Sabata iliyonse, makina athu ozindikira mapulogalamu a pulogalamu yaumbanda amasanthula ma phukusi ambiri atsopano komanso atsopano m'ma registry a anthu onse monga npm ndi PyPI. Sabata ino sizinali zosiyana.
Tinatsimikizira ma phukusi opitilira 90 oyipa pakati pa June 26 ndi July 3, 2026, pa npm ndi PyPI, ndipo ma kampeni angapo akupitilira kuyambira masabata apitawa ndi atsopano akutuluka.
The nolimit-agent kampeni inapitiriza kufalitsa mitundu yatsopano (1.0.306, 1.0.315, 1.0.316), kukulitsa dongosolo la phishing la Microsoft 365 device-code lomwe tidalemba mwatsatanetsatane mu Lipoti la DeviceDoor. The anthropic-toolkit Gulu la anthu linali kampeni yatsopano yodziwika bwino, ndipo mitundu 20 yatsimikiziridwa pa June 30 yokha — yomwe imayang'ana mwachindunji ma phukusi okhudzana ndi zida za omanga mapulogalamu a Anthropic. cursed-modules Banja linafalitsa mitundu yoposa 15 pakati pa Julayi 1 ndi Julayi 2 m'magawo onse awiri standard ndi manambala amitundu yowonjezereka (999.x), motsatira buku losewerera la kusokonezeka kwa kudalira. date-fns-lite gulu (mabaibulo 5, pa Julayi 2) linapitiriza njira yotsanzira ma phukusi ovomerezeka komanso ogwiritsidwa ntchito kwambiri.
Kachitidwe kogwiritsa ntchito zida za AI komwe kanakhazikitsidwa sabata yatha ndi ollama-helpers ndi openai-agents-helpers inakulitsidwa mu nthawi ino ndi ai-explain, ai-sdk-helpersndipo @langgraphjs/toolkit, zonse zatsimikizika pakati pa June 28 ndi June 30. @szc-ft/mcp-szcd-client phukusi (mitundu 0.38.0 ndi 0.39.0, yatsimikiziridwa pa Julayi 2) idayambitsa mawonekedwe atsopano omwe tikuwatsatira monga SkillLeak: chochotsera mbiri yachinsinsi chobisika mkati mwa luso la MCP osati cholumikizira chokhazikitsa, chomwe sichimaoneka ndi ma scanner omwe amasiya pambuyo pokhazikitsa. Tinafalitsa a Kusanthula kwathunthu kwa SkillLeak apa.
Chithunzi cha sabata ino ndi gawo la zomwe zikuchitika Chidule cha Ma Code Oyipa, komwe timatsimikizira ziwopsezo zatsopano ndikupereka nzeru zothandiza magulu a DevSecOps kuteteza pipelineTiyeni tikambirane zomwe tapeza sabata ino komanso chifukwa chake zili zofunika.
Maphukusi opitilira 90. Sabata imodzi. Pipeline Ndi Cholinga.
Nkhani ya sabata ino ikuwonetsa kusintha kwa chidwi cha owukira, osati kuchuluka kokha, komanso asanayambecision. Kusefukira kwa madzi kosatha, magulu a zida za AI, kuba kwa ziphaso za MCP-layer, ndi chisokonezo chodalirana chikuukira malo osungira mayina amkati mwa monorepo. Makampeniwa ndi odziyimira pawokha komanso opitilira. Kujambula kamodzi pa sabata si chitetezo.
Chenjezo la Xygeni Yoyambirira ya Malware Amawunika npm, PyPI, ndi ma registry ena nthawi yeniyeni, akumawonetsa ziwopsezo panthawi yofalitsa, asanafike pa zomangamanga, wothandizira wa AI asanaziyike yekha, komanso asanayambe kugwiritsa ntchito SkillLeak. anthropic-toolkit imafalitsa mitundu 20 patsiku limodzi kapena cursed-modules floods npm yokhala ndi mtundu wa 999.x kwa masiku awiri, kuzindikira komwe kumachitika pambuyo pake kwachedwa kale.
Xygeni's Open Source Security Pulatifomu imapatsa magulu a DevSecOps kuzindikira nthawi yeniyeni ndi kuyika patsogolo zomwe zimafunikira kuti akhale patsogolo pa kuthamanga kwa unyolo wogwirizana, kotero pipelineKhalani aukhondo popanda kuchedwetsa magulu anu.
