Ampir unggal minggu, sistem deteksi malware kami nyeken rébuan pakét énggal sareng anu diénggalan di sakumna pendaptaran umum sapertos npm sareng PyPI. Minggu ieu aktip pisan.
Kami mastikeun 198 pakét jahat, utamina di sakuliah npm, kalayan kasus tambahan dina éksténsi PyPI, OpenVSX, Composer, sareng VS Code. Sababaraha muncul dina klaster anu terkoordinasi, kalayan rilis jahat anu diulang-ulang diterbitkeun dina nami anu sami atanapi di sakumna kulawarga pakét anu raket patalina. Kasus anu nonjol nyaéta sensivity pakét, anu ngabanjiran npm ku langkung ti 60 rilis vérsi dina rentang 2.5.x. Klaster penting anu sanés kalebet ai-sdk-helpers (8 vérsi anu ditujukeun pikeun pamekar AI), @antoncallahan/aws-user-helper (7 vérsi anu nyamar jadi utilitas AWS), @apple-pay-trust jeung @google-pay-trust kulawarga (niru modul pamayaran), @frengki0707/google-cloud-clone (5 vérsi anu nipu Google Cloud), sareng cms-storehub, cms-helpgit, sarta cms-github (ngararancang CMS pipelines). Seueur pakét anu niru modul pamayaran sareng checkout, enterprise sareng pakét wéb internal, klien analitik, yayasan UI, utilitas pamekar, panjelajah komponén, pakét téma awan sareng Google, sareng modul sanés anu umumna dipercaya dina alur kerja pamekaran modéren.
Ieu sanés anomali anu terasing. Anu nonjol minggu ieu nyaéta skala penerbitan anu diulang-ulang di sakumna kulawarga pakét anu sami, panggunaan deui pola penamaan, sareng cara pakét jahat disamarkan supados katingalina sapertos dependensi anu sah dina pangiriman parangkat lunak anu nyata. pipelines.
Cuplikan mingguan ieu mangrupikeun bagian tina Intisari Kodeu Malicious kami anu terus-terusan, dimana kami ngavalidasi ancaman énggal sareng nyayogikeun intelijen anu tiasa ditindaklanjuti pikeun ngabantosan tim DevSecOps ngajagaan pipelines sateuacan karusakan kajadian.
Hayu urang bahas naon anu urang mendakan minggu ieu sareng kunaon éta penting.
| ékosistem | paket | tanggal |
|---|---|---|
| npm | @cloudplatform-single-spa/administrasi:99.99.100 | Bisa 30, 2026 |
| npm | @cloudplatform-single-spa/svp-s3-storage:99.99.100 | Bisa 30, 2026 |
| npm | @maximvs1538/os-npm:99.0.0 | Bisa 30, 2026 |
| npm | @asup-gampang/rute-pendaratan:99.9.5 | Bisa 30, 2026 |
| npm | @asup-gampang/pendaptaran-luar-navigator-fop:99.9.5 | Bisa 30, 2026 |
| npm | @easily-entry/rutes:99.9.5 | Bisa 30, 2026 |
| npm | @t-in-one/form_product_token:5.7.1 | Bisa 30, 2026 |
| npm | @capibar.chat/ui-kit:99.5.7 | Bisa 30, 2026 |
| vscode | xampp-manager:5.1.3 | Bisa 30, 2026 |
| npm | @template-obrolan/auth:1.0.0 | Bisa 31, 2026 |
| npm | json-ka-skéma-graphql-basajan:1.0.0 | Jun 1, 2026 |
| npm | @gs-select/aplikasi-klien-tabungan:99.0.0 | Jun 1, 2026 |
| npm | nemo-reporter:1.8.2 | Jun 1, 2026 |
| npm | cms-github:4.2.4 | Jun 1, 2026 |
| npm | cms-helpgit:4.2.6 | Jun 1, 2026 |
| npm | cms-helpgit:4.2.8 | Jun 1, 2026 |
| npm | cms-storehub:1.3.4 | Jun 1, 2026 |
| npm | cms-storehub:1.3.5 | Jun 1, 2026 |
| npm | cms-storehub:1.3.6 | Jun 1, 2026 |
| pypi | simtooreal-cli:0.3.0 | Jun 1, 2026 |
| npm | strategi-lokasi-ritel-frontend:1.1.1 | Jun 1, 2026 |
| npm | strategi-lokasi-ritel-frontend:1.1.2 | Jun 1, 2026 |
| npm | conversa-sdk:2.0.2 | Jun 1, 2026 |
| npm | veltrix:9.0.0 | Jun 1, 2026 |
| npm | veltrix:9.0.1 | Jun 1, 2026 |
| npm | jingmeideshishi: 1.0.4 | Jun 1, 2026 |
| npm | jingmeideshishi: 1.0.5 | Jun 1, 2026 |
| npm | @tse-digital/core:99.0.0 | Jun 1, 2026 |
| npm | @telenor-se/core:99.0.0 | Jun 1, 2026 |
| npm | @ownit/inti:99.0.0 | Jun 1, 2026 |
| npm | dokumén pasien: 75.0.0 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.69 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.68 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.82 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.80 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.81 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.83 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.3 | Jun 1, 2026 |
| npm | @emcd-vue/auth:6.4.9 | Jun 1, 2026 |
| npm | @emcd-vue/b2b-pay-form:5.7.4 | Jun 1, 2026 |
