I-malware ye-Npm namhlanje iyaqhubeka nokukhula, kunye nabahlaseli abapapasha ikhowudi enobungozi, iipakethe ze-npm ezinobungozi, yaye Iiphakheji ezinobuthi zePyPI yenzelwe ukujolisa kwimisebenzi yophuhliso, CI/CD pipelineskunye neenkqubo ze-ecosystem ezivulelekileyo. I-Digest yeKhowudi enobungozi yingxelo yophando eqhubekayo kaXygeni elandelela kwaye iqinisekisa iipakeji zokwenyani ezinobungozi kuyo yonke indawo npm, I-PyPI, Code VS, yaye I-OpenVSX, kuquka abantu abaqinisekisiweyo ukuba basebenza ngaphandle kwekhompyutha, abantu abathiya idatha, abantu abafumana iimvume zokukhupha idatha, kunye neephulo ze-malware ezizenzekelayo.
Iqela lethu lophando lihlaziya eli phepha rhoqo nge iziphumo eziqinisekisiweyo, izalathisi zokuvumelana (ii-IOC), Iindlela zokuziphatha, yaye uhlalutyo yobugcisaNgenxa yoko, abaphuhlisi, Amaqela e-AppSeckwaye iinjineli zokhuseleko zingahlala ziphambili i-malware ye-npm namhlanje kunye nemisebenzi yephakheji enobungozi evelayo echaphazela uthotho lwezixhobo zesoftware zanamhlanje.
I-NPM Malware Namhlanje: Isishwankathelo Seveki 24–29 Epreli 2026
Abaphandi baqinisekisile Iiphakheji ezili-97 ezinobungozi kuzo zonke iirejista zikarhulumente ngeli xesha.
Ukuqwalaselwa kweseti yedatha
- Uninzi lweepakeji eziqinisekisiweyo zipapashwe kwi npm
- Amanye amatyala achaphazelekayo I-PyPI, I-OpenVSX, yaye Umqambi
- Ukupapashwa okungalunganga okuphindaphindwayo kwiintsapho ezifanayo zeepakeji kunye namagama anxulumene noko
- Iipateni zenguqulelo eziphezulu okanye ezingaqhelekanga ezifana 99.x, 99.9.x, yaye 1.0.x
- Ukusetyenziswa kakhulu kwe intlawulo kunye nokuphuma, enterpriseisitayile, usetyenziso lwewebhu lwangaphakathi, kubahlalutyi, Isiseko se-UI, isixhobo somphuhlisi, umxholo welifu, yaye ezinxulumene nezinto iipateni zokubiza amagama
- Iinguqulelo ezininzi ezidibeneyo zenzelwe ukufana nohlaziyo olusemthethweni lwephakheji
Ingxelo yeNyanga yeMalware: Iiphakheji ze-npm eziMangalisayo eziqinisekisiweyo ngo-Epreli 2026
Wamkelekile kuhlelo lwamva nje lwe I-Xygeni Malicious Code Digest (Uhlelo lweNyanga), e April 2026, iqela lethu lophando liqinisekisile iipakeji ezinobuthi ezingaphezu kwama-250, ikakhulu kulo lonke npm, kunye nezinye iimeko ezichaphazela I-PyPI, ikhowudi ye-VS, i-OpenVSX, kunye nomqambi.
U-Aprili wayengathethi nje kuphela ngomthamo. amaza okushicilela aqhutywa ngokuzenzekelayo, iiphulo zokunyuka kwamaxabiso ezivuselelayo, ukuhlanganiswa kweentsapho kwiphakheji, yaye ukulingisa isixhobo sangaphakathi, sibone ezinye zeendlela eziphawulekayo zenyanga ekupapashweni okungalunganga okudibeneyo kuzo zonke:
izixhobo zangaphakathi zobuxoki, iiphakheji ezinemixholo ye-AI, iimodyuli zentlawulo kunye nokuphuma, abathengi be-analytics, izinto ezingaphambili, izixhobo zomphuhlisi, izixhobo ze-Kubernetes kunye ne-cloud tooling, izandiso ze-VS Code kunye ne-OpenVSX, kunye namagama eephakheji athembekileyo afana ne-brand ayilelwe ukudibanisa nokuhanjiswa kwesoftware yokwenyani. pipelines.
