Marware eNpm nhasi iri kuramba ichichinja, nevanorwisa vachiburitsa pachena yakaipa code, yakaipa npm mapakeji, uye Mapakeji ane njodzi ePyPI yakagadzirirwa kunanga mafambisirwo ebasa ekuvandudza, CI/CD pipelines, uye nharaunda dzenharaunda dzakavhurika. Kuongororwa kweMakodhi Akaipa ndiwo mushumo wekutsvagisa weXygeni unoramba uchitevera uye uchisimbisa mapakeji chaiwo ane hukasha mukati npm, P&PI, VS Code, uye OpenVSX, kusanganisira vanhu vakamboonekwa kuti vari muchivande, vanoba data, vanobvisa ma credit exfiltration payloads, uye mapurogiramu e automated multi-version malware campaigns.
Chikwata chedu chekutsvagisa chinogadzirisa peji rino nguva nenguva ne zvakawanikwa zvakasimbiswa, zviratidzo zvekubvumirana (IOCs), maitiro maitiro, uye zvekushandisa ongororoNekuda kweizvozvo, vagadziri, Zvikwata zveAppSecuye mainjiniya ekuchengetedza vanogona kuramba vari pamberi npm malware nhasi uye mabasa ekuchengetedza mapurogiramu ane njodzi ari kubuda achikanganisa macheni emazuva ano ekupa mapurogiramu esoftware.
NPM Malware Nhasi: Pfupiso yeVhiki Nevhiki 24–29 Kubvumbi 2026
Vaongorori vakasimbisa Mapakeji ane njodzi zana nemakumi matatu nemashanu munzvimbo dzese dzehurumende munguva ino.
Zvakacherechedzwa nedataset
- Mapakeji mazhinji akasimbiswa akabudiswa mu npm
- Dzimwe nyaya dzakakanganiswa P&PI, OpenVSX, uye munyori
- Kudzokorora kuburitsa mashoko ane hutsinye mumhuri imwe chete dzepakeji nemazita akafanana
- Mapatani emhando yepamusoro kana kuti isina kujairika akadai se 99.x, 99.9.x, uye 1.0.x
- Kushandiswa kwakasimba kwe kubhadhara uye kubhadhara, enterprise-style, app yewebhu yemukati, analytics, Nheyo yeUI, chishandiso chemugadziri, ine dingindira regore, uye zvine chekuita nezvikamu mapatani emazita
- Mabhuroko akawanda akarongeka akagadzirirwa kufanana nekugadziriswa kwemapakeji epamutemo
Mushumo weMalware wepamwedzi: Mapakeji eNpm Akasimbiswa Aine Mhosva muna Kubvumbi 2026
Tinokugamuchirai kuchinyorwa chazvino che Xygeni Malicious Code Digest (Chinyorwa Chemwedzi Nemwedzi), mu April 2026, chikwata chedu chekutsvagisa chakasimbisa mapakeji ane njodzi anopfuura 250, kunyanya mhiri npm, nedzimwe nyaya dzinokanganisa PyPI, VS Code, OpenVSX, uye Munyori.
Kubvumbi kwaisangova nezvehuwandu chete. mafungu ekuburitsa anotungamirirwa neotomatiki, makwikwi ekurwisa inflation ane hutsinye, kuunganidzwa kwemhuri yepakeji, uye kutevedzera chishandiso chemukati, takaona mamwe emaitiro anozivikanwa zvikuru emwedzi uno mukuburitswa kwemashoko ane njodzi kwakarongeka mu:
maturusi emukati enhema, mapakeji ane dingindira reAI, ma module ekubhadhara nekubhadhara, ma analytics clients, frontend components, developer utilities, Kubernetes ne cloud tooling, VS Code ne OpenVSX extensions, uye mazita emapakeji akafanana ne brand akagadzirwa kuti asanganiswe mu software chaiyo. pipelines.
Izvi zvaisava zviitiko zvekungonyora zvisiri nyore. Kubvumbi seti yedata, takaona maitiro ekushungurudzwa kwezvitupa, kugadzirisa cheni yekugovera, kushandiswazve kwenzvimbo yemazita kakawanda, uye kuburitswa kwemashoko ane hutsinye kwakarongeka yakagadzirirwa kusangana nenzvimbo dzevagadziri chaivo uye kutumirwa kwesoftware pipelines.
Mukati medata rese, takaramba tichiona kuburitswa kwezvinyorwa zvakawanda, zvirongwa zvekushandura zvakakwidzwa, kubhadhara- uye enterprise-mazita ane dingindira, Mazita emapakeji ane dingindira reAI uye re agent, SDK uye kutevedzera chikamu chepamberi, kutevedzera zvishandiso zvemukati, uye maitiro ekare akadai se kuvhiringidzika kwekuvimba uye data exfiltration.
