Deyarli har hafta, bizning zararli dasturlarni aniqlash tizimlarimiz npm va PyPI kabi ommaviy registrlarda minglab yangi va yangilangan paketlarni skanerlaydi. Bu hafta juda faol bo'ldi.
Biz tasdiqladik 198 ta zararli paket, asosan npm bo'ylab, PyPI, OpenVSX, Composer va VS Code kengaytmalarida qo'shimcha holatlar bilan. Bir nechtasi muvofiqlashtirilgan klasterlarda paydo bo'ldi, bir xil nomlar ostida yoki yaqin bog'liq paket oilalarida takroriy zararli nashrlar nashr etildi. Eng muhim holat bu edi sensivity npm ni 2.5.x diapazonida 60 dan ortiq versiyali versiyalar bilan to'ldirgan paket. Boshqa diqqatga sazovor klasterlar ham kiritilgan ai-sdk-helpers (AI ishlab chiquvchilariga qaratilgan 8 ta versiya), @antoncallahan/aws-user-helper (AWS yordam dasturini taqlid qiluvchi 7 ta versiya), @apple-pay-trust va @google-pay-trust oilalar (to'lovni amalga oshirish modullarini taqlid qilish), @frengki0707/google-cloud-clone (Google Cloud’ni soxtalashtirgan 5 ta versiya) va cms-storehub, cms-helpgitva cms-github (CMS ni nishonga olish pipelines). Ko'pgina paketlar to'lov va to'lov modullarini taqlid qildi, enterprise va ichki veb-paketlar, analitik mijozlar, UI asoslari, ishlab chiquvchilar uchun yordamchi dasturlar, komponentlarni o'rganuvchilar, bulut va Google mavzusidagi paketlar va zamonaviy ishlab chiqish ish oqimlarida keng tarqalgan boshqa modullar.
Bular alohida anomaliyalar emas edi. Bu hafta diqqatga sazovor bo'lgan narsa bir xil paket oilalarida takroriy nashrlarning ko'lami, nomlash naqshlaridan qayta foydalanish va zararli paketlarning haqiqiy dasturiy ta'minot yetkazib berish ichida qonuniy qaramliklarga o'xshab ko'rinishi uchun niqoblanganligi edi. pipelines.
Ushbu haftalik qisqacha ma'lumot bizning davom etayotgan zararli kodlar dayjestining bir qismidir, unda biz yangi tahdidlarni tekshiramiz va DevSecOps guruhlariga o'zlarini himoya qilishga yordam berish uchun amaliy ma'lumotlarni taqdim etamiz pipelineshikastlanishdan oldin s.
Keling, bu hafta nimani topganimizni va nima uchun bu muhimligini tahlil qilaylik.
| Ekosistema | To'plam | sana |
|---|---|---|
| npm | @cloudplatform-single-spa/administration: 99.99.100 | , 30 2026 mumkin |
| npm | @cloudplatform-single-spa/svp-s3-storage:99.99.100 | , 30 2026 mumkin |
| npm | @maximvs1538/os-npm:99.0.0 | , 30 2026 mumkin |
| npm | @easy-entry/landing-routes:99.9.5 | , 30 2026 mumkin |
| npm | @easy-entry/outside-registration-fop-navigator:99.9.5 | , 30 2026 mumkin |
| npm | @easy-entry/marshrutlar:99.9.5 | , 30 2026 mumkin |
| npm | @t-in-one/shakl_mahsulot_token:5.7.1 | , 30 2026 mumkin |
| npm | @capibar.chat/ui-kit:99.5.7 | , 30 2026 mumkin |
| vscode | xampp-menejeri: 5.1.3 | , 30 2026 mumkin |
| npm | @chat-shabloni/auth:1.0.0 | , 31 2026 mumkin |
| npm | json-dan-simple-graphql-schema-ga:1.0.0 | Jun 1, 2026 |
| npm | @gs-select/savings-client-application:99.0.0 | Jun 1, 2026 |
| npm | nemo-reportyor: 1.8.2 | Jun 1, 2026 |
| npm | cms-github:4.2.4 | Jun 1, 2026 |
| npm | cms-helpgit:4.2.6 | Jun 1, 2026 |
| npm | cms-helpgit:4.2.8 | Jun 1, 2026 |
| npm | cms-storehub:1.3.4 | Jun 1, 2026 |
| npm | cms-storehub:1.3.5 | Jun 1, 2026 |
| npm | cms-storehub:1.3.6 | Jun 1, 2026 |
| pypi | simtooreal-cli:0.3.0 | Jun 1, 2026 |
| npm | chakana savdo-joylashuv-strategiyasi-frontend: 1.1.1 | Jun 1, 2026 |
| npm | chakana savdo-joylashuv-strategiyasi-frontend: 1.1.2 | Jun 1, 2026 |
| npm | suhbat-sdk:2.0.2 | Jun 1, 2026 |
| npm | veltriks:9.0.0 | Jun 1, 2026 |
| npm | veltriks:9.0.1 | Jun 1, 2026 |
| npm | jingmeideshishi: 1.0.4 | Jun 1, 2026 |
| npm | jingmeideshishi: 1.0.5 | Jun 1, 2026 |
| npm | @tse-raqamli/yadro:99.0.0 | Jun 1, 2026 |
| npm | @telenor-se/core:99.0.0 | Jun 1, 2026 |
| npm | @ownit/core:99.0.0 | Jun 1, 2026 |
| npm | bemor hujjatlari: 75.0.0 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.69 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.68 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.82 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.80 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.81 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.83 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.3 | Jun 1, 2026 |
| npm | @emcd-vue/auth:6.4.9 | Jun 1, 2026 |
| npm | @emcd-vue/b2b-to'lov shakli: 5.7.4 | Jun 1, 2026 |
