Susu maia i le Lomiga Iuni o le Xygeni Malicious Code Digest. I lenei masina, na faʻamaonia ai e le matou 'au suʻesuʻe saogalemu le sili atu nai lo 645 afifi leaga i luga o le npm, PyPI, ma (mo le taimi muamua) le maketi fa'aopoopoga VSCode.
O Iuni na faʻamatalaina e ala i aga masani se tolu na fetaiaʻi: o tauvaga faʻaauau pea ona faʻateleina lomiga na mamanuina e sili atu nai lo lisi poloka, o se faʻavavevaveina tele o osofaʻiga e faʻatatau i meafaigaluega a le AI ma le atinaʻeina o galuega faatino, ma osofaʻiga fenumiai faʻalagolago faʻatasi faʻasaga i namespaces monorepo i totonu.
O nisi o tauvaga sili ona mataʻina na faʻamaumauina i lenei masina:
- lagona maaleale ua lofia le npm i lomiga e silia ma le 70 i le vaega 2.5.x, o se tauvaga faifai pea e aloese ai mai le toe lolomiina pea ina ia vave ona aveese.
- A tauvaga fa'alua a Solana typosquat (Iuni 7–8) lomia afifi e 15 e fa'atagā
@solana-labsmeafaigaluega fa'ale-siosiomaga, e fa'atatau sa'o i le au atia'e Web3 ma DeFi. - houzidawang806 e silia ma le 25 lomiga na faia i le aso e tasi (Iuni 13), faatasi ai ma fua fa'atataupipeline-d8k2 toe lolomiina i lomiga e 21 i le va o Iuni 15–18.
- le Fenumiai o CryptoDAO O le tauvaga (Iuni 17) na lolomiina ai afifi e 11 i le lomiga 99.99.99, e tofu ma se uta tutusa pe a uma ona faapipii CI/CD fa'ailoga, fa'amaoniga o le ao, ma mea lilo o atotupe crypto.
- O le vaiaso o Iuni 20–26 na aumaia ai le faʻatatauga sili ona faʻapitoa o meafaigaluega AI o le masina: fesoasoani a ollama (20 lomiga), fesoasoani-ofisa-openai (23 lomiga), monokalaude, ai-sdk-fesoasoani, ma @langgraphjs/meafaigaluega, ua fa'amaonia uma i le vaiaso e tasi, ma taula'i sa'o lava ia Ollama, OpenAI agents SDK, LangGraph, ma le Claude API integrations.
- Ua fa'amaonia e lua fa'aopoopoga leaga o le VSCode na aliali mai i lenei masina, o loʻo faʻailoa mai ai o loʻo faʻalauteleina e le au osofaʻi tala atu o resitala o afifi i totonu o le siosiomaga o le au atiaʻe lava ia.
O le mamanu fa'ailoa o Iuni: o lo'o agai atu osofa'iga i fa'aopoopoga IDE, meafaigaluega a le AI agent, ma galuega fa'atino a le agentic lea e fa'apipi'i tuto'atasi ai se afifi leaga e leai se tagata e iloiloina i le va o le fa'ama'i ma le fa'atinoina.
O lenei fa'afouga fa'alemasina o se vaega o le su'esu'ega faifai pea a Xygeni i polokalame fa'aletonu ma fa'amata'u o le sapalai. Mo se fa'amatalaga atoa i afifi fa'aleagaina uma na fa'amaonia i lenei masina, su'esu'e le Fa'amatalaga atoa o Tulafono Fa'aleaga ia Iuni ma su'esu'ega e feso'ota'i i ai mai le 'Au Puipuiga a Xygeni.
