Beke e ngoe le e ngoe, litsamaiso tsa rona tsa ho lemoha malware li hlahloba liphutheloana tse likete tse ncha le tse ntlafalitsoeng ho pholletsa le li-registry tsa sechaba joalo ka npm le PyPI. Beke ena e ne e le mokhelo.
Re netefalitse liphutheloana tse fetang 200 tse kotsi pakeng tsa la 12 Phuptjane le la 19 Phuptjane, 2026, haholo-holo ho pholletsa le npm, ka linyeoe tse ling ho PyPI. Tse 'maloa li hlahile ka lihlopha tse kopanetsoeng, litokollo tse mpe tse phetoang khafetsa tse hatisitsoeng tlas'a mabitso a tšoanang kapa malapeng a liphutheloana tse amanang haufi-ufi.
Nyeoe e ikhethang bekeng ena e ne e le sensivity, e ileng ea tlala npm ka liphetolelo tse fetang 70 tse lokollotsoeng ho pholletsa le mefuta ea 2.5.x, e tiisitsoeng ka matsatsi a mangata. Lihlopha tse ling tse hlahelletseng li ne li kenyelletsa leqhubu la @solana-labs Li-typosquat tse shebaneng le tikoloho ea Solana (web3.js, web3-js, etherjs, spl-toke, ancor, web3js — ho pholletsa le matšolo a mabeli a arohaneng a phatlalatso ka la 7 Phuptjane le la 8 Phuptjane), @nstrlabs lelapa (sdk, ixel, utils, shared-components, api-client, auth — tlhaselo ea pherekano ea ho itšetleha khahlanong le sebaka sa lebitso sa sephutheloana sa kahare), @klapp-login-platform sehlopha (native-sdk, oidc, routes — ho iketsa sethala sa netefatso), internallib_v557 'me internallib_v984 (mefuta e mengata ea baikhakanyi ba ka hare ba laeborari ba patiloeng), pocteszep (Mefuta e 6 e phatlalalitsoe ka la 11 Phuptjane), le sehlopha sa lits'ebeletso tsa crypto le Web3 ho kenyeletsoa blockchain-helper-0, ethereum-kit-1, ethereum-kit-9, crypto-utils-7, wallet-sdk-9, defi-tools-39, swap-sdk-87, 'me farming-tools-12. The morningstar-design-system sephutheloana se hlahile ka mefuta e meraro ka la 10 Phuptjane, se etsisa sistimi e tsebahalang ea moralo oa lichelete.
Ho tloha ka la 13 Phuptjane ho ea pele, lebelo le ile la eketseha. houzidawang806 Sehlopha se le seng se ne se ikarabella bakeng sa liphetolelo tse fetang 25 tse hatisitsoeng ka letsatsi le le leng, tse kopantsoeng ke banab'eso houzidawang807 'me houzidawang808. The metrics-pipeline-d8k2 Sephutheloana sena se ile sa hatisoa hape ka ho tsoelang pele ho pholletsa le mefuta e 21 pakeng tsa la 15 Phuptjane le la 18 Phuptjane — letšolo le tsoelang pele la ho qoba ho kena-kenana le reretsoeng ho lula le le ka pele ho manane a thibelo. friendly-greeter-demo sephutheloana se ile sa lula se hlaha hape liphetolelong tsohle bekeng. Maiteko a macha a pherekano ea ho itšetleha a hlahile tlas'a xy-shared, axl-ui, loadninja-shared, carousel-controller-mixin, token-prices-cron, hemi-supply-cron, portal-backend, vault-strategies, le tse ling tse 'maloa — kaofela li na le linomoro tsa mofuta o phahamisitsoeng mofuteng oa 999.x. Sehlopha se secha sa mabitso a lits'ebeletso tse akaretsang a nang le li-suffix tsa hex tse sa reroang (color-utils-dee0, data-utils-d703, string-tools-be6c, type-check-816d, fmt-helpers-794b, metrics-probe-*) e hlahile ka la 18-19 Phuptjane, e tsamaellana le ngoliso e ngotsoeng ka bongata. Beke e koetsoe ka trimprompt, trimprompt-hub, claude-cup, 'me web3-crypto-address-utils e tiisitsoe ka la 19 Phuptjane. Ho PyPI, neuralbridge-sdk (mefuta e mehlano ho pholletsa le 4.5.x–5.1.x), deepstrain, teambot-ai, hello-test-s1, 'me aiaddin-agent li tiisitsoe beke kaofela.
Tsena e ne e se lintho tse sa tloaelehang tse ikhethileng. Se ileng sa hlahella bekeng ena e ne e le pokello ea litlhaselo tsa pherekano ea ho itšetleha ka batho ba bang khahlanong le libaka tsa mabitso tsa liphutheloana tsa ka hare, matšolo a phatlalatso a tsoelang pele a matsatsi a mangata a reretsoeng ho feta ho tlosoa ha liphutheloana, ho shejoa ho tsoelang pele ha lisebelisoa tsa Web3 le DeFi (mokhoa o potlakileng haholo ka 2026), le tšebeliso e ntseng e hola ea mabitso a liphutheloana a tloaelehileng, a kang lerata a entsoeng ho qoba ho fumanoa ka ho kopana le lifate tse tloaelehileng tsa ho itšetleha ka batho ba bang.
Setšoantšo sena sa beke le beke ke karolo ea Malicious Code Digest ea rona e tsoelang pele, moo re netefatsang litšokelo tse ncha le ho fana ka bohlale bo sebetsang ho thusa lihlopha tsa DevSecOps ho sireletsa tsa tsona. pipelinepele tshenyo e etsahala. A re hlahlobisiseng seo re se fumaneng bekeng ena le hore na ke hobane'ng ha se le bohlokoa.
Se ke oa Lumella Matšolo a Kopaneng ho Finyella Hao Pipelines
Tlhaloso ea beke ena e ne e se ka tšokelo e le 'ngoe feela; e ne e le ka tekanyo e kholo. Liphutheloana tse fetang 200 tse tiisitsoeng, mofuta o tsitsitseng o tletse ka matsatsi a mangata, le matšolo a ngoliso ea bongata a ngotsoeng a potlakileng ho feta kamoo litlhahlobo tsa letsoho li ka latelwang. Bahlaseli ha ba emetse hore u fihlelle.
Tlhahlobo ea Malware ea Xygeni Pele e beha leihlo npm, PyPI, le lirejistri tse ling khafetsa, e tšoaea litšokelo nakong ea phatlalatso, eseng kamora hore li fihle mohahong. Ha letšolo le phatlalatsa mefuta e 21 ea sephutheloana se tšoanang se kotsi ka matsatsi a mane, skena ea beke le beke ha e fumane letho ka nako.
Xygeni's Open Source Security Tharollo e fa lihlopha tsa hau tsa DevSecOps ponahalo ea nako ea sebele le ho li beha pele tseo li li hlokang ho lula li le ka pele ho mofuta ona oa khatello e kopanetsoeng, kahoo pipelineLula u hloekile ntle le ho liehisa lihlopha tsa hau.
