Wamkelekile Uhlelo lukaJuni lweXygeni Malicious Code DigestKule nyanga, iqela lethu lophando lokhuseleko liqinisekisile okungaphezulu Iiphakheji ezili-645 ezinobungozi kuyo yonke i-npm, i-PyPI, kunye (okokuqala ngqa) indawo yentengiso yolwandiso lwe-VSCode.
UJuni uchazwe ziindlela ezintathu ezidibanayo: iiphulo eziqhubekayo zokukhukula kwenguqulelo ezenzelwe ukuhlala ixesha elide kunee-blocklists, ukukhawuleziswa okukhulu kohlaselo olujolise kwizixhobo ze-AI kunye nemisebenzi yophuhliso lwe-arhente, kunye nohlaselo oludibeneyo lokudideka kokuxhomekeka ngokuchasene nezithuba zamagama zangaphakathi ze-monorepo.
Phakathi kweephulo eziphawulekayo ezibhalwe kule nyanga:
- ukuvakalelwa i-npm egcwele iinguqulelo ezingaphezu kwama-70 kuluhlu lwe-2.5.x, iphulo lokubaleka eliqhubekayo eliphinda lipapashwe rhoqo ukuze lihlale liphambili kunee-takedowns.
- A iphulo lokubhala amagama eSolana elinamaza amabini (Juni 7–8) wapapasha iipakeji ezili-15 ezizenza umntu ongenguye
@solana-labsizixhobo ze-ecosystem, zijolise ngqo kubaphuhlisi beWeb3 kunye neDeFi. - houzidawang806 babalwa kwiinguqulelo ezingaphezu kwama-25 ngosuku olunye (nge-13 kaJuni), bajoyinwa yi imilinganiselo-pipeline-d8k2 yapapashwa kwakhona kwiinguqulelo ezingama-21 phakathi kwe-15-18 kaJuni.
- The Ukudideka kweCryptoDAO iphulo (nge-17 kaJuni) lipapashe iipakeji ezili-11 kwinguqulelo 99.99.99, nganye iphethe umthwalo ofanayo emva kokufakwa CI/CD iithokheni, iziqinisekiso zelifu, kunye neemfihlo ze-crypto wallet.
- Iveki kaJuni 20-26 izise eyona njongo igxile kakhulu kwizixhobo ze-AI kule nyanga: abancedisi be-ollama (Iinguqulelo ezingama-20), abancedisi-beearhente-zokuvula (Iinguqulelo ezingama-23), i-monoclaude, abancedisi be-ai-sdk, yaye @langgraphjs/izixhobo zokusebenza, zonke ziqinisekisiwe kwiveki enye, zijolise ngqo kwi-Ollama, ii-OpenAI agents SDK, LangGraph, kunye neClaude API integrations.
- Ezimbini ziqinisekisiwe izandiso ze-VSCode ezinobungozi ivele kule nyanga, nto leyo ebonisa ukuba abahlaseli bayanda ngaphaya kweerejista zeephakheji baye kwindawo yabaphuhlisi ngokwabo.
Indlela ecacileyo kaJuni: uhlaselo lungena kwizandiso ze-IDE, izixhobo ze-AI agent, kunye nemisebenzi ye-agent apho iphakheji enobubi efakwe ngokuzimela ingenamvavanyi phakathi kosulelo kunye nokusebenza.
Olu hlaziyo lwenyanga luyinxalenye yephulo le-Xygeni eliqhubekayo lophando lwe-malware kunye nosongelo lwe-supply chain. Ukuze ufumane umxholo opheleleyo kuyo yonke iphakheji ye-malware eqinisekisiweyo kule nyanga, jonga i-June Malicious Code Digest epheleleyo kunye nophando oluhambelanayo oluvela kwiQela loKhuseleko lweXygeni.
