Vhiki rimwe nerimwe, masisitimu edu ekuona malware anoskena zviuru zvemapakeji matsva uye akagadziridzwa mumarejista everuzhinji akadai senpm nePyPI. Vhiki rino hazvina kusiyana.
Takasimbisa mapakeji anodarika makumi mapfumbamwe ane njodzi pakati paChikumi 26 naChikunguru 3, 2026, kuburikidza nenpm nePyPI, nemakwikwi akati wandei emavhiki apfuura uye matsva achibuda.
The nolimit-agent Kambani yakaramba ichiburitsa shanduro itsva (1.0.306, 1.0.315, 1.0.316), ichiwedzera framework yeMicrosoft 365 device-code phishing yatakanyora zvakadzama mudura redu. Mushumo weDeviceDoor. The anthropic-toolkit boka raive chirongwa chitsva chakakura, neshanduro makumi maviri dzakasimbiswa musi wa30 Chikumi chete — dzakanangana zvakananga nemapakeji ane chekuita nekushandisa maturusi eAnthropic ekugadzira. cursed-modules mhuri yakaburitsa shanduro dzinopfuura gumi neshanu pakati paChikunguru 1 naChikunguru 2 muzvose zviri zviviri standard uye nhamba dzeshanduro dzakakwidzwa (999.x), zvichitevera bhuku remitambo rekusawirirana kwekuvimbika. date-fns-lite boka (5 versions, Chikunguru 2) rakaramba richitevedzera mapakeji ekushandisa anoshandiswa zvakanyanya uye ari pamutemo.
Maitiro ekutarisa maturusi eAI akatangwa svondo rapfuura ne ollama-helpers uye openai-agents-helpers yakawedzerwa munguva ino ne ai-explain, ai-sdk-helpers, uye @langgraphjs/toolkit, zvese zvakasimbiswa pakati pa28 Chikumi na30 Chikumi. @szc-ft/mcp-szcd-client package (shanduro 0.38.0 na 0.39.0, yakasimbiswa musi wa2 Chikunguru) yakaunza pattern itsva yatiri kutevera se SkillLeak: chiziviso chekuongorora ruzivo chakavigwa mukati mehunyanzvi hweMCP kwete muchina wekuisa, chisingaonekwe nemaskena anomira mushure mekuisa. Takaburitsa a Ongororo yakazara yeSkillLeak pano.
Mufananidzo uyu wevhiki nevhiki chikamu chedu chinoenderera mberi Kuongororwa kweMakodhi Akaipa, kwatinosimbisa njodzi itsva uye tinopa hungwaru hunoshanda kuti tibatsire zvikwata zveDevSecOps kuchengetedza pipelines tisati takuvara. Ngatitsanangure zvatakawana vhiki rino uye kuti nei zvichikosha.
Mapakeji anopfuura 90. Vhiki Rimwe. Pipeline Ndiwo Chinangwa.
Kuverenga kwevhiki rino kunoratidza kuchinja kwekutarisa kwemurwisi, kwete huwandu hwemashoko chete, asi pambericision. Kufashamira kweshanduro inoenderera mberi, mapoka ekushandisa maAI, kuba kweMCP-layer credential, uye kuvhiringidzika kwekuvimbika kunorwisa nzvimbo dzemazita dzemukati dzemonorepo. Mishandirapamwe iyi inongoerekana yaitika uye inoramba iripo. Kuongororwa kwevhiki nevhiki hakusi kudzivirira.
Yambiro yeMalware Ekutanga yeXygeni inoongorora npm, PyPI, nedzimwe nzvimbo dzekunyoresa panguva chaiyo, ichiratidza njodzi panguva yekuburitswa, isati yasvika pakuvaka, mumiriri weAI asati aisa maakaundi acho ega, uye mubhadharo weSkillLeak usati wawana mukana wekuita. anthropic-toolkit inoburitsa shanduro makumi maviri muzuva rimwe chete kana cursed-modules floods npm ine vhezheni 999.x mumazuva maviri, kuonekwa kunoitika mushure mechiitiko kwatove kunonoka.
Xygeni's Open Source Security Chikuva chinopa zvikwata zveDevSecOps ruzivo rwekuona uye kuisa zvinhu zvakakosha panguva chaiyo zvinodiwa kuti zvirambe zviri pamberi pekumanikidzwa kwecheni yekugovera kwakarongeka, saka yako pipelinerambai makachena musinganonotse zvikwata zvenyu.
