Vhiki rimwe nerimwe, masisitimu edu ekuona malware anoskena zviuru zvemapakeji matsva uye akagadziridzwa mumarejista everuzhinji akadai se npm nePyPI.
Vhiki rino raive rakabatikana zvikuru.
Takasimbisa Mapakeji makumi mapfumbamwe nematatu ane njodzi, kunyanya mhiri npm, nedzimwe nyaya dziri mu P&PI, OpenVSX, uye munyori. Dzakawanda dzakaonekwa mumaboka akarongeka, nekuburitswa kwakashata kakawanda kwakabudiswa nemazita akafanana kana mumhuri dzemapakeji dzine hukama hwepedyo. module dzekubhadhara nekubhadhara, enterprise uye mapakeji ewebhu emukati, vatengi vekuongorora, Nheyo dzeUI, zvishandiso zvevagadziri, vaongorori vezvikamu, mapakeji ane dingindira regore neGoogle, nedzimwe modules dzinowanzo shandiswa mumabasa ekuvandudza emazuva ano.
Izvi zvakanga zvisiri zvinhu zvisina kujairika. Chakanyanya kuoneka vhiki rino kwaive kukura kwekuburitswa kwemashoko kakawanda mumhuri imwe chete yemapakeji, kushandiswazve kwemapatani emazita, uye nzira iyo mapakeji ane njodzi aionekwa seakavimbika mukati mekutumira software chaiyo. pipelines.
Mufananidzo uyu wevhiki nevhiki chikamu chedu chinoenderera mberi Kuongororwa kweMakodhi Akaipa, patinosimbisa njodzi itsva uye kupa hungwaru hunogona kushandiswa kubatsira Zvikwata zveDevSecOps chengetedza yavo pipelines usati wakuvara.
Ngatitsanangure zvatakawana vhiki rino uye kuti nei zvichikosha.
| Ecosystem | nhuri | zuva |
|---|---|---|
| npm | yakanyorwa pa:99.1.10 | Apr 27, 2026 |
| pypi | moonbit-locale-compat:0.2.3 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.13 | Apr 27, 2026 |
| npm | @sbt_gitverse/analytics-client:99.0.1 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.33.1 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.14 | Apr 27, 2026 |
| npm | @tochka-ui/nheyo:99.0.2 | Apr 27, 2026 |
| vhuravsx | arcane-spark/ubel:0.1.0 | Apr 28, 2026 |
| npm | @2011-08-19/n:99.9.9 | Apr 28, 2026 |
| npm | @frengki0707/google-cloud-clone:1.38.0 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.38.1 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.39.0 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.43.0 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.44.0 | Apr 27, 2026 |
| npm | google-logging-utils-yemukati: 9.9.9 | Apr 27, 2026 |
| npm | google-logging-utils-yemukati: 1.1.4 | Apr 27, 2026 |
| npm | @combinezone/dingindira:99.9.10 | Apr 28, 2026 |
| npm | maninos:1.3.0 | Apr 28, 2026 |
| npm | @inheritdoc/n:99.9.9 | Apr 28, 2026 |
| npm | @mts-pay/web-sdk:99.9.9 | Apr 28, 2026 |
| npm | @cashback/mashandiro-ekuita-sei-widget:99.9.9 | Apr 28, 2026 |
| npm | @mari inodzoserwa/postal-premium: 99.9.9 | Apr 28, 2026 |
| npm | @toprimitive/nif:99.9.9 | Apr 28, 2026 |