Mushumo uyu chikamu chedu chiri kuenderera mberi Kuongororwa kweMakodhi Akaipa, patinosimbisa njodzi itsva uye kupa kuita njere kubatsira Zvikwata zveDevSecOps ramba uri pamberi software yekugovera cheni njodzi.
| Ecosystem | nhuri | zuva |
|---|---|---|
| npm | yakanyorwa pa:99.1.10 | Apr 27, 2026 |
| pypi | moonbit-locale-compat:0.2.3 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.13 | Apr 27, 2026 |
| npm | @sbt_gitverse/analytics-client:99.0.1 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.33.1 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.14 | Apr 27, 2026 |
| npm | @tochka-ui/nheyo:99.0.2 | Apr 27, 2026 |
| vhuravsx | arcane-spark/ubel:0.1.0 | Apr 28, 2026 |
| npm | @2011-08-19/n:99.9.9 | Apr 28, 2026 |
| npm | @frengki0707/google-cloud-clone:1.38.0 | Apr 27, 2026 |
Maitiro Atinoona Kodhi Yezvakaipa mu npm Malware nePyPI Malware
Xygeni inoshandisa nzira dzakasiyana-siyana kumisa kodhi yakaipa isati yapararira. Chekutanga, ongororo yekodhi isingachinji inoona maitiro ekuvhara, mitoro yakavanzwa, uye kushandiswa zvisina kunaka kwescript. Pamusoro pezvo, ongororo dzesandboxing dzinoitwa nemaitiro ekuita. hooks, mirairo yekumhanya, uye matipi ekutsungirira. Uyezve, kuona machine learning kunoratidza zero-day npm malware uye pypi malware variants zvisipo nema signature scanners. Pakupedzisira, Early Warning System inotarisa marepository everuzhinji munguva chaiyo, inosimbisa zvakawanikwa, uye inonyevera mapoka eDevOps ipapo ipapo.
Nekuda kweizvozvo, musanganiswa uyu unoita kuti vagadziri vagamuchire ruzivo rwakakurumidza uye runoshanda rwakabatanidzwa zvakananga mu CI/CD workflows.
Nei Vagadziri Vachifanira Kufarira Nezve Matambudziko eNpm
Zvinotyisa zvemazuva ano hazviwanzo mirira nguva yekumhanya. Semuenzaniso, mapakeji e-npm ane njodzi anowanzo shandiswa panguva yekuiswa, nepo mapakeji e-pypi ane njodzi achiviga kubuda kwematokeni kana masuo ekumashure. Varwi:
- Chinja ma reposi eGitHub akavanzika kuita eruzhinji kuti adzokorore.
- Budisa zvitupa nezvakavanzika uchishandisa zvinhu zvakanyoreswa.
- Shandisa maJavaScript loaders asina kujeka kuti uise ransomware kana botnets.
Kutaura zvazviri, mapakeji ekutsvaga ruzivo rwakapararira akawedzera ne156% mugore rimwe chete. Nokudaro, zvikwata zvinongovimba chete nema feeds akanonoka kana ma basic scanners zvinosara kumashure.
Zvinotevedzwa neMalware Report iyi muna npm nePyPI
Kuverenga uku ndiko musimboti we:
- Mapakeji eNpm ane hutsinye akasimbiswa
- Mapakeji ane njodzi ePypi akasimbiswa
- Kuonekwa kwekodhi ine njodzi kunoenderana nemaitiro
- Zviitiko zvakasimbiswa neRegistry
- Pfupiso yemishumo yemalware yevhiki nevhiki uye yemwedzi
- Nhoroondo yekuchinja kwezvese zvakawanikwa pa npm malware ne pypi malware
Nemamwe mashoko, inopa pfungwa imwe chete yekutarisa. Chikwata chekutsvagisa cheXygeni chinovandudza peji rino vhiki nevhiki nekubatanidza kune zvese zvekuongorora tekinoroji uye maGitHub IOC.
Maitiro Ekudzivirira Kubva kuMarware eNpm uye PyPI Malware
Nekuda kwenjodzi iyi iri kukura, masangano anoda zvinopfuura kuongororwa kwekuvimba nemakambani. Dziviriro dzakasimba kubva kumapakeji e-npm ane njodzi uye mapakeji e-pypi ane njodzi dzinoda zvese kudzora kudzivirira uye kusimbiswa kwekushanda kwemabasa:
Simbisa Kuiswa kweLockfile-Chete Kupesana neMalcious npm Packages
shandisa npm ci or pip install --require-hashes in CI/CD.
