Kupfupikiswa Kwemwedzi Nemwedzi kweMalcious Code Digest: Chivabvu

Tinokugamuchirai kuXygeni Malicious Code Digest yaMay. Mwedzi uno, timu yedu yekutsvagisa zvekuchengetedza yakaramba ichitevera mamiriro ezvinhu ari kuchinja ekutyisidzira kwekutengeswa kwesoftware mumapakeji everuzhinji, maturusi evagadziri, maworkflows anobatsirwa neAI, uye emazuva ano. CI/CD nharaunda. Mumwedzi waChivabvu wese, Xygeni yakaona uye yakasimbisa mazana emapakeji ane hukasha akatarisana nenpm, PyPI, VS Code, uye OpenVSX ecosystems.

Asi May yakanga isiri nyaya yehuwandu chete. Yaivawo mwedzi apo vapambi vakawedzera kugadzirisa hunyanzvi hwavo kuti huenderane nenzvimbo dzekuvandudza dzeAI, fungidziro dzevagadziri, uye otomatiki. pipelines.

Pakati peongororo dzakakurumbira dzakaburitswa neXygeni Security Team mwedzi uno:

• JulesJacker, chirongwa che "npm malware" chine matanho akawanda chinotevedzera mumiriri weGoogle weJules AI kuti aba marepository, kushandisa zvisirizvo CI/CD nharaunda, uye kunyange kunanga sandbox iri kuiongorora. Mushandirapamwe uyu wakaunza ma encrypted host-gated loaders, akaumbwa google-labs-jules[bot] commits, kuba kwedata regore, uye kuongorora Kubernetes kurwisa zvivakwa zvekuongorora pachazvo.
• PhantomBot, chirongwa che npm chine hutsinye chinoshandisa zvisina kunaka chikwama chenhema, blockchain, uye Web3 tooling kuba zvitupa, kukanganisa nharaunda dzevagadziri, uye kunanga mafambiro ebasa ane chekuita ne crypto kuburikidza nekusashandisa zvakanaka kuchengetedzwa kwevatengi uye kutumirwa kwemubhadharo wakarongwa.
• Nzvimbo yakakura ine njodzi yenpm inoshandisa zvisina kunaka maturusi enhema eTypeScript, mapakeji ane dingindira reAI, kutevedzera maturusi emukati, maraibhurari epamberi, vabatsiri vema cloud, uye ma builder frameworks kunzvimbo dzeminwe, kuburitsa ma certificate, kuisa persistency, uye kukanganisa ma developer systems.
• Mafungu emapakeji anoenderera mberi ane njodzi anokonzera kuvhiringidzika kwekuvimba, typosquatting, postinstall abuse, AI-tool impersonation, version inflation, uye namespace abuse yakadzokororwa yakagadzirirwa kunzvenga developer trust heuristics uye kukanganisa mazuva ano. SDLC mashandiro ebasa asati aonekwa.
• Kuwanikwa kwemakambani ekurwisa malware akasiyana-siyana akadai se @jaggle/resizeobserves clipboard hijacker, iyo yakatevedzera package yepamutemo uku ichishandisa Python-based persistence uye crypto-wallet clipboard substitution muLinux, macOS, uye Windows systems.

Mumwedzi wese, takaonawo kubatana kuri kukura pakati pekushandisa maAI tooling, open-source ecosystems, uye kurwiswa kwesoftware supply chain. Vanoita zvinhu zvekutyisidzira vakaramba vachitarisa maworkflows ekuvandudza anobatsira AI, nzvimbo dzevamiririri, vatyairi vemakomputa, uye kuvakwa kwezvinhu zvemugore. pipelinesechikamu chemabasa makuru ekuba matsamba ekuongorora magwaro uye kugadzirisa nyaya dzekuchengetedza magwaro.

Kurwiswa uku hakusisiri nyaya dzekunyora zviri nyore. Kunosanganisira mishandirapamwe yekuburitsa mabhuku yakarongeka, kuburitswa kweshanduro otomatiki, kuba ma "cloud token", CI/CD kushungurudzwa, kuvharirwa kwepayload staging, kunzvenga ma "sandbox", uye nzira dzinogara dzichienderana dzakagadzirwa kuti dzisanganiswe muzvirongwa zvevagadziri vanovimbwa nazvo.

Iyi update yemwedzi wega wega chikamu chechirongwa cheXygeni chekutsvaga malware nenjodzi dzekutengesa, uko timu yedu inogara ichisimbisa mapakeji ane njodzi, inoongorora maitiro matsva ekurwiswa, uye inoburitsa hungwaru hunobatsira kuchengetedza, zvikwata zveAppSec, neDevSecOps kuti zvirambe zviri pamberi penjodzi dzinochinja dzekutengesa.

Kuti uwane ruzivo rwakakwana pamusoro pemapakeji ese ane njodzi, chirongwa chemalware, uye ongororo yekutyisidzira yakaburitswa mwedzi uno, tsvaga May Malicious Code Digest yakazara pamwe netsvagurudzo yakabatana kubva kuXygeni Security Team.