| npm | @tostringtag/nsettostringtag:99.9.9 | Apr 28, 2026 |
| npm | maneja we rtms: 1.4.0 | Apr 28, 2026 |
| npm | vscode-component-explorer:99.9.15 | Apr 28, 2026 |
| npm | js-component-explorer:99.9.16 | Apr 27, 2026 |
| npm | js-component-explorer:99.9.17 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.15 | Apr 27, 2026 |
| npm | @tochka-ui/nheyo:99.0.3 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.16 | Apr 27, 2026 |
| npm | @sbt_gitverse/analytics-client:99.0.4 | Apr 27, 2026 |
| npm | @tochka-ui/nheyo:99.0.4 | Apr 27, 2026 |
| npm | kl-b2c-ui-kit:99.0.1 | Apr 27, 2026 |
| munyori | dot-env-it/laravel-core-helper:v1.0.0 | Apr 28, 2026 |
| npm | uipath-ui-widgets:1.0.1 | Apr 28, 2026 |
| npm | mapurogiramu akazvimirira: 1.0.1 | Apr 28, 2026 |
| npm | @tw-utils/static:99.0.1 | Apr 27, 2026 |
| npm | @tw-models/storage:99.0.1 | Apr 27, 2026 |
| npm | @tw-marionette/clipboard:99.0.1 | Apr 27, 2026 |
| npm | @tw-marionette/input:99.0.1 | Apr 27, 2026 |
| npm | Apollo-landing:1.0.1 | Apr 28, 2026 |
| npm | basa rekugadzirisa-app:1.0.1 | Apr 28, 2026 |
| npm | apollo-vertex:1.0.1 | Apr 28, 2026 |
| npm | @ozon-complt/split:99.0.1 | Apr 27, 2026 |
| npm | @apple-pay-trust/destroy:99.0.1 | Apr 27, 2026 |
| npm | @apple-pay-trust/merchant-session:99.0.1 | Apr 27, 2026 |
| npm | @apple-pay-trust/start:99.0.1 | Apr 27, 2026 |
| npm | @google-pay-trust/finish:99.0.1 | Apr 27, 2026 |
| npm | @apple-pay-trust/finish:99.0.1 | Apr 27, 2026 |
| npm | @apple-pay-trust/validate-merchant:99.0.1 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.17 | Apr 27, 2026 |
| npm | @zirutan/utils:1.0.2 | Apr 27, 2026 |
| npm | @zirutan/utils:1.0.4 | Apr 27, 2026 |
| npm | mushumo-ng:1.0.2 | Apr 27, 2026 |
| npm | kl-b2c-ui-kit:99.0.2 | Apr 27, 2026 |
| npm | @apple-pay-trust/bvumidza-kubhadhara:99.0.2 | Apr 27, 2026 |
| npm | @google-pay-trust/bvumidza-kubhadhara:99.0.2 | Apr 27, 2026 |
| npm | @ozon-complt/antibot-handler:99.0.2 | Apr 27, 2026 |
| npm | @sbt_gitverse/analytics-client:99.0.5 | Apr 27, 2026 |
| npm | @tw-models/storage:99.0.2 | Apr 27, 2026 |
| npm | frank-bot-gogle-cloning:1.1.0 | Apr 27, 2026 |
| npm | frank-research-poc-apple:1.1.4 | Apr 27, 2026 |
| npm | @google-pay-trust/init-google-pay-result:99.0.2 | Apr 27, 2026 |
| npm | @google-pay-trust/start:99.0.2 | Apr 27, 2026 |
| npm | @b2b_blocker/show_activation_error:99.0.2 | Apr 27, 2026 |
| npm | @business_promocode/cancel_promocode:99.0.2 | Apr 27, 2026 |
| npm | @business_promocode/apply_promocode:99.0.2 | Apr 27, 2026 |
| npm | @b2b_blocker/hide_activation_error:99.0.2 | Apr 27, 2026 |
| npm | apple-yemukati-pki-zvishandiso:1.0.1 | Apr 27, 2026 |
| npm | apuro-yemukati-pki-trust-v5:1.0.0 | Apr 27, 2026 |