Ezi yayingezizo iziganeko ezilula zokuchwetheza amagama. UTshazimpuzi iseti yedatha, sibonile iipateni zokuxhatshazwa kweziqinisekiso, ulawulo lwekhonkco lokubonelela, ukuphinda-phinda ukusetyenziswa kwakhona kwesithuba segama, yaye ukupapashwa okunobungozi okucwangcisiweyo yenzelwe ukudibanisa neendawo zomphuhlisi wokwenyani kunye nokuhanjiswa kwesoftware pipelines.
Kuyo yonke idatha ebanzi, siqhubekile nokujonga ukupapashwa kweentlobo ngeentlobo ezibhaliweyo, izicwangciso zokuguqula ezinyuswe kakhulu, intlawulo- kunye enterprise-ukuqamba amagama okunesihloko, Amagama eephakheji aneetheme ze-AI kunye neze-arhente, Ukulingisa i-SDK kunye necandelo langaphambili, ukulinganisa izixhobo zangaphakathikunye namaqhinga aqhelekileyo afana ukudideka kokuxhomekeka kwaye ukukhutshwa kwedatha.
Le ngxelo yinxalenye yenkqubo yethu eqhubekayo I-Digest yeKhowudi enobungozi, apho siqinisekisa khona izoyikiso ezintsha size sinike ubukrelekrele obunokusetyenzwa ukunceda Amaqela eDevSecOps hlala phambili umngcipheko wonikezelo lwesoftware.
| Ecosystems | ipakethe | umhla |
|---|---|---|
| npm | uphawu lwe-pa: 99.1.10 | Ngo-Apr 27, 2026 |
| pypi | i-moonbit-locale-compat:0.2.3 | Ngo-Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.13 | Ngo-Apr 27, 2026 |
| npm | @sbt_gitverse/umxhasi-wohlalutyo:99.0.1 | Ngo-Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.33.1 | Ngo-Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.14 | Ngo-Apr 27, 2026 |
| npm | @tochka-ui/isiseko:99.0.2 | Ngo-Apr 27, 2026 |
| i-openvsx | i-arcane-spark/ubel:0.1.0 | Ngo-Apr 28, 2026 |
| npm | @2011-08-19/n:99.9.9 | Ngo-Apr 28, 2026 |
| npm | @frengki0707/google-cloud-clone:1.38.0 | Ngo-Apr 27, 2026 |
Indlela Esifumana Ngayo Ikhowudi Enobungozi kwi-npm Malware kunye ne-PyPI Malware
I-Xygeni isebenzisa iindlela ezininzi zokuthintela ikhowudi enobungozi ngaphambi kokuba isasazeke. Okokuqala, uhlalutyo lwekhowudi emileyo lubona iipatheni zokungacaci, imithwalo efihliweyo, kunye nokusetyenziswa gwenxa kweskripthi. Ukongeza, uhlalutyo lwesanti yokuziphatha luyafakelwa hooks, imiyalelo yexesha lokusebenza, kunye namaqhinga okunyamezela. Ngaphezu koko, ukufunyanwa kokufunda komatshini kuchonga i-malware ye-npm ye-zero-day kunye ne-pypi malware variants ezingafakwanga zizikena zesiginesha. Okokugqibela, iNkqubo yeSilumkiso sasekuqaleni ijonga iindawo zokugcina ulwazi zikawonke-wonke ngexesha langempela, iqinisekisa iziphumo, kwaye ilumkisa amaqela e-DevOps ngoko nangoko.
Ngenxa yoko, olu dibaniselwano luqinisekisa ukuba abaphuhlisi bafumana ulwazi olukhawulezayo nolusebenzayo oluhlanganiswe ngqo kwi CI/CD usebenza.
