Siyakwamukela Uhlelo lukaJuni lwe-Xygeni Malicious Code DigestKule nyanga, ithimba lethu locwaningo lwezokuphepha liqinisekisile okungaphezu kwalokho Amaphakheji angu-645 anonya kuyo yonke i-npm, i-PyPI, kanye (okokuqala ngqa) nemakethe yesandiso se-VSCode.
UJuni wachazwa yizindlela ezintathu ezihlanganayo: imikhankaso eqhubekayo yokukhukhula kwenguqulo eyenzelwe ukuhlala isikhathi eside kunezinhlu zokuvimba, ukusheshisa okukhulu kokuhlaselwa okuqondiswe kumathuluzi e-AI kanye nemisebenzi yokuthuthukiswa kwe-ejenti, kanye nokuhlaselwa kokudideka kokuthembela okuqondisiwe ngokumelene nezikhala zamagama zangaphakathi ze-monorepo.
Phakathi kwemikhankaso ephawuleka kakhulu ebhalwe phansi kule nyanga:
- ukuzwela i-npm egcwele izinguqulo ezingaphezu kuka-70 kulo lonke uhla lwe-2.5.x, umkhankaso wokugwema oqhubekayo oshicilela kabusha njalo ukuze uhlale uphambi kokususwa.
- A umkhankaso we-typosquat kaSolana wamagagasi amabili (Juni 7–8) bashicilele amaphakheji ayi-15 azenza sengathi
@solana-labsamathuluzi e-ecosystem, okuqondiswe ngqo kubathuthukisi be-Web3 kanye ne-DeFi. - houzidawang806 babalwa ngezinguqulo ezingaphezu kuka-25 ngosuku olulodwa (Juni 13), bajoyinwa yi izilinganiso-pipeline-d8k2 kushicilelwe kabusha kuzo zonke izinguqulo ezingu-21 phakathi kukaJuni 15-18.
- The Ukudideka kwe-CryptoDAO umkhankaso (Juni 17) ushicilele amaphakheji ayi-11 kunguqulo 99.99.99, ngalinye liphethe umthwalo ofanayo wokufaka ngemuva kokufakwa CI/CD amathokheni, iziqinisekiso zamafu, kanye nezimfihlo zesikhwama semali se-crypto.
- Isonto likaJuni 20-26 lilethe ukuhloswa okugxile kakhulu kwamathuluzi e-AI enyangeni: abasizi be-ollama (Izinguqulo ezingu-20), abasizi be-openai-agents (Izinguqulo ezingu-23), i-monoclaude, abasizi be-ai-sdk, Futhi @langgraphjs/ikhithi yamathuluzi, konke kuqinisekiswe ngesonto elilodwa, kuqondiswe ngqo ku-Ollama, ama-ejenti e-OpenAI SDK, LangGraph, kanye nokuhlanganiswa kwe-Claude API.
- Kuqinisekisiwe okubili izandiso ze-VSCode ezinonya kuvele kule nyanga, okubonisa ukuthi abahlaseli bayanda ngale kokubhaliswa kwamaphakheji bangene endaweni yonjiniyela uqobo.
Iphethini echazayo kaJuni: ukuhlaselwa kuqhubekela phambili ekunwetshweni kwe-IDE, amathuluzi e-AI agent, kanye nemisebenzi ye-agent lapho iphakheji enonya efakwe ngokuzenzakalelayo ingenaye umbukeli womuntu phakathi kokutheleleka kanye nokubulawa.
Lokhu kubuyekezwa kwanyanga zonke kuyingxenye yohlelo lwe-Xygeni oluqhubekayo lokucwaninga nge-malware kanye nosongo lwe-supply chain. Ukuze uthole umongo ogcwele kuwo wonke amaphakheji anonya aqinisekisiwe kule nyanga, hlola i-June Malicious Code Digest ephelele kanye nocwaningo oluhlobene oluvela ku-Xygeni Security Team.
