I-malware ye-Npm namuhla iyaqhubeka nokukhula, njengoba abahlaseli beshicilela ikhodi enonya, amaphakheji we-npm anonya, Futhi Amaphakheji anonya e-PyPI eklanyelwe ukuqondisa imisebenzi yokuthuthukiswa, CI/CD pipelineskanye nezinhlelo zemvelo ezivulekile. I-Malacious Code Digest umbiko wocwaningo oqhubekayo we-Xygeni olandelela futhi uqinisekise amaphakheji angempela anonya kuwo wonke npm, I-PyPI, Ikhodi ye-VS, Futhi I-OpenVSX, okuhlanganisa ukutholakala kwangasese okuqinisekisiwe, ukwebiwa kwedatha, imithwalo yokukhokha yokukhipha iziqinisekiso, kanye nemikhankaso ye-malware yezinguqulo eziningi ezenzakalelayo.
Ithimba lethu locwaningo libuyekeza leli khasi njalo nge okutholakele okuqinisekisiwe, izinkomba zokuvumelana (ama-IOC), amaphethini wokuziphatha, Futhi analysis technicalNgenxa yalokho, onjiniyela, Amaqembu e-AppSec, futhi onjiniyela bezokuphepha bangahlala phambili i-malware ye-npm namuhla kanye nomsebenzi wephakheji onobungozi oqhamukayo othinta izintambo zokuhlinzeka ngesofthiwe zesimanje.
I-NPM Malware Namuhla: Isifinyezo Samasonto Onke 24–29 Ephreli 2026
Abacwaningi baqinisekisile Amaphakheji angu-97 anonya kuzo zonke izindawo zokubhalisa zomphakathi phakathi nalesi sikhathi.
Ukubonwa kwesethi yedatha
- Amaphakheji amaningi aqinisekisiwe ashicilelwe ku- npm
- Amacala engeziwe athintekile I-PyPI, I-OpenVSX, Futhi Umqambi
- Ukushicilela okunonya okuphindaphindiwe kuyo yonke imindeni efanayo yamaphakheji namagama ahlobene
- Amaphethini enguqulo aphezulu noma angajwayelekile afana nalawa 99.x, 99.9.x, Futhi 1.0.x
- Ukusetshenziswa okunamandla kwe inkokhelo kanye nokuphuma, enterprise-style, uhlelo lokusebenza lwewebhu lwangaphakathi, analytics, Isisekelo se-UI, ithuluzi lonjiniyela, inetimu yamafu, Futhi okuhlobene nezingxenye amaphethini okuqamba amagama
- Ukuqhuma kwenguqulo ehlanganisiwe eminingi eyenzelwe ukufana nezibuyekezo zephakheji ezisemthethweni
Umbiko Wenyanga We-Malware: Amaphakheji e-npm Aqinisekisiwe Anobungozi ngo-Ephreli 2026
Siyakwamukela kuhlelo lwakamuva lwe- I-Xygeni Malicious Code Digest (Uhlelo Lwanyanga Zonke), e April 2026, ithimba lethu locwaningo liqinisekisile amaphakheji anonya angaphezu kuka-250, ikakhulukazi ngaphesheya npm, kanye namacala engeziwe athinta I-PyPI, i-VS Code, i-OpenVSX, kanye nomqambi.
U-Ephreli wayengekhona nje kuphela ngomthamo. amaza okushicilela aqhutshwa ngokuzenzakalela, imikhankaso yokwenyuka kwamanani entengo ephansi, ukuhlanganiswa komndeni wephakheji, Futhi ukuzenza ongeyena ithuluzi langaphakathi, sibone amanye amaphethini aphawuleka kakhulu enyangeni ekushicilelweni okunonya okuhleliwe kuyo yonke indawo:
amathuluzi angaphakathi angamanga, amaphakheji anetimu ye-AI, amamojula okukhokha nokukhokha, amaklayenti okuhlaziya, izingxenye ze-frontend, izinsiza zonjiniyela, ama-Kubernetes kanye namathuluzi efu, izandiso ze-VS Code kanye ne-OpenVSX, kanye namagama ephakheji athembekile afana nomkhiqizo aklanyelwe ukuhlangana nokulethwa kwesofthiwe yangempela pipelines.