Kutheni Abaphuhlisi Befanele Bakhathalele Iiphakheji Ezinobungozi ze-npm
Izisongelo zanamhlanje azilindeli ixesha lokusebenza. Umzekelo, iipakethe ze-npm ezinobungozi zihlala zisebenza ngexesha lokufakwa, ngelixa iipakethe ze-pypi ezinobungozi zifihla ukuphuma kwethokheni okanye iingcango zangasemva. Abahlaseli:
- Jikelezisa ii-repos zeGitHub zabucala zibe zezoluntu ukuze uziphindaphinde.
- Khupha iziqinisekiso kunye neemfihlo usebenzisa imithwalo efihliweyo.
- Sebenzisa ii-JavaScript loaders ezifihliweyo ukuze usebenzise i-ransomware okanye ii-botnets.
Enyanisweni, iipakethe zemithombo evulekileyo ezinobungozi zinyuke nge-156% kunyaka omnye. Ke ngoko, amaqela axhomekeke kuphela kwii-feeds ezilibazisekileyo okanye kwiiskena ezisisiseko asala emva.
Oko Le Ngxelo yeMalware Ikulandelelayo kwi-npm kunye ne-PyPI
Olu hlalutyo luphambili kwezi zinto zilandelayo:
- Iiphakheji ze-npm ezinobungozi eziqinisekisiweyo
- Iiphakheji ezinobuthi ze-pypi eziqinisekisiweyo
- Ukufunyanwa kwekhowudi enobungozi ngokusekelwe ekuziphatheni
- Iziganeko eziqinisekisiweyo yiRejista
- Isishwankathelo seengxelo ze-malware zeveki nenyanga
- Imbali yotshintsho lwazo zonke iziphumo ze-npm malware kunye ne-pypi malware
Ngamanye amazwi, inika ingongoma enye yokubhekisela kuyo. Iqela lophando eXygeni lihlaziya eli phepha veki nganye ngamakhonkco ohlalutyo olupheleleyo lobuchwephesha kunye neGitHub IOCs.
Indlela Yokuzikhusela Kwiiphakheji ze-npm Ezinobungozi kunye ne-PyPI Malware
Ngenxa yolu mngcipheko ukhulayo, imibutho ifuna okungaphezulu kokuhlolwa kokuxhomekeka okusisiseko. Ukhuselo oluqinileyo kwiipakethe ze-npm ezinobuthi kunye neepakethe ze-pypi ezinobuthi zifuna zombini ulawulo lokuthintela kunye nokunyanzeliswa kwexesha lokusebenza:
Sebenzisa ii-Lockfile-Kuphela xa ufaka iiPakeji ze-npm ezinobungozi
ukusebenzisa npm ci or pip install --require-hashes in CI/CD.
Oku kuqinisekisa ukuba umthi wokuxhomekeka ochanekileyo ochazwe kwiifayile zokutshixa uyasetyenziswa. Ngenxa yoko, abahlaseli abanakutyibilika kwiinguqulelo eziguquliweyo okanye ezibhalwe nge-typosquat zeepakeji ze-npm ezinobubi.
Ukuskena kwangaphambili kwe-npm Malware kunye ne-PyPI Malware
Hlanganisa i-Early Warning Engine ye-Xygeni ukuze uskene i-npm malware kunye ne-pypi malware ngaphambi kokuba iipakethe zifikelele kwindawo okuyo.
Ngaphezu koko, fumana izinto ezikrokrisayo postinstall izikripthi, ii-obfuscated loaders, okanye ii-C2 URLs eziqinileyo.
Guardrails ukuvimba ulwakhiwo ngekhowudi enobungozi
Cwangcisa guardrails ukungaphumeleli ukwakha ngokuzenzekelayo ukuba iipakethe ze-npm ezinobungozi eziqinisekisiweyo okanye iipakethe ze-pypi ezinobungozi ziyafunyanwa.
Umzekelo, i-break yakhela kwiipakethe ezinee-maintainers ezingashicilelwanga, iipatheni ze-obfuscation, okanye ii-IOC matches. Ngenxa yoko, ikhowudi enobungozi ayikaze idlule ingabonwa.
Yenza kwaye Uqinisekise SBOMs Against Malicious npm Packages kunye nePyPI Malware
dala SBOMs (iCycloneDX, i-SPDX) kuyo yonke into eyakhiweyo.
