Njalo ngeviki, izinhlelo zethu zokuthola i-malware ziskena izinkulungwane zamaphakheji amasha nabuyekeziwe kuzo zonke izindawo zokubhalisa zomphakathi ezifana ne-npm, i-PyPI, ne-OpenVSX. Siqinisekisile ukuthi Amaphakheji angama-53 anonya phakathi kuka-Agasti 21 no-Agasti 28, Unyaka ka-2026, oholwa ukuqhubeka komkhankaso wokulingisa iBaileys ohlatshwe umkhosi ngesonto eledlule, iqoqo lamaphakheji ayisikhombisa anezinhlobo ezifanayo ze-e-commerce ashicilelwe ngosuku olulodwa, kanye negagasi lamaphakheji anezihloko zokuqinisekisa (i-TOTP, i-2FA, i-OTP) asakazeke kuzo zonke izinhlobo ezinhlanu ezihlukene zokuqamba amagama.
Ukulingisa kukaBailey kwaqhubeka ngaphansi @vanzxy/baileys, ngezinguqulo ezintsha eziyisikhombisa (1.4.3 kuya ku-1.4.9) eziqinisekisiwe phakathi kuka-Agasti 22 no-23, iphethini efanayo yokuphindaphinda okusheshayo ebonwe ngesonto eledlule.
Iqoqo lamaphakheji ayisikhombisa (sm-billing-form, sm-cart, sm-payment, sm-checkout, sm-session, sm-admin, sm-apikey-model) zonke zanyatheliswa ngenguqulo efanayo 99.0.1 ngo-Agasti 24, inombolo yenguqulo engavamile eyabiwe kuwo wonke amagama amaphakheji okuthiwa azimele, anetimu ye-e-commerce.
Futhi kufanelekile ukumaka: ukusabalala kwamagama ephakheji ahlobene nokuqinisekiswa, totp-utils, secret-key-totp, secretkey-2fa, secretkey2fa, Futhi 2fa-secretkey, ivele kulo lonke isonto ngaphansi kwemithetho ehlukene yokuqamba amagama kodwa inesihloko esifanayo, eceleni auth-otp, eyashicilela izinguqulo ezinhlanu ngosuku olulodwa (Agasti 24).
Lesi sithombe samasonto onke siyingxenye yesithombe sethu esiqhubekayo I-Malacious Code Digest, lapho siqinisekisa khona izinsongo ezintsha ukusiza amaqembu e-DevSecOps ukuvikela pipelinengaphambi kokuba kwenzeke umonakalo.
Inguqulo efanayo, Amagama Ayisikhombisa: Amaphakheji Angama-53 Anobungozi Kuleli Sonto
Incazelo yaleli sonto ikhombisa ingcindezi efanayo evela ezinhlangothini ezimbili ezahlukene: umkhankaso osaqhubeka ngegama elidala, kanye neqembu elisha elicashe ngemuva kwemininingwane ehlanganyelwe, engavamile.
Umkhankaso wokulingisa iBaileys ohlatshwe umkhosi ngesonto eledlule awukapheli. @vanzxy/baileys kushicilelwe izinguqulo ezintsha eziyisikhombisa (1.4.3 kuya ku-1.4.9) phakathi kuka-Agasti 22 no-23, iphethini efanayo yenguqulo yokukhuphuka ebonwe ngesonto eledlule ngaphansi kwegama elihlukile, elihambisana nomhlaseli olungisa igama lephakheji kunokuyeka umzamo ngemva kokutholwa.
Iqembu elihlukile lazinikela ngezinombolo zenguqulo kunamagama. Amaphakheji ayisikhombisa anophawu lwe-e-commerce (sm-billing-form, sm-cart, sm-payment, sm-checkout, sm-session, sm-admin, sm-apikey-model) konke kuthunyelwe ngaphansi kwenguqulo efanayo 99.0.1 ngo-Agasti 24, kwenzeka ukuhlangana okungajwayelekile kumaphrojekthi okuthiwa azimele okukhomba umlingisi oyedwa ngemuva kwawo wonke ayisikhombisa. Igagasi elihlukile lamaphakheji anesihloko sokuqinisekisa, totp-utils, secret-key-totp, secretkey-2fa, secretkey2fa, Futhi 2fa-secretkey, basakaze isihloko esifanayo emihlanganweni emihlanu ehlukene yokuqamba amagama phakathi nesonto, kanye auth-otp ngizishicilela izinguqulo ezinhlanu ngosuku olulodwa.
Isexwayiso Se-Malware Yasekuqaleni ye-Xygeni iqapha i-npm, i-PyPI, i-Maven, i-OpenVSX, kanye nezinye izikhungo zokubhalisa ngesikhathi sangempela, imaka izinsongo ngesikhathi sokushicilelwa, ngaphambi kokuba zifike esakhiweni nangaphambi kokuba i-ejenti ye-AI izifake ngokuzimela. Lapho amagama ayisikhombisa amaphakheji abukeka engahlobene eshicilela ngaphansi kwenombolo efanayo yenguqulo ngosuku olufanayo, noma umkhankaso uphinde uvele ngaphansi kwegama elisha elingafanele ngesonto ngemva kwelokugcina, ukutholwa okuhlola kanye kuphela sekuvele sekuphelile.
I-Xygeni's Open Source Security ipulatifomu inikeza amaqembu e-DevSecOps ukutholwa kwesikhathi sangempela kanye nokubekwa phambili okudingekayo ukuze ahlale phambili kunengcindezi yochungechunge lokuhlinzekwa okuhlanganisiwe, ngakho-ke pipelineHlala uhlanzekile ngaphandle kokunciphisa ijubane lamaqembu akho.