Vaiaso 4: Ua Mauaina Afifi e Silia ma le 201
| Ecosystem | afī | aso |
|---|---|---|
| Iuni 20, 2026 | ||
| npm | panrouter:5.0.2 + 30 lomiga i le va o le 5.x–6.x se'ia o'o ia Iuni 22 — tauvaga autū o le vaiaso | Laitiiti 20, 2026 |
| npm | trimpront:1.0.5 + 4 lomiga — fa'aauauga mai le vaiaso talu ai, o lo'o fa'aauau pea | Laitiiti 20, 2026 |
| npm | monoclaude:1.0.1 + 2 lomiga — Claude API tooling impersonation | Laitiiti 20, 2026 |
| vscode | polokalame-pa'aga-orbit-agent-for-smalltalk:1.206.0 + 1 lomiga — fa'aopoopoga leaga o le VSCode e fa'atatau i le atina'eina o sui | Laitiiti 20, 2026 |
| npm | simplisafe-gatsby:1.0.1 Fa'ata'ita'iga o le igoa o le fausaga o fale atamai | Laitiiti 20, 2026 |
| Iuni 21, 2026 | ||
| npm | atlasora-shared:1.0.0 + 6 afifi — fenumiai fa'alagolago i le monorepo fa'atasi: atlasora-api, -client, -sdk, -types, -utils, -config | Laitiiti 21, 2026 |
| npm | apintergrationpost:4.0.2 + 6 lomiga — meafaigaluega fa'apipi'i fa'apitoa mo le fa'asalalauga sese o lo'o fa'atatauina | Laitiiti 21, 2026 |
| npm | llm-traces-app:1.0.1 Meafaigaluega e mata'ituina ai le LLM ua fa'atatauina | Laitiiti 21, 2026 |
| pypi | d0rk3r-telemetry:1.0.0 Afifi telemetry fa'alilolilo i le PyPI | Laitiiti 21, 2026 |
| Iuni 22, 2026 | ||
| pypi | tm-ai:2.91.75 + 7 lomiga — fa'aauauina pea le fa'asalalauga fa'asalalau o le lomiga PyPI | Laitiiti 22, 2026 |
| pypi | talosaga-cache-py:1.0.4 + 6 lomiga — Lolovaia le lomiga PyPI | Laitiiti 22, 2026 |
| pypi | corvinos:0.17.0 + 6 lomiga — Tauvaga resitala tele a le PyPI | Laitiiti 22, 2026 |
| Iuni 23, 2026 | ||
| npm | web3-token-fesoasoani:1.1.1 + 2 lomiga — Fa'atatauga o le aoga o le Web3 token | Laitiiti 23, 2026 |
| npm | monocross:1.0.1 + 1 lomiga — mono-* fa'aputuga igoa fa'atasi ma monoclaude ma monotacos | Laitiiti 23, 2026 |
| Iuni 24, 2026 | ||
| npm | fesoasoani-ollama:0.1.0 + 19 lomiga — o le tauvaga meafaigaluega AI sili ona tele o le masina, e faʻatatau i le taimi e faʻagaoioia ai le AI i le lotoifale a Ollama | Laitiiti 24, 2026 |
| npm | openai-agents-helpers:0.1.1 + 22 lomiga — tauvaga fa'amaopoopo e fa'atatau i le faiga fa'avae SDK a sui o le OpenAI | Laitiiti 24, 2026 |
| Iuni 25, 2026 | ||
| npm | ai-sdk-fesoasoani:1.4.3 Meafaigaluega AI SDK ua fa'atatauina fa'atasi ma le @langgraphjs/toolkit:1.2.11 | Laitiiti 25, 2026 |
| npm | saini-fa'apipi'i:99.99.99-poc3 + hs-locale-management — Fenumiai i le faalagolago i totonu o le HubSpot i le namespace, ua faamaonia ai e le poc suffix le tauvaga suʻesuʻega o loʻo galue malosi | Laitiiti 25, 2026 |
| Iuni 26, 2026 | ||
| npm | pusa-fa'igofie-o-le-fa'aputuga:1.0.1 + 8 lomiga e aofia ai le variant easy-string-kit232 — resitalaina tele i lalo o le igoa lautele o le aoga | Laitiiti 26, 2026 |
