Hoo e ka bang beke e 'ngoe le e 'ngoe, litsamaiso tsa rona tsa ho lemoha malware li skena liphutheloana tse likete tse ncha le tse ntlafalitsoeng ho pholletsa le li-registry tsa sechaba joalo ka npm le PyPI. Beke ena e bile mafolofolo haholo.
Re tiisitse Liphutheloana tse 198 tse kotsi, haholo-holo ho pholletsa le npm, ka linyeoe tse ling ho PyPI, OpenVSX, Composer, le VS Code extensions. Tse 'maloa li hlahile ka lihlopha tse hokahaneng, ka litokollo tse mpe tse pheta-phetoang tse phatlalalitsoeng tlas'a mabitso a tšoanang kapa ho pholletsa le malapa a liphutheloana tse amanang haufi-ufi. Nyeoe e ikhethang e ne e le sensivity sephutheloana, se ileng sa tlala npm ka ditokollo tse fetang 60 tse fetoletsweng ho pholletsa le mefuta ya 2.5.x. Dihlopha tse ding tse hlahelletseng di ne di kenyeletswa ai-sdk-helpers (Mefuta e 8 e shebaneng le bahlahisi ba AI), @antoncallahan/aws-user-helper (Mefuta e 7 e etsisang sesebelisoa sa AWS), @apple-pay-trust 'me @google-pay-trust malapa (ho etsisa di-module tsa ho lefa ditefello), @frengki0707/google-cloud-clone (Mefuta e 5 e qhekellang Google Cloud), le cms-storehub, cms-helpgit, 'me cms-github (ho shebana le CMS pipelines). Liphutheloana tse ngata li etsisa li-module tsa tefo le tsa ho lefa, enterprise le liphutheloana tsa webo tsa kahare, bareki ba tlhahlobo, metheo ea UI, lits'ebeletso tsa baqapi, bafuputsi ba likarolo, liphutheloana tsa leru le tsa Google, le li-module tse ling tse tšeptjoang haholo mesebetsing ea nts'etsopele ea sejoale-joale.
Tsena e ne e se lintho tse sa tloaelehang tse ikhethileng. Se ileng sa hlahella bekeng ena e ne e le boholo ba phatlalatso e pheta-phetoang malapeng a tšoanang a liphutheloana, ho sebelisoa hape ha mekhoa ea ho reha mabitso, le tsela eo liphutheloana tse kotsi li neng li patiloe ka eona ho shebahala joaloka lintho tse itšetlehileng ka molao ka har'a phano ea software ea 'nete. pipelines.
Setšoantšo sena sa beke le beke ke karolo ea Malicious Code Digest ea rona e tsoelang pele, moo re netefatsang litšokelo tse ncha le ho fana ka bohlale bo sebetsang ho thusa lihlopha tsa DevSecOps ho sireletsa tsa tsona. pipelinepele tshenyo e etsahala.
A re hlaloseng seo re se fumaneng bekeng ena le hore na ke hobane'ng ha se le bohlokoa.
| Ts'ebetso | sephutheloana | letsatsi |
|---|---|---|
| npm | @cloudplatform-single-spa/tsamaiso:99.99.100 | E se eka 30, 2026 |
| npm | @cloudplatform-single-spa/svp-s3-storage:99.99.100 | E se eka 30, 2026 |
| npm | @maximvs1538/os-npm:99.0.0 | E se eka 30, 2026 |
| npm | @ho kena habonolo/litsela tsa ho lula:99.9.5 | E se eka 30, 2026 |
| npm | @ho kena habonolo/ho-ngolisa-kantle-fop-navigator:99.9.5 | E se eka 30, 2026 |
| npm | @ho kena habonolo/litsela:99.9.5 | E se eka 30, 2026 |
| npm | @t-in-one/form_product_token:5.7.1 | E se eka 30, 2026 |
| npm | @capibar.chat/ui-kit:99.5.7 | E se eka 30, 2026 |
| vscode | xampp-manejara: 5.1.3 | E se eka 30, 2026 |
| npm | @template-ea moqoqo/auth:1.0.0 | E se eka 31, 2026 |
| npm | json-ho-ea-e bonolo-graphql-schema:1.0.0 | Jun 1, 2026 |
