Malware a Npm kajeno e ntse e tsoela pele ho fetoha, ka bahlaseli ba phatlalatsang khoutu e kotsi, liphutheloana tsa npm tse mpe, 'me Liphutheloana tse kotsi tsa PyPI e etselitsoe ho shebana le mesebetsi ea nts'etsopele, CI/CD pipelines, le tikoloho e bulehileng. Khoutu e mpe ea Molao ke tlaleho e tsoelang pele ea lipatlisiso ea Xygeni e latelang le ho netefatsa liphutheloana tsa 'nete tse kotsi ho pholletsa le npm, PyPI, Code VS, 'me OpenVSX, ho kenyeletsoa le batho ba sa tsebeng letho ba fumanweng ka morao, ba utsoang data, meputso e mengata ea ho ntša mangolo a tumello, le matšolo a malware a mefuta e mengata a iketsahalletseng.
Sehlopha sa rona sa bafuputsi se ntjhafatsa leqephe lena kgafetsa ka liphetho tse netefalitsoeng, matšoao a ho sekisetsa (IOCs), mekhoa ea boitšoaro, 'me Analysis botekgenikiKa lebaka leo, bahlahisi, Lihlopha tsa AppSec, 'me baenjiniere ba tšireletso ba ka lula ba le ka pele ho malware a npm kajeno le ts'ebetso e hlahang ea liphutheloana tse kotsi tse amang liketane tsa phepelo ea software ea sejoale-joale.
NPM Malware Kajeno: Kakaretso ea Beke le Beke la 24–29 Mmesa 2026
Bafuputsi ba tiisitse Liphutheloana tse 97 tse kotsi ho pholletsa le lingoliso tsa sechaba nakong ena.
Litlhokomeliso tsa sete ea lintlha
- Liphutheloana tse ngata tse netefalitsoeng li phatlalalitsoe ho npm
- Linyeoe tse ling tse amehileng PyPI, OpenVSX, 'me Moqapi
- Ho phatlalatsa ka mokhoa o kotsi khafetsa malapeng a tšoanang a sephutheloana le mabitso a amanang le sona
- Mekhoa e phahameng kapa e sa tloaelehang ea mofuta o kang 99. x, 99.9. x, 'me 1.0. x
- Tšebeliso e matla ea tefo le ho lefa, enterprisesetaele, sesebelisoa sa webo sa kahare, Analytics, Motheo oa UI, sesebelisoa sa moqapi, sehlooho sa maru, 'me e amanang le likarolo mekhoa ea ho reha mabitso
- Mehlala e mengata e hlophisitsoeng e reretsoeng ho tšoana le lintlafatso tsa liphutheloana tse nepahetseng
Tlaleho ea Khoeli le Khoeli ea Malware: Liphutheloana tsa npm tse Netefalitsoeng tse Loful ka Mmesa 2026
Rea u amohela khatisong ea morao-rao ea Xygeni Malicious Code Digest (Khatiso ea Khoeli le Khoeli), a April 2026, sehlopha sa rona sa lipatlisiso se tiisitse liphutheloana tse kotsi tse fetang 250, haholo-holo ho pholletsa le npm, ka linyeoe tse ling tse amang PyPI, Khoutu ea VS, OpenVSX, le Moqapi.
Mmesa e ne e se feela taba ea bophahamo ba modumo. maqhubu a phatlalatso a tsamaisoang ke othomathiki, matšolo a infleishene a mofuta o mabifi, ho kopanya malapa ka sephutheloana, 'me boiketsetso ba sesebelisoa sa kahare, re bone tse ling tsa mekhoa e hlahelletseng ka ho fetisisa khoeling ena ea ho phatlalatsa ka mokhoa o kotsi ho pholletsa le:
lisebelisoa tsa ka hare tsa bohata, liphutheloana tse nang le sehlooho sa AI, li-module tsa tefo le ho lefa, bareki ba tlhahlobo, likarolo tsa frontend, lisebelisoa tsa bahlahisi, lisebelisoa tsa Kubernetes le cloud, katoloso ea VS Code le OpenVSX, le mabitso a liphutheloana tse tšepahalang tse kang tsa cha a etselitsoeng ho kopana le phano ea software ea 'nete. pipelines.
