Welcome kuna Chinyorwa chaChikumi cheXygeni Malicious Code DigestMwedzi uno, timu yedu yekutsvagisa zvekuchengetedza yakasimbisa zvinopfuura Mapakeji ane njodzi zana nemakumi matatu nemashanu kuburikidza ne npm, PyPI, uye (kekutanga) musika wekuwedzera weVSCode.
Chikumi chakatsanangurwa nemaitiro matatu akabatana: mishandirapamwe yekuwedzera mavhezheni yakagadzirirwa kugara kwenguva refu kupfuura ma blocklists, kukurumidza kukuru kwekurwiswa kwakanangana neAI tooling uye agent development workflows, uye kurwiswa kwakarongeka kwedependency confusion kurwisa internal monorepo namespaces.
Pakati pemishandirapamwe yakakurumbira yakanyorwa mwedzi uno:
- kunzwa kwemuviri yakazadza npm ine shanduro dzinopfuura makumi manomwe muhuwandu hwe2.5.x, chirongwa chekunzvenga chinoenderera mberi chichiburitsazve nguva dzose kuti chirambe chiri pamberi pekutora.
- A mushandirapamwe wekunyora typosquat weSolana wemafungu maviri (Chikumi 7–8) yakaburitsa mapakeji gumi nemashanu aitevedzera
@solana-labskugadzira maturusi e ecosystem, vachinanga zvakananga vagadziri veWeb3 neDeFi. - houzidawang806 yakaverengerwa shanduro dzinopfuura makumi maviri neshanu muzuva rimwe chete (Chikumi 13), yakabatana na zviyero-pipeline-d8k2 yakaburitswazve mushanduro makumi maviri nerimwe pakati pa15–18 Chikumi.
- The Kuvhiringidzika kweCryptoDAO mushandirapamwe (Chikumi 17) wakaburitsa mapakeji gumi nerimwe pavhezheni 99.99.99, rimwe nerimwe riine mutoro wakafanana wepayload mushure mekuiswa CI/CD zviratidzo, marekodhi egore, uye zvakavanzika zvewallet ye crypto.
- Vhiki yaChikumi 20-26 yakaunza chinangwa chakanyanya kukoshesa chekushandisa maAI emwedzi uno: ollama-vabatsiri (Mavhezheni makumi maviri nematatu), vabatsiri-vamiririri-ve-openai (Mavhezheni makumi maviri nematatu), monoclaude, vabatsiri veai-sdk, uye @langgraphjs/toolkit, zvese zvakasimbiswa muvhiki imwe chete, zvakananga kunangana nekubatanidzwa kweOllama, OpenAI agents SDK, LangGraph, uye Claude API.
- Zviviri zvakasimbiswa kuwedzerwa kweVSCode kwakaipa yakaonekwa mwedzi uno, zvichiratidza kuti vapambi vari kuwedzera kupfuura marejisiti emapakeji vachipinda munzvimbo yevagadziri vemapurogiramu.
Maitiro akajeka aChikumi: kurwiswa kuri kupinda muIDE extensions, AI agent tooling, uye agent workflows uko package ine njodzi yakaiswa yoga isina munhu anoongorora pakati pehutachiona nekuuraya.
Kuvandudzwa uku kwemwedzi wega wega chikamu chechirongwa cheXygeni chekutsvaga malware nekutengesa zvinhu zvinotyisidzira. Kuti uwane ruzivo rwakakwana pamusoro pemapakeji ese emalware akasimbiswa mwedzi uno, tarisa ongororo yakazara yaJune Malicious Code Digest pamwe netsvagiridzo yakabatana kubva kuXygeni Security Team.
