{"id":102213,"date":"2021-11-05T03:36:51","date_gmt":"2021-11-05T01:36:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-npm-paket-coa-naschityvayushhij-9-mln-zagruzok-v-nedelyu-vnedreno-vredonosnoe-po"},"modified":"2021-11-05T03:36:51","modified_gmt":"2021-11-05T01:36:51","slug":"v-npm-paket-coa-naschityvayushhij-9-mln-zagruzok-v-nedelyu-vnedreno-vredonosnoe-po","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-npm-paket-coa-naschityvayushhij-9-mln-zagruzok-v-nedelyu-vnedreno-vredonosnoe-po","title":{"rendered":"NPM-paketti coa, millel on 9 miljonit allalaadimist n\u00e4dalas, on sisestatud pahavara.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

R\u00fcndajad suutsid saada kontrolli NPM-paki coa \u00fcle ja vabastada versioonid 2.0.3, 2.0.4, 2.1.1, 2.1.3 ja 3.1.3, mis sisaldavad kahjulikke muudatusi. Pakett coa, mis pakub funktsioone k\u00e4surea argumentide parsimiseks, on saanud umbes 9 miljonit allalaadimist n\u00e4dalas ja on s\u00f5ltuvusena 159 teises NPM-pakis, sealhulgas react-scripts ja vue\/cli-service. NPM administraator on juba eemaldanud kahjulike muudatustega v\u00e4ljaande ja blokeerinud uute versioonide avaldamise kuni p\u00e4\u00e4sme taastamiseni p\u00f5hiarendaja repositooriumisse. <\/p>\n

R\u00fcnnak korraldati projekti arendaja konto h\u00e4kkimise kaudu. Lisatud kahjulikud muudatused on sarnased neile, mida kasutati kaks n\u00e4dalat tagasi NPM-paki UAParser.js kasutajate vastu tehtud r\u00fcnnakus, kuid piirdusid r\u00fcnnakuga ainult Windowsi platvormil (Linuxi ja macOS-i allalaadimisbloxides on t\u00fchjad plokid). Kasutaja s\u00fcsteemile laaditi v\u00e4lisest hostist alla ja k\u00e4ivitati t\u00e4itmisfail, et sooritada Monero kr\u00fcptovaluuta kaevandamine (kasutati kaevandajat XMRig) ja installiti paroolide p\u00fc\u00fcdmiseks m\u00f5eldud teek. <\/p>\n

Kahjulikku koodi sisaldava paketi loomisel tekkis viga, mis p\u00f5hjustas paketi installimise rikke. Seet\u00f5ttu tuvastati probleem kiiresti ja kahjuliku v\u00e4rskenduse levik takistati alguses. Kasutaja peaks veenduma, et neil on installitud versioon coa 2.0.2, ja soovitatav on lisada oma projektide package.json faili seos t\u00f6\u00f6tava versiooniga juhuks, kui kompromiteerimine kordub. npm ja yarn: \"resolutions\": { \"coa\": \"2.0.2\" }, pnpm: \"pnpm\": { \"overrides\": { \"coa\": \"2.0.2\" } },
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u043c coa \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f 2.0.3, 2.0.4, 2.1.1, 2.1.3 \u0438 3.1.3, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u041f\u0430\u043a\u0435\u0442 coa, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e 9 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 159 \u0434\u0440\u0443\u0433\u0438\u0445 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f react-scripts \u0438 vue\/cli-service. \u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f NPM \u0443\u0436\u0435 \u0443\u0434\u0430\u043b\u0438\u043b\u0430 \u0432\u044b\u043f\u0443\u0441\u043a \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102213","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47NPM-paketis coa, millel on 9 miljonit allalaadimist n\u00e4dalas, on levinud pahavara | ProHoster","description":"Kurjategijatel \u00f5nnestus saada kontroll NPM-paketi coa \u00fcle ja v\u00e4lja anda v\u00e4rskendused 2.0.3, 2.0.4, 2.1.1, 2.1.3 ja 3.1.3, mis sisaldavad pahatahtlikke muudatusi. Pakett coa, mis pakub argumentide s\u00f5rmitsemise funktsioone, kogub umbes 9 miljonit allalaadimist n\u00e4dalas ning seda kasutatakse s\u00f5ltuvusena 159 teises NPM-paketis, sealhulgas react-scripts ja vue\/cli-service. NPM administratsioon on juba eemaldanud pahatahtlikud v\u00e4ljalasked.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-npm-paket-coa-naschityvayushhij-9-mln-zagruzok-v-nedelyu-vnedreno-vredonosnoe-po","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 NPM-\u043f\u0430\u043a\u0435\u0442 coa, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0439 9 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e, \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e | ProHoster","og:description":"\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u043c coa \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f 2.0.3, 2.0.4, 2.1.1, 2.1.3 \u0438 3.1.3, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u041f\u0430\u043a\u0435\u0442 coa, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e 9 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 159 \u0434\u0440\u0443\u0433\u0438\u0445 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f react-scripts \u0438 vue\/cli-service. \u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f NPM \u0443\u0436\u0435 \u0443\u0434\u0430\u043b\u0438\u043b\u0430 \u0432\u044b\u043f\u0443\u0441\u043a \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c\u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-npm-paket-coa-naschityvayushhij-9-mln-zagruzok-v-nedelyu-vnedreno-vredonosnoe-po","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-05T01:36:51+00:00","article:modified_time":"2021-11-05T01:36:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102213","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-05 01:37:53","updated":"2022-10-05 02:11:26"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102213","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102213"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102213\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102213"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102213"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102213"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}