Amohela ho Khatiso ea Phuptjane ea Xygeni Malicious Code DigestKhoeling ena, sehlopha sa rona sa lipatlisiso tsa ts'ireletso se tiisitse tse fetang Liphutheloana tse 645 tse kotsi ho pholletsa le npm, PyPI, le (ka lekhetlo la pele) 'maraka oa katoloso oa VSCode.
Phuptjane e hlalositsoe ke mekhoa e meraro e kopanang: matšolo a tsoelang pele a ho phalla ha mefuta a reretsoeng ho feta manane a thibelo, ho potlaka ho hoholo ha litlhaselo tse shebaneng le lisebelisoa tsa AI le mesebetsi ea nts'etsopele ea baemeli, le litlhaselo tse hokahantsoeng tsa pherekano ea ho itšetleha khahlanong le libaka tsa mabitso tsa ka hare tsa monorepo.
Har'a matšolo a hlahelletseng ka ho fetisisa a tlalehiloeng khoeling ena:
- kutlo Npm e tletse metsi ka mefuta e fetang 70 ho pholletsa le mefuta ea 2.5.x, letšolo le tsoelang pele la ho qoba ho phatlalatsa bocha khafetsa ho lula pele ho ho tlosoa ha data.
- A letšolo la ho ngola la Solana la maqhubu a mabeli (Phuptjane 7–8) e phatlalalitse liphutheloana tse 15 tse iketsang eka ke tsa motho e mong
@solana-labsho sebelisa lisebelisoa tsa tikoloho, ho shebana le bahlahisi ba Web3 le DeFi ka kotloloho. - houzidawang806 e ne e le liphetolelo tse fetang 25 ka letsatsi le le leng (Phuptjane 13), e kopantsoe ke litekanyo-pipeline-d8k2 e phatlalalitsoe hape liphetolelong tse 21 pakeng tsa la 15-18 Phuptjane.
- The Pherekano ea CryptoDAO letšolo (la 17 Phuptjane) le phatlalalitse liphutheloana tse 11 ka mofuta oa 99.99.99, e 'ngoe le e 'ngoe e nkile mojaro o tšoanang oa ho kenya ka mor'a ho kenya CI/CD li-tokens, mangolo a tumello a leru, le liphiri tsa sepache sa crypto.
- Beke ea la 20-26 Phuptjane e tlisitse sepheo se seholo sa lisebelisoa tsa AI tsa khoeli: bathusi ba ollama (Liphetolelo tse 20), bathusi-ba-baemeli-ba-openai (Liphetolelo tse 23), monoclaude, bathusi ba ai-sdk, 'me @langgraphjs/lisebelisoa tsa lisebelisoa, kaofela li tiisitsoe ka beke e le 'ngoe, li shebane ka ho toba le kopanyo ea Ollama, baemeli ba OpenAI SDK, LangGraph, le Claude API.
- Tse peli li tiisitsoe katoloso ea VSCode e kotsi e hlahile khoeling ena, e leng se bontšang hore bahlaseli ba ntse ba atoloha ka nģ'ane ho li-registry tsa liphutheloana ho ea tikolohong ea bahlahisi ka bobona.
Mokhoa o hlalosang oa Phuptjane: litlhaselo li ntse li fetela ho likatoloso tsa IDE, lisebelisoa tsa moemeli oa AI, le mekhoa ea ts'ebetso ea moemeli moo sephutheloana se kotsi se kentsoeng ka boikemelo se se nang mohlahlobi oa motho pakeng tsa tšoaetso le ts'ebetso.
Ntlafatso ena ea khoeli le khoeli ke karolo ea boiteko bo tsoelang pele ba Xygeni ba ho etsa lipatlisiso ka malware le tšokelo ea ketane ea phepelo. Bakeng sa moelelo o felletseng ho pholletsa le sephutheloana se seng le se seng sa kotsi se tiisitsoeng khoeling ena, hlahloba Malicious Code Digest e felletseng ea Phuptjane le lipatlisiso tse amanang le eona ho tsoa ho Sehlopha sa Tšireletso sa Xygeni.