Isonto 4: Kutholakale Amaphakheji Angaphezu Kwe-201
| Ecosystem | Iphakheji | Usuku |
|---|---|---|
| June 20, 2026 | ||
| npm | i-panrouter: 5.0.2 + Izinguqulo ezingu-30 ku-5.x–6.x zisukela ngoJuni 22 — umkhankaso ovelele weviki | Jun 20, 2026 |
| npm | i-trimprompt:1.0.5 + Izinguqulo ezi-4 — ukuqhubeka kwesonto eledlule, kusasebenza | Jun 20, 2026 |
| npm | i-monoclaude:1.0.1 + Izinguqulo ezi-2 — Ukulingiswa kwe-Claude API ngamathuluzi | Jun 20, 2026 |
| vscode | uhlelo lwe-orbit-agent-pair-for-smalltalk:1.206.0 + 1 inguqulo — isandiso se-VSCode esinonya esiqondisa ukuthuthukiswa kwe-ejenti | Jun 20, 2026 |
| npm | i-simplisafe-gatsby:1.0.1 Ukulingiswa kwesikhala segama leplatifomu yekhaya elihlakaniphile | Jun 20, 2026 |
| June 21, 2026 | ||
| npm | okwabiwe nge-atlasora:1.0.0 + amaphakheji ayi-6 — ukudideka kokuxhomekeka kwe-monorepo okuhlanganisiwe: i-atlasora-api, -client, -sdk, -types, -utils, -config | Jun 21, 2026 |
| npm | i-apintergrationpost:4.0.2 + Izinguqulo ezi-6 — ukusebenzisa umkhankaso wokupela okungalungile ngamabomu okuhloswe ngawo ukuhlanganisa amathuluzi | Jun 21, 2026 |
| npm | uhlelo lokusebenza lwe-llm-traces:1.0.1 Amathuluzi okubuka e-LLM aqondiswe kuwo | Jun 21, 2026 |
| pypi | i-d0rk3r-telemetry:1.0.0 Iphakheji ye-telemetry efihliwe ku-PyPI | Jun 21, 2026 |
| June 22, 2026 | ||
| pypi | tm-ai:2.91.75 + Izinguqulo ezingu-7 — umkhankaso wezikhukhula wenguqulo ye-PyPI oqhubekayo | Jun 22, 2026 |
| pypi | isicelo-se-cache-py:1.0.4 + Izinguqulo ezi-6 — Inguqulo ye-PyPI ekhukhula | Jun 22, 2026 |
| pypi | ama-corvino:0.17.0 + Izinguqulo ezi-6 — Umkhankaso wokubhalisa ngobuningi we-PyPI | Jun 22, 2026 |
| June 23, 2026 | ||
| npm | umsizi wethokheni le-web3:1.1.1 + Izinguqulo ezi-2 — Ukuqondiswa kwezinsiza ze-Web3 token | Jun 23, 2026 |
| npm | i-monocross:1.0.1 + 1 inguqulo — i-mono-* iqembu lokuqamba amagama eceleni kwe-monoclaude kanye ne-monotacos | Jun 23, 2026 |
| June 24, 2026 | ||
| npm | abasizi be-ollama:0.1.0 + Izinguqulo ezingu-19 — umkhankaso omkhulu kakhulu wokusebenzisa amathuluzi e-AI wenyanga, ohlose isikhathi sokusebenza se-AI sendawo sase-Ollama | Jun 24, 2026 |
| npm | openai-agents-helpers:0.1.1 + Izinguqulo ezingu-22 — umkhankaso ohleliwe oqondiswe kuhlelo lwe-SDK lwama-ejenti e-OpenAI | Jun 24, 2026 |
| June 25, 2026 | ||
| npm | abasizi be-ai-sdk:1.4.3 Ukufakwa kwamathuluzi e-AI SDK kuqondiswe eceleni kwe-@langgraphjs/toolkit:1.2.11 | Jun 25, 2026 |
| npm | i-embedder yokubhalisa: 99.99.99-poc3 + ukuphathwa kwe-hs-locale — Ukudideka kokuxhomekeka kwesikhala samagama sangaphakathi se-HubSpot, isijobelelo se-poc siqinisekisa umkhankaso wocwaningo osebenzayo | Jun 25, 2026 |
| June 26, 2026 | ||
| npm | ikhithi yezintambo ezilula: 1.0.1 + Izinguqulo ezingu-8 ezifaka phakathi uhlobo lwe-easy-string-kit232 — ukubhaliswa kwenqwaba ngaphansi kwegama lokusetshenziswa elijwayelekile | Jun 26, 2026 |