Tsena e ne e se liketsahalo tse bonolo tsa ho ngola ka mongolo o sa reng letho. April sete ea lintlha, re bone mekhoa ea tšebeliso e mpe ea mangolo a tumello, taolo ea ketane ea phepelo, tšebeliso e phetoang ea sebaka sa mabitso, 'me phatlalatso e hlophisitsoeng e kotsi e etselitsoe ho kopana le libaka tsa moqapi oa 'nete le phano ea software pipelines.
Ho pholletsa le sete e pharaletseng ea data, re ile ra tsoela pele ho shebella khatiso e ngotsoeng ka mefuta e mengata, merero ea phetolelo e phahamisitsoeng, tefo- le enterprise-mabitso a sehlooho, Mabitso a liphutheloana tse nang le sehlooho sa AI le sa baemeli, SDK le ho etsisa karolo ea frontend, ho etsisa lisebelisoa tsa ka harele maqiti a khale a kang pherekano ea ho itšetleha 'me tlhahiso ea data.
Tlaleho ena ke karolo ea lenaneo la rona le tsoelang pele la Khoutu e mpe ea Molao, moo re netefatsang litšokelo tse ncha le ho fana ka bohlale bo sebetsang ho thusa Lihlopha tsa DevSecOps lula pele ho kotsi ea phepelo ea software.
| Ts'ebetso | sephutheloana | letsatsi |
|---|---|---|
| npm | e tšoailoeng ka pa:99.1.10 | Apr 27, 2026 |
| pypi | moonbit-locale-compat:0.2.3 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.13 | Apr 27, 2026 |
| npm | @sbt_gitverse/mosebelisi-oa tlhahlobo:99.0.1 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.33.1 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.14 | Apr 27, 2026 |
| npm | @tochka-ui/motheo:99.0.2 | Apr 27, 2026 |
| openvsx | tlhase ea arcane/ubel:0.1.0 | Apr 28, 2026 |
| npm | @2011-08-19/n:99.9.9 | Apr 28, 2026 |
| npm | @frengki0707/google-cloud-clone:1.38.0 | Apr 27, 2026 |
Mokhoa oa ho Fumana Khoutu e Lonya ho npm Malware le PyPI Malware
Xygeni e sebelisa mekhoa e mengata ho emisa khoutu e kotsi pele e hasana. Taba ea pele, tlhahlobo ea khoutu e sa fetoheng e lemoha mekhoa ea ho se utloisisehe, meputso e patiloeng, le tšebeliso e mpe ea sengoloa. Ho phaella moo, tlhahlobo ea sandboxing ea boitšoaro e kenya hooks, ditaelo tsa nako ya ho sebetsa, le maqheka a ho phehella. Ho feta moo, ho lemoha ho ithuta ha mochini ho hlwaya mefuta e fapaneng ya malware ya npm ya letsatsi le letsatsi le malware ya pypi e lahlehileng ke di-scanner tsa saena. Qetellong, Sistimi ya Temoso ya Pele e lekola dipolokelo tsa setjhaba ka nako ya sebele, e netefatsa diphihlello, mme e lemosa dihlopha tsa DevOps hang-hang.
Ka lebaka leo, motsoako ona o netefatsa hore bahlahisi ba fumana bohlale bo potlakileng le bo sebetsang bo kopantsoeng ka ho toba ho CI/CD workflows.
