{"id":103932,"date":"2022-05-02T15:37:01","date_gmt":"2022-05-02T13:37:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi"},"modified":"2022-05-02T15:37:01","modified_gmt":"2022-05-02T13:37:01","slug":"opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi","title":{"rendered":"Analysen offentliggjort, afsl\u00f8rede 200 skadelige pakker i NPM og PyPI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>OpenSSF (Open Source Security Foundation), dannet af Linux Foundation og med fokus p\u00e5 at forbedre sikkerheden for open source software, har pr\u00e6senteret et \u00e5bent projekt Package Analysis, som udvikler et system til analyse af skadeligt kode i pakker. Projektets kode er skrevet i Go og distribueres under Apache 2.0 licensen. Forel\u00f8bige scanninger af NPM- og PyPI-repositorier ved hj\u00e6lp af det foresl\u00e5ede v\u00e6rkt\u00f8j har gjort det muligt at identificere mere end 200 tidligere uopdagede skadelige pakker.    <\/p>\n<p>Hovedparten af de identificerede problematiske pakker manipulerer med navne, der krydser med interne, private afh\u00e6ngigheder af projekter (dependency confusion attack), eller bruger metoder til type-squatting (tildeling af navne, der ligner navne p\u00e5 popul\u00e6re biblioteker), samt udf\u00f8rer scripts, der anmoder eksterne v\u00e6rter under installationsprocessen. If\u00f8lge udviklerne af Package Analysis er st\u00f8rstedelen af de identificerede problematiske pakker sandsynligvis skabt af sikkerhedsresearchere, der deltager i bel\u00f8nningsprogrammer for at identificere s\u00e5rbarheder (bug bounty), da de sendte data kun begr\u00e6nses til brugernavn og system, og handlingerne udf\u00f8res \u00e5benlyst, uden fors\u00f8g p\u00e5 at skjule deres adf\u00e6rd.      <\/p>\n<p>De pakker med skadelig aktivitet omfatter:  <\/p>\n<ul>\n<li class=\"l\"> PyPI-pakken discordcmd, som registrerede us\u00e6dvanlige foresp\u00f8rgsler til raw.githubusercontent.com, Discord API og ipinfo.io. Den n\u00e6vnte pakke downloadede en bagerdit fra GitHub og installerede den i mappen for Windows-klienten Discord, hvorefter den startede en proces til at s\u00f8ge efter Discord-tokens i filsystemet og sende dem til en ekstern Discord-server, kontrolleret af angriberne.\n<li class=\"l\"> NPM-pakken colorsss, der ogs\u00e5 fors\u00f8gte at sende til en ekstern <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/server\/\"   title=\"server\" data-wpil-keyword-link=\"linked\">server<\/a> token fra Discord-kontoen.\n<li class=\"l\"> NPM-pakken @roku-web-core\/ajax \u2014 under installation sendte den systemoplysninger og aktiverede en handler (reverse shell), der modtager eksterne forbindelser og udf\u00f8rer kommandoer.\n<li class=\"l\"> PyPI-pakken secrevthree \u2014 aktiverede reverse shell ved import af en bestemt modul.\n<li class=\"l\"> NPM-pakken random-vouchercode-generator \u2014 efter import af biblioteket sendte den en anmodning til en ekstern server, som returnerede en kommando og tidspunktet for, hvorn\u00e5r den skulle udf\u00f8res.      <\/ul>\n<p>Arbejdet med Package Analysis handler om at analysere kildekoden i pakker for at etablere netv\u00e6rksforbindelser, f\u00e5 adgang til filer og udf\u00f8re kommandoer. Derudover overv\u00e5ges \u00e6ndringer i pakkernes tilstand for at identificere tilf\u00f8jelsen af skadelige indhold i en oprindeligt harml\u00f8s softwareudgivelse. Til overv\u00e5gning af nye pakker i lagre og \u00e6ndringer i tidligere offentliggjorte pakker anvendes v\u00e6rkt\u00f8jet Package Feeds, som standardiserer arbejdet med NPM, PyPI, Go, RubyGems, Packagist, NuGet og Crate-lagre.      <\/p>\n<p>Package Analysis inkluderer tre grundl\u00e6ggende komponenter, der kan bruges sammen eller hver for sig:   <\/p>\n<ul>\n<li class=\"l\"> Planl\u00e6gger, der retter analyseringsarbejdet med data fra Package Feeds.\n<li class=\"l\"> Analysator, der direkte tjekker pakken og vurderer dens adf\u00e6rd ved hj\u00e6lp af metoder til statisk analyse og dynamisk sporing. Kontrollen udf\u00f8res i et isoleret milj\u00f8.\n<li class=\"l\"> Loader, der placerer kontrolresultaterne i BigQuery-lageret.    <\/ul>\n<p>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=57123\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0424\u043e\u043d\u0434 OpenSSF (Open Source Security Foundation), \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Linux Foundation \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 Package Analysis, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Go \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 Apache 2.0. \u041f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 NPM \u0438 PyPI \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u0432\u044b\u044f\u0432\u0438\u0442\u044c \u0431\u043e\u043b\u0435\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103932","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0424\u043e\u043d\u0434 OpenSSF (Open Source Security Foundation), \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Linux Foundation \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 Package Analysis, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0430\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440, \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 200 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 NPM \u0438 PyPI | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0424\u043e\u043d\u0434 OpenSSF (Open Source Security Foundation), \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Linux Foundation \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 Package Analysis, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-05-02T13:37:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-05-02T13:37:01+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Analysatoren, der har identificeret 200 skadelige pakker i NPM og PyPI, er blevet offentliggjort | ProHoster","description":"OpenSSF (Open Source Security Foundation), dannet af Linux Foundation og med fokus p\u00e5 at forbedre sikkerheden i open source-software, har pr\u00e6senteret et \u00e5bent projekt Package Analysis, der udvikler systemet.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0430\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440, \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 200 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 NPM \u0438 PyPI | ProHoster","og:description":"\u0424\u043e\u043d\u0434 OpenSSF (Open Source Security Foundation), \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Linux Foundation \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 Package Analysis, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-05-02T13:37:01+00:00","article:modified_time":"2022-05-02T13:37:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103932","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-25 10:46:15","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-05-02 13:37:58","updated":"2026-01-25 10:46:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/103932","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=103932"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/103932\/revisions"}],"predecessor-version":[{"id":172983,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/103932\/revisions\/172983"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=103932"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=103932"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=103932"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}