{"id":95989,"date":"2020-10-06T01:43:14","date_gmt":"2020-10-05T23:43:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele"},"modified":"2020-10-06T01:43:14","modified_gmt":"2020-10-05T23:43:14","slug":"v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","title":{"rendered":"Der NPM-repository har identificeret fire pakker, der sender brugerdata.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I NPM-repositoriet opdaget<\/a><\/noindex> ble der opdaget skadelig aktivitet i fire pakker, der indeholdt et preinstall-script, som f\u00f8r installationen af pakken sendte en kommentar med information om IP-adressen, placering, login, CPU-model og brugerens hjemmemappe til GitHub. Skadelig kode blev fundet i pakkerne electorn<\/a><\/noindex> (255 downloads), lodashs<\/a><\/noindex> (78 downloads), loadyaml<\/a><\/noindex> (48 downloads) og loadyml<\/a><\/noindex> (37 downloads). <\/p>\n

\"Der<\/a><\/noindex><\/center><\/p>\n

De problematiske pakker blev uploadet til NPM fra den 17. til den 24. august for at blive distribueret ved at type-squatting<\/a><\/noindex>, dvs. ved at tildele navne, der ligner navne p\u00e5 andre popul\u00e6re biblioteker, med det form\u00e5l at brugeren kunne beg\u00e5 en skrivefejl, n\u00e5r de indtastede navnet eller ikke bem\u00e6rkede forskelle, n\u00e5r de valgte en modul fra listen. If\u00f8lge antallet af downloads faldt omkring 400 brugere for denne f\u00e6lde, hvoraf de fleste forvekslede electorn med electron. I \u00f8jeblikket er pakkerne electorn og loadyaml allerede<\/a><\/noindex> blive fjernet<\/a><\/noindex> blevet fjernet af NPM-administrationen, mens pakkerne lodashs og loadyml blev slettet af forfatteren.<\/p>\n

Motivationen bag angriberne er ukendt, men det antages, at oplysningerne blev l\u00e6kket via GitHub (kommentaren blev sendt via Issue og blev slettet inden for et d\u00f8gn) muligvis som en del af et eksperiment for at vurdere effektiviteten af metoden eller var en planlagt angrebsfase, hvor den f\u00f8rste fase indsamlede data om ofrene, og i den anden, der ikke blev gennemf\u00f8rt p\u00e5 grund af blokering, havde angriberne til hensigt at udgive en opdatering med inkludering af mere farlig skadelig kode eller en backdoor i den nye udgave.<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 preinstall-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0435\u0440\u0435\u0434 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u043f\u0430\u043a\u0435\u0442\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b \u043d\u0430 GitHub \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u043e\u0431 IP-\u0430\u0434\u0440\u0435\u0441\u0435, \u043c\u0435\u0441\u0442\u043e\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0438, \u043b\u043e\u0433\u0438\u043d\u0435, \u043c\u043e\u0434\u0435\u043b\u0438 CPU \u0438 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u044b\u043b \u043d\u0430\u0439\u0434\u0435\u043d \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 electorn (255 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a), lodashs (78 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a), loadyaml (48 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a) \u0438 loadyml (37 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0431\u044b\u043b\u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u044b \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":95990,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-95989","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Der er blevet opdaget fire pakker i NPM-repositoriet, der sender brugerdata | ProHoster","description":"Der er blevet opdaget skadelig aktivitet i fire pakker i NPM-repositoriet, som indeholdt et preinstall-script.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0447\u0435\u0442\u044b\u0440\u0435 \u043f\u0430\u043a\u0435\u0442\u0430, \u043f\u0435\u0440\u0435\u0441\u044b\u043b\u0430\u044e\u0449\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435 | ProHoster","og:description":"\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 preinstall-\u0441\u043a\u0440\u0438\u043f\u0442.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-05T23:43:14+00:00","article:modified_time":"2020-10-05T23:43:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95989","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:53:27","updated":"2022-10-03 07:39:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/95989","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=95989"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/95989\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/95990"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=95989"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=95989"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=95989"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}