Izvi zvinoita kuti muti chaiwo wekuvimba unotsanangurwa muma lockfiles ushandiswe. Nekuda kweizvozvo, vapambi havagone kupinda mushanduro dzakagadziriswa kana dzakanyorwa dzema package e npm ane hukasha.
Kuskena Pamberi peNpm Malware nePyPI Malware
Shandisa Xygeni's Early Warning Engine kuti uongorore npm malware nepypi malware mapakeji asati asvika kwaunogara.
Uyezve, tsvaga zvinofungira postinstall mascript, ma obfuscated loaders, kana ma hardcoded C2 URLs.
Guardrails Kuvhara Zvivakwa neMalcious Code
Set guardrails kuti zvikundikane kuvaka otomatiki kana mapakeji e npm ane njodzi kana mapakeji e pypi ane njodzi akaonekwa.
Semuenzaniso, break inovakirwa pamapakeji ane maintainers asina kuburitswa, maitiro e obfuscation, kana match eIOC. Nekuda kweizvozvo, kodhi yakaipa haimbofi yakaonekwa.
Gadzira uye Simbisa SBOMs Against Malicious npm Packages uye PyPI Malware
sika SBOMs (CycloneDX, SPDX) yekuvaka kwega kwega.
Mushure mezvo, enzanisa nemapakeji anozivikanwa e-npm ane hutsinye uye ma pypi malware feeds kuti utevedzere zvese zvinoenderana zvakananga uye zvinoshanduka.
Kudzivirirwa kweCredential uye Token kubva kuNpm Malware nePyPI Malware
Mapakeji mazhinji ehutsinye eNpm anoedza kuverenga .npmrc, .pypirc, kana kuti zvinoshanduka-shanduka zvakatipoteredza.
Saka, shandisa ma "builds" mumidziyo yakaoma isina zvakavanzika zvakawanda. Uyezve, shandisa ma "secrets managers" panzvimbo pe "environment variables" kudzivirira kushandiswa zvisina kunaka kwekodhi.
Tarisa Kuchinja kweRegistry neMaintainer muMalicious npm Packages
Varwisi vanowanzoba mapurojekiti akasiyiwa.
Zvikuru, tarisa kana paine kuchinjana kwemaintainer kamwe kamwe, kusvetuka kusingawanzoitika kweshanduro, kana kuburitswa kwakawandisa mu npm malware uye pypi malicious package.
Kudzidziswa kweVagadziri paKuona Kodhi Yakaipa muna npm nePyPI
Dzidzisai mapoka kuona zviratidzo zvakaita se:
- Mazita emapakeji ane mapoinzi ekunyora (
reqeustpanzvimbo yerequest). - kujairika
installorpreparezvinyorwa. - Mapakeji akagadzirwa munguva pfupi yapfuura ane nhamba dzeshanduro dzakakwira zvinokatyamadza.
Kupfuura zvose, kuziva uku kunobatsira kuona kodhi ine njodzi pakutanga.
Kuongororwa kweRuntime Anomaly kweMapakeji ane Malicious npm uye PyPI Malware
Kunyangwe kana malware ikasatarisa zvinhu zvisina kumira zvakanaka, kuongororwa kwenguva yekumhanya kuri mukati CI/CD inogona kubata:
- Kubatana kwenetiweki kusingatarisirwi.
- Kugadziriswa kwemafaira system kunze kwemadhairekitori anotarisirwa.
- Kuedza kutsungirira mumabasa ese.
Chekupedzisira, izvi zvinoita kuti npm malware ne pypi malware zvisashande kunyangwe mushure mekuiswa.
Nekubatanidza izvi zvinodzora, mapoka anodzivirira mapakeji e-npm ane njodzi uye mapakeji e-pypi ane njodzi kuti asasvike pakugadzirwa. pipelines.
Edza maturusi ekuona mavhairasi eXygeni
Xygeni inopa:
- Kuwanikwa kwekodhi yakaipa panguva chaiyo, kusanganisira backdoors, spyware, uye ransomware.
- Kusiyana nema scanner ekutanga, ongororo ye npm, PyPI, Maven, NuGet, RubyGems, nezvimwewo.
- Kuvharira kwekuvaka otomatiki kana mushumo we malware unoratidza njodzi.
- Ruzivo rwekushandiswa kwechinhu, kuongorora mukurumbira wemuchengeti, uye kuona zvinhu zvisina kujairika.
Gara Uchiziviswa
Chikwata chedu chinogadzirisa peji rino vhiki rega rega. Kuti mugamuchire zviziviso nemishumo yakadzama:
- Nyorera kune zvedu Newsletter
- tevera @XygeniSecurity paLinkedin
- Isa chiratidzo papeji rino kuti utevere zvazvino malware e npm uye pypi malware zvinotyisa