| npm | @ccrm/user-storage-api-axios: 5.0.1 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.8 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.12 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.16 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.17 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.18 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.19 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.20 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.21 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.22 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.23 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.24 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.25 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.26 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.27 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.28 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.29 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.30 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.31 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.32 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.41 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.42 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.43 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.44 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.45 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.46 | Jun 2, 2026 |
| npm | meoo-ui-yordamchilari:1.0.1 | Jun 2, 2026 |
| npm | @langgraphjs/toolkit:1.2.10 | Jun 2, 2026 |
| npm | eyevox:9.0.1 | Jun 2, 2026 |
| npm | sezgirlik: 2.5.53 | Jun 3, 2026 |
| npm | sezgirlik: 2.5.54 | Jun 3, 2026 |
| npm | sezgirlik: 2.5.55 | Jun 3, 2026 |
| npm | sezgirlik: 2.5.56 | Jun 3, 2026 |
| npm | sezgirlik: 2.5.57 | Jun 3, 2026 |
| npm | sezgirlik: 2.5.61 | Jun 3, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.1 | Jun 4, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.2 | Jun 4, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.5 | Jun 4, 2026 |
| npm | mablag' yig'ish xizmati: 1.0.0 | Jun 4, 2026 |
| npm | sezgirlik: 2.5.67 | Jun 4, 2026 |
| npm | sezgirlik: 2.5.68 | Jun 4, 2026 |
| npm | vg-o'zaro ta'sir modeli: 40.0.5 | Jun 4, 2026 |
| npm | internallib_v346:1.0.3 | Jun 4, 2026 |
| npm | internallib_v346:1.0.5 | Jun 4, 2026 |
| npm | internallib_v346:1.0.9 | Jun 4, 2026 |
| npm | ai-sdk-yordamchilari: 0.2.1 | Jun 4, 2026 |
| npm | ai-sdk-yordamchilari: 0.3.0 | Jun 4, 2026 |
| npm | ai-sdk-yordamchilari: 0.3.1 | Jun 4, 2026 |
| npm | ai-sdk-yordamchilari: 1.1.0 | Jun 4, 2026 |
| npm | ai-sdk-yordamchilari: 1.1.1 | Jun 4, 2026 |
| npm | ai-sdk-yordamchilari: 1.3.0 | Jun 4, 2026 |
| npm | ai-sdk-yordamchilari: 1.4.0 | Jun 4, 2026 |
| npm | ai-sdk-yordamchilari: 1.4.2 | Jun 4, 2026 |
| npm | @achuthvp/postinstall-poc: 1.0.3 | Jun 4, 2026 |
| npm | sezgirlik: 2.5.0 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.1 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.2 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.3 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.4 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.5 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.13 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.14 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.15 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.33 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.34 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.35 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.36 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.37 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.38 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.58 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.59 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.60 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.62 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.63 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.64 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.65 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.66 | Jun 5, 2026 |
| npm | sezgirlik: 2.5.69 | Jun 5, 2026 |
Ochiq kodli bog'liqliklaringizni zaifliklar va zararli kodlardan himoya qiling
Zararli paketlar sizning qurilmangizga yetib borishiga yo'l qo'ymang pipelines. Xygeni erta zararli dasturlarni aniqlash zararli bog'liqliklar sizning dasturingizga tegmasdan oldin ularni aniqlab, jamoangizga eng muhim tahdidlarni real vaqt rejimida ko'rish imkonini beradi.
Ushbu haftalik dayjestda aniq ko'rsatilganidek, zararli paket kampaniyalarining hajmi va murakkabligi sekinlashmayapti. Muvofiqlashtirilgan versiyalar oqimi, to'lov moduli taqlidi va ichki ovozli paket nomlari - bu hujumchilar chetlab o'tish uchun foydalanadigan taktikalarning bir qismi. standard himoya. Ushbu tahdidlardan oldinda bo'lish davriy auditlardan ko'proq narsani talab qiladi, bu sizning jamoalaringiz bog'liq bo'lgan har bir registrda doimiy monitoringni talab qiladi.
Xygeni's Open Source Security Yechim zararli paketlarni nashr etish vaqtida, npm, PyPI va undan tashqarida skanerlaydi va bloklaydi. Eng katta real dunyo xavfini tug'diradigan zaifliklarni kontekstual ravishda ustuvorlashtirish (va DevSecOps jamoalaringiz uchun tuzatish yo'lini soddalashtirish) orqali Xygeni sizga ishlab chiqishni sekinlashtirmasdan xavfsiz va ishonchli dasturiy ta'minot yetkazib berishni ta'minlashga yordam beradi.