| npm | afifi-leaga-e-le-saogalemu:1.0.0 + 5 lomiga — afifi ua ta'ua manino o se mea leaga, uta ua fa'amaonia, suega atonu po'o se tauvaga fa'aosofia | Laitiiti 26, 2026 |
| npm | @vpms/design-system:1.1.2 + 2 lomiga — fa'ata'ita'i igoa ole faiga mamanu | Laitiiti 26, 2026 |
Vaiaso 3: Ua Mauaina Afifi e Silia ma le 200
| Ecosystem | afī | aso |
|---|---|---|
| Iuni 13, 2026 | ||
| npm | houzidawang806:1.0.0 + 25 lomiga i le 1.0.x–1.2.x e aofia ai uso ma tuafafine o houzidawang807 ma houzidawang808 — o le tauvaga autū o le vaiaso | Laitiiti 13, 2026 |
| npm | fa'aaliga-fa'afeiloa'i-fa'auo:1.0.2 + 4 lomiga — o loʻo toe aliali mai pea le tauvaga faifai pea i ni nai aso | Laitiiti 13, 2026 |
| npm | tsc-ai:1.2.0 tsc-* cluster: tsc-ai, tsc-mesh, tsc-lotl — Fa'ata'ita'iga o le igoa o le CI tooling | Laitiiti 13, 2026 |
| pypi | neuralbridge-sdk:4.5.4 + 6 lomiga i le 4.5.x–5.1.x — tauvaga PyPI faifai pea mo le tele o aso | Laitiiti 13, 2026 |
| Iuni 15, 2026 | ||
| npm | tau-token-cron:999.0.0 + 6 afifi — Fa'aputuga fenumiai o le fa'alagolago i le atina'e o le DeFi e fa'atatau i meafaigaluega cron ma vault i totonu | Laitiiti 15, 2026 |
| Iuni 16, 2026 | ||
| npm | bodega-sdk:9.9.9 + 8 afifi — DeFi nonōina ma le Cardano ecosystem cluster: flow-lending, surf-lending, janus-*, flowcardano, flowdefi | Laitiiti 16, 2026 |
| npm | fua fa'atatau o mea tutupu-q3x7:1.0.0 + 8 lomiga — afifi hex-suffix lautele e resitalaina ai igoa tetele e fa'atatau i le mata'ituina | Laitiiti 16, 2026 |
| npm | nic-datagov:1.0.0 + 3 afifi — fa'ata'ita'iga o le igoa o le fausaga fa'amaumauga a le malo: ogd-analytics, ogd-platform, dms-backend | Laitiiti 16, 2026 |
| Iuni 17, 2026 | ||
| npm | konekarate-cryptodao:99.99.99 + 10 afifi — Fenumiai o le faalagolago i le CryptoDAO: autu, sdk, bot, config, utils, deploy, signer, backend, types | Laitiiti 17, 2026 |
| pypi | teambot-ai:1.48.0 Meafaigaluega a le sui o le AI ua fa'atatauina i le PyPI | Laitiiti 17, 2026 |
| Iuni 18, 2026 | ||
| npm | fua fa'atataupipeline-d8k2:1.0.0 + 20 lomiga i le aso 18 o Iuni — fa'aauau pea le taumafaiga e aloese mai ai i le aso e tasi, toe lolomiina pea lava pea ina ia umi atu nai lo lisi poloka | Laitiiti 18, 2026 |
| npm | na'o le su'esu'ega:0.4.5 + 6 lomiga — tauvaga lolovaia o lomiga | Laitiiti 18, 2026 |
| npm | lanu-utils-dee0:1.0.0 + 5 afifi hex-suffix lautele: data-utils, string-tools, type-check, fmt-helpers, metrics-probe — resitalaina tele ua tusia | Laitiiti 18, 2026 |
| npm | @azure-lab-services/ml-ts:99.0.0 Fa'ata'ita'iga o le igoa ole Azure ML | Laitiiti 18, 2026 |
| Iuni 19, 2026 | ||
| npm | trimpront:1.0.2 + trimprompt-hub — meafaigaluega fa'ainisinia vave ua fa'atatauina | Laitiiti 19, 2026 |