| npm | @ccrm/pamaké-storage-api-axios:5.0.1 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.8 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.12 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.16 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.17 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.18 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.19 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.20 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.21 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.22 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.23 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.24 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.25 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.26 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.27 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.28 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.29 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.30 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.31 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.32 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.41 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.42 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.43 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.44 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.45 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.46 | Jun 2, 2026 |
| npm | meoo-ui-helpers:1.0.1 | Jun 2, 2026 |
| npm | @langgraphjs/toolkit:1.2.10 | Jun 2, 2026 |
| npm | eyevox:9.0.1 | Jun 2, 2026 |
| npm | sensitivitas: 2.5.53 | Jun 3, 2026 |
| npm | sensitivitas: 2.5.54 | Jun 3, 2026 |
| npm | sensitivitas: 2.5.55 | Jun 3, 2026 |
| npm | sensitivitas: 2.5.56 | Jun 3, 2026 |
| npm | sensitivitas: 2.5.57 | Jun 3, 2026 |
| npm | sensitivitas: 2.5.61 | Jun 3, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.1 | Jun 4, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.2 | Jun 4, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.5 | Jun 4, 2026 |
| npm | layanan panggalangan dana:1.0.0 | Jun 4, 2026 |
| npm | sensitivitas: 2.5.67 | Jun 4, 2026 |
| npm | sensitivitas: 2.5.68 | Jun 4, 2026 |
| npm | modél-interaksi-vg:40.0.5 | Jun 4, 2026 |
| npm | internallib_v346:1.0.3 | Jun 4, 2026 |
| npm | internallib_v346:1.0.5 | Jun 4, 2026 |
| npm | internallib_v346:1.0.9 | Jun 4, 2026 |
| npm | ai-sdk-helpers:0.2.1 | Jun 4, 2026 |
| npm | ai-sdk-helpers:0.3.0 | Jun 4, 2026 |
| npm | ai-sdk-helpers:0.3.1 | Jun 4, 2026 |
| npm | ai-sdk-helpers:1.1.0 | Jun 4, 2026 |
| npm | ai-sdk-helpers:1.1.1 | Jun 4, 2026 |
| npm | ai-sdk-helpers:1.3.0 | Jun 4, 2026 |
| npm | ai-sdk-helpers:1.4.0 | Jun 4, 2026 |
| npm | ai-sdk-helpers:1.4.2 | Jun 4, 2026 |
| npm | @achuthvp/postinstall-poc:1.0.3 | Jun 4, 2026 |
| npm | sensitivitas: 2.5.0 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.1 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.2 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.3 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.4 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.5 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.13 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.14 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.15 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.33 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.34 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.35 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.36 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.37 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.38 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.58 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.59 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.60 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.62 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.63 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.64 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.65 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.66 | Jun 5, 2026 |
| npm | sensitivitas: 2.5.69 | Jun 5, 2026 |
Amankeun Dependensi Sumber Terbuka Anjeun tina Karentanan sareng Kode Jahat
Ulah ngantep paket jahat nepi ka anjeun pipelines. Deteksi Malware Awal Xygeni méré tim anjeun visibilitas sacara real-time kana ancaman anu paling penting, néwak dependensi anu ngabahayakeun sateuacan aranjeunna némpél parangkat lunak anjeun.
Sakumaha anu dijelaskeun dina ringkesan minggu ieu, volume sareng kecanggihan kampanye pakét jahat henteu ngalambat. Banjir vérsi anu terkoordinasi, paniruan modul pamayaran, sareng nami pakét anu kadéngéna internal ngan ukur sababaraha taktik anu dianggo ku panyerang pikeun lolos. standard pertahanan. Tetep payuneun ancaman ieu meryogikeun langkung ti ngan ukur audit périodik, éta meryogikeun pangawasan anu terus-terusan di unggal pendaptaran anu diandelkeun ku tim anjeun.
Xygeni's Open Source Security Solusi nyeken sareng meungpeuk pakét anu ngabahayakeun dina titik publikasi, di sakuliah npm, PyPI, sareng saluareunana. Ku cara ngutamakeun sacara kontekstual kerentanan anu nyababkeun résiko dunya nyata panggedéna (sareng ngarampingkeun jalur remediasi pikeun tim DevSecOps anjeun) Xygeni ngabantosan anjeun ngajaga pangiriman parangkat lunak anu aman sareng tiasa dipercaya tanpa ngalambatkeun pamekaran.