Iveki yoku-4: Kufunyenwe iipakeji ezingaphezu kwe-201
| Ecosystems | ipakethe | umhla |
|---|---|---|
| Juni 20, 2026 | ||
| npm | i-panrouter: 5.0.2 + Iinguqulelo ezingama-30 kwi-5.x–6.x ziqala nge-22 kaJuni — iphulo eliphambili leveki | Juni 20, 2026 |
| npm | i-trimprompt:1.0.5 + Iinguqulelo ezi-4 — ukuqhubeka kweveki ephelileyo, kusasebenza | Juni 20, 2026 |
| npm | i-monoclaude:1.0.1 + Iinguqulelo ezi-2 — Ukulingisa izixhobo zeClaude API | Juni 20, 2026 |
| vscode | inkqubo-ye-orbit-agent-pair-programming-for-smalltalk:1.206.0 + Inguqulelo e-1 — ulwandiso lwe-VSCode olunobungozi olujolise kuphuhliso lwe-arhente | Juni 20, 2026 |
| npm | i-simplisafe-gatsby:1.0.1 Ukulingisa indawo yegama leqonga lekhaya elikrelekrele | Juni 20, 2026 |
| Juni 21, 2026 | ||
| npm | i-atlasora-eyabelwe:1.0.0 + iipakeji ezi-6 — i-conjunction edibeneyo yokuxhomekeka kwe-monorepo: i-atlasora-api, -client, -sdk, -types, -utils, -config | Juni 21, 2026 |
| npm | isithuba sokudibanisa:4.0.2 + Iinguqulelo ezi-6 — iphulo lokubhala kakubi ngabom elijolise kwizixhobo zokudibanisa | Juni 21, 2026 |
| npm | usetyenziso lwe-llm-traces:1.0.1 Izixhobo zokujonga ze-LLM ezijoliswe kuzo | Juni 21, 2026 |
| pypi | i-d0rk3r-telemetry:1.0.0 Iphakheji ye-telemetry efihliweyo kwi-PyPI | Juni 21, 2026 |
| Juni 22, 2026 | ||
| pypi | tm-ai:2.91.75 + Iinguqulelo ezi-7 — iphulo eliqhubekayo lenguqulelo yePyPI lokukhukula | Juni 22, 2026 |
| pypi | isicelo-se-cache-py:1.0.4 + Iinguqulelo ezi-6 — Inguqulelo yePyPI ekhukulayo | Juni 22, 2026 |
| pypi | ii-corvinos:0.17.0 + Iinguqulelo ezi-6 — Iphulo lokubhalisa ngobuninzi le-PyPI | Juni 22, 2026 |
| Juni 23, 2026 | ||
| npm | umncedisi-web3-token:1.1.1 + Iinguqulelo ezi-2 — Ukujolisa kwi-Web3 token utility targeting | Juni 23, 2026 |
| npm | i-monocross:1.0.1 + Inguqulelo e-1 — iqela lokubiza amagama elino-* ecaleni kwe-monoclaude kunye ne-monotacos | Juni 23, 2026 |
| Juni 24, 2026 | ||
| npm | abancedisi be-ollama:0.1.0 + Iinguqulelo ezili-19 — iphulo elikhulu lezixhobo ze-AI lenyanga, elijolise kwixesha lokusebenza kwe-AI yasekuhlaleni yase-Ollama | Juni 24, 2026 |
| npm | abancedisi be-openai-agents:0.1.1 + Iinguqulelo ezingama-22 — iphulo elidibeneyo elijolise kwi-ecosystem ye-OpenAI agents SDK | Juni 24, 2026 |
| Juni 25, 2026 | ||
| npm | abancedisi be-ai-sdk:1.4.3 Izixhobo ze-AI SDK zijolise kwi-@langgraphjs/toolkit:1.2.11 | Juni 25, 2026 |
| npm | i-embedder yokubhalisa: 99.99.99-poc3 + ulawulo lwe-hs-locale — Ukudideka kokuxhomekeka kwendawo yangaphakathi yeHubSpot, isimamva se-poc siqinisekisa iphulo lophando elisebenzayo | Juni 25, 2026 |
| Juni 26, 2026 | ||
| npm | ikhithi yentambo elula: 1.0.1 + Iinguqulelo ezi-8 kuquka uhlobo lwe-easy-string-kit232 — ubhaliso olukhulu phantsi kwegama eliqhelekileyo lesixhobo | Juni 26, 2026 |
