En af udviklerne af JavaScript-pakker gennemf\u00f8rte et eksperiment ved at oprette og uploade en pakke kaldet «everything» til NPM, som d\u00e6kker alle eksisterende pakker i lageret som afh\u00e6ngigheder. For at realisere denne mulighed er pakken «everything» direkte knyttet til fem pakker «@everything-registry\/chunk-N», som igen er knyttet til mere end 3000 pakker «sub-chunk-N», hvor hver af dem har tilknytning til 800 eksisterende pakker i lageret. <\/p>\n
Uploaden af «everything» til NPM f\u00f8rte til to interessante effekter. For det f\u00f8rste blev pakken «everything» en slags v\u00e6rkt\u00f8j til at udf\u00f8re DoS-angreb, da fors\u00f8g p\u00e5 at installere den resulterer i download af millioner af pakker, der er hostet p\u00e5 NPM, hvilket kan udt\u00f8mme tilg\u00e6ngelig diskplads eller stoppe opbygningens proces. If\u00f8lge statistikker blev NPM-pakken downloadet omkring 250 gange, men der er intet, der forhindrer, at den tilf\u00f8jes som afh\u00e6ngighed til en anden pakke efter hijacking af udviklerens konto for at udf\u00f8re sabotage. Desuden viste nogle overv\u00e5gningstjenester og v\u00e6rkt\u00f8jer, der monitorerer og tjekker nye pakker, der uploades til NPM, sig utilsigtet at v\u00e6re s\u00e5rbare over for angreb. <\/p>\n
For det andet forhindrede offentligg\u00f8relsen af pakken «everything» faktisk muligheden for at slette nogen pakker i NPM, der blev n\u00e6vnt som afh\u00e6ngigheder i dens liste. En pakke fra NPM kan kun slettes af forfatteren, hvis den ikke l\u00e6ngere bruges som afh\u00e6ngighed af andre pakker, men efter offentligg\u00f8relsen af «everything» var alle pakker i lageret p\u00e5virket som afh\u00e6ngigheder. Det er bem\u00e6rkelsesv\u00e6rdigt, at slettelsen af selve pakken «everything» ogs\u00e5 blev blokkeret, da en testpakke «everything-else» blev uploadet til lageret for 9 \u00e5r siden, der indeholdt «everything» i sin afh\u00e6ngighedsliste. Dermed blev pakken «everything» efter offentligg\u00f8relsen en afh\u00e6ngighed for en anden pakke. \u041e\u0434\u0438\u043d \u0438\u0437 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 JavaScript-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u0440\u043e\u0432\u0451\u043b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442 \u0441 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435\u043c \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u0435\u043c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u043f\u0430\u043a\u0435\u0442\u0430 «everything», \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0432\u0441\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438. \u0414\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0439 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442 «everything» \u0441\u0432\u044f\u0437\u0430\u043d \u043f\u0440\u044f\u043c\u044b\u043c\u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0441 \u043f\u044f\u0442\u044c\u044e \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 «@everything-registry\/chunk-N», \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043f\u0440\u0438\u0432\u044f\u0437\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u043a \u0431\u043e\u043b\u0435\u0435 3000 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 «sub-chunk-N», \u0432 \u043a\u0430\u0436\u0434\u043e\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0430 \u043a 800 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112714","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Eksperiment med at skabe en NPM-pakke, der er afh\u00e6ngig af alle pakker i depotet | ProHoster","description":"En af udviklerne af JavaScript-pakker gennemf\u00f8rte et eksperiment med at skabe og uploade en NPM-pakke \"everything\", som d\u00e6kker afh\u00e6ngighederne af alle eksisterende pakker i depotet.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/eksperiment-s-sozdaniem-npm-paketa-zavisimogo-ot-vseh-paketov-v-repozitorii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u042d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442 \u0441 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435\u043c NPM-\u043f\u0430\u043a\u0435\u0442\u0430, \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u043e\u0442 \u0432\u0441\u0435\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 | ProHoster","og:description":"\u041e\u0434\u0438\u043d \u0438\u0437 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 JavaScript-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u0440\u043e\u0432\u0451\u043b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442 \u0441 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435\u043c \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u0435\u043c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u043f\u0430\u043a\u0435\u0442\u0430 "everything", \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0432\u0441\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/eksperiment-s-sozdaniem-npm-paketa-zavisimogo-ot-vseh-paketov-v-repozitorii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-05T13:10:15+00:00","article:modified_time":"2024-01-05T13:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/112714","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=112714"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/112714\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=112714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=112714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=112714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"