Cishe njalo ngeviki, izinhlelo zethu zokuthola i-malware ziskena izinkulungwane zamaphakheji amasha nabuyekeziwe kuzo zonke izindawo zokubhalisa zomphakathi ezifana ne-npm ne-PyPI. Leli sonto belisebenza kakhulu.
Siqinisekisile Amaphakheji angu-198 anonya, ikakhulukazi ku-npm, kanye namacala engeziwe ku-PyPI, i-OpenVSX, i-Composer, kanye ne-VS Code extensions. Eziningana zivele kumaqoqo ahlanganisiwe, kanye nokukhishwa okunonya okuphindaphindiwe okushicilelwe ngaphansi kwamagama afanayo noma emindenini yamaphakheji ahlobene eduze. Icala elivelele kwakuyi- sensivity iphakheji, egcwalise i-npm ngokukhishwa okungaphezu kuka-60 okuhunyushiwe kububanzi be-2.5.x. Amanye amaqoqo aphawulekayo afakiwe ai-sdk-helpers (Izinguqulo ezingu-8 eziqondiswe kubathuthukisi be-AI), @antoncallahan/aws-user-helper (Izinguqulo ezingu-7 ezenza sengathi i-AWS utility), @apple-pay-trust futhi @google-pay-trust imindeni (ukulingisa amamojula okukhokha), @frengki0707/google-cloud-clone (izinguqulo ezi-5 ezikhohlisa i-Google Cloud), kanye cms-storehub, cms-helpgit, Futhi cms-github (ukuqondisa i-CMS pipelines). Amaphakheji amaningi alingisa amamojula okukhokha nokukhokha, enterprise kanye namaphakheji ewebhu angaphakathi, amaklayenti okuhlaziya, izisekelo ze-UI, izinsiza zonjiniyela, abahloli bezingxenye, amaphakheji anetimu yamafu kanye ne-Google, kanye namanye amamojula avame ukuthenjwa emisebenzini yokuthuthukiswa kwesimanje.
Lokhu kwakungewona ama-anomals ahlukile. Okuvelele kuleli sonto kwakuyisilinganiso sokushicilela okuphindaphindiwe emindenini efanayo yamaphakheji, ukusetshenziswa kabusha kwamaphethini okuqamba amagama, kanye nendlela amaphakheji anonya ayefihlwa ngayo ukuze abukeke njengokuthembela okusemthethweni ngaphakathi kokulethwa kwesofthiwe yangempela. pipelines.
Lesi sithombe samasonto onke siyingxenye ye-Malicious Code Digest yethu eqhubekayo, lapho siqinisekisa khona izinsongo ezintsha futhi sinikeze ubuhlakani obusebenzayo ukusiza amaqembu e-DevSecOps ukuvikela pipelinengaphambi kokuba kwenzeke umonakalo.
Ake sichaze lokho esikutholile kuleli sonto nokuthi kungani kubalulekile.
| Ecosystem | Iphakheji | Usuku |
|---|---|---|
| npm | @cloudplatform-single-spa/ukuphathwa:99.99.100 | Kwangathi 30, 2026 |
| npm | @cloudplatform-single-spa/svp-s3-storage:99.99.100 | Kwangathi 30, 2026 |
| npm | @maximvs1538/os-npm:99.0.0 | Kwangathi 30, 2026 |
| npm | @ukungena okulula/imizila yokufika:99.9.5 | Kwangathi 30, 2026 |
| npm | @ukungena okulula/ukubhalisa-ngaphandle-kwe-fop-navigator:99.9.5 | Kwangathi 30, 2026 |
| npm | @ukungena okulula/imizila:99.9.5 | Kwangathi 30, 2026 |
| npm | @t-in-one/form_product_token:5.7.1 | Kwangathi 30, 2026 |
| npm | @capibar.chat/ui-kit:99.5.7 | Kwangathi 30, 2026 |
| vscode | umphathi we-xampp: 5.1.3 | Kwangathi 30, 2026 |
| npm | @ithempulethi-yengxoxo/ugunyazo:1.0.0 | Kwangathi 31, 2026 |
| npm | i-schema ye-json-kuya-elula-ye-graphql:1.0.0 | Jun 1, 2026 |
| npm | @gs-select/savings-client-application:99.0.0 | Jun 1, 2026 |
| npm | intatheli ye-nemo:1.8.2 | Jun 1, 2026 |
| npm | cms-github:4.2.4 | Jun 1, 2026 |
| npm | usizo lwe-cms:4.2.6 | Jun 1, 2026 |
| npm | usizo lwe-cms:4.2.8 | Jun 1, 2026 |
| npm | isikhungo sesitolo se-cms:1.3.4 | Jun 1, 2026 |
| npm | isikhungo sesitolo se-cms:1.3.5 | Jun 1, 2026 |
| npm | isikhungo sesitolo se-cms:1.3.6 | Jun 1, 2026 |
| pypi | i-simtooreal-cli:0.3.0 | Jun 1, 2026 |
| npm | isu-lendawo-yokuthengisa-ingaphambili: 1.1.1 | Jun 1, 2026 |
| npm | isu-lendawo-yokuthengisa-ingaphambili: 1.1.2 | Jun 1, 2026 |
| npm | i-conversa-sdk:2.0.2 | Jun 1, 2026 |
| npm | i-veltrix:9.0.0 | Jun 1, 2026 |
| npm | i-veltrix:9.0.1 | Jun 1, 2026 |
| npm | i-jingmeideshishi:1.0.4 | Jun 1, 2026 |
| npm | i-jingmeideshishi:1.0.5 | Jun 1, 2026 |
| npm | @tse-digital/core:99.0.0 | Jun 1, 2026 |
| npm | @telenor-se/core:99.0.0 | Jun 1, 2026 |
| npm | @ownit/core:99.0.0 | Jun 1, 2026 |
| npm | imibhalo yesiguli: 75.0.0 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.69 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.68 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.82 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.80 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.81 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.83 | Jun 1, 2026 |
| npm | @antoncallahan/aws-user-helper:6767.67.3 | Jun 1, 2026 |
| npm | @emcd-vue/auth:6.4.9 | Jun 1, 2026 |
| npm | @emcd-vue/b2b-pay-form:5.7.4 | Jun 1, 2026 |