Vhiki 4: Mapakeji Anopfuura 201 Akawanikwa
| Ecosystem | nhuri | zuva |
|---|---|---|
| June 20, 2026 | ||
| npm | panrouter: 5.0.2 + 30 shanduro kubva pa5.x kusvika 6.x dzinotangira pa22 Chikumi - mushandirapamwe mukuru wevhiki | Jun 20, 2026 |
| npm | trimprompt:1.0.5 + 4 shanduro — kuenderera mberi kwevhiki rapfuura, zvichiri kushanda | Jun 20, 2026 |
| npm | monoclaude:1.0.1 + 2 shanduro — Claude API tooling exemplating | Jun 20, 2026 |
| vscode | orbit-agent-pair-programming-for-smalltalk:1.206.0 + 1 vhezheni — kuwedzera kweVSCode kwakashata kwakanangana nekugadzirwa kweanoshanda | Jun 20, 2026 |
| npm | nyore-gatsby:1.0.1 Kutevedzera nzvimbo yemazita yepuratifomu yepamba yakangwara | Jun 20, 2026 |
| June 21, 2026 | ||
| npm | atlasora-yakagovaniswa:1.0.0 + mapakeji matanhatu — kuvhiringidzika kwekuvimba kwemonorepo kwakarongeka: atlasora-api, -client, -sdk, -types, -utils, -config | Jun 21, 2026 |
| npm | chinyorwa chekubatanidza:4.0.2 + 6 shanduro — kunyorera zvisirizvo nemaune mushandirapamwe wakanangana nekushandisa maturusi ekubatanidza | Jun 21, 2026 |
| npm | llm-traces-app:1.0.1 Zvishandiso zvekutarisa LLM zvakanangwa | Jun 21, 2026 |
| pypi | d0rk3r-telemetry:1.0.0 Pakeji ye telemetry yakavanzika muPyPI | Jun 21, 2026 |
| June 22, 2026 | ||
| pypi | tm-ai:2.91.75 + 7 shanduro — mushandirapamwe wePyPI vhezheni yemvura inoyerera | Jun 22, 2026 |
| pypi | chikumbiro-cache-py:1.0.4 + 6 shanduro — PyPI shanduro inofashamira | Jun 22, 2026 |
| pypi | corvinos:0.17.0 + 6 shanduro — PyPI bulk registration campaign | Jun 22, 2026 |
| June 23, 2026 | ||
| npm | web3-token-helper:1.1.1 + 2 shanduro — Web3 token utility targeting | Jun 23, 2026 |
| npm | monocross:1.0.1 + 1 vhezheni — boka remazita emono-* pamwe chete ne monoclaude ne monotacos | Jun 23, 2026 |
| June 24, 2026 | ||
| npm | ollama-vabatsiri:0.1.0 + 19 shanduro — chirongwa chikuru chekushandisa maturusi eAI chemwedzi uno, chakanangana nenguva yekushanda kweAI yemuno muOllama | Jun 24, 2026 |
| npm | openai-agents-helpers:0.1.1 + Mavhezheni makumi maviri nemaviri — mushandirapamwe wakarongeka wakanangana nevamiriri veOpenAI SDK ecosystem | Jun 24, 2026 |
| June 25, 2026 | ||
| npm | vabatsiri veai-sdk:1.4.3 Kugadzira maturusi eAI SDK kwakanangwa pamwe chete ne @langgraphjs/toolkit:1.2.11 | Jun 25, 2026 |
| npm | kunyoresa-embedder:99.99.99-poc3 + hs-locale-management — Kuvhiringidzika kwekuvimba kwenzvimbo yemazita yemukati yeHubSpot, poc suffix inosimbisa mushandirapamwe wekutsvagisa uri kushanda | Jun 25, 2026 |
| June 26, 2026 | ||
| npm | kit-yakareruka-yetambo:1.0.1 + Mavhezheni masere anosanganisira imwe mhando ye easy-string-kit232 — kunyoresa kwakawanda pasi pezita rekushandisa rakajairika | Jun 26, 2026 |