| npm | @ gs-khetha/tshebediso-ya-moreki-ya-poloko:99.0.0 | Jun 1, 2026 |
| npm | nemo-moqolotsi oa litaba:1.8.2 | Jun 1, 2026 |
| npm | cms-github:4.2.4 | Jun 1, 2026 |
| npm | cms-helpgit:4.2.6 | Jun 1, 2026 |
| npm | cms-helpgit:4.2.8 | Jun 1, 2026 |
| npm | setsi sa lebenkele sa cms:1.3.4 | Jun 1, 2026 |
| npm | setsi sa lebenkele sa cms:1.3.5 | Jun 1, 2026 |
| npm | setsi sa lebenkele sa cms:1.3.6 | Jun 1, 2026 |
| pypi | simtooreal-cli:0.3.0 | Jun 1, 2026 |
| npm | leano-la-sebaka-sa-mabenkele-pele: 1.1.1 | Jun 1, 2026 |
| npm | leano-la-sebaka-sa-mabenkele-pele: 1.1.2 | Jun 1, 2026 |
| npm | moqoqo-sdk:2.0.2 | Jun 1, 2026 |
| npm | veltrix:9.0.0 | Jun 1, 2026 |
| npm | veltrix:9.0.1 | Jun 1, 2026 |
| npm | jingmeideshishi:1.0.4 | Jun 1, 2026 |
| npm | jingmeideshishi:1.0.5 | Jun 1, 2026 |
| npm | @tse-digital/core:99.0.0 | Jun 1, 2026 |
| npm | @telenor-se/core:99.0.0 | Jun 1, 2026 |
| npm | @ownit/core:99.0.0 | Jun 1, 2026 |
| npm | litokomane tsa bakuli: 75.0.0 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.69 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.68 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.82 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.80 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.81 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.83 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.3 | Jun 1, 2026 |
| npm | @emcd-vue/auth:6.4.9 | Jun 1, 2026 |
| npm | @emcd-vue/b2b-pay-form:5.7.4 | Jun 1, 2026 |
| npm | @ccrm/user-storage-api-axios:5.0.1 | Jun 2, 2026 |
| npm | kutlo: 2.5.8 | Jun 2, 2026 |
| npm | kutlo: 2.5.12 | Jun 2, 2026 |
| npm | kutlo: 2.5.16 | Jun 2, 2026 |
| npm | kutlo: 2.5.17 | Jun 2, 2026 |
| npm | kutlo: 2.5.18 | Jun 2, 2026 |
| npm | kutlo: 2.5.19 | Jun 2, 2026 |
| npm | kutlo: 2.5.20 | Jun 2, 2026 |
| npm | kutlo: 2.5.21 | Jun 2, 2026 |
| npm | kutlo: 2.5.22 | Jun 2, 2026 |
| npm | kutlo: 2.5.23 | Jun 2, 2026 |
| npm | kutlo: 2.5.24 | Jun 2, 2026 |
| npm | kutlo: 2.5.25 | Jun 2, 2026 |
| npm | kutlo: 2.5.26 | Jun 2, 2026 |
| npm | kutlo: 2.5.27 | Jun 2, 2026 |
| npm | kutlo: 2.5.28 | Jun 2, 2026 |
| npm | kutlo: 2.5.29 | Jun 2, 2026 |
| npm | kutlo: 2.5.30 | Jun 2, 2026 |
| npm | kutlo: 2.5.31 | Jun 2, 2026 |
| npm | kutlo: 2.5.32 | Jun 2, 2026 |
| npm | kutlo: 2.5.41 | Jun 2, 2026 |
| npm | kutlo: 2.5.42 | Jun 2, 2026 |
| npm | kutlo: 2.5.43 | Jun 2, 2026 |
| npm | kutlo: 2.5.44 | Jun 2, 2026 |
| npm | kutlo: 2.5.45 | Jun 2, 2026 |
| npm | kutlo: 2.5.46 | Jun 2, 2026 |
| npm | bathusi ba meoo-ui:1.0.1 | Jun 2, 2026 |
| npm | @langgraphjs/lisebelisoa:1.2.10 | Jun 2, 2026 |
| npm | eyevox:9.0.1 | Jun 2, 2026 |
| npm | kutlo: 2.5.53 | Jun 3, 2026 |
| npm | kutlo: 2.5.54 | Jun 3, 2026 |
| npm | kutlo: 2.5.55 | Jun 3, 2026 |
| npm | kutlo: 2.5.56 | Jun 3, 2026 |
| npm | kutlo: 2.5.57 | Jun 3, 2026 |
| npm | kutlo: 2.5.61 | Jun 3, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.1 | Jun 4, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.2 | Jun 4, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.5 | Jun 4, 2026 |
