Vhiki rimwe nerimwe, masisitimu edu ekuona malware anoskena zviuru zvemapakeji matsva uye akagadziridzwa mumarejista everuzhinji akadai senpm nePyPI. Vhiki rino hazvina kusiyana.
Takasimbisa mapakeji anodarika mazana maviri ane njodzi pakati paChikumi 12 naChikumi 19, 2026, akawanda acho ari munpm, pamwe nemamwe macases ari muPyPI. Akawanda akaonekwa mumaclusters akarongeka, akadzokororwa kuburitswa kwenjodzi kwakabudiswa nemazita akafanana kana mumhuri dzemapakeji dzine hukama hwakasimba.
Nyaya yakanakisa vhiki rino yaive sensivity, iyo yakazadza npm nemavhidhiyo anopfuura makumi manomwe akaburitswa muhuwandu hwe2.5.x, yakasimbiswa kwemazuva akati wandei. Mamwe mapoka anozivikanwa aisanganisira fungu re @solana-labs typosquats dzakanangana neSolana ecosystem (web3.js, web3-js, etherjs, spl-toke, ancor, web3js — mumakwikwi maviri akasiyana ekuburitsa mabhuku musi wa7 Chikumi na8 Chikumi), @nstrlabs mhuri (sdk, ixel, utils, shared-components, api-client, auth — kurwiswa kwekusawirirana kwekuvimbana nepakeji yemukati (namespace), iyo @klapp-login-platform boka (native-sdk, oidc, routes — kutevedzera chikuva chekusimbisa), internallib_v557 uye internallib_v984 (shanduro dzakawanda dzevanyengeri vemukati meraibhurari vasina kujeka), pocteszep (Mavhezheni matanhatu akabudiswa musi wa11 Chikumi), uye boka rezvinhu zve crypto ne Web3 zvinosanganisira blockchain-helper-0, ethereum-kit-1, ethereum-kit-9, crypto-utils-7, wallet-sdk-9, defi-tools-39, swap-sdk-87, uye farming-tools-12. The morningstar-design-system package yakaonekwa mushanduro nhatu musi wa10 Chikumi, ichitevedzera hurongwa hwekugadzira mari hunozivikanwa.
Kubva musi wa13 Chikumi zvichienda mberi, kumhanya kwacho kwakawedzera. houzidawang806 boka rega ndiro rakaburitsa mavhezheni anopfuura makumi maviri nemashanu pazuva rimwe chete, rakabatanidzwa nevanun'una houzidawang807 uye houzidawang808. The metrics-pipeline-d8k2 Pakeji iyi yakaburitswazve nguva nenguva mushanduro makumi maviri nerimwe pakati paChikumi 15 naChikumi 18 — chirongwa chekunzvenga chakagadzirirwa kuramba chiri pamberi pezvinyorwa zvinorambidzwa. friendly-greeter-demo Pakeji yakaramba ichionekwazve mushanduro dzakasiyana-siyana mukati mevhiki rese. Kuedza kutsva kwekuvhiringidzika kwekuvimba kwakaonekwa pasi pe xy-shared, axl-ui, loadninja-shared, carousel-controller-mixin, token-prices-cron, hemi-supply-cron, portal-backend, vault-strategies, nedzimwe dzakati wandei — dzese dzine manhamba eshanduro akakwidzwa mu999.x range. Boka idzva remazita ekushandisa akajairika ane zvimisikidzo zvehex zvisina kurongeka (color-utils-dee0, data-utils-d703, string-tools-be6c, type-check-816d, fmt-helpers-794b, metrics-probe-*) yakabuda musi wa18–19 Chikumi, zvichienderana nekunyoreswa kwehuwandu hwese kwakanyorwa. Vhiki rapera ne trimprompt, trimprompt-hub, claude-cup, uye web3-crypto-address-utils yakasimbiswa musi wa19 Chikumi. MuPyPI, neuralbridge-sdk (mavhezheni mashanu kubva pa4.5.x kusvika 5.1.x), deepstrain, teambot-ai, hello-test-s1, uye aiaddin-agent zvakasimbiswa mukati mevhiki rese.
Izvi zvakanga zvisiri zvinhu zvisina kujairika. Chakanyanya kuoneka vhiki rino kwaiva kuwanda kwekurwiswa kwevanoda kushandisa ruzivo rwevanhu vari mumakambani epakeji, mishandirapamwe yekuburitsa mabhuku kwemazuva akawanda yakagadzirirwa kuramba ichibviswa, kuramba kuchishandiswa Web3 neDeFi tooling (maitiro akawedzera zvakanyanya muna 2026), uye kuwedzera kushandiswa kwemazita emapakeji akafanana neruzha akagadzirwa kudzivirira kuonekwa nekubatana nemiti yakajairika yekushandisa ruzivo rwevanhu vari mumakambani.
Mufananidzo uyu wevhiki nevhiki chikamu cheMalicious Code Digest yedu iri kuenderera mberi, kwatinosimbisa njodzi itsva uye kupa hungwaru hunoshanda kubatsira matimu eDevSecOps kuchengetedza kwavo pipelines tisati takuvara. Ngatitsanangure zvatakawana vhiki rino uye kuti nei zvichikosha.
Usarega Mishandirapamwe Yakarongeka Ichipinda Mukati Mako Pipelines
Nyaya yevhiki rino yakanga isiri yekutyisidzira kumwe chete; yakanga iri pamusoro pehukuru. Mapakeji akasimbiswa anopfuura mazana maviri, shanduro yakaramba ichizadza kwemazuva akawanda, uye magwaro ekunyorera akawanda anomhanya nekukurumidza kupfuura zvinogona kutevedzwa nemaoko. Varwisi havasi kumirira kuti muwane ruzivo.
Kuonekwa Kwemarware EXygeni Pakutanga Vanotarisa npm, PyPI, nedzimwe nzvimbo dzekunyoresa nguva dzose, vachiratidza kutyisidzira panguva yekuburitswa, kwete mushure mekunge vasvika muchivakwa. Kana mushandirapamwe ukaburitsa shanduro makumi maviri nerimwe dzepakeji imwe chete ine njodzi kwemazuva mana, scan yevhiki nevhiki haibati chinhu panguva.
Xygeni's Open Source Security Mhinduro inopa timu dzako dzeDevSecOps kuoneka uye kukoshesa zvavanoda kuti varambe vari pamberi perudzi urwu rwekumanikidzwa kwakarongeka, saka yako pipelinerambai makachena musinganonotse zvikwata zvenyu.