| npm | iphakheji engaphephile-enobungozi:1.0.0 + Izinguqulo ezi-5 — iphakheji eqanjwe ngokusobala njengomkhankaso ononya, umthwalo oqinisekisiwe, okungenzeka ukuthi umkhankaso wokuhlola noma wokuvusa inkanuko | Jun 26, 2026 |
| npm | @vpms/design-system:1.1.2 + izinguqulo ezi-2 — ukulingisa indawo yegama lesistimu yokuklama | Jun 26, 2026 |
Isonto 3: Kutholakale Amaphakheji Angaphezu Kwe-200
| Ecosystem | Iphakheji | Usuku |
|---|---|---|
| June 13, 2026 | ||
| npm | houzidawang806:1.0.0 + Izinguqulo ezingu-25 ku-1.0.x–1.2.x kufaka phakathi izingane zakubo u-houzidawang807 no-houzidawang808 — umkhankaso ovelele weviki | Jun 13, 2026 |
| npm | idemo yokubingelela enobungane:1.0.2 + Izinguqulo ezi-4 — umkhankaso oqhubekayo uphinda uvele ezinsukwini eziningi | Jun 13, 2026 |
| npm | i-tsc-ai:1.2.0 i-tsc-* cluster: tsc-ai, tsc-mesh, tsc-lotl — Ukulingisa indawo yegama le-CI tooling | Jun 13, 2026 |
| pypi | i-neuralbridge-sdk:4.5.4 + izinguqulo ezingu-6 ku-4.5.x–5.1.x — umkhankaso we-PyPI wezinsuku eziningi oqhubekayo | Jun 13, 2026 |
| June 15, 2026 | ||
| npm | amanani-amathokheni-cron:999.0.0 + amaphakheji ayi-6 — Iqembu lokudideka lokuncika kwengqalasizinda ye-DeFi eliqondisa ukusetshenziswa kwamathuluzi angaphakathi e-cron kanye ne-vault | Jun 15, 2026 |
| June 16, 2026 | ||
| npm | i-bodega-sdk:9.9.9 + Amaphakheji angu-8 — Iqembu le-DeFi loan kanye ne-Cardano ecosystem: ukubolekisa nge-flow, ukubolekisa nge-surf, i-janus-*, i-flowcardano, i-flowdefi | Jun 16, 2026 |
| npm | amamethrikhi emicimbi-q3x7:1.0.0 + Izinguqulo ezingu-8 — iphakheji ejwayelekile ye-hex-suffix ebhalisa amagama anetimu yokuqapha ngobuningi | Jun 16, 2026 |
| npm | i-nic-datagov:1.0.0 + amaphakheji ama-3 — ipulatifomu yedatha kahulumeni ukulingisa indawo yegama: i-ogd-analytics, i-ogd-platform, i-dms-backend | Jun 16, 2026 |
| June 17, 2026 | ||
| npm | izinkontileka ze-cryptodao: 99.99.99 + amaphakheji ayi-10 — Ukudideka kokuthembela kwe-CryptoDAO: i-core, i-sdk, i-bot, i-config, i-utils, i-deploy, i-signer, i-backend, izinhlobo | Jun 17, 2026 |
| pypi | i-teambot-ai:1.48.0 Ukufakwa kwamathuluzi e-ejenti ye-AI okuqondiswe ku-PyPI | Jun 17, 2026 |
| June 18, 2026 | ||
| npm | izilinganiso-pipeline-d8k2:1.0.0 + Izinguqulo ezingu-20 kulo lonke uJuni 18 — umkhankaso wokugwema wosuku olulodwa oqhubekayo, oshicilela kabusha ngokuqhubekayo ukuze udlule uhlu oluvinjelwe | Jun 18, 2026 |
| npm | ukuskena kuphela: 0.4.5 + Izinguqulo ezi-6 — inguqulo yomkhankaso wezikhukhula | Jun 18, 2026 |
| npm | i-color-utils-dee0:1.0.0 + amaphakheji ama-hex-suffix ayi-5 ajwayelekile: ama-data-utils, amathuluzi e-string, i-type-check, abasizi be-fmt, i-metrics-probe — ukubhaliswa kwenqwaba okubhaliwe | Jun 18, 2026 |
