Anenge vhiki rega rega, masisitimu edu ekuona malware anoskena zviuru zvemapakeji matsva uye akagadziridzwa mumarejista everuzhinji akadai senpm nePyPI. Vhiki rino hazvina kusiyana.
Takasimbisa mapakeji anodarika zana nemakumi matatu pakati paChikumi 7 naChikumi 12, 2026, akawanda acho ari munpm, pamwe nemamwe macases ari muPyPI. Akawanda akaonekwa mumaclusters akarongeka, akadzokororwa kuburitswa kwemamwe mazita kana mumhuri dzemapakeji dzine hukama hwakasimba.
Nyaya yakanakisa vhiki rino yaive sensivity, iyo yakazadza npm nemavhidhiyo anopfuura makumi manomwe akaburitswa muhuwandu hwe2.5.x, yakasimbiswa kwemazuva akati wandei. Mamwe mapoka anozivikanwa aisanganisira fungu re @solana-labs typosquats dzakanangana neSolana ecosystem (web3.js, web3-js, etherjs, spl-toke, ancor, web3js — mumakwikwi maviri akasiyana ekuburitsa mabhuku musi wa7 Chikumi na8 Chikumi), iyo @nstrlabs mhuri (sdk, ixel, utils, shared-components, api-client, auth - dependency confusion kurwisa internal package namespace), iyo @klapp-login-platform boka (native-sdk, oidc, routes — kutevedzera chikuva chekusimbisa), internallib_v557 uye internallib_v984 (shanduro dzakawanda dzevanyengeri vemukati meraibhurari vasina kujeka), pocteszep (Mavhezheni matanhatu akabudiswa musi wa11 Chikumi), uye boka rezvinhu zve crypto ne Web3 zvinosanganisira blockchain-helper-0, ethereum-kit-1, ethereum-kit-9, crypto-utils-7, wallet-sdk-9, defi-tools-39, swap-sdk-87, uye farming-tools-12. The morningstar-design-system Pakeji iyi yakaonekwa mushanduro nhatu musi wa10 Chikumi, ichitevedzera hurongwa hwekugadzira mari hunozivikanwa. MuPyPI, helixagentai, telegramlite, uye cdjeez zvakasimbiswa mukati mevhiki rese.
Izvi zvakanga zvisiri zvinhu zvisina kujairika. Chakanyanya kuoneka vhiki rino kwaiva kuwanda kwekuvhiringidzika kwekuvimbana nevanhu vachishandisa nzvimbo dzemazita epakeji, kuburitswa kwemazuva akawanda kwebhuku iri. sensivity cluster, uye kuramba kuchinangwa kweWeb3 neSolana tooling, maitiro akawedzera zvakanyanya muna 2026.
Mufananidzo uyu wevhiki nevhiki chikamu cheMalicious Code Digest yedu iri kuenderera mberi, kwatinosimbisa njodzi itsva uye kupa hungwaru hunoshanda kubatsira matimu eDevSecOps kuchengetedza kwavo pipelines usati wakuvara.
Ngatitsanangure zvatakawana vhiki rino uye kuti nei zvichikosha.
Usarega Mapakeji Anokuvadza Achisvika Pakugadzirwa
Mapakeji anoshandiswa nezvikwata zvako ari kushandiswa zvakanyanya senzvimbo yekupinda. Kuonekwa Kwemarware EXygeni Pakutanga inoongorora marejistri panguva chaiyo, saka njodzi dzakadai sedziri muchidimbu chevhiki rino dzinovharwa dzisati dzasvika pazvivakwa zvako.
Zvakawanikwa vhiki rino zvinotiyeuchidza kuti mazano aya ari kunyanya kurongwa nemaune. Kufashukira kweshanduro, kutevedzera nzvimbo dzemazita, uye mishandirapamwe yakarongeka yemazuva akawanda hazvisiri nyaya dzengozi zvakare, asi zviri standard Bhuku rekutamba rekurwisa. Kuongororwa kamwe chete uye kuongororwa nemaoko hakugone kuenderana nemakampeni anoburitsa akawanda mavhezheni mumazuva akawanda uye marejistri panguva imwe chete.
Xygeni's Open Source Security Mhinduro iyi inoita kuti timu dzeDevSecOps dzirambe dzichionekwa munpm, PyPI, nezvimwewo, dzichiona mapakeji ane njodzi panguva yekuburitswa, dzichiisa pamberi zvinhu zvinokonzera njodzi chaiyo, uye dzichipfupisa nzira kubva pakuonekwa kusvika pakugadziriswa. Saka timu dzako dzinogona kutumira nekukurumidza pasina kukanganisa kuchengetedzeka.