| npm | iphakheji engakhuselekanga-enobungozi: 1.0.0 + Iinguqulelo ezi-5 — iphakheji echazwe ngokucacileyo njengenobungozi, umthwalo oqinisekisiweyo, iphulo lovavanyo okanye lokuxhokonxa | Juni 26, 2026 |
| npm | @vpms/inkqubo yoyilo:1.1.2 + Iinguqulelo ezi-2 — uyilo lwenkqubo yokulinganisa indawo yegama | Juni 26, 2026 |
Iveki yoku-3: Kufunyenwe iipakeji ezingaphezu kwe-200
| Ecosystems | ipakethe | umhla |
|---|---|---|
| Juni 13, 2026 | ||
| npm | houzidawang806:1.0.0 + Iinguqulelo ezingama-25 kwi-1.0.x–1.2.x kuquka abantakwabo uHouzidawang807 kunye noHouzidawang808 — iphulo eliphambili leveki | Juni 13, 2026 |
| npm | idemo-yokubulisa enobuhlobo: 1.0.2 + Iinguqulelo ezi-4 — iphulo eliqhubekayo liphinda livele kwiintsuku ezininzi | Juni 13, 2026 |
| npm | i-tsc-ai:1.2.0 iqela le-tsc-*: tsc-ai, tsc-mesh, tsc-lotl — Ukwenziwa kwe-CI tooling namespace | Juni 13, 2026 |
| pypi | i-neuralbridge-sdk:4.5.4 + Iinguqulelo ezi-6 kuzo zonke i-4.5.x–5.1.x — iphulo le-PyPI eliqhubekekayo leentsuku ezininzi | Juni 13, 2026 |
| Juni 15, 2026 | ||
| npm | amaxabiso-ethokheni-cron:999.0.0 + Iiphakheji ezi-6 — Iqela lokudideka lokuxhomekeka kwiziseko zeDeFi elijolise kwi-cron yangaphakathi kunye nezixhobo ze-vault | Juni 15, 2026 |
| Juni 16, 2026 | ||
| npm | i-bodega-sdk:9.9.9 + Iipakeji ezi-8 — I-DeFi loan kunye neqela le-Cardano ecosystem: ukubolekisa ngemali flow, ukubolekisa ngemali kwi-surf, i-janus-*, i-flowcardano, i-flowdefi | Juni 16, 2026 |
| npm | i-event-metrics-q3x7:1.0.0 + Iinguqulelo ezi-8 — iphakheji yesimamva se-hex-suffix ebhalisa amagama anemixholo yokubeka esweni ngobuninzi | Juni 16, 2026 |
| npm | i-nic-datagov:1.0.0 + iipakeji ezi-3 — iqonga ledatha likarhulumente ukulingisa indawo yegama: i-ogd-analytics, iqonga le-ogd, i-dms-backend | Juni 16, 2026 |
| Juni 17, 2026 | ||
| npm | iikhontrakthi ze-cryptodao: 99.99.99 + Iipakeji ezili-10 — Ukudideka kokuxhomekeka kweCryptoDAO: i-core, i-sdk, i-bot, i-config, i-utils, i-deploy, i-signer, i-backend, iintlobo | Juni 17, 2026 |
| pypi | i-teambot-ai:1.48.0 Ukusetyenziswa kwezixhobo zearhente ye-AI ekujoliswe kuyo kwi-PyPI | Juni 17, 2026 |
| Juni 18, 2026 | ||
| npm | imilinganiselo-pipeline-d8k2:1.0.0 + Iinguqulelo ezingama-20 kuyo yonke i-18 kaJuni — iphulo lokuphepha ukusasazwa kosuku olunye, liphinda lipapashwe rhoqo ukuze lidlule uluhlu oluvaliweyo | Juni 18, 2026 |
| npm | iskena kuphela: 0.4.5 + Iinguqulelo ezi-6 — iphulo lokukhukula kwenguqulelo | Juni 18, 2026 |
| npm | izixhobo zombala-dee0:1.0.0 + Iipakeji ezi-5 ze-generic hex-suffix: i-data-utils, i-string-tools, i-type-check, i-fmt-helpers, i-metrics-probe — ubhaliso olune-scripted bulk | Juni 18, 2026 |
| npm | @iinkonzo-zelabhu ze-azure/ml-ts:99.0.0 Ukulingisa indawo yegama le-Azure ML | Juni 18, 2026 |
| Juni 19, 2026 | ||