| npm | tšebeletso ea ho bokella chelete:1.0.0 | Jun 4, 2026 |
| npm | kutlo: 2.5.67 | Jun 4, 2026 |
| npm | kutlo: 2.5.68 | Jun 4, 2026 |
| npm | mohlala oa tšebelisano-'moho ea vg:40.0.5 | Jun 4, 2026 |
| npm | internallib_v346:1.0.3 | Jun 4, 2026 |
| npm | internallib_v346:1.0.5 | Jun 4, 2026 |
| npm | internallib_v346:1.0.9 | Jun 4, 2026 |
| npm | bathusi ba ai-sdk:0.2.1 | Jun 4, 2026 |
| npm | bathusi ba ai-sdk:0.3.0 | Jun 4, 2026 |
| npm | bathusi ba ai-sdk:0.3.1 | Jun 4, 2026 |
| npm | bathusi ba ai-sdk:1.1.0 | Jun 4, 2026 |
| npm | bathusi ba ai-sdk:1.1.1 | Jun 4, 2026 |
| npm | bathusi ba ai-sdk:1.3.0 | Jun 4, 2026 |
| npm | bathusi ba ai-sdk:1.4.0 | Jun 4, 2026 |
| npm | bathusi ba ai-sdk:1.4.2 | Jun 4, 2026 |
| npm | @achuthvp/postinstall-poc:1.0.3 | Jun 4, 2026 |
| npm | kutlo: 2.5.0 | Jun 5, 2026 |
| npm | kutlo: 2.5.1 | Jun 5, 2026 |
| npm | kutlo: 2.5.2 | Jun 5, 2026 |
| npm | kutlo: 2.5.3 | Jun 5, 2026 |
| npm | kutlo: 2.5.4 | Jun 5, 2026 |
| npm | kutlo: 2.5.5 | Jun 5, 2026 |
| npm | kutlo: 2.5.13 | Jun 5, 2026 |
| npm | kutlo: 2.5.14 | Jun 5, 2026 |
| npm | kutlo: 2.5.15 | Jun 5, 2026 |
| npm | kutlo: 2.5.33 | Jun 5, 2026 |
| npm | kutlo: 2.5.34 | Jun 5, 2026 |
| npm | kutlo: 2.5.35 | Jun 5, 2026 |
| npm | kutlo: 2.5.36 | Jun 5, 2026 |
| npm | kutlo: 2.5.37 | Jun 5, 2026 |
| npm | kutlo: 2.5.38 | Jun 5, 2026 |
| npm | kutlo: 2.5.58 | Jun 5, 2026 |
| npm | kutlo: 2.5.59 | Jun 5, 2026 |
| npm | kutlo: 2.5.60 | Jun 5, 2026 |
| npm | kutlo: 2.5.62 | Jun 5, 2026 |
| npm | kutlo: 2.5.63 | Jun 5, 2026 |
| npm | kutlo: 2.5.64 | Jun 5, 2026 |
| npm | kutlo: 2.5.65 | Jun 5, 2026 |
| npm | kutlo: 2.5.66 | Jun 5, 2026 |
| npm | kutlo: 2.5.69 | Jun 5, 2026 |
Sireletsa Litšekamelo tsa Hao tsa Mohloli o Bulehileng Khahlanong le Bofokoli le Khoutu e Lonyang
Se ke oa lumella liphutheloana tse kotsi ho fihla ho uena pipelines. Tlhahlobo ea Malware ea Xygeni Pele E fa sehlopha sa hau ponahalo ea nako ea sebele litšokelong tse bohlokoa ka ho fetisisa, e tšoasa batho ba itšetlehileng ka bona ba kotsi pele ba ama software ea hau.
Jwalo ka ha tlhahlobo ya beke ena e hlakisa, bongata le boqhetseke ba matsholo a diphuthelwana tse kotsi ha di fokotsehe. Metswako e hokahaneng ya mofuta o hokahaneng, boiketsetso ba mojule wa tefo, le mabitso a diphuthelwana tse utlwahalang ka hare ke a mang a maqiti ao bahlasedi ba a sebedisang ho feta. standard ho itšireletsa. Ho lula u le ka pele ho litšokelo tsena ho hloka ho fetang tlhahlobo ea nako le nako, ho hloka tlhokomelo e tsoelang pele ho ngoliso e 'ngoe le e 'ngoe eo lihlopha tsa hau li itšetlehileng ka eona.
Xygeni's Open Source Security Tharollo e hlahloba le ho thibela liphutheloana tse kotsi moo li hatisoang teng, ho pholletsa le npm, PyPI, le ho feta. Ka ho beha pele bofokoli bo bakang kotsi e kholo ka ho fetisisa lefatšeng la 'nete (le ho nolofatsa tsela ea tokiso bakeng sa lihlopha tsa hau tsa DevSecOps) Xygeni e u thusa ho boloka phano ea software e sireletsehileng le e tšepahalang ntle le ho liehisa nts'etsopele.