Lezi kwakungezona izehlakalo ezilula zokubhala amagama. Ephreli isethi yedatha, sibonile amaphethini okusebenzisa kabi iziqinisekiso, ukuphathwa kochungechunge lokuhlinzekwa kwempahla, ukusetshenziswa kabusha kwesikhala segama okuphindaphindiwe, Futhi ukushicilela okunonya okuhleliwe yakhelwe ukuhlangana nezimo zonjiniyela bangempela kanye nokulethwa kwesofthiwe pipelines.
Kuyo yonke idatha ebanzi, siqhubeke nokubuka ukushicilelwa kwezinhlobo eziningi okubhalwe phansi, izinhlelo zokuguqula ezikhuphukile, inkokhelo- kanye enterprise-ukuqamba amagama okunesihloko, Amagama ephakheji anetimu ye-AI kanye ne-ejenti, Ukulingiswa kwe-SDK kanye nengxenye ye-frontend, ukulingisa kwamathuluzi angaphakathi, kanye namaqhinga ajwayelekile afana nalawa ukudideka kokuthembela futhi ukukhishwa kwedatha.
Lo mbiko uyingxenye yesikhathi sethu esiqhubekayo I-Malacious Code Digest, lapho siqinisekisa khona izinsongo ezintsha futhi sinikeze ubuhlakani obusebenzisekayo ukusiza Amaqembu e-DevSecOps hlala phambili ingozi yochungechunge lokuhlinzekwa kwesofthiwe.
| Ecosystem | Iphakheji | Usuku |
|---|---|---|
| npm | okuphawulwe nge-pa: 99.1.10 | Apr 27, 2026 |
| pypi | i-moonbit-locale-compat:0.2.3 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.13 | Apr 27, 2026 |
| npm | @sbt_gitverse/iklayenti le-analytics:99.0.1 | Apr 27, 2026 |
| npm | @frengki0707/google-cloud-clone:1.33.1 | Apr 27, 2026 |
| npm | @alfa.life.mapp/app.web:99.0.14 | Apr 27, 2026 |
| npm | @tochka-ui/isisekelo:99.0.2 | Apr 27, 2026 |
| i-openvsx | i-arcane-spark/ubel:0.1.0 | Apr 28, 2026 |
| npm | @2011-08-19/n:99.9.9 | Apr 28, 2026 |
| npm | @frengki0707/google-cloud-clone:1.38.0 | Apr 27, 2026 |
Indlela Esithola Ngayo Ikhodi Enonya ku-npm Malware kanye ne-PyPI Malware
I-Xygeni isebenzisa amasu anezingqimba eziningi ukuvimba ikhodi enonya ngaphambi kokuba isakazeke. Okokuqala, ukuhlaziywa kwekhodi engaguquki kuthola amaphethini okufiphaza, imithwalo efihliwe, kanye nokusebenzisa kabi iskripthi. Ngaphezu kwalokho, ukuhlaziywa kwe-behavioral sandboxing kufakwa hooks, imiyalo yesikhathi sokusebenza, kanye namaqhinga okuphikelela. Ngaphezu kwalokho, ukutholwa kokufunda komshini kukhomba izinhlobo ze-malware ze-npm ze-zero-day kanye ne-malware ye-pypi ezingatholakali yizikena zesiginesha. Ekugcineni, i-Early Warning System iqapha izindawo zokugcina zomphakathi ngesikhathi sangempela, iqinisekisa okutholakele, futhi ixwayise amaqembu e-DevOps ngokushesha.
Ngenxa yalokho, le nhlanganisela iqinisekisa ukuthi onjiniyela bathola ubuhlakani obusheshayo nobusebenzayo obuhlanganiswe ngqo ku- CI/CD ukuhamba komsebenzi.
