{"id":36164,"date":"2019-10-31T22:09:56","date_gmt":"2019-10-31T19:09:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-zavisimostyah-k-npm-paketu-s-ustanovshhikom-purescript-vyyavleny-vredonosnye-izmeneniya\/"},"modified":"2019-10-31T22:09:56","modified_gmt":"2019-10-31T19:09:56","slug":"v-zavisimostyah-k-npm-paketu-s-ustanovshhikom-purescript-vyyavleny-vredonosnye-izmeneniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/v-zavisimostyah-k-npm-paketu-s-ustanovshhikom-purescript-vyyavleny-vredonosnye-izmeneniya","title":{"rendered":"PureScript installijaga npm-paketi s\u00f5ltuvustes leiti pahatahtlikke muutusi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

PureScripti installeri npm-paketi