| npm | unsafe-malicious-package:1.0.0 + 5 shanduro — pakeji yakataurwa pachena kuti ine njodzi, yakasimbiswa payload, inogona kunge iri yekuedza kana yekutsamwisa | Jun 26, 2026 |
| npm | @vpms/dhizaini-system:1.1.2 + 2 shanduro — dhizaini yesystem yekugadzira nzvimbo yemazita | Jun 26, 2026 |
Vhiki 3: Mapakeji Anopfuura 200 Akawanikwa
| Ecosystem | nhuri | zuva |
|---|---|---|
| June 13, 2026 | ||
| npm | houzidawang806:1.0.0 + Mavhezheni makumi maviri nemashanu kubva pa1.0.x kusvika pa1.2.x kusanganisira hama nehanzvadzi houzidawang807 nahouzidawang808 — mushandirapamwe mukuru wevhiki | Jun 13, 2026 |
| npm | dhimoni rekukwazisa rine hushamwari:1.0.2 + 4 shanduro — mushandirapamwe unoramba uchienderera mberi uchidzokazve mumazuva akati wandei | Jun 13, 2026 |
| npm | tsc-ai:1.2.0 tsc-* cluster: tsc-ai, tsc-mesh, tsc-lotl — CI tooling namespace implementation | Jun 13, 2026 |
| pypi | neuralbridge-sdk:4.5.4 + 6 shanduro kubva pa4.5.x kusvika 5.1.x — chirongwa chePyPI chemazuva akawanda chakaramba chiripo | Jun 13, 2026 |
| June 15, 2026 | ||
| npm | mitengo yezviratidzo-cron:999.0.0 + Mapakeji matanhatu — DeFi inobatanidza kuvhiringidzika kwezvivakwa ichitarisa ma cron emukati uye maturusi evault | Jun 15, 2026 |
| June 16, 2026 | ||
| npm | bodega-sdk:9.9.9 + Mapakeji masere — DeFi lending uye Cardano ecosystem cluster: flow-lending, surf-lending, janus-*, flowcardano, flowdefi | Jun 16, 2026 |
| npm | zviyero zvezviitiko-q3x7:1.0.0 + 8 shanduro — generic hex-suffix package inonyoresa mazita ane dingindira rekutarisa kwakawanda | Jun 16, 2026 |
| npm | nic-datagov:1.0.0 + mapakeji matatu — kutevedzera nzvimbo yedata rehurumende yedata: ogd-analytics, ogd-platform, dms-backend | Jun 16, 2026 |
| June 17, 2026 | ||
| npm | zvibvumirano zve cryptodao:99.99.99 + mapakeji gumi — Kuvhiringidzika kwekuvimba kweCryptoDAO: core, sdk, bot, config, utils, deploy, signer, backend, types | Jun 17, 2026 |
| pypi | teambot-ai:1.48.0 Kugadziriswa kwezvishandiso zveAI muPyPI kwakanangwa | Jun 17, 2026 |
| June 18, 2026 | ||
| npm | zviyero-pipeline-d8k2:1.0.0 + Mavhezheni makumi maviri kubva muna Chikumi 18 — chirongwa chekudzivisa mavhidhiyo chezuva rimwe chete chakaramba chiripo, chichiburitswazve nguva dzose kuti chisavepo kwenguva refu kupfuura mazita akavharirwa. | Jun 18, 2026 |
| npm | scan-chete:0.4.5 + 6 shanduro — shanduro yekufashamira kwemushandirapamwe | Jun 18, 2026 |
| npm | mavara-maturusi-dee0:1.0.0 + mapakeji mashanu ehex-suffix akajairika: data-utils, string-tools, type-check, fmt-helpers, metrics-probe — scripted bulk registration | Jun 18, 2026 |