| npm | @ccrm/user-storage-api-axios:5.0.1 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.8 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.12 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.16 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.17 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.18 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.19 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.20 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.21 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.22 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.23 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.24 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.25 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.26 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.27 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.28 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.29 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.30 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.31 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.32 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.41 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.42 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.43 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.44 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.45 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.46 | Jun 2, 2026 |
| npm | abasizi be-meoo-ui:1.0.1 | Jun 2, 2026 |
| npm | @langgraphjs/ikhithi yamathuluzi:1.2.10 | Jun 2, 2026 |
| npm | i-eyevox:9.0.1 | Jun 2, 2026 |
| npm | ukuzwela: 2.5.53 | Jun 3, 2026 |
| npm | ukuzwela: 2.5.54 | Jun 3, 2026 |
| npm | ukuzwela: 2.5.55 | Jun 3, 2026 |
| npm | ukuzwela: 2.5.56 | Jun 3, 2026 |
| npm | ukuzwela: 2.5.57 | Jun 3, 2026 |
| npm | ukuzwela: 2.5.61 | Jun 3, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.1 | Jun 4, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.2 | Jun 4, 2026 |
| npm | @sentry-browser-sdk/profiling-node:1.0.5 | Jun 4, 2026 |
| npm | isevisi yokuqoqa imali:1.0.0 | Jun 4, 2026 |
| npm | ukuzwela: 2.5.67 | Jun 4, 2026 |
| npm | ukuzwela: 2.5.68 | Jun 4, 2026 |
| npm | imodeli-yokuxhumana kwe-vg:40.0.5 | Jun 4, 2026 |
| npm | i-internallib_v346:1.0.3 | Jun 4, 2026 |
| npm | i-internallib_v346:1.0.5 | Jun 4, 2026 |
| npm | i-internallib_v346:1.0.9 | Jun 4, 2026 |
| npm | abasizi be-ai-sdk:0.2.1 | Jun 4, 2026 |
| npm | abasizi be-ai-sdk:0.3.0 | Jun 4, 2026 |
| npm | abasizi be-ai-sdk:0.3.1 | Jun 4, 2026 |
| npm | abasizi be-ai-sdk:1.1.0 | Jun 4, 2026 |
| npm | abasizi be-ai-sdk:1.1.1 | Jun 4, 2026 |
| npm | abasizi be-ai-sdk:1.3.0 | Jun 4, 2026 |
| npm | abasizi be-ai-sdk:1.4.0 | Jun 4, 2026 |
| npm | abasizi be-ai-sdk:1.4.2 | Jun 4, 2026 |
| npm | @achuthvp/postinstall-poc:1.0.3 | Jun 4, 2026 |
| npm | ukuzwela: 2.5.0 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.1 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.2 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.3 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.4 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.5 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.13 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.14 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.15 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.33 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.34 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.35 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.36 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.37 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.38 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.58 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.59 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.60 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.62 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.63 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.64 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.65 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.66 | Jun 5, 2026 |
| npm | ukuzwela: 2.5.69 | Jun 5, 2026 |
Vikela Ukuthembela Kwakho Komthombo Ovulekile Ekulimaleni kanye Nekhodi Enonya
Ungavumeli amaphakheji anonya afinyelele kuwe pipelines. Ukutholwa Kwe-Malware Yasekuqaleni kwe-Xygeni inikeza ithimba lakho ukubonakala kwangempela ezinsongweni ezibaluleke kakhulu, libamba abantu abathembele kuzo abayingozi ngaphambi kokuba bathinte isofthiwe yakho.
Njengoba inhlolovo yaleli sonto icacisa, ubukhulu kanye nobuchwepheshe bemikhankaso yamaphakheji anonya akuyehlisi ijubane. Ukukhukhula kwenguqulo ehlelekile, ukuzenza umuntu ongeyena wemodyuli yokukhokha, kanye namagama amaphakheji azwakala ngaphakathi kumane nje kungenye yamaqhinga abahlaseli abawasebenzisayo ukuze badlule. standard ukuzivikela. Ukuhlala phambili kulezi zinsongo kudinga okungaphezu kokuhlolwa okwenziwa njalo, kudinga ukuqapha okuqhubekayo kuyo yonke irejista amaqembu akho athembele kuyo.
I-Xygeni's Open Source Security Isixazululo siskena futhi sivimba amaphakheji ayingozi lapho kushicilelwa khona, kuyo yonke i-npm, i-PyPI, nangale kwalokho. Ngokubeka phambili ngokomongo ubuthakathaka obubeka ingozi enkulu kunazo zonke emhlabeni wangempela (nokwenza kube lula indlela yokulungisa yamaqembu akho e-DevSecOps) i-Xygeni ikusiza ukuthi ugcine ukulethwa kwesofthiwe okuphephile nokuthembekile ngaphandle kokunciphisa ijubane lokuthuthukiswa.
