Debido al aumento de incidentes de secuestro de repositorios de grandes proyectos y la difusi\u00f3n de c\u00f3digo malicioso a trav\u00e9s de la compromoci\u00f3n de cuentas de desarrolladores, GitHub implementar\u00e1 la verificaci\u00f3n ampliada de cuentas de manera generalizada. Adicionalmente, para los mantenedores y administradores de los 500 paquetes NPM m\u00e1s populares, se implementar\u00e1 la autenticaci\u00f3n de dos factores obligatoria a principios del pr\u00f3ximo a\u00f1o. <\/p>\n
Desde el 7 de diciembre de 2021 hasta el 4 de enero de 2022, se realizar\u00e1 la transici\u00f3n de todos los mantenedores que tienen derecho a publicar paquetes NPM, pero que no utilizan autenticaci\u00f3n de dos factores, a la verificaci\u00f3n ampliada de cuentas. La verificaci\u00f3n ampliada implica la necesidad de ingresar un c\u00f3digo de un solo uso, enviado por correo electr\u00f3nico, al intentar iniciar sesi\u00f3n en npmjs.com o al realizar una operaci\u00f3n autenticada en la herramienta npm. <\/p>\n
La verificaci\u00f3n ampliada no reemplaza, sino que complementa la autenticaci\u00f3n de dos factores opcional previamente disponible, que requiere confirmaci\u00f3n mediante contrase\u00f1as de un solo uso (TOTP). Al habilitar la autenticaci\u00f3n de dos factores, la verificaci\u00f3n ampliada por correo electr\u00f3nico no se aplica. A partir del 1 de febrero de 2022, comenzar\u00e1 el proceso de transici\u00f3n a la autenticaci\u00f3n de dos factores obligatoria para los mantenedores de los 100 paquetes NPM m\u00e1s populares que tienen el mayor n\u00famero de dependencias. Tras la finalizaci\u00f3n de la migraci\u00f3n de los primeros cien, el cambio se extender\u00e1 a los 500 paquetes NPM m\u00e1s populares por n\u00famero de dependencias. <\/p>\n
Adem\u00e1s del esquema disponible actualmente de autenticaci\u00f3n de dos factores basado en aplicaciones para generar contrase\u00f1as de un solo uso (Authy, Google Authenticator, FreeOTP, etc.), se planea agregar en abril de 2022 la posibilidad de utilizar claves de hardware y esc\u00e1neres biom\u00e9tricos, que cuentan con soporte para el protocolo WebAuthn, as\u00ed como la capacidad de registrar y gestionar diversos factores adicionales de autenticaci\u00f3n. <\/p>\n
Recordemos que, de acuerdo con un estudio realizado en 2020, solo el 9.27% de los mantenedores de paquetes utilizan autenticaci\u00f3n de dos factores para proteger el acceso, y en el 13.37% de los casos, al registrar nuevas cuentas de usuario, los desarrolladores intentaron reutilizar contrase\u00f1as comprometidas que figuran en filtraciones de contrase\u00f1as conocidas. Durante la verificaci\u00f3n de la solidez de las contrase\u00f1as utilizadas, se logr\u00f3 acceder al 12% de las cuentas en NPM (13% de los paquetes) debido al uso de contrase\u00f1as predecibles y triviales, como \u00ab123456\u00bb. Entre los problemas, se encontraron 4 cuentas de usuarios de los 20 paquetes m\u00e1s populares, 13 cuentas de aquellos cuyos paquetes se descargaron m\u00e1s de 50 millones de veces al mes, 40 con m\u00e1s de 10 millones de descargas al mes y 282 con m\u00e1s de 1 mill\u00f3n de descargas al mes. Dado que se cargan m\u00f3dulos a trav\u00e9s de cadenas de dependencias, la compromisi\u00f3n de cuentas no seguras podr\u00eda afectar hasta el 52% de todos los m\u00f3dulos en NPM. \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0443\u0447\u0430\u0441\u0442\u0438\u0432\u0448\u0438\u043c\u0438\u0441\u044f \u0441\u043b\u0443\u0447\u0430\u044f\u043c\u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0432\u0432\u043e\u0434\u0438\u0442 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439. \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 500 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0433\u043e\u0434\u0430 \u0431\u0443\u0434\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f. \u0421 7 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430 \u043f\u043e 4 \u044f\u043d\u0432\u0430\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u0431\u0443\u0434\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102521","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub implementa la verificaci\u00f3n avanzada obligatoria de cuentas en NPM | ProHoster","description":"Debido al aumento de casos de secuestro de repositorios de grandes proyectos y la promoci\u00f3n de c\u00f3digo malicioso a trav\u00e9s de la compromisi\u00f3n de cuentas de desarrolladores, GitHub est\u00e1 introduciendo la verificaci\u00f3n avanzada obligatoria en todas partes.","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 \u0432 NPM \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 | ProHoster","og:description":"\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0443\u0447\u0430\u0441\u0442\u0438\u0432\u0448\u0438\u043c\u0438\u0441\u044f \u0441\u043b\u0443\u0447\u0430\u044f\u043c\u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0432\u0432\u043e\u0434\u0438\u0442 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e.","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-08T13:36:53+00:00","article:modified_time":"2021-12-08T13:36:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102521","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-08 13:38:11","updated":"2022-09-27 14:40:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/102521","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=102521"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/102521\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=102521"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=102521"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=102521"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Fuente: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"