| npm | @azure-lab-services/ml-ts:99.0.0 Kutevedzera nzvimbo yemazita yeAzure ML | Jun 18, 2026 |
| June 19, 2026 | ||
| npm | trimprompt:1.0.2 + trimprompt-hub — maturusi einjiniya ekukurumidza akatarisana | Jun 19, 2026 |
| npm | kapu yeclaude:0.8.6 Kutevedzera maturusi eClaude API | Jun 19, 2026 |
| pypi | aiaddin-mumiriri:0.1.0 Kugadziriswa kwezvishandiso zveAI muPyPI kwakanangwa | Jun 19, 2026 |
| npm | zvishandiso zvewebhu-crypto-address:0.1.0 Kutarisa mashandisirwo eWeb3 | Jun 19, 2026 |
Vhiki 2: Mapakeji Anopfuura 135 Akawanikwa
| Ecosystem | nhuri | zuva |
|---|---|---|
| June 7, 2026 | ||
| npm | @solana-labs/web3.js:1.0.0 + Mhando 5 — Solana ecosystem typosquat campaign, first wave | Jun 7, 2026 |
| npm | @jisan901/teamfocus:1.0.0 + 2 shanduro | Jun 7, 2026 |
| npm | @sflyinc-knapsack/shutterfly-reaction:999.0.0 Kuvhiringidzika kwekuvimba, shanduro yakakwidibira | Jun 7, 2026 |
| June 8, 2026 | ||
| npm | @solana-labs/web3.js:1.98.102 + Mhando 9 — Solana ecosystem typosquat campaign, second wave | Jun 8, 2026 |
| pypi | helixagentai:0.1.3 Kugadziriswa kwezvishandiso zveAI muPyPI kwakanangwa | Jun 8, 2026 |
| June 9, 2026 | ||
| npm | @nstrlabs/sdk:99.0.0 + mapakeji manomwe — kuvhiringidzika kwekuvimbana neinternal monorepo namespace | Jun 9, 2026 |
| npm | @klapp-login-puratifomu/native-sdk:99.0.0 + mapakeji 9 — kutevedzera kwepuratifomu yekusimbisa munzvimbo dzakawanda dzemazita dzeklapp | Jun 9, 2026 |
| npm | blockchain-helper-0:1.0.0 + Mapakeji manomwe — boka rezvishandiso zve crypto/DeFi rakanangana nevagadziri veWeb3 | Jun 9, 2026 |
| npm | @kadhi-pci-data/chitoro:99.0.0 Nzvimbo yemazita emakadhi ekubhadhara yakanangwa | Jun 9, 2026 |
| June 10, 2026 | ||
| npm | dhizaini-yenyeredzi yemangwanani:99.0.0 + 2 shanduro — kutevedzera hurongwa hwekugadzira mari | Jun 10, 2026 |
| June 11, 2026 | ||
| npm | pocteszep:1.0.1 + 5 shanduro dzakaburitswa zuva rimwe chete | Jun 11, 2026 |
| npm | @coze-common/nzvimbo yekukurukura:99.1.1 Kutevedzera nzvimbo yemazita yeAI chat platform | Jun 11, 2026 |
| pypi | telegramlite:1.0.0 + 1 vhezheni — kutevedzera puratifomu yekutumira mameseji muPyPI | Jun 11, 2026 |
| June 12, 2026 | ||
| npm | ecto-corsair-whisper-6f3b9:1.0.18 + 7 ecto-* variants — boka remazita akavanzika | Jun 12, 2026 |
| npm | internallib_v984:1.0.3 + internallib_v557 cluster — shanduro gumi nenhatu dzevanyori vemukati me library | Jun 12, 2026 |
| npm | rwendo-rwewebhu:999.0.0 Kuvhiringidzika kwekuvimba, shanduro yakakwidibira | Jun 12, 2026 |
| pypi | cdjeez:0.32.0 | Jun 12, 2026 |
Vhiki 1: Mapakeji Anopfuura 118 Akawanikwa
| Ecosystem | nhuri | zuva |
|---|---|---|
| Dai 30, 2026 | ||