Hobaneng Bahlahisi ba Lokela ho Tsotella Liphutheloana tse Mpe tsa npm
Litšokelo tsa sejoale-joale hangata ha li emele nako ea ts'ebetso. Mohlala, liphutheloana tsa npm tse kotsi hangata lia sebetsa nakong ea ho kenya, ha liphutheloana tsa pypi tse kotsi li pata ho tsoa ha token kapa mamati a ka morao. Bahlaseli:
- Fetola li-repo tsa poraefete tsa GitHub ho ea ho sechaba ho li pheta-pheta.
- Ntša mangolo a thuto le liphiri u sebelisa meputso e kentsoeng ka khouto.
- Sebelisa li-loader tsa JavaScript tse sa tsejoeng ho kenya ransomware kapa li-botnets.
Ha e le hantle, liphutheloana tsa mohloli o bulehileng o kotsi li nyolohile ka 156% ka selemo se le seng. Ka hona, lihlopha tse itšetlehileng feela ka li-feed tse liehang kapa li-scanner tsa motheo lia salla morao.
Seo Tlaleho ena ea Malware e se Latelang ho npm le PyPI
Tlhaloso ena ke setsi sa mantlha sa:
- Liphutheloana tse mpe tsa npm tse netefalitsoeng
- Liphutheloana tse kotsi tsa pypi tse netefalitsoeng
- Ho lemoha khoutu e kotsi ho latela boitšoaro
- Liketsahalo tse netefalitsoeng ke ngoliso
- Kakaretso ea litlaleho tsa malware tsa beke le beke le khoeli
- Phetoho ea nalane ea liphetho tsohle tsa malware tsa npm le malware tsa pypi
Ka mantsoe a mang, e fana ka ntlha e le 'ngoe ea litšupiso. Sehlopha sa lipatlisiso sa Xygeni se ntlafatsa leqephe lena beke le beke ka lihokelo tsa tlhahlobo e felletseng ea tekheniki le GitHub IOCs.
Mokhoa oa ho Sireletsa Khahlanong le Liphutheloana tse mpe tsa npm le Malware ea PyPI
Ka lebaka la kotsi ena e ntseng e hola, mekhatlo e hloka ho feta liteko tsa motheo tsa ho itšetleha. Tšireletso e matla khahlanong le liphutheloana tsa npm tse kotsi le liphutheloana tsa pypi tse kotsi li hloka taolo ea thibelo le ts'ebetso ea nako ea ts'ebetso:
Kenya Ts'ebetsong Litlhophiso tsa Lockfile-Feela Khahlanong le Liphutheloana tsa Npm tse Locious
tshebediso npm ci or pip install --require-hashes in CI/CD.
Sena se netefatsa hore sefate se nepahetseng sa ho itšetleha se hlalositsoeng lifaeleng tsa senotlolo sea sebelisoa. Ka lebaka leo, bahlaseli ba ke ke ba thella liphetolelong tse fetotsoeng kapa tse thaepiloeng tsa liphutheloana tse kotsi tsa npm.
Ho Sekena Pele ho Npm Malware le PyPI Malware
Kopanya Enjene ea Tlhokomeliso ea Pele ea Xygeni ho hlahloba malware ea npm le malware ea pypi pele liphutheloana li fihla tikolohong ea hau.
Ho feta moo, lemoha tse belaetsang postinstall dingolwa, di-load tse sa tsejweng, kapa di-URL tsa C2 tse nang le dikhoutu tse thata.
Guardrails ho Thibela Meaho ka Khoutu e Lonya
Ipehele guardrails ho hloleha ho aha ka bohona haeba liphutheloana tse netefalitsoeng tsa npm tse kotsi kapa liphutheloana tse kotsi tsa pypi li fumanoa.
Mohlala, khefu e hahella hodima dipakete tse nang le bahlokomedi ba sa phatlalatswang, dipaterone tsa ho se kgomarele, kapa ditshwantshiso tsa IOC. Ka lebaka leo, khoutu e kotsi ha e fete e sa hlokomelwe.