| npm | @taxmoninor/taxmon:99.0.6 | Apr 28, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.19 | Apr 28, 2026 |
| npm | @apiary-annex/meta:99.0.4 | Apr 28, 2026 |
| npm | @apple-pay-trust/yakanzurwa:99.0.3 | Apr 28, 2026 |
| npm | @apple-pay-trust/check-apple-pay:99.0.3 | Apr 28, 2026 |
| npm | @apple-pay-trust/check-apple-pay:99.0.4 | Apr 28, 2026 |
| npm | @apple-pay-trust/finish:99.0.3 | Apr 28, 2026 |
| npm | @apple-pay-trust/merchant-session:99.0.4 | Apr 28, 2026 |
| npm | @apple-pay-trust/merchant-session:99.0.3 | Apr 28, 2026 |
| npm | @apple-pay-trust/finish:99.0.4 | Apr 28, 2026 |
| npm | @apple-pay-trust/destroy:99.0.4 | Apr 28, 2026 |
| npm | @apple-pay-trust/destroy:99.0.3 | Apr 28, 2026 |
| npm | @pyme-web/web-api:99.0.4 | Apr 28, 2026 |
| npm | @google-pay-trust/bvumidza-kubhadhara:99.0.4 | Apr 28, 2026 |
| npm | @google-pay-trust/finish:99.0.3 | Apr 28, 2026 |
| npm | @google-pay-trust/init-google-pay:99.0.4 | Apr 28, 2026 |
| npm | @google-pay-trust/start:99.0.4 | Apr 28, 2026 |
| npm | kl-b2c-ui-kit:99.0.3 | Apr 28, 2026 |
| npm | @ozon-complt/antibot-handler:99.0.3 | Apr 28, 2026 |
| npm | @ozon-complt/antibot-handler:99.0.4 | Apr 28, 2026 |
| npm | @tw-models/storage:99.0.3 | Apr 28, 2026 |
| npm | @w3m-app/is_connected:99.0.4 | Apr 28, 2026 |
| npm | @w3m-frame/session_update:99.0.4 | Apr 28, 2026 |
| npm | accesso-angular-cache-buster:99.9.0 | Apr 29, 2026 |
| npm | accesso-angular-cache-buster:99.0.0 | Apr 29, 2026 |
| npm | gadziriro yehp:2.0.0 | Apr 29, 2026 |
Chengetedza Kuvimba Kwako Nevashandisi Vasina Ruzivo uye Kusava Nekodzero Dzekuchengetedza Makombiyuta
Deredza njodzi uye chengetedza mapurogiramu ako kubva kumapakeji ane njodzi ane Kuonekwa Kwemarware EXygeni PakutangaIsa zvinhu zvinonyanya kukosha uye gadzirisa matambudziko anonyanya kukosha. Mhinduro yedu yakazara inopa kutarisa nguva chaiyo kwezvishandiso zvako kuti uone uye uderedze njodzi dzisati dzakanganisa software yako.
Kutarisira zvikamu zvemapurogiramu akavhurika munzvimbo iripo yekugadzira software kwakakosha nekuda kwekuwedzera kwekusagadzikana uye kutyisidzira kwekodhi yakaipa. Xygeni's Open Source Security Mhinduro inoongorora uye inovhara mapakeji ane njodzi kana yaburitswa, zvichideredza zvikuru njodzi yekuti malware nenjodzi zvipinde mumasisitimu ako. Kutarisa kwedu kwakazara kunosanganisira marejista eruzhinji akawanda, tichiona kuti zvese zvinoenderana nazvo zvinoongororwa kuti zvionekwe zvakanaka uye zvakavimbika. Xygeni inowedzera kugona kwechikwata chako kuchengetedza mapurojekiti esoftware akachengeteka uye akavimbika nekuisa zvinhu zvakakosha pakutanga uye kutungamira maitiro ekugadzirisa akareruka.