| npm | @azure-lab-services/ml-ts:99.0.0 Ukulingiswa kwesikhala segama le-Azure ML | Jun 18, 2026 |
| June 19, 2026 | ||
| npm | i-trimprompt:1.0.2 + i-trimprompt-hub — ithuluzi lobunjiniyela elisheshayo eliqondiswe | Jun 19, 2026 |
| npm | indebe ye-claude: 0.8.6 Ukuzenza ongeyena kwe-Claude API tooling | Jun 19, 2026 |
| pypi | i-aiaddin-ejenti:0.1.0 Ukufakwa kwamathuluzi e-ejenti ye-AI okuqondiswe ku-PyPI | Jun 19, 2026 |
| npm | Izinsiza zekheli le-web3-crypto:0.1.0 Ukuqondisa izinsiza ze-Web3 | Jun 19, 2026 |
Isonto 2: Kutholakale Amaphakheji Angaphezu Kwe-135
| Ecosystem | Iphakheji | Usuku |
|---|---|---|
| June 7, 2026 | ||
| npm | @solana-labs/web3.js:1.0.0 + Izinhlobo ezi-5 — umkhankaso we-Solana ecosystem typosquat, igagasi lokuqala | Jun 7, 2026 |
| npm | @jisan901/teamfocus:1.0.0 + izinguqulo ezi-2 | Jun 7, 2026 |
| npm | @sflyinc-knapsack/shutterfly-reaction:999.0.0 Ukudideka kokuthembela, inguqulo ekhuphukile | Jun 7, 2026 |
| June 8, 2026 | ||
| npm | @solana-labs/web3.js:1.98.102 + Izinhlobo ezingu-9 — umkhankaso we-Solana ecosystem typosquat, igagasi lesibili | Jun 8, 2026 |
| pypi | i-helixagentai:0.1.3 Ukufakwa kwamathuluzi e-ejenti ye-AI okuqondiswe ku-PyPI | Jun 8, 2026 |
| June 9, 2026 | ||
| npm | @nstrlabs/sdk:99.0.0 + amaphakheji angu-7 — ukudideka kokuthembela ngokumelene nesikhala sangaphakathi se-monorepo | Jun 9, 2026 |
| npm | @klapp-login-platform/native-sdk:99.0.0 + amaphakheji angu-9 — ukulingisa kweplatifomu yokuqinisekisa kuzo zonke izikhala zamagama ze-klapp | Jun 9, 2026 |
| npm | i-blockchain-helper-0:1.0.0 + amaphakheji angu-7 — iqembu lezinsiza ze-crypto/DeFi eliqondise onjiniyela be-Web3 | Jun 9, 2026 |
| npm | @idatha-yekhadi-le-pci/isitolo:99.0.0 Isikhala segama ledatha yekhadi lokukhokha esiqondiwe | Jun 9, 2026 |
| June 10, 2026 | ||
| npm | uhlelo-lokuklama lwenkanyezi yasekuseni:99.0.0 + Izinguqulo ezi-2 — ukulingisa uhlelo lokuklama lwezezimali | Jun 10, 2026 |
| June 11, 2026 | ||
| npm | i-pocteszep:1.0.1 + Izinguqulo ezi-5 ezishicilelwe ngalolo suku | Jun 11, 2026 |
| npm | @coze-common/indawo yokuxoxa:99.1.1 Ukulingiswa kwesikhala segama lesikhulumi sengxoxo se-AI | Jun 11, 2026 |
| pypi | i-telegramlite:1.0.0 + 1 inguqulo — ukulingisa ipulatifomu yemiyalezo ku-PyPI | Jun 11, 2026 |
| June 12, 2026 | ||
| npm | i-ecto-corsair-whisper-6f3b9:1.0.18 + 7 izinhlobo ze-ecto-* — iqoqo lamagama elifihliwe | Jun 12, 2026 |
| npm | i-internallib_v984:1.0.3 + i-internallib_v557 cluster — izinguqulo eziyi-13 zabakhohlisi bomtapo wangaphakathi | Jun 12, 2026 |
| npm | i-voyager-web:999.0.0 Ukudideka kokuthembela, inguqulo ekhuphukile | Jun 12, 2026 |
| pypi | i-cdjeez:0.32.0 | Jun 12, 2026 |
Isonto 1: Kutholakale Amaphakheji Angaphezu Kwe-118
| Ecosystem | Iphakheji | Usuku |
|---|---|---|
| Kwangathi 30, 2026 | ||