Beke ea 4: Liphutheloana tse fetang 201 li fumanoe
| Ts'ebetso | sephutheloana | letsatsi |
|---|---|---|
| June 20, 2026 | ||
| npm | panrouter: 5.0.2 + Mefuta e 30 ho pholletsa le 5.x–6.x e qala ho fihlela ka la 22 Phuptjane — letšolo le leholo la beke | Jun 20, 2026 |
| npm | trimprompt:1.0.5 + Mefuta e 4 — tswelopele ya beke e fetileng, e ntse e sebetsa | Jun 20, 2026 |
| npm | monoclaude:1.0.1 + Mefuta e 2 — Boiketsetso ba ho etsa lisebelisoa tsa Claude API | Jun 20, 2026 |
| vscode | Lenaneo-la-para-ea-orbit-agent-pair-for-smalltalk:1.206.0 + Mofuta o le mong — katoloso e kotsi ea VSCode e shebaneng le nts'etsopele ea moemeli | Jun 20, 2026 |
| npm | simplisafe-gatsby:1.0.1 Ho etsisa sebaka sa mabitso sa sethala sa lehae se bohlale | Jun 20, 2026 |
| June 21, 2026 | ||
| npm | atlasora-e arolelanoeng:1.0.0 + liphutheloana tse 6 — pherekano e hokahantsoeng ea ho itšetleha ka monorepo: atlasora-api, -client, -sdk, -types, -utils, -config | Jun 21, 2026 |
| npm | poso ea ho kopanya:4.0.2 + Mefuta e 6 — ho ngola hampe ka boomo letšolo le shebaneng le lisebelisoa tsa kopanyo | Jun 21, 2026 |
| npm | Sesebelisoa sa llm-traces:1.0.1 Lisebelisoa tsa ho shebella tsa LLM li reretsoe | Jun 21, 2026 |
| pypi | d0rk3r-telemetry:1.0.0 Sephutheloana sa telemetry se sa tsejoeng ho PyPI | Jun 21, 2026 |
| June 22, 2026 | ||
| pypi | tm-ai:2.91.75 + Mefuta e 7 — letšolo la likhohola la mofuta oa PyPI le tsitsitseng | Jun 22, 2026 |
| pypi | kopo-cache-py:1.0.4 + Mefuta e 6 — Phetolelo ea PyPI e tletse metsi | Jun 22, 2026 |
| pypi | li-corvino:0.17.0 + Mefuta e 6 — Letšolo la ngoliso ea PyPI ka bongata | Jun 22, 2026 |
| June 23, 2026 | ||
| npm | mothusi-oa-token oa web3:1.1.1 + Mefuta e 2 — Ho shebana le lisebelisoa tsa Web3 token | Jun 23, 2026 |
| npm | sefapano se le seng:1.0.1 + Mofuta o le mong — sehlopha sa mabitso a mono-* hammoho le monoclaude le monotacos | Jun 23, 2026 |
| June 24, 2026 | ||
| npm | bathusi ba ollama:0.1.0 + Mefuta e 19 — letšolo le leholo ka ho fetisisa la lisebelisoa tsa AI la khoeli, le shebaneng le nako ea ho sebetsa ea AI ea lehae ea Ollama | Jun 24, 2026 |
| npm | bathusi-ba-baemeli ba openai:0.1.1 + Mefuta e 22 — letšolo le hlophisitsoeng le shebaneng le tikoloho ea SDK ea baemeli ba OpenAI | Jun 24, 2026 |
| June 25, 2026 | ||
| npm | bathusi ba ai-sdk:1.4.3 Lisebelisoa tsa AI SDK tse reretsoeng ho sebelisoa hammoho le @langgraphjs/toolkit:1.2.11 | Jun 25, 2026 |
| npm | ho ingolisa-embedder:99.99.99-poc3 + hs-locale-management — Pherekano ea ho itšetleha ka sebaka sa mabitso sa HubSpot ka hare, sehlomathiso sa poc se tiisa letšolo la lipatlisiso le mafolofolo | Jun 25, 2026 |
| June 26, 2026 | ||
| npm | Kit ea likhoele tse bonolo: 1.0.1 + Mefuta e 8 ho kenyeletsoa le mofuta oa easy-string-kit232 — ngoliso ea bongata tlas'a lebitso la sesebelisoa se akaretsang | Jun 26, 2026 |