Kungani Onjiniyela Kufanele Bakhathalele Amaphakheji e-npm Ayingozi
Izinsongo zanamuhla azilindi isikhathi sokusebenza. Isibonelo, amaphakheji e-npm anonya avame ukusebenza ngesikhathi sokufakwa, kuyilapho amaphakheji e-pypi anonya efihla ukuphuma kwethokheni noma iminyango yangemuva. Abahlaseli:
- Guqula ama-repos e-GitHub ayimfihlo abe ngumphakathi ukuze uwaphinde.
- Khipha iziqinisekiso nezimfihlo usebenzisa imithwalo efakiwe.
- Sebenzisa izilayishi zeJavaScript ezifihliwe ukuze usebenzise i-ransomware noma ama-botnets.
Eqinisweni, amaphakheji omthombo ovulekile ononya akhuphuke ngo-156% ngonyaka owodwa. Ngakho-ke, amaqembu athembele kuphela kuma-feed abambezelekile noma kuma-scanner ayisisekelo ayasala ngemuva.
Lokho Okulandelwa Yilo Mbiko We-Malware ku-npm kanye ne-PyPI
Lokhu kuchazwa kuyisihluthulelo esiyinhloko salokhu okulandelayo:
- Amaphakheji e-npm aqinisekisiwe anonya
- Amaphakheji anonya e-pypi aqinisekisiwe
- Ukutholwa kwekhodi enonya okusekelwe ekuziphatheni
- Izigameko eziqinisekiswe yi-Registry
- Izifinyezo zemibiko ye-malware yamasonto onke neyanyanga zonke
- I-log yokushintsha komlando yazo zonke i-npm malware kanye ne-pypi malware ezitholwe
Ngamanye amazwi, inikeza iphuzu elilodwa lokubhekisela. Ithimba locwaningo e-Xygeni libuyekeza leli khasi masonto onke ngezixhumanisi zokuhlaziya okugcwele kobuchwepheshe kanye nama-IOC e-GitHub.
Indlela Yokuvikela Amaphakheji e-npm Anobungozi kanye ne-PyPI Malware
Ngenxa yale ngozi ekhulayo, izinhlangano zidinga okungaphezu kokuhlolwa okuyisisekelo kokuthembela. Ukuzivikela okuqinile kumaphakheji e-npm anonya kanye namaphakheji e-pypi anonya kudinga kokubili ukulawulwa kokuvimbela kanye nokuphoqelelwa kwesikhathi sokusebenza:
Sebenzisa ukufakwa kwe-Lockfile-Kuphela ngokumelene namaphakheji e-npm anonya
Sebenzisa npm ci or pip install --require-hashes in CI/CD.
Lokhu kuqinisekisa ukuthi umuthi wokuthembela oqondile ochazwe kumafayela okukhiya uyasetshenziswa. Ngenxa yalokho, abahlaseli abakwazi ukushelela ezinguqulweni eziguquliwe noma ezibhalwe phansi zamaphakheji e-npm anonya.
Ukuskena Ngaphambi Kokufaka i-npm Malware kanye ne-PyPI Malware
Hlanganisa i-Early Warning Engine ye-Xygeni ukuze uskene i-npm malware kanye ne-pypi malware ngaphambi kokuba amaphakheji afike endaweni yakho.
Ngaphezu kwalokho, thola okusolisayo postinstall izikripthi, izilayishi ezifihliwe, noma ama-URL e-C2 aqinile.
Guardrails ukuvimba ukwakhiwa ngekhodi enonya
Misa guardrails ukwehluleka ukwakha ngokuzenzakalelayo uma kutholwa amaphakheji e-npm anonya noma amaphakheji e-pypi anonya.
Isibonelo, i-break yakhela kumaphakheji anabanakekeli abangakashicilelwa, amaphethini okufiphaza, noma ukufana kwe-IOC. Ngenxa yalokho, ikhodi enonya ayikaze idlule ingaqashelwa.
Khiqiza futhi Uqinisekise SBOMs Against Malicious npm Packages kanye ne-PyPI Malware
Dala SBOMs (CycloneDX, SPDX) kuyo yonke into eyakhiwe.