| npm | ipu-klaude:0.8.6 Fa'ata'ita'iga o meafaigaluega API a Claude | Laitiiti 19, 2026 |
| pypi | aiaddin-agent:0.1.0 Meafaigaluega a le sui o le AI ua fa'atatauina i le PyPI | Laitiiti 19, 2026 |
| npm | web3-crypto-address-utils:0.1.0 Fa'atatauga o le Web3 utility | Laitiiti 19, 2026 |
Vaiaso 2: Ua Mauaina Afifi e Silia ma le 135
| Ecosystem | afī | aso |
|---|---|---|
| Iuni 7, 2026 | ||
| npm | @solana-labs/web3.js:1.0.0 + 5 fesuiaiga — Solana ecosystem typosquat campaign, vaega muamua | Laitiiti 7, 2026 |
| npm | @jisan901/teamfocus:1.0.0 + 2 lomiga | Laitiiti 7, 2026 |
| npm | @sflyinc-knapsack/shutterfly-react:999.0.0 Fenumiai o le faalagolago, lomiga fa'afefeteina | Laitiiti 7, 2026 |
| Iuni 8, 2026 | ||
| npm | @solana-labs/web3.js:1.98.102 + 9 fesuiaiga — Solana ecosystem typosquat campaign, vaega lona lua | Laitiiti 8, 2026 |
| pypi | helixagentai:0.1.3 Meafaigaluega a le sui o le AI ua fa'atatauina i le PyPI | Laitiiti 8, 2026 |
| Iuni 9, 2026 | ||
| npm | @nstrlabs/sdk:99.0.0 + 7 afifi — fenumiai o le faalagolago faasaga i le namespace monorepo i totonu | Laitiiti 9, 2026 |
| npm | @klapp-login-platform/native-sdk:99.0.0 + 9 afifi — fa'ata'ita'iga o le fa'avae fa'amaonia i luga o le tele o avanoa igoa klapp | Laitiiti 9, 2026 |
| npm | feso'ota'iga-poloka-0:1.0.0 + 7 afifi — fa'aputuga o meafaigaluega crypto/DeFi e fa'atatau i tagata atia'e Web3 | Laitiiti 9, 2026 |
| npm | @card-pci-data/store:99.0.0 Fa'atatauina le igoa o fa'amatalaga o kata totogi | Laitiiti 9, 2026 |
| Iuni 10, 2026 | ||
| npm | faiga-fuafua-mo'e-fetu-matua:99.0.0 + 2 lomiga — fa'ata'ita'iga o le faiga o le mamanu tau tupe | Laitiiti 10, 2026 |
| Iuni 11, 2026 | ||
| npm | pocteszep:1.0.1 + 5 lomiga na lomia i le aso lava e tasi | Laitiiti 11, 2026 |
| npm | @coze-common/chat-area:99.1.1 Fa'ata'ita'i o le igoa o le platform talatalanoaga AI | Laitiiti 11, 2026 |
| pypi | telegramlite:1.0.0 + 1 lomiga — fa'ata'ita'iga o le fausaga o fe'au i le PyPI | Laitiiti 11, 2026 |
| Iuni 12, 2026 | ||
| npm | ecto-corsair-whisper-6f3b9:1.0.18 + 7 ecto-* variants — fa'aputuga igoa fa'alilolilo | Laitiiti 12, 2026 |
| npm | internallib_v984:1.0.3 + internallib_v557 cluster — 13 fa'aliliuga o faila pepelo i totonu o le faletusi | Laitiiti 12, 2026 |
| npm | upega tafa'ilagi a le voyager:999.0.0 Fenumiai o le faalagolago, lomiga fa'afefeteina | Laitiiti 12, 2026 |
| pypi | cdjeez:0.32.0 | Laitiiti 12, 2026 |
Vaiaso 1: Ua Mauaina Afifi e Silia ma le 118
| Ecosystem | afī | aso |
|---|---|---|
| Ia 30, 2026 | ||
| npm | @cloudplatform-single-spa/pulega:99.99.100 Fenumiai o le faalagolago, lomiga fa'afefeteina | Ia 30, 2026 |
| vscode | pule-xampp:5.1.3 Fa'aopoopoga VSCode — fa'ata'ita'iga o meafaigaluega a le tagata atia'e | Ia 30, 2026 |