| npm | sephutheloana se sa sireletsehang-se kotsi: 1.0.0 + Mefuta e 5 — sephutheloana se boletsoeng ka ho hlaka e le letšolo le kotsi, le tiisitsoeng la mojaro, mohlomong letšolo la teko kapa la ho qholotsa | Jun 26, 2026 |
| npm | @vpms/mokgwa-wa-moralo:1.1.2 + Mefuta e 2 — mokhoa oa ho etsisa sebaka sa mabitso sa sistimi ea moralo | Jun 26, 2026 |
Beke ea 3: Liphutheloana tse fetang 200 li fumanoe
| Ts'ebetso | sephutheloana | letsatsi |
|---|---|---|
| June 13, 2026 | ||
| npm | houzidawang806:1.0.0 + Mefuta e 25 ho pholletsa le 1.0.x–1.2.x ho kenyeletsoa le banab'eso houzidawang807 le houzidawang808 — letšolo le ka sehloohong la beke | Jun 13, 2026 |
| npm | demo-ea-lumelisa-ea botsoalle:1.0.2 + Mefuta e 4 — letšolo le sa khaotseng le hlaha hape ka matsatsi a mangata | Jun 13, 2026 |
| npm | tsc-ai:1.2.0 sehlopha sa tsc-*: tsc-ai, tsc-mesh, tsc-lotl — Ho etsisa sebaka sa mabitso sa lisebelisoa tsa CI | Jun 13, 2026 |
| pypi | neuralbridge-sdk:4.5.4 + Mefuta e 6 ho pholletsa le 4.5.x–5.1.x — letšolo la PyPI la matsatsi a mangata le tsitsitseng | Jun 13, 2026 |
| June 15, 2026 | ||
| npm | litheko-tsa-token-cron:999.0.0 + Liphutheloana tse 6 — Sehlopha sa pherekano ea ho itšetleha ka meralo ea motheo ea DeFi se shebaneng le lisebelisoa tsa kahare tsa cron le vault | Jun 15, 2026 |
| June 16, 2026 | ||
| npm | bodega-sdk:9.9.9 + Liphutheloana tse 8 — Sehlopha sa likalimo tsa DeFi le tsa tikoloho ea Cardano: ho alima ka phallo, ho alima ka maqhubu, janus-*, flowcardano, flowdefi | Jun 16, 2026 |
| npm | metrics ea ketsahalo-q3x7:1.0.0 + Mefuta e 8 — sephutheloana sa hex-suffix se akaretsang se ngolisang mabitso a nang le sehlooho sa tlhokomelo e kholo | Jun 16, 2026 |
| npm | nic-datagov:1.0.0 + liphutheloana tse 3 — mokhoa oa ho etsisa sebaka sa mabitso sa sethala sa data sa mmuso: ogd-analytics, ogd-platform, dms-backend | Jun 16, 2026 |
| June 17, 2026 | ||
| npm | likonteraka tsa cryptodao:99.99.99 + Liphutheloana tse 10 — Pherekano ea ho itšetleha ka CryptoDAO: core, sdk, bot, config, utils, deploy, signer, backend, types | Jun 17, 2026 |
| pypi | teambot-ai:1.48.0 Lisebelisoa tsa moemeli oa AI tse reretsoeng ho PyPI | Jun 17, 2026 |
| June 18, 2026 | ||
| npm | litekanyo-pipeline-d8k2:1.0.0 + Mefuta e 20 ho pholletsa le la 18 Phuptjane — letšolo la ho qoba la letsatsi le le leng le tsitsitseng, le phatlalatsoang bocha khafetsa ho feta manane a thibelo | Jun 18, 2026 |
| npm | skena feela: 0.4.5 + Mefuta e 6 — mofuta oa letšolo la likhohola | Jun 18, 2026 |
| npm | color-utils-dee0:1.0.0 + Liphutheloana tse 5 tse akaretsang tsa hex-suffix: data-utils, string-tools, type-check, fmt-helpers, metrics-probe — ngoliso e ngotsoeng ka bongata | Jun 18, 2026 |
| npm | @litšebeletso-tsa-lab-azure/ml-ts:99.0.0 Ho etsisa sebaka sa mabitso sa Azure ML | Jun 18, 2026 |