Xygeni inoshandisa nzira dzakasiyana-siyana kumisa kodhi yakaipa isati yapararira. Chekutanga, ongororo yekodhi isingachinji inoona maitiro ekuvhara, mitoro yakavanzwa, uye kushandiswa zvisina kunaka kwescript. Pamusoro pezvo, ongororo dzesandboxing dzinoitwa nemaitiro ekuita. hooks, mirairo yekumhanya, uye matipi ekutsungirira. Uyezve, kuona machine learning kunoratidza zero-day npm malware uye pypi malware variants zvisipo nema signature scanners. Pakupedzisira, Early Warning System inotarisa marepository everuzhinji munguva chaiyo, inosimbisa zvakawanikwa, uye inonyevera mapoka eDevOps ipapo ipapo.
Nekuda kweizvozvo, musanganiswa uyu unoita kuti vagadziri vagamuchire ruzivo rwakakurumidza uye runoshanda rwakabatanidzwa zvakananga mu CI/CD workflows.
Nei Vagadziri Vachifanira Kufarira Nezve Matambudziko eNpm
Zvinotyisa zvemazuva ano hazviwanzo mirira nguva yekumhanya. Semuenzaniso, mapakeji e-npm ane njodzi anowanzo shandiswa panguva yekuiswa, nepo mapakeji e-pypi ane njodzi achiviga kubuda kwematokeni kana masuo ekumashure. Varwi:
- Chinja ma reposi eGitHub akavanzika kuita eruzhinji kuti adzokorore.
- Budisa zvitupa nezvakavanzika uchishandisa zvinhu zvakanyoreswa.
- Shandisa maJavaScript loaders asina kujeka kuti uise ransomware kana botnets.
Kutaura zvazviri, mapakeji ekutsvaga ruzivo rwakapararira akawedzera ne156% mugore rimwe chete. Nokudaro, zvikwata zvinongovimba chete nema feeds akanonoka kana ma basic scanners zvinosara kumashure.
Zvinotevedzwa neMalware Report iyi muna npm nePyPI
Kuverenga uku ndiko musimboti we:
- Mapakeji eNpm ane hutsinye akasimbiswa
- Mapakeji ane njodzi ePypi akasimbiswa
- Kuonekwa kwekodhi ine njodzi kunoenderana nemaitiro
- Zviitiko zvakasimbiswa neRegistry
- Pfupiso yemishumo yemalware yevhiki nevhiki uye yemwedzi
- Nhoroondo yekuchinja kwezvese zvakawanikwa pa npm malware ne pypi malware
Nemamwe mashoko, inopa pfungwa imwe chete yekutarisa. Chikwata chekutsvagisa cheXygeni chinovandudza peji rino vhiki nevhiki nekubatanidza kune zvese zvekuongorora tekinoroji uye maGitHub IOC.
Maitiro Ekudzivirira Kubva kuMarware eNpm uye PyPI Malware
Nekuda kwengozi iyi iri kukura, masangano anoda dziviriro yakasimba:
- Simbisai kuiswa kwe lockfile chete (
npm ciin CI/CD. - Uyezve, tarisa zvinoenderana nekushandisa Xygeni's Early Warning Engine.
- Uyezve, block inovaka pazviratidzo zvekodhi yakaipa uchishandisa Guardrails.
- tanga SBOMs kutsvaga zvinhu zvisina kunanga uye kushandisa marongero.
- Pamusoro pezvose, dzidzisai vagadziri vemapurogiramu kuti vaone kunyorwa kwemashoko asina kunaka, kuvharika, uye magwaro ekuisa anofungirwa.
Edza maturusi ekuona mavhairasi eXygeni
Xygeni inopa:
- Kuwanikwa kwekodhi yakaipa panguva chaiyo, kusanganisira backdoors, spyware, uye ransomware.
- Kusiyana nema scanner ekutanga, ongororo mukati me npm, P&PI, Maven, NuGet, rubygems, Uye zvakawanda.
- Kuvharira kwekuvaka otomatiki kana mushumo we malware unoratidza njodzi.
- Ruzivo rwekushandiswa kwechinhu, kuongorora mukurumbira wemuchengeti, uye kuona zvinhu zvisina kujairika.