Ngemuva kwalokho, qhathanisa namaphakheji e-npm anobungozi aziwayo kanye nokuphakelwa kwe-malware ye-pypi ukuze ulandelele kokubili ukuncika okuqondile nokuguquguqukayo.
Ukuvikelwa Kwesiqinisekiso Nokutholakala Kwethokheni kusuka ku-npm Malware kanye ne-PyPI Malware
Amaphakheji amaningi e-npm anonya azama ukufunda .npmrc, .pypirc, noma iziguquguquko zemvelo.
Ngakho-ke, sebenzisa izakhiwo ezitsheni eziqinile lapho izimfihlo ezincane zivezwa khona. Ngaphezu kwalokho, sebenzisa abaphathi bezimfihlo esikhundleni sezinto eziguquguqukayo zemvelo ukuvimba ukusetshenziswa kabi kwekhodi okunonya.
Gada Izinguquko Zokubhalisa Nokugcina Kumaphakheji E-Malicious npm
Abahlaseli bavame ukuthumba amaphrojekthi ashiywe dengwane.
Ikakhulukazi, qaphela ukushintshana okungazelelwe kwe-maintainer, ukweqa okungavamile kwenguqulo, noma ukushicilela ngokweqile kuma-npm malware nama-pypi malicious packages.
Ukuqeqeshwa Konjiniyela Ekutholeni Ikhodi Enonya ku-npm kanye ne-PyPI
Fundisa amaqembu ukubona amafulegi abomvu afana nalawa:
- Amagama ephakheji anezimpawu zokubhala (
reqeustesikhundleni serequest). - okungajwayelekile
installorprepareimibhalo. - Kusanda kwenziwa amaphakheji anezinombolo zenguqulo eziphezulu ngendlela exakayo.
Ngaphezu kwakho konke, lokhu kuqaphela kusiza ekutholeni ikhodi enonya kusenesikhathi.
Ukutholwa Kwe-Runtime Anomaly Kwamaphakheji E-npm Anobungozi kanye ne-PyPI Malware
Noma ngabe i-malware idlula ukuhlolwa okungaguquki, ukutholwa kwesikhathi sokusebenza ku CI/CD kungabamba:
- Ukuxhumeka kwenethiwekhi okungalindelekile.
- Ukuguqulwa kwesistimu yefayela ngaphandle kwezinhlu zemibhalo ezilindelekile.
- Imizamo yokuphikelela emisebenzini yonke.
Ekugcineni, lokhu kuqinisekisa ukuthi izinsongo ze-npm malware kanye ne-pypi malware ziyamiswa ngisho nangemva kokufakwa.
Ngokuhlanganisa lezi zilawuli, amaqembu avimbela amaphakheji e-npm anonya kanye namaphakheji e-pypi anonya ukuthi angafinyeleli ekukhiqizweni pipelines.
Zama Amathuluzi Okuthola I-Malware ka-Xygeni
I-Xygeni inikeza:
- Ukutholwa kwekhodi enonya ngesikhathi sangempela, okuhlanganisa iminyango yangemuva, i-spyware, kanye ne-ransomware.
- Ngokungafani nezikena eziyisisekelo, ukuhlaziywa ku-npm, PyPI, Maven, NuGet, RubyGems, nokuningi.
- Ukuvimba ukwakha okuzenzakalelayo lapho umbiko we-malware ukhomba ingozi.
- Ukuqonda kokusetshenziswa kabi, ukuhlolwa kwedumela lomnakekeli, kanye nokutholwa kwezinkinga.
Hlala Uyazi
Ithimba lethu libuyekeza leli khasi njalo ngeviki. Ukuze uthole izexwayiso nemibiko enemininingwane:
- Bhalisela kwethu Newsletter
- Landela @XygeniSecurity ku-Linkedin
- Maka leli khasi ukuze ulandelele okwakamuva i-malware ye-npm futhi i-malware ye-pypi izinsongo
