Qho ngeveki, iinkqubo zethu zokufumanisa ii-malware ziskena amawaka eepakethe ezintsha nezihlaziyiweyo kuzo zonke iirejista zikarhulumente ezifana ne-npm kunye ne-PyPI. Kule veki bekungekho nto ingaqhelekanga.
Siqinisekisile iipakeji ezingaphezulu kwama-90 ezinobuthi phakathi komhla wama-26 kuJuni kunye nomhla wesi-3 kuJulayi 2026, kwi-npm kunye ne-PyPI, kunye neephulo ezininzi eziqhubekayo kwiiveki ezidlulileyo kunye nezintsha ezivelayo.
The nolimit-agent Iphulo liqhubekile nokupapasha iinguqulelo ezintsha (1.0.306, 1.0.315, 1.0.316), landisa isakhelo se-phishing seMicrosoft 365 device-code esisibhale ngokweenkcukacha kwi-intanethi yethu. Ingxelo yeDeviceDoor. The anthropic-toolkit Iqela yayiliphulo elitsha eliphambili, kunye neenguqulelo ezingama-20 eziqinisekisiweyo nge-30 kaJuni kuphela — ezijolise ngqo kwiipakeji ezinxulumene nezixhobo zomphuhlisi ze-Anthropic. cursed-modules Usapho lupapashe iinguqulelo ezingaphezu kwe-15 phakathi komhla woku-1 kuJulayi kunye nomhla wesi-2 kuJulayi kuzo zombini standard kunye neenombolo zenguqulelo ezinyuswe kakhulu (999.x), kulandela incwadi yokudlala yokudideka kokuxhomekeka. date-fns-lite Iqela (iinguqulelo ezi-5, nge-2 kaJulayi) laqhubeka nomzekelo wokwenza iipakethe zezixhobo ezisemthethweni nezisetyenziswa kakhulu.
Indlela yokujolisa kwizixhobo ze-AI yasekwa kwiveki ephelileyo nge ollama-helpers kwaye openai-agents-helpers yolulelwe kweli xesha kunye ai-explain, ai-sdk-helpers, yaye @langgraphjs/toolkit, zonke ziqinisekisiwe phakathi komhla wama-28 kuJuni kunye nowama-30 kuJuni. @szc-ft/mcp-szcd-client iphakheji (iinguqulelo 0.38.0 kunye no-0.39.0, iqinisekisiwe nge-2 kaJulayi) yazisa ipateni entsha esiyilandelayo njenge I-SkillLeak: i-decryptor yeziqinisekiso efihliweyo ngaphakathi kwisakhono se-MCP endaweni ye-hook yokufaka, engabonakaliyo kwizikena ezima emva kokufaka. Sipapashe i- Uhlalutyo olupheleleyo lweSkillLeak apha.
Le vidiyo yeveki iyinxalenye yenkqubo yethu eqhubekayo I-Digest yeKhowudi enobungozi, apho siqinisekisa khona izisongelo ezintsha kwaye sinike ulwazi olusebenzayo ukunceda amaqela eDevSecOps akhusele pipelinengaphambi kokuba kwenzeke umonakalo. Masihlalutye oko sikufumeneyo kule veki kunye nesizathu sokuba kubalulekile.
Iipakeji ezingaphezu kwama-90. Iveki enye. Pipeline Ngaba yiTarget.
Ingxelo yale veki ibonisa utshintsho kwindlela umhlaseli agxile ngayo, kungekuphela nje kwivolumu, kodwa nangaphambi kokubacisi-ion. Ukukhukula kwenguqulelo eqhubekayo, amaqela ezixhobo ze-AI, ubusela beziqinisekiso ze-MCP-layer, kunye nohlaselo lokudideka kokuxhomekeka kwiindawo zamagama zangaphakathi ze-monorepo. Iiphulo ziyazenzekela kwaye ziyaqhubeka. Ukuskena veki nganye akuyondlela yokuzikhusela.
Isilumkiso se-Xygeni kwiMalware yasekuqaleni Ijonga i-npm, i-PyPI, kunye nezinye iirejista ngexesha langempela, iphawula izoyikiso ngexesha lokupapashwa, ngaphambi kokuba zifike kwindawo yokwakha, ngaphambi kokuba iarhente ye-AI izifakele ngokwayo, nangaphambi kokuba umthwalo wesitayile seSkillLeak ube nethuba lokuphumeza. anthropic-toolkit ipapasha iinguqulelo ezingama-20 ngosuku olunye okanye cursed-modules i-floods npm enenguqulelo engu-999.x kwiintsuku ezimbini, ukufunyanwa okulandela inyani sele kusemva kwexesha.
IXygeni's Open Source Security Iqonga linika amaqela eDevSecOps ukufunyanwa kwexesha langempela kunye nokubekwa phambili okufunekayo ukuze ahlale phambili kuxinzelelo lwekhonkco lokubonelela oludibeneyo, ukuze pipelineHlala ucocekile ngaphandle kokulibazisa amaqela akho.