| npm | i-trimprompt:1.0.2 + i-trimprompt-hub — izixhobo zobunjineli ezikhawulezileyo ezijoliswe kuzo | Juni 19, 2026 |
| npm | indebe yeclaude:0.8.6 Ukulingisa izixhobo zeClaude API | Juni 19, 2026 |
| pypi | iarhente ye-aiaddin:0.1.0 Ukusetyenziswa kwezixhobo zearhente ye-AI ekujoliswe kuyo kwi-PyPI | Juni 19, 2026 |
| npm | izixhobo-zedilesi ye-web3-crypto:0.1.0 Ukujolisa kwiinkonzo zeWeb3 | Juni 19, 2026 |
Iveki yoku-2: Kufunyenwe iipakeji ezingaphezu kwe-135
| Ecosystems | ipakethe | umhla |
|---|---|---|
| Juni 7, 2026 | ||
| npm | @solana-labs/web3.js:1.0.0 + Iindidi ezi-5 — Iphulo le-typosquat ye-Solana ecosystem, igagasi lokuqala | Juni 7, 2026 |
| npm | @jisan901/teamfocus:1.0.0 + Iinguqulelo ezi-2 | Juni 7, 2026 |
| npm | @sflyinc-knapsack/shutterfly-react:999.0.0 Ukudideka kokuxhomekeka, uhlobo olunyuswe kakhulu | Juni 7, 2026 |
| Juni 8, 2026 | ||
| npm | @solana-labs/web3.js:1.98.102 + Iindidi ezili-9 — Iphulo le-typosquat le-Solana ecosystem, igagasi lesibini | Juni 8, 2026 |
| pypi | i-helixagentai:0.1.3 Ukusetyenziswa kwezixhobo zearhente ye-AI ekujoliswe kuyo kwi-PyPI | Juni 8, 2026 |
| Juni 9, 2026 | ||
| npm | @nstrlabs/sdk:99.0.0 + iipakeji ezi-7 — ukudideka kokuxhomekeka ngokuchasene nesithuba sangaphakathi segama le-monorepo | Juni 9, 2026 |
| npm | @klapp-login-platform/native-sdk:99.0.0 + Iiphakheji ezili-9 — ukuqinisekiswa kweqonga lokulingisa kwiindawo ezininzi zamagama ze-klapp | Juni 9, 2026 |
| npm | i-blockchain-helper-0:1.0.0 + Iiphakheji ezisi-7 — iqela le-crypto/DeFi elijolise kubaphuhlisi beWeb3 | Juni 9, 2026 |
| npm | @idatha-yekhadi-lekhompyutha/ivenkile:99.0.0 Indawo yegama ledatha yekhadi lokuhlawula ekujoliswe kuyo | Juni 9, 2026 |
| Juni 10, 2026 | ||
| npm | inkqubo-yoyilo lwe-morningstar:99.0.0 + Iinguqulelo ezi-2 — ukulingisa inkqubo yoyilo lwezemali | Juni 10, 2026 |
| Juni 11, 2026 | ||
| npm | i-pocteszep:1.0.1 + Iinguqulelo ezi-5 ezipapashwe ngaloo mini | Juni 11, 2026 |
| npm | @coze-common/indawo yokuncokola:99.1.1 Ukulingisa indawo yegama leqonga lengxoxo ye-AI | Juni 11, 2026 |
| pypi | i-telegramlite: 1.0.0 + 1 inguqulelo — ukulingisa iqonga lemiyalezo kwiPyPI | Juni 11, 2026 |
| Juni 12, 2026 | ||
| npm | i-ecto-corsair-whisper-6f3b9:1.0.18 + 7 ii-ecto-* variants — iqela lamagama elifihliweyo | Juni 12, 2026 |
| npm | i-internallib_v984:1.0.3 + iqela le-internallib_v557 — Iinguqulelo ezili-13 zeenkohliso zethala leencwadi langaphakathi | Juni 12, 2026 |
| npm | i-voyager-web:999.0.0 Ukudideka kokuxhomekeka, uhlobo olunyuswe kakhulu | Juni 12, 2026 |
| pypi | cdjeez:0.32.0 | Juni 12, 2026 |
Iveki yoku-1: Kufunyenwe iipakeji ezingaphezu kwe-118
| Ecosystems | ipakethe | umhla |
|---|---|---|
| Ngamana 30, 2026 | ||
| npm | @cloudplatform-single-spa/ulawulo:99.99.100 Ukudideka kokuxhomekeka, uhlobo olunyuswe kakhulu | Ngamana 30, 2026 |
