Jeden z v\u00fdvoj\u00e1\u0159\u016f bal\u00edk\u016f JavaScript provedl experiment se vytvo\u0159en\u00edm a um\u00edst\u011bn\u00edm bal\u00edku «everything» do repozit\u00e1\u0159e NPM, kter\u00fd pokr\u00fdv\u00e1 v\u0161echny existuj\u00edc\u00ed bal\u00edky v repozit\u00e1\u0159i pomoc\u00ed z\u00e1vislost\u00ed. Pro realizaci takov\u00e9 mo\u017enosti je bal\u00edk «everything» spojen p\u0159\u00edm\u00fdmi z\u00e1vislostmi s p\u011bti bal\u00edky «@everything-registry\/chunk-N», kter\u00e9 se zase v\u00e1\u017eou na v\u00edce ne\u017e 3000 bal\u00edk\u016f «sub-chunk-N», v ka\u017ed\u00e9m z nich\u017e je nastaveno p\u0159ipojen\u00ed k 800 existuj\u00edc\u00edm bal\u00edk\u016fm v repozit\u00e1\u0159i. <\/p>\n
Um\u00edst\u011bn\u00ed «everything» do NPM vedlo ke dv\u011bma zaj\u00edmav\u00fdm efekt\u016fm. Zaprv\u00e9 bal\u00edk «everything» se stal zvl\u00e1\u0161tn\u00edm n\u00e1strojem pro prov\u00e1d\u011bn\u00ed DoS \u00fatok\u016f, proto\u017ee pokus o jeho instalaci vede k sta\u017een\u00ed milion\u016f bal\u00edk\u016f um\u00edst\u011bn\u00fdch v NPM a vy\u010derp\u00e1n\u00ed dostupn\u00e9ho diskov\u00e9ho prostoru nebo zastaven\u00ed prov\u00e1d\u011bn\u00ed kompilac\u00ed. Podle statistik byl bal\u00edk NPM sta\u017een p\u0159ibli\u017en\u011b 250kr\u00e1t, ale nikdo nebr\u00e1n\u00ed tomu, aby byl p\u0159id\u00e1n do z\u00e1vislost\u00ed jin\u00e9ho bal\u00edku po hackerstv\u00ed \u00fa\u010dtu v\u00fdvoj\u00e1\u0159e k proveden\u00ed diverze. Krom\u011b toho se nev\u011bdom\u011b \u00fatok\u016fm staly n\u011bkter\u00e9 slu\u017eby a n\u00e1stroje prov\u00e1d\u011bj\u00edc\u00ed monitorov\u00e1n\u00ed a kontrolu nov\u00fdch bal\u00edk\u016f um\u00edst\u011bn\u00fdch v NPM. <\/p>\n
Za druh\u00e9 publikace bal\u00edku «everything» fakticky zablokovala mo\u017enost odstran\u011bn\u00ed jak\u00fdchkoli bal\u00edk\u016f v NPM, kter\u00e9 se ocitly v seznamu jeho z\u00e1vislost\u00ed. Bal\u00edk z NPM m\u016f\u017ee b\u00fdt autorem odstran\u011bn pouze tehdy, pokud nen\u00ed ji\u017e pou\u017e\u00edv\u00e1n v z\u00e1vislostech jin\u00fdch bal\u00edk\u016f, ale po publikaci «everything» byly z\u00e1vislostmi pokryty v\u0161echny bal\u00edky v repozit\u00e1\u0159i. Je pozoruhodn\u00e9, \u017ee odstran\u011bn\u00ed samotn\u00e9ho bal\u00edku «everything» se tak\u00e9 uk\u00e1zalo jako zablokovan\u00e9, proto\u017ee p\u0159ed 9 lety byl v repozit\u00e1\u0159i um\u00edst\u011bn testovac\u00ed bal\u00edk «everything-else», ve kter\u00e9m byla uvedena \u0159\u00e1dka «everything» v seznamu z\u00e1vislost\u00ed. Tak\u017ee bal\u00edk «everything» po publikaci vedl k z\u00e1vislostem jin\u00e9ho bal\u00edku. \u041e\u0434\u0438\u043d \u0438\u0437 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 JavaScript-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u0440\u043e\u0432\u0451\u043b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442 \u0441 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435\u043c \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u0435\u043c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u043f\u0430\u043a\u0435\u0442\u0430 «everything», \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0432\u0441\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438. \u0414\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0439 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442 «everything» \u0441\u0432\u044f\u0437\u0430\u043d \u043f\u0440\u044f\u043c\u044b\u043c\u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0441 \u043f\u044f\u0442\u044c\u044e \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 «@everything-registry\/chunk-N», \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043f\u0440\u0438\u0432\u044f\u0437\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u043a \u0431\u043e\u043b\u0435\u0435 3000 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 «sub-chunk-N», \u0432 \u043a\u0430\u0436\u0434\u043e\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0430 \u043a 800 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112714","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Experiment s vytvo\u0159en\u00edm NPM bal\u00ed\u010dku, z\u00e1visl\u00e9ho na v\u0161ech bal\u00ed\u010dc\u00edch v repozit\u00e1\u0159i | ProHoster","description":"Jeden z v\u00fdvoj\u00e1\u0159\u016f JavaScriptov\u00fdch bal\u00ed\u010dk\u016f provedl experiment s vytv\u00e1\u0159en\u00edm a um\u00edst\u011bn\u00edm bal\u00ed\u010dku \"everything\" do repozit\u00e1\u0159e NPM, kter\u00fd pokr\u00fdv\u00e1 z\u00e1vislostmi v\u0161echny existuj\u00edc\u00ed bal\u00ed\u010dky v repozit\u00e1\u0159i.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/eksperiment-s-sozdaniem-npm-paketa-zavisimogo-ot-vseh-paketov-v-repozitorii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u042d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442 \u0441 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435\u043c NPM-\u043f\u0430\u043a\u0435\u0442\u0430, \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u043e\u0442 \u0432\u0441\u0435\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 | ProHoster","og:description":"\u041e\u0434\u0438\u043d \u0438\u0437 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 JavaScript-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u0440\u043e\u0432\u0451\u043b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442 \u0441 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435\u043c \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u0435\u043c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u043f\u0430\u043a\u0435\u0442\u0430 "everything", \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0432\u0441\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/eksperiment-s-sozdaniem-npm-paketa-zavisimogo-ot-vseh-paketov-v-repozitorii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-05T13:10:15+00:00","article:modified_time":"2024-01-05T13:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/112714","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=112714"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/112714\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=112714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=112714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=112714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"