Hlahisa le ho Netefatsa SBOMKhahlanong le Liphutheloana tsa npm tse mpe le Malware ea PyPI
Create SBOMs (CycloneDX, SPDX) bakeng sa kaho e 'ngoe le e 'ngoe.
Kamora moo, bapisa le liphutheloana tse tsebahalang tsa npm tse kotsi le li-feed tsa malware tsa pypi ho latela mekhoa e tobileng le e fetohang.
Tšireletso ea Bopaki le ea Matšoao ho npm Malware le PyPI Malware
Liphutheloana tse ngata tse mpe tsa npm li leka ho bala .npmrc, .pypirc, kapa diphetoho tsa tikoloho.
Ka hona, sebelisa li-builds ka har'a lijana tse thatafetseng tse pepesitseng liphiri tse fokolang. Ho feta moo, sebelisa batsamaisi ba liphiri ho e-na le mefuta-futa ea tikoloho ho thibela tšebeliso e mpe ea khoutu.
Hlokomela Liphetoho tsa Ngoliso le Mohlokomeli ho Liphutheloana tsa Npm tse Lokileng
Hangata bahlaseli ba utsoa merero e lahliloeng.
Haholo-holo, ela hloko liphetoho tse sa lebelloang tsa tlhokomelo ea mohlokomeli, ho tlola ho sa tloaelehang ha liphetolelo, kapa ho hatisoa ho feteletseng ho liphutheloana tsa npm malware le pypi malicious.
Koetliso ea Baqapi mabapi le ho Fumana Khoutu e Lonya ho npm le PyPI
Ruta lihlopha ho bona lifolakha tse khubelu tse kang:
- Mabitso a liphutheloana a nang le liphoso tsa ho ngola (
reqeustsebakeng sarequest). - e sa tloaelehang
installorpreparemengolo. - Liphutheloana tse sa tsoa etsoa tse nang le linomoro tsa mofuta o phahameng ka mokhoa o belaetsang.
Ka holim'a tsohle, temoho ena e thusa ho lemoha khoutu e kotsi esale pele.
Tlhahlobo ea Runtime Anomaly bakeng sa Liphutheloana tse mpe tsa npm le Malware ea PyPI
Esita le haeba malware e feta diteko tse sa fetoheng, ho lemoha nako ya tshebetso ho CI/CD e ka tšoasa:
- Likhokahano tsa marang-rang tse sa lebelloang.
- Liphetoho tsa sistimi ea lifaele ka ntle ho li-directory tse lebelletsoeng.
- Maiteko a ho phehella mesebetsing eohle.
Qetellong, sena se netefatsa hore litšokelo tsa npm malware le pypi malware lia emisoa esita le ka mor'a ho kenngoa.
Ka ho kopanya litsamaiso tsena, lihlopha li thibela liphutheloana tse kotsi tsa npm le liphutheloana tse kotsi tsa pypi ho fihlela tlhahiso. pipelines.
Leka Lisebelisoa tsa ho Lemoha Malware tsa Xygeni
Xygeni e fana ka:
- Ho lemoha khoutu e kotsi ka nako ea sebele, ho kenyeletsoa le backdoors, spyware le ransomware.
- Ho fapana le di-scanner tsa motheo, tlhahlobo ho pholletsa le npm, PyPI, Maven, NuGet, RubyGems, le tse ding.
- Thibelo ea kaho e iketsahallang ha tlaleho ea malware e khetholla kotsi.
- Temohisiso ea tšebeliso e mpe, liteko tsa botumo ba mohlokomeli, le ho lemoha lintho tse sa tloaelehang.
Lula U Ruta
Sehlopha sa rona se ntjhafatsa leqephe lena beke e nngwe le e nngwe. Ho fumana ditemoso le ditlaleho tse qaqileng:
- Ingolise ho tsa rona lekwalodikgang
- Follow @XygeniSecurity ho Linkedin
- Tšoaea leqephe lena ho latela tsa morao-rao malware a npm 'me pypi malware litšokelo
