{"id":36164,"date":"2019-10-31T22:09:56","date_gmt":"2019-10-31T19:09:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-zavisimostyah-k-npm-paketu-s-ustanovshhikom-purescript-vyyavleny-vredonosnye-izmeneniya\/"},"modified":"2019-10-31T22:09:56","modified_gmt":"2019-10-31T19:09:56","slug":"v-zavisimostyah-k-npm-paketu-s-ustanovshhikom-purescript-vyyavleny-vredonosnye-izmeneniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-zavisimostyah-k-npm-paketu-s-ustanovshhikom-purescript-vyyavleny-vredonosnye-izmeneniya","title":{"rendered":"PureScript'i installeriga npm-paketi s\u00f5ltuvustes tuvastati pahatahtlikud muudatused.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

PureScript'i paigalduspakettide s\u00f5ltuvustes tuvastati<\/a><\/noindex> kahjulik kode, mis ilmneb paketi paigaldamise katsete ajal purescript<\/a><\/noindex>. Kahjulik kood on integreeritud kaudu s\u00f5ltuvuste load-from-cwd-or-npm<\/a><\/noindex> ja rate-map<\/a><\/noindex>. M\u00e4rkimisv\u00e4\u00e4rne on see, et nende s\u00f5ltuvustega pakette haldab algne autor npm-paketist PureScript'i paigaldamiseks, kes on seni selle npm-paketiga tegelenud, kuid umbes kuu aega tagasi anti paket teiste haldajate k\u00e4tte. <\/p>\n

Probleemi avastas \u00fcks uue haldaja meeskonna liikmetest, kellele \u00f5igused haldamiseks anti p\u00e4rast mitmeid eriarvamusi ja ebameeldivaid arutelusid algse npm-paketi autoriga purescript. Uued haldajad vastutavad PureScript'i kompilaatori eest ja n\u00f5udsid, et npm-pakett koos paigaldajaga peaks olema \u00fchendatud samade haldajatega, mitte kolmandate osalistega. Algne npm-paketi autor PureScript'i paigaldamiseks ei olnud kaua n\u00f5us, kuid l\u00f5puks alla vandus ja andis enda repository juurde ligip\u00e4\u00e4su. Samas j\u00e4id m\u00f5ned s\u00f5ltuvused siiski tema kontrolli alla.<\/p>\n

Eelmisel n\u00e4dalal anti v\u00e4lja PureScript'i kompilaatori versioon 0.13.2 ja
\nuusimate hooldajate poolt on ette valmistatud vastav npm-paketi v\u00e4rskendus, mille installijate s\u00f5ltuvustes tuvastati pahavara. PureScript installija npm-paketi hooldaja postitusest eemaldatud \u00fctles, et tema konto oli tundmatute r\u00fcndajate poolt ohustatud. Siiski, praeguses vormis piirdusid pahatahtlikud tegevused ainult paketi installimise saboteerimisega, mis oli uusim versioon uutelt hooldajatelt. Pahatahtlikud tegevused h\u00f5lmasid silmuste tegemist ja veateate kuvamist, kui proovida paketti installida k\u00e4suga 'npm i -g purescript' ilma selges\u00f5nalise kahjuliku tegevuseta.<\/p>\n

Avastati kaks r\u00fcnnakut. M\u00f5ni tund p\u00e4rast uue npm-paketi purescript ametlikku v\u00e4ljaandmist loodi keegi uus versioon s\u00f5ltuvusest load-from-cwd-or-npm 3.0.2, mille muudatused viisid selleni, et loadFromCwdOrNpm() kutsumise asemel, mis tagasi andis vajalikud binaarfailid installimiseks, tagastati voog PassThrough<\/a><\/noindex>, mis peegeldas sisendp\u00e4ringuid v\u00e4ljundv\u00e4\u00e4rtustena. <\/p>\n

Neli p\u00e4eva p\u00e4rast seda, kui arendajad selgitasid t\u00f5rgete allikaid ja valmistusid v\u00e4lja laskma uuendust, mis eemaldab load-from-cwd-or-npm s\u00f5ltuvused, avaldasid kurjategijad veel \u00fche uuenduse load-from-cwd-or-npm 3.0.4, milles pahavara oli eemaldatud. Siiski ilmus peaaegu kohe v\u00e4lja ka raamistiku teine s\u00f5ltuvus rate-map 1.0.3, milles lisati parandused, mis blokeerisid callback-kutsed laadimist. Seega olid m\u00f5lemas versioonis load-from-cwd-or-npm ja rate-map muudatused ilmselgelt saboteerimise iseloomuga. Veelgi enam, pahavara koodis oli kontroll, mis aktiveeris rikkeid ainult uute versioonide paigaldamisel, ega ilmunud vanade versioonide installeerimisel.<\/p>\n

Arendajad lahendasid probleemi, v\u00e4lja lastes uuenduse, milles probleemsed s\u00f5ltuvused eemaldati. Et v\u00e4ltida kompromiteeritud koodi j\u00e4\u00e4mist kasutajate s\u00fcsteemidesse p\u00e4rast probleemse versiooni installatsiooni, soovitatakse eemaldada katalooge node_modules ja faile package-lock.json, seej\u00e4rel seadistada purescript versiooniks 0.13.2.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u043a npm-\u043f\u0430\u043a\u0435\u0442\u0443 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u043e\u043c PureScript \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 purescript. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432\u0441\u0442\u0440\u043e\u0435\u043d \u0447\u0435\u0440\u0435\u0437 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 load-from-cwd-or-npm \u0438 rate-map. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0430\u0432\u0442\u043e\u0440 npm-\u043f\u0430\u043a\u0435\u0442\u0430 \u0441 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0442\u043e\u0440\u043e\u043c PureScript, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u043f\u043e\u0440 \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0441\u044f \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u0434\u0430\u043d\u043d\u043e\u0433\u043e npm-\u043f\u0430\u043a\u0435\u0442\u0430, \u043d\u043e \u043e\u043a\u043e\u043b\u043e \u043c\u0435\u0441\u044f\u0446\u0430 \u043d\u0430\u0437\u0430\u0434 \u043f\u0430\u043a\u0435\u0442 \u043f\u0435\u0440\u0435\u0448\u0451\u043b \u043a \u0434\u0440\u0443\u0433\u0438\u043c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u043c. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36164","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PureScript'i paigalduspaketi s\u00f5ltuvustes on tuvastatud pahatahtlikud muudatused | ProHoster","description":"PureScript'i installeriga seotud npm-paketis leiti pahatahtlik kood, mis avaldub.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-zavisimostyah-k-npm-paketu-s-ustanovshhikom-purescript-vyyavleny-vredonosnye-izmeneniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u043a npm-\u043f\u0430\u043a\u0435\u0442\u0443 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u043e\u043c PureScript \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0412 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u043a npm-\u043f\u0430\u043a\u0435\u0442\u0443 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u043e\u043c PureScript \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0439\u0441\u044f.","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-zavisimostyah-k-npm-paketu-s-ustanovshhikom-purescript-vyyavleny-vredonosnye-izmeneniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:09:56+00:00","article:modified_time":"2019-10-31T19:09:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36164","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 02:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:49:43","updated":"2026-01-22 02:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=36164"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36164\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=36164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=36164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=36164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}