{"id":156092,"date":"2026-02-01T11:11:55","date_gmt":"2026-02-01T09:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone"},"modified":"2026-02-01T11:11:55","modified_gmt":"2026-02-01T09:11:55","slug":"atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","title":{"rendered":"Angriberen har form\u00e5et at tilf\u00f8je uset skadelig kode til Plone-repositoriet","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Udviklerne af det frie indholdsstyringssystem Plone, skrevet i Python og JavaScript\/NodeJS, har annonceret et sikkerhedshendelse, hvor ondsindet kode blev tilf\u00f8jet til projektets git-repositorium p\u00e5 GitHub. Oprindeligt blev tre \u00e6ndringer, der opstod den 7. januar (1, 2, 3), identificeret, som tilf\u00f8jede ondsindet kode til projektets JavaScript-filer (1, 2, 3). Unders\u00f8gelsen af h\u00e6ndelsen viste, at integrationen af den ondsindede kode skete som f\u00f8lge af, at en af udviklernes konto blev kompromitteret, og adgangstoken blev opsnappet af angribere efter, at ondsindet software blev k\u00f8rt p\u00e5 deres system. <\/p>\n

Den 14. januar blev den kompromitterede konto l\u00e5st, og udviklerne af projektet blev anbefalet at analysere commits fra 1. til 14. januar. Den 27. januar blev det opdaget, at de observerede commits ikke var enest\u00e5ende, og angrebet havde p\u00e5virket fem af projektets repositories (plone\/volto, plone\/mockup, plone\/plone.app.mosaic, plone\/critical-css-cli, plone\/plonetheme.barceloneta), hvor ondsindet kode var integreret uset. I tilf\u00e6ldet med repoet plone.app.mosaic lykkedes det angriberen at erstatte master-grenen. Angrebet blev udf\u00f8rt to m\u00e5neder efter opfangningen af udviklerens adgangstoken. <\/p>\n

For integration of changes, instead of regular commits, the attackers used the 'force push' operation (git push with the '--force' option), which allows them to forcibly replace the branch in the external repository with their content, effectively rewriting the change history (after the replacement, the history from the branch uploaded by the attacker is shown). To prevent such branch substitution in the future, the Plone developers implemented rules in GitHub that block 'force push' operations for main branches and tags. <\/p>\n

In the plone.app.mosaic repository, to complicate the detection of compromise, the attackers inserted a malicious commit into the master branch, which had a fictitious date \u2014 December 18, believing that the search area for malicious code would focus on changes made after their initial activity in the repository. The malicious change was presented in the injected commit as the beginning of the development of a new test release, but in addition to changing the version number in the metadata (from 4.0.0a1 to 4.0.0a2.dev0), malicious code was added to the javascript file 'prettier.config.js' called during the build phase. To conceal it in the terminal view, the code was added in one line with a legitimate operation and shifted out of the visible area using spaces. In the GitHub interface, this code was also not shown by default and required clicking the 'Load Diff' button.

\"Angriberen<\/center> <\/p>\n

Angrebet m\u00e5lrettede i h\u00f8jere grad udviklerne af projektet end brugerne. De ondsindede \u00e6ndringer kom ikke med i udgivelsen. Den ondsindede kode blev aktiveret ved bygning, indl\u00e6ste exploits for at opn\u00e5 forh\u00f8jede rettigheder, konfigurerede automatisk opstart ved at kalde sine processer fra startskripterne og tillod fjernstyring. serveren<\/a>. Derudover udf\u00f8rte den installerede ondsindede komponent s\u00f8gning og sendte fortrolige data s\u00e5som adgangstokens, browserprofiler og n\u00f8gler til kryptovaluta-lommeb\u00f8ger.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c Plone, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Python \u0438 JavaScript\/NodeJS, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430 GitHub \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0438\u0445\u0441\u044f 7 \u044f\u043d\u0432\u0430\u0440\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f (1, 2, 3), \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 JavaScript-\u0444\u0430\u0439\u043b\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 (1, 2, 3). \u0420\u0430\u0437\u0431\u043e\u0440 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":156093,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-156092","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Angriberne lykkedes med at tilf\u00f8je uset ondsindet kode i Plone-repositoriet | ProHoster","description":"Udviklerne af det frie indholdsstyringssystem Plone, skrevet i Python og JavaScript\/NodeJS, har annonceret h\u00e6ndelsen, hvor der blev tilf\u00f8jet ondsindet kode i git-repositoriet for projektet p\u00e5 GitHub.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 Plone | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c Plone, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Python \u0438 JavaScript\/NodeJS, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430 GitHub \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-02-01T09:11:55+00:00","article:modified_time":"2026-02-01T09:11:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"156092","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:49:15","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-01 09:11:56","updated":"2026-02-09 21:49:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/156092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=156092"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/156092\/revisions"}],"predecessor-version":[{"id":160399,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/156092\/revisions\/160399"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/156093"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=156092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=156092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=156092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}