| vscode | umphathi we-xampp: 5.1.3 ulwandiso lwe-VSCode — ukwenziwa ongeyena kwesixhobo somphuhlisi | Ngamana 30, 2026 |
| Juni 1, 2026 | ||
| npm | @tse-digital/core:99.0.0 Ukudideka kokuxhomekeka — @telenor-se kunye no-@ownit nabo bachaphazelekile | Juni 1, 2026 |
| npm | i-cms-storehub:1.3.4 + Iinguqulelo ezi-2, iqela le-CMS namespace | Juni 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.69 + Iinguqulelo ezi-6, amanani eenguqulelo ezinyuswe kakhulu ajolise kwiinkcukacha ze-AWS | Juni 1, 2026 |
| npm | amaxwebhu ezigulane: 75.0.0 Indawo ejolise kuyo igama lenkonzo yezempilo | Juni 1, 2026 |
| npm | @emcd-vue/auth:6.4.9 Ukuzenza umntu ongeyena kwi-crypto exchange namespace | Juni 1, 2026 |
| pypi | i-simtooreal-cli:0.3.0 | Juni 1, 2026 |
| Juni 2, 2026 | ||
| npm | uvakalelo: 2.5.8 + Iinguqulelo ezingama-70 kuluhlu lwe-2.5.x, ngoJuni 2–5 — iphulo eliphambili lelo xesha | Juni 2, 2026 |
| npm | @langgraphjs/izixhobo zokusebenza:1.2.10 Izixhobo zeLangGraph ezijoliswe kuzo | Juni 2, 2026 |
| Juni 4, 2026 | ||
| npm | @sentry-browser-sdk/profiling-node:1.0.1 + Iinguqulelo ezi-2, ukulingisa indawo yegama leSentry | Juni 4, 2026 |
| npm | i-internallib_v346:1.0.3 + Iinguqulelo ezi-2, umkhohlisi wethala leencwadi langaphakathi | Juni 4, 2026 |
| npm | abancedisi be-ai-sdk:0.2.1 + Iinguqulelo ezisi-7, ezijolise ekusebenziseni izixhobo ze-AI SDK | Juni 4, 2026 |
Yeka ikhowudi enobungozi ngaphambi kokuba ifikelele kwi-akhawunti yakho Pipeline
Izisongelo zobonelelo lwesoftware zidlule kakhulu ngaphaya kwengcamango. Uhlaselo lokudideka kokuxhomekeka, ukweba iikhredithi, i-malware ejoliswe kwi-AI, kunye nezixhobo zomphuhlisi onetyhefu zihlasela amaqela okwenyani ngokwenene. SDLCveki nganye.
IXygeni's ukufunyanwa kwe-malware kwaye iqonga lokhuseleko lwekhonkco lokubonelela inika imibutho ithuba lokubamba ukuxhomekeka okunobungozi ngaphambi kokuba kusetyenziswe kumatshini womphuhlisi, kungene kwinkqubo yokwakha, okanye kufikelele kwimveliso. Ugutyungelwe luqala kwi-npm, i-PyPI, i-VSCode, nangaphezulu, kujongwe iipateni zokupapasha ezikrokrelekayo, ukusetyenziswa gwenxa kweendawo zamagama, ukubhalwa kwemibhalo, kunye neendlela zokuhlasela zendalo ze-AI njengoko zivela.
Yonke into efunyenweyo ibekwa phambili ngokuzenzekelayo ngenxa yokusebenziseka kwayo, ukufikeleleka kwayo, kunye nempembelelo yayo kwishishini, ngoko ke iqela lakho ligxila kwinto efuna ukulungiswa, kungekhona ingxolo.
Nokuba yiphakheji evulekileyo enobubi, sisixhobo somphuhlisi esisengozini, okanye umngcipheko wekhowudi eyenziwe yi-AI, i-Xygeni igcina amaqela okhuseleko kunye nobunjineli inyathelo elinye phambili kunomngcipheko we-supply chain.
Hlola zonke iipakethe kunye nephulo elinobungozi eliqinisekiswe yiQela loKhuseleko leXygeni kwi I-Digest yeKhowudi enobungozi.
Hlala ukhuselekile. Hlala ukhawuleza. Hlala ulawula iXygeni.