| Iuni 1, 2026 | ||
| npm | @tse-digital/core:99.0.0 Fenumiai o le faalagolago — na aafia foi @telenor-se ma @ownit | Laitiiti 1, 2026 |
| npm | cms-storehub:1.3.4 + 2 lomiga, vaega o le igoa o le CMS | Laitiiti 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.69 + 6 lomiga, numera fa'ateleina o lomiga e fa'atatau i fa'amaoniga a le AWS | Laitiiti 1, 2026 |
| npm | pepa fa'amaonia o gasegase:75.0.0 Fa'amoemoega o le igoa ole soifua maloloina | Laitiiti 1, 2026 |
| npm | @emcd-vue/auth:6.4.9 Fa'ata'ita'i o igoa o le fesuiaiga o crypto | Laitiiti 1, 2026 |
| pypi | simtooreal-cli:0.3.0 | Laitiiti 1, 2026 |
| Iuni 2, 2026 | ||
| npm | lagona: 2.5.8 + 70 lomiga i le va o le 2.5.x, Iuni 2–5 — tauvaga pule o le vaitaimi | Laitiiti 2, 2026 |
| npm | @langgraphjs/toolkit:1.2.10 Fa'atatauina o meafaigaluega LangGraph | Laitiiti 2, 2026 |
| Iuni 4, 2026 | ||
| npm | @sentry-browser-sdk/profiling-node:1.0.1 + 2 lomiga, fa'ata'ita'iga o le igoa Sentry | Laitiiti 4, 2026 |
| npm | internallib_v346:1.0.3 + 2 lomiga, fa'afoliga i totonu o le faletusi | Laitiiti 4, 2026 |
| npm | ai-sdk-fesoasoani:0.2.1 + 7 lomiga, e fa'atatau i meafaigaluega a le AI SDK | Laitiiti 4, 2026 |
Taofi le Tulafono Malicious a'o le'i oo atu i lau Pipeline
Ua sili atu le lamatia o le sapalai o polokalama faakomepiuta nai lo le mea ua fuafuaina. O osofaʻiga fenumiai o le faalagolago, gaoi o faʻamaoniga, polokalama leaga e faʻatatau i le AI, ma meafaigaluega faʻaonaponei a le au atinaʻe o loʻo aʻafia ai 'au moni i le lalolagi moni. SDLCs i vaiaso uma.
Xygeni's su'esu'eina o mea leaga ma fa'avae mo le saogalemu o le sapalai o sapalai e maua ai e faʻalapotopotoga le vaʻaia e puʻeina ai faʻalagolago leaga aʻo leʻi faʻatinoina i luga o se masini atiaʻe, ulufale i se faiga fausia, pe oʻo atu i le gaosiga. O le ufiufi e aofia ai le npm, PyPI, VSCode, ma tua atu, mataʻituina mo mamanu lolomiina masalomia, faʻaaogaina sese o namespace, typosquatting, ma metotia osofaʻiga AI-native aʻo latou tulaʻi mai.
O fa'amaumauga uma e otometi lava ona fa'amuamua e tusa ai ma le faigofie ona fa'aaogaina, le mafai ona o'o atu i ai, ma le a'afiaga i pisinisi, o lea e taula'i atu ai lau 'au i mea e mana'omia moni ona fa'aleleia, ae le o le pisa.
Pe o se afifi tatala-punaoa leaga, o se meafaigaluega a le atinaʻe ua faʻaleagaina, poʻo se lamatiaga o se code na gaosia e le AI, e faʻatumauina e Xygeni le 'au puipuiga ma le 'au inisinia i se laʻasaga e tasi e sili atu nai lo le tulaga o lamatiaga o le sapalai o sapalai.
Su'esu'e afifi ma tauvaga leaga uma ua fa'amaonia e le Xygeni Security Team i totonu o le Fa'amatalaga o Tulafono Fa'aleaga.
Ia saogalemu. Ia vave. Ia pulea lelei mea uma ma Xygeni.
