Web3 ndi DeFi (kachitidwe komwe kakula kwambiri mu 2026), komanso kugwiritsa ntchito mayina a ma phukusi omwe amafanana ndi phokoso omwe adapangidwa kuti apewe kuzindikirika posakanikirana ndi mitengo yokhazikika yodalira.
Chithunzichi cha sabata iliyonse ndi gawo la Malicious Code Digest yathu yomwe ikupitilira, komwe timatsimikizira ziwopsezo zatsopano ndikupereka nzeru zothandiza magulu a DevSecOps kuteteza awo pipelineTiyeni tikambirane zomwe tapeza sabata ino komanso chifukwa chake zili zofunika.
Musalole kuti Ma kampeni Ogwirizana Afike Pamtima Panu Pipelines
Nkhani ya sabata ino sinali yokhudza chiwopsezo chimodzi; inali yokhudza kukula kwake. Ma phukusi opitilira 200 otsimikizika, mtundu wopitilira unasefukira kwa masiku angapo, komanso ma kampeni olembetsa ambiri omwe anali ndi zolemba omwe anali othamanga kuposa momwe ndemanga zamanja zingawonere. Owukira sakukuyembekezerani kuti muwapeze.
Kuzindikira Malware Oyambirira a Xygeni Amawunika npm, PyPI, ndi ma registry ena mosalekeza, akumawonetsa ziwopsezo panthawi yofalitsa, osati atangofika pa pulogalamu yomanga. Pamene kampeni ikufalitsa mitundu 21 ya phukusi lomwelo loipa kwa masiku anayi, kusanthula kwa sabata iliyonse sikugwira ntchito iliyonse panthawi yake.
Xygeni's Open Source Security Yankho limapatsa magulu anu a DevSecOps mawonekedwe enieni komanso kuyika patsogolo zomwe akufunikira kuti akhale patsogolo pa kukakamizidwa kogwirizana kumeneku, kotero pipelineKhalani aukhondo popanda kuchedwetsa magulu anu.