| npm | @cloudplatform-single-spa/ukuphathwa:99.99.100 Ukudideka kokuthembela, inguqulo ekhuphukile | Kwangathi 30, 2026 |
| vscode | umphathi we-xampp: 5.1.3 Isandiso se-VSCode — ukulingisa ithuluzi lonjiniyela | Kwangathi 30, 2026 |
| June 1, 2026 | ||
| npm | @tse-digital/core:99.0.0 Ukudideka kokuthembela — @telenor-se kanye no-@ownit nabo bathintekile | Jun 1, 2026 |
| npm | isikhungo sesitolo se-cms:1.3.4 + izinguqulo ezi-2, iqembu le-CMS namespace | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.69 + Izinguqulo ezi-6, izinombolo zenguqulo ezikhulisiwe eziqondisa iziqinisekiso ze-AWS | Jun 1, 2026 |
| npm | imibhalo yesiguli: 75.0.0 Inhloso yesikhala segama lezempilo | Jun 1, 2026 |
| npm | @emcd-vue/auth:6.4.9 Ukulingiswa kwegama lesikhala sokushintshana kwe-crypto | Jun 1, 2026 |
| pypi | i-simtooreal-cli:0.3.0 | Jun 1, 2026 |
| June 2, 2026 | ||
| npm | ukuzwela: 2.5.8 + Izinguqulo ezingu-70 kububanzi obungu-2.5.x, ngoJuni 2–5 — umkhankaso ovelele walesi sikhathi | Jun 2, 2026 |
| npm | @langgraphjs/ikhithi yamathuluzi:1.2.10 Ukuqondisa amathuluzi e-LangGraph | Jun 2, 2026 |
| June 4, 2026 | ||
| npm | @sentry-browser-sdk/profiling-node:1.0.1 + Izinguqulo ezi-2, ukuzenza ongeyena i-Sentry namespace | Jun 4, 2026 |
| npm | i-internallib_v346:1.0.3 + Izinguqulo ezi-2, umkhohlisi welabhulali yangaphakathi | Jun 4, 2026 |
| npm | abasizi be-ai-sdk:0.2.1 + Izinguqulo ezingu-7, eziqondiswe kumathuluzi e-AI SDK | Jun 4, 2026 |
Misa Ikhodi Enonya Ngaphambi Kokuthi Ifike Kuwe Pipeline
Izinsongo zokunikezela ngesofthiwe sezidlule kakhulu kunezinkolelo-mbono. Ukuhlaselwa kokudideka kokuthembela, ukweba iziqinisekiso, i-malware eqondiswe ku-AI, kanye namathuluzi onjiniyela anobuthi kuhlasela amaqembu angempela. SDLCs njalo ngeviki.
I-Xygeni's ukutholwa kwe-malware futhi ipulatifomu yokuphepha kweketanga lokunikezela Inikeza izinhlangano ithuba lokubamba ukuncika okunonya ngaphambi kokuba kusebenze emshinini wonjiniyela, kufakwe ohlelweni lokwakha, noma kufinyelelwe ekukhiqizeni. Ukumbozwa kuhlanganisa i-npm, i-PyPI, i-VSCode, nangale kwalokho, ukuqapha amaphethini okushicilela asolisayo, ukusetshenziswa kabi kwesikhala samagama, ukubhala amagama, kanye namasu okuhlasela endabuko e-AI njengoba evela.
Konke okutholakele kubekwa phambili ngokuzenzakalelayo ngokusebenziseka kalula, ukufinyeleleka kalula, kanye nomthelela webhizinisi, ngakho ithimba lakho ligxila kulokho okudinga ukulungiswa ngempela, hhayi umsindo.
Kungakhathaliseki ukuthi kuyiphakheji yomthombo ovulekile enonya, ithuluzi lonjiniyela elisengozini, noma ingozi yekhodi ekhiqizwe yi-AI, i-Xygeni igcina amaqembu okuphepha nawobunjiniyela ephambi kwesimo sezinsongo zochungechunge lokuhlinzekwa kwempahla.
Hlola yonke iphakheji enonya kanye nomkhankaso oqinisekiswe yi-Xygeni Security Team ku I-Malacious Code Digest.
Hlala uphephile. Hlala ushesha. Hlala ulawula i-Xygeni.