| npm | @cloudplatform-single-spa/administration:99.99.100 Kuvhiringidzika kwekuvimba, shanduro yakakwidibira | Dai 30, 2026 |
| vscode | xampp-maneja: 5.1.3 VSCode extension — developer tool embellishment | Dai 30, 2026 |
| June 1, 2026 | ||
| npm | @tse-digital/core:99.0.0 Kuvhiringidzika kwekuvimba — @telenor-se na @ownit vabatawo | Jun 1, 2026 |
| npm | cms-storehub:1.3.4 + 2 shanduro, CMS namespace cluster | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.69 + 6 mavhezheni, manhamba evhezheni akakwidziridzwa akananga kuAWS certifications | Jun 1, 2026 |
| npm | Magwaro evarwere: 75.0.0 Chinangwa chenzvimbo yemazita yehutano | Jun 1, 2026 |
| npm | @emcd-vue/auth:6.4.9 Kutevedzera nzvimbo yemazita ekuchinjana mari yecrypto | Jun 1, 2026 |
| pypi | simtooreal-cli:0.3.0 | Jun 1, 2026 |
| June 2, 2026 | ||
| npm | kunzwa: 2.5.8 + 70 shanduro dzakasiyana-siyana dze2.5.x, Chikumi 2–5 — mushandirapamwe wakakura wenguva iyoyo | Jun 2, 2026 |
| npm | @langgraphjs/toolkit:1.2.10 Maturusi eLangGraph akatarisana | Jun 2, 2026 |
| June 4, 2026 | ||
| npm | @sentry-browser-sdk/profiling-node:1.0.1 + 2 shanduro, kutevedzera nzvimbo yemazita yeSentry | Jun 4, 2026 |
| npm | internallib_v346:1.0.3 + 2 shanduro, munyengeri weraibhurari yemukati | Jun 4, 2026 |
| npm | vabatsiri veai-sdk:0.2.1 + Shanduro 7, dzakanangana nekushandisa maturusi eAI SDK | Jun 4, 2026 |
Rega Kodhi Yenhema Isati Yasvika Kwauri Pipeline
Zvipingamupinyi zvekutengesa software zvapfuura pfungwa dzekufungidzira. Kurwiswa kwekusagadzikana kwevatengi, kuba ma credenti, malware anotarirwa neAI, uye kushandisa ma developer tooling ane chepfu zviri kurova timu chaiyo. SDLCvhiki rega rega.
Xygeni's kuonekwa kwemalware uye chikuva chekuchengetedza cheni yekugovera inopa masangano mukana wekubata zvinhu zvisina kunaka zvisati zvatanga kushanda pamuchina wekugadzira, kupinda musystem yekuvaka, kana kusvika pakugadzira. Kufukidzwa kunosanganisira npm, PyPI, VSCode, zvichienda mberi, kutarisa maitiro ekuburitsa zvinhu zvinofungirwa, kushandiswa zvisina kunaka kwenzvimbo yemazita, kunyora zvinyorwa, uye matekiniki ekurwisa eAI sezvaanobuda.
Zvese zvinowanikwa zvinotanga kutariswa nekushandiswa, kugona kusvika, uye kukanganisa kwebhizinesi, saka timu yako inotarisa pane zvinoda kugadziriswa, kwete ruzha.
Ingave iri package ine malware, chishandiso chevagadziri chakakanganiswa, kana njodzi yekodhi yakagadzirwa neAI, Xygeni inochengetedza zvikwata zvekuchengetedza neinjiniya nhanho imwe pamberi penzvimbo yekutyisidzira kwekutengesa.
Ongorora mapakeji ese ane hukasha uye mushandirapamwe wakasimbiswa neXygeni Security Team mu Kuongororwa kweMakodhi Akaipa.
Gara wakachengeteka. Gara wakasimba. Gara uchidzora Xygeni.
