Cishe njalo ngeviki, izinhlelo zethu zokuthola i-malware ziskena izinkulungwane zamaphakheji amasha nabuyekeziwe kuzo zonke izindawo zokubhalisa zomphakathi ezifana ne-npm ne-PyPI. Kuleli sonto bekungenjalo.
Siqinisekisile amaphakheji anonya angaphezu kuka-130 phakathi kukaJuni 7 noJuni 12, 2026, ikakhulukazi phakathi no-npm, kanye namacala engeziwe ku-PyPI. Amaningana avele kumaqoqo ahlanganisiwe, ukukhishwa okunonya okuphindaphindiwe okushicilelwe ngaphansi kwamagama afanayo noma emindenini yamaphakheji ahlobene eduze.
Icala elivelele kuleli sonto beliwukuthi sensivity, eyagcwalisa i-npm ngokukhishwa okungaphezu kuka-40 okuhunyushwe kuhlu lwe-2.5.x, okuqinisekisiwe ezinsukwini eziningi. Amanye amaqoqo aphawulekayo afaka igagasi le- @solana-labs ama-typosquat aqondiswe ohlelweni lwe-Solana (i-web3.js, i-web3-js, i-etherjs, i-spl-toke, i-ancor, i-web3js — emikhankasweni emibili yokushicilela ehlukene ngoJuni 7 nangoJuni 8), @nstrlabs umndeni (sdk, ixel, utils, shared-components, api-client, auth - ukuhlaselwa kokudideka kokuxhomekeka ngokumelene nesikhala segama lephakheji yangaphakathi), i @klapp-login-platform iqembu (native-sdk, oidc, routes — ezenza ipulatifomu yokuqinisekisa), internallib_v557 futhi internallib_v984 (izinguqulo eziningi zabakhohlisi bangaphakathi abafihliwe), pocteszep (Izinguqulo ezi-6 ezishicilelwe ngoJuni 11), kanye neqoqo lezinsiza ze-crypto kanye ne-Web3 okuhlanganisa blockchain-helper-0, ethereum-kit-1, ethereum-kit-9, crypto-utils-7, wallet-sdk-9, defi-tools-39, swap-sdk-87, Futhi farming-tools-12. The morningstar-design-system iphakheji ivele ezinguqulweni ezintathu ngoJuni 10, izenza uhlelo lokuklama lwezezimali oludumile. Ku-PyPI, helixagentai, telegramlite, Futhi cdjeez kwaqinisekiswa kulo lonke isonto.
Lokhu kwakungewona ama-anomals ahlukile. Okuvelele kuleli sonto kwakuwukuqoqwa kokuhlaselwa kokudideka kokuthembela ezindaweni zamagama zangaphakathi zephakheji, ukushicilelwa okuqhubekayo kwezinsuku eziningi kwe- sensivity i-cluster, kanye nokuqondiswa okuqhubekayo kwe-Web3 kanye ne-Solana tooling, iphethini esheshile kakhulu ngo-2026.
Lesi sithombe samasonto onke siyingxenye ye-Malicious Code Digest yethu eqhubekayo, lapho siqinisekisa khona izinsongo ezintsha futhi sinikeze ubuhlakani obusebenzayo ukusiza amaqembu e-DevSecOps ukuvikela pipelinengaphambi kokuba kwenzeke umonakalo.
Ake sichaze lokho esikutholile kuleli sonto nokuthi kungani kubalulekile.
Ungavumeli Amaphakheji Anobungozi Afinyelele Ekukhiqizweni
Amaphakheji amaqembu akho athembele kuwo asetshenziswa kakhulu njengendawo yokungena. Ukutholwa Kwe-Malware Yasekuqaleni kwe-Xygeni Iqapha amarejista ngesikhathi sangempela, ngakho-ke izinsongo ezifana nalezo eziku-digest yaleli sonto ziyavinjelwa ngaphambi kokuba zifinyelele ezakhiweni zakho.
Okutholakele kuleli sonto kuyisikhumbuzo sokuthi amaqhinga aya ngokuya ehlanekezelwa. Ukukhukhula kwenguqulo, ukuzenza umuntu ongeyena endaweni yamagama, kanye nemikhankaso ehlanganisiwe yezinsuku eziningi akusezona izimo ezibucayi manje, kodwa standard incwadi yokudlala yomhlaseli. Ukuskena kanye kanye nokuhlolwa ngesandla akukwazi ukuhambisana nemikhankaso eshicilela izinguqulo eziningi ezinsukwini eziningi kanye nokubhaliswa ngasikhathi sinye.
I-Xygeni's Open Source Security Isixazululo sinikeza amaqembu akho e-DevSecOps ukubonakala okuqhubekayo ku-npm, i-PyPI, nangale kwalokho, ukuthola amaphakheji ayingozi ngesikhathi sokushicilelwa, ukubeka phambili lokho okubeka engcupheni yangempela engasetshenziswa, kanye nokunciphisa indlela kusukela ekutholakaleni kuya ekulungisweni. Ngakho amaqembu akho angathumela ngokushesha ngaphandle kokubeka engcupheni ukuphepha.
