{"id":103932,"date":"2022-05-02T15:37:01","date_gmt":"2022-05-02T13:37:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi"},"modified":"2022-05-02T15:37:01","modified_gmt":"2022-05-02T13:37:01","slug":"opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi","title":{"rendered":"Avaldatud on anal\u00fcsaator, mis tuvastas 200 pahatahtlikku paketti NPM-is ja PyPIs","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>OpenSSF (Open Source Security Foundation), mille asutatud Linux Foundation, on suunatud avatud tarkvara turvalisuse parandamisele. Nad on esitanud avatud projekti Package Analysis, mis arendab kahjuliku koodi tuvastamise s\u00fcsteemi paketis. Projekti kood on kirjutatud Go keeles ja levitatakse Apache 2.0 litsentsi all. Esialgne NPM ja PyPI hoidlate skaneerimine pakutud t\u00f6\u00f6riistade abil on v\u00f5imaldanud tuvastada \u00fcle 200 seni varjatud kahjuliku paketi.    <\/p>\n<p>Enamik tuvastatud probleemseid pakette manipuleerib nimede ristumistega projektide sisemiste avalike s\u00f5ltuvustega (dependency confusion r\u00fcnnak) v\u00f5i kasutab pettuse meetodeid (nimede m\u00e4\u00e4ramine, mis sarnanevad populaarsete raamatukogude nimedega). Samuti kutsuvad nad installimise k\u00e4igus v\u00e4lja skripte, mis suhtlevad v\u00e4liste hostidega. Package Analysis'i arendajate arvates on enamik tuvastatud probleemsetest pakettidest ilmselt loodud turvauuringutega tegelevate teadlaste poolt, kes osalevad haavatavuste avastamisprogrammides (bug bounty), kuna edastatud andmed piirduvad kasutajanime ja s\u00fcsteemi nimedega ning toimingud tehakse selgelt, ilma katseteta oma k\u00e4itumist varjata.      <\/p>\n<p>Tuvastatud kahjuliku aktiivsusega paketid on:  <\/p>\n<ul>\n<li class=\"l\"> PyPI pakett discordcmd, kus on registreeritud ebat\u00fc\u00fcpiliste p\u00e4ringute saatmine raw.githubusercontent.com, Discord API ja ipinfo.io. Antud pakett laadis b\u00e4kdoori koodi GitHub'ist ja installis selle Windowsi Discordi kliendi kataloogi, seej\u00e4rel k\u00e4ivitas protsessi, mis otsis Discordi tokenit failis\u00fcsteemist ja saatis need v\u00e4lisele Discordi serverile, mis oli r\u00fcndajate kontrolli all.\n<li class=\"l\"> NPM pakett colorsss, mis proovis samuti edastada v\u00e4lisele <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/\"   title=\"server\" data-wpil-keyword-link=\"linked\">server<\/a> tokeneid Discordi kontolt.\n<li class=\"l\"> NPM-pakett @roku-web-core\/ajax \u2014 installimise k\u00e4igus edastas s\u00fcsteemi andmeid ja k\u00e4ivitas t\u00f6\u00f6tleja (reverse shell), mis v\u00f5ttis vastu v\u00e4liseid \u00fchendusi ja k\u00e4ivitas k\u00e4ske.\n<li class=\"l\"> PyPI-pakett secrevthree \u2014 k\u00e4ivitas reverse shell'i, kui teatud moodulit imporditi.\n<li class=\"l\"> NPM-pakett random-vouchercode-generator \u2014 p\u00e4rast teegi importimist saatis p\u00e4ringu v\u00e4lisele serverile, mis tagastas k\u00e4su ja aja, millal see k\u00e4ivitada tuleb.      <\/ul>\n<p>Package Analysis t\u00f6\u00f6tab koodi paketide allikatekstide anal\u00fc\u00fcsil, et seadistada v\u00f5rgu\u00fchendusi, p\u00e4\u00e4seda failidele ja k\u00e4ivitada k\u00e4ske. Lisaks j\u00e4lgitakse pakettide oleku muutusi, et tuvastada pahavara lisamists\u00fcklid algselt kahjututes tarkvarades. Uute paketide ilmumise j\u00e4lgimiseks repositooriumites ja varasemate pakettide muudatuste j\u00e4lgimiseks kasutatakse Package Feeds t\u00f6\u00f6riistu, mis unifitseerivad NPM, PyPI, Go, RubyGems, Packagist, NuGet ja Crate repositooriumide haldamise.      <\/p>\n<p>Package Analysis koosneb kolmest p\u00f5hikomponendist, mida saab kasutada nii koos kui ka eraldi:   <\/p>\n<ul>\n<li class=\"l\"> T\u00f6\u00f6kava, mis haldab pakettide anal\u00fc\u00fcsi andmete p\u00f5hjal, mis p\u00e4rinevad Package Feeds'ilt.\n<li class=\"l\"> Anal\u00fcsaator, mis kontrollib paketti ja hindab selle k\u00e4itumist staatilise anal\u00fc\u00fcsi ja d\u00fcnaamilise j\u00e4lgimise meetodite abil. Kontroll toimub isoleeritud keskkonnas.\n<li class=\"l\"> Laadija, mis salvestab kontrolli tulemused BigQuery'sse.    <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=57123\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0424\u043e\u043d\u0434 OpenSSF (Open Source Security Foundation), \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Linux Foundation \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 Package Analysis, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Go \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 Apache 2.0. \u041f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 NPM \u0438 PyPI \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u0432\u044b\u044f\u0432\u0438\u0442\u044c \u0431\u043e\u043b\u0435\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103932","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0424\u043e\u043d\u0434 OpenSSF (Open Source Security Foundation), \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Linux Foundation \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 Package Analysis, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0430\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440, \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 200 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 NPM \u0438 PyPI | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0424\u043e\u043d\u0434 OpenSSF (Open Source Security Foundation), \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Linux Foundation \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 Package Analysis, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-05-02T13:37:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-05-02T13:37:01+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Avaldatud anal\u00fcsaator, mis tuvastas 200 pahavara paketti NPM-is ja PyPI-s | ProHoster","description":"OpenSSF (Avatud Tarkvara Turvafond), mille on asutanud Linux Foundation, et t\u00f5sta avatud tarkvara turvalisust, tutvustas avatud projekti Package Analysis, arendades s\u00fcsteemi.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0430\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440, \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 200 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 NPM \u0438 PyPI | ProHoster","og:description":"\u0424\u043e\u043d\u0434 OpenSSF (Open Source Security Foundation), \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Linux Foundation \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 Package Analysis, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-05-02T13:37:01+00:00","article:modified_time":"2022-05-02T13:37:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103932","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-25 10:46:15","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-05-02 13:37:58","updated":"2026-01-25 10:46:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103932","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=103932"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103932\/revisions"}],"predecessor-version":[{"id":172983,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103932\/revisions\/172983"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=103932"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=103932"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=103932"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}