| June 19, 2026 | ||
| npm | trimprompt:1.0.2 + trimprompt-hub — lisebelisoa tsa boenjiniere tse potlakileng li reretsoe | Jun 19, 2026 |
| npm | kopi ea claude: 0.8.6 Boiketsiso ba lisebelisoa tsa Claude API | Jun 19, 2026 |
| pypi | moemeli oa aiaddin:0.1.0 Lisebelisoa tsa moemeli oa AI tse reretsoeng ho PyPI | Jun 19, 2026 |
| npm | lisebelisoa tsa aterese ea crypto ea web3:0.1.0 Sepheo sa lits'ebeletso tsa Web3 | Jun 19, 2026 |
Beke ea 2: Liphutheloana tse fetang 135 li fumanoe
| Ts'ebetso | sephutheloana | letsatsi |
|---|---|---|
| June 7, 2026 | ||
| npm | @solana-labs/web3.js:1.0.0 + Mefuta e 5 — Letšolo la typosquat la Solana ecosystem, leqhubu la pele | Jun 7, 2026 |
| npm | @jisan901/teamfocus:1.0.0 + Mefuta e 2 | Jun 7, 2026 |
| npm | @sflyinc-knapsack/shutterfly-reaction:999.0.0 Pherekano ea ho itšetleha, mofuta o feteletseng | Jun 7, 2026 |
| June 8, 2026 | ||
| npm | @solana-labs/web3.js:1.98.102 + Mefuta e 9 — Letšolo la typosquat la Solana ecosystem, leqhubu la bobeli | Jun 8, 2026 |
| pypi | helixagentai:0.1.3 Lisebelisoa tsa moemeli oa AI tse reretsoeng ho PyPI | Jun 8, 2026 |
| June 9, 2026 | ||
| npm | @nstrlabs/sdk:99.0.0 + liphutheloana tse 7 — pherekano ea ho itšetleha khahlanong le sebaka sa lebitso sa ka hare sa monorepo | Jun 9, 2026 |
| npm | @klapp-login-platform/native-sdk:99.0.0 + Liphutheloana tse 9 — boiketsetso ba sethala sa netefatso ho pholletsa le libaka tse ngata tsa mabitso tsa klapp | Jun 9, 2026 |
| npm | blockchain-helper-0:1.0.0 + Liphutheloana tse 7 — sehlopha sa lisebelisoa tsa crypto/DeFi se shebaneng le bahlahisi ba Web3 | Jun 9, 2026 |
| npm | @karete-pci-data/lebenkele:99.0.0 Sebaka sa mabitso sa karete ea tefo se reretsoeng | Jun 9, 2026 |
| June 10, 2026 | ||
| npm | sistimi-ea-moralo oa morningstar:99.0.0 + Mefuta e 2 — boiketsetso ba sistimi ea moralo oa lichelete | Jun 10, 2026 |
| June 11, 2026 | ||
| npm | pocteszep:1.0.1 + Mefuta e 5 e phatlalalitsoeng letsatsing lona leo | Jun 11, 2026 |
| npm | @coze-common/sebaka sa moqoqo:99.1.1 Ho etsisa sebaka sa mabitso sethaleng sa moqoqo sa AI | Jun 11, 2026 |
| pypi | telegramlite:1.0.0 + Mofuta o le 1 — ho etsisa sethala sa melaetsa ho PyPI | Jun 11, 2026 |
| June 12, 2026 | ||
| npm | ecto-corsair-whisper-6f3b9:1.0.18 + Mefuta e 7 ea ecto-* — sehlopha sa mabitso a patiloeng | Jun 12, 2026 |
| npm | internallib_v984:1.0.3 + sehlopha sa internallib_v557 — mefuta e 13 ea baikhakanyi ba laeborari ea kahare | Jun 12, 2026 |
| npm | voyager-web:999.0.0 Pherekano ea ho itšetleha, mofuta o feteletseng | Jun 12, 2026 |
| pypi | cdjeez:0.32.0 | Jun 12, 2026 |
Beke ea 1: Liphutheloana tse fetang 118 li fumanoe
| Ts'ebetso | sephutheloana | letsatsi |
|---|---|---|
| E se eka 30, 2026 | ||
| npm | @cloudplatform-single-spa/tsamaiso:99.99.100 Pherekano ea ho itšetleha, mofuta o feteletseng | E se eka 30, 2026 |
| vscode | xampp-manejara: 5.1.3 Katoloso ea VSCode — ho etsisa sesebelisoa sa moqapi | E se eka 30, 2026 |
| June 1, 2026 | ||
| npm | @tse-digital/core:99.0.0 Pherekano ea ho itšetleha — @telenor-se le @ownit le tsona lia ameha | Jun 1, 2026 |
| npm | setsi sa lebenkele sa cms:1.3.4 + Mefuta e 2, sehlopha sa sebaka sa mabitso sa CMS | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.69 + Mefuta e 6, linomoro tsa mefuta e phahamisitsoeng tse shebaneng le mangolo a tumello a AWS | Jun 1, 2026 |
| npm | litokomane tsa bakuli: 75.0.0 Sepheo sa sebaka sa mabitso sa tlhokomelo ea bophelo bo botle | Jun 1, 2026 |
| npm | @emcd-vue/auth:6.4.9 Boiketsiso ba sebaka sa mabitso a phapanyetsano ea chelete ea crypto | Jun 1, 2026 |
| pypi | simtooreal-cli:0.3.0 | Jun 1, 2026 |
| June 2, 2026 | ||
| npm | kutlo: 2.5.8 + Mefuta e 70 ho pholletsa le mefuta ea 2.5.x, Phuptjane 2–5 — letšolo le matla la nako eo | Jun 2, 2026 |
| npm | @langgraphjs/lisebelisoa:1.2.10 Lisebelisoa tsa LangGraph li reretsoe | Jun 2, 2026 |
| June 4, 2026 | ||
| npm | @sentry-browser-sdk/profiling-node:1.0.1 + Mefuta e 2, ho etsisa sebaka sa mabitso sa Sentry | Jun 4, 2026 |
| npm | internallib_v346:1.0.3 + Mefuta e 2, moqhekelli oa laeborari ea kahare | Jun 4, 2026 |
| npm | bathusi ba ai-sdk:0.2.1 + Mefuta e 7, e shebaneng le lisebelisoa tsa AI SDK | Jun 4, 2026 |
Emisa Khoutu e Lonya Pele e Fihla ho Hao Pipeline
Litšokelo tsa ketane ea phepelo ea software li fetile khopolo-taba haholo. Litlhaselo tsa pherekano ea boitšepo, ba utsoang mangolo a tumello, malware e shebaneng le AI, le lisebelisoa tsa bahlahisi ba chefo li hlasela lihlopha tsa 'nete ka 'nete. SDLCbeke e 'ngoe le e 'ngoe.
Xygeni's ho lemoha malware 'me sethala sa ts'ireletso ea ketane ea phepelo e fa mekhatlo ponahalo ea ho tšoara mekhoa e kotsi pele e qala ho sebetsa mochining oa moqapi, ho kena tsamaisong ea kaho, kapa ho fihlela tlhahiso. Kakaretso e akaretsa npm, PyPI, VSCode, le ho feta, ho beha leihlo mekhoa e belaetsang ea phatlalatso, tšebeliso e mpe ea sebaka sa mabitso, ho ngola ka mongolo o fosahetseng, le mekhoa ea tlhaselo ea tlhaho ea AI ha e ntse e hlaha.
Sephetho se seng le se seng se etelletsoa pele ka boiketsetso ke ho sebelisoa ha sona, ho fihlelleha ha sona, le tšusumetso ea khoebo, kahoo sehlopha sa hau se tsepamisa maikutlo ho seo ehlile se hlokang ho lokisoa, eseng lerata.
Ebang ke sephutheloana se bulehileng se kotsi, sesebelisoa sa moqapi se senyehileng, kapa kotsi ea khoutu e hlahisoang ke AI, Xygeni e boloka lihlopha tsa tšireletso le tsa boenjiniere li le ka pele ho boemo ba tšokelo ea ketane ea phepelo.
Hlahloba sephutheloana se seng le se seng se kotsi le letšolo le netefalitsoeng ke Sehlopha sa Tšireletso sa Xygeni ho Khoutu e mpe ea Molao.
Lula u sireletsehile. Lula u potlakile. Lula u laola Xygeni.