Emva koko, thelekisa iipakeji ze-npm ezinobungozi kunye nee-pypi malware feeds ukuze ulandelele zombini ukuxhomekeka ngokuthe ngqo kunye nokuguqukayo.
Ukhuseleko lweSiqinisekiso kunye neToken kwi-npm Malware kunye ne-PyPI Malware
Iiphakheji ezininzi ze-npm ezingalunganga zizama ukufunda .npmrc, .pypirc, okanye izinto eziguquguqukayo kokusingqongileyo.
Ngoko ke, sebenzisa izakhiwo kwiikhonteyina eziqinileyo apho iimfihlo ezincinci zityhilekileyo. Ukongeza, sebenzisa abaphathi beemfihlo endaweni yezinto eziguquguqukayo zendalo ukuthintela ukusetyenziswa gwenxa kweekhowudi.
Jonga utshintsho lweRegistry kunye noLondolozo lweeNkonzo kwiiphakheji ze-npm ezinobungozi
Abahlaseli badla ngokuphanga iiprojekthi ezingasasebenziyo.
Ngokukodwa, jonga utshintsho olukhawulezileyo lwe-maintainer, ukutsiba okungaqhelekanga kwe-versioning, okanye ukupapashwa okugqithisileyo kwi-npm malware kunye neepakethe ze-pypi ezinobuthi.
Uqeqesho lwabaphuhlisi malunga nokufumanisa ikhowudi enobungozi kwi-npm kunye ne-PyPI
Fundisa amaqela ukuba abone iimpawu ezibomvu ezifana nezi:
- Amagama eephakheji aneempazamo zokubhala (
reqeustngaphandle kwerequest). - Unusual
installorprepareizikripthi. - Kutshanje kwenziwe iipakeji ezineenombolo zenguqulelo eziphezulu ngendlela engaqondakaliyo.
Ngaphezu kwako konke, olu lwazi lunceda ekufumaneni ikhowudi enobungozi kwangethuba.
Ukufunyanwa kwe-Runtime Anomaly kwiiphakheji ze-npm ezinobungozi kunye ne-PyPI Malware
Nokuba i-malware ayiphumeleli ukujonga izinto ezingashukumiyo, ukufunyanwa kwexesha lokusebenza kuyasebenza CI/CD ingabamba:
- Uqhagamshelo lwenethiwekhi olungalindelekanga.
- Utshintsho kwinkqubo yefayile ngaphandle kwee-directory ezilindelekileyo.
- Imizamo yokuzingisa kwimisebenzi eyahlukeneyo.
Okokugqibela, oku kuqinisekisa ukuba izoyikiso ze-npm malware kunye ne-pypi malware ziyayekiswa nasemva kokufakwa.
Ngokudibanisa ezi zilawuli, amaqela athintela iipakeji ze-npm ezinobungozi kunye neepakeji ze-pypi ezinobungozi ukuba zingafikeleli kwimveliso pipelines.
Zama izixhobo zokufumanisa i-malware zeXygeni
IXygeni inika:
- Ukufunyanwa kwekhowudi enobungozi ngexesha langempela, kuquka ii-backdoors, i-spyware, kunye ne-ransomware.
- Ngokungafaniyo neeskena ezisisiseko, uhlalutyo lubandakanya i-npm, i-PyPI, i-Maven, i-NuGet, i-RubyGems, kunye nokunye.
- Ukuvimba ulwakhiwo ngokuzenzekelayo xa ingxelo ye-malware ichonga umngcipheko.
- Ingqiqo yokuxhatshazwa, ukujonga udumo lomlondolozi, kunye nokuchongwa kwezinto ezingaqhelekanga.
Hlala unolwazi
Iqela lethu lihlaziya eli phepha qho ngeveki. Ukuze ufumane izilumkiso kunye neengxelo ezineenkcukacha:
- Bhalisa kwi-eyethu Newsletter
- landela @XygeniSecurity kwiLinkedin
- Bhukisha eli phepha ukuze ulandelele ezamva nje i-malware ye-npm kwaye pypi malware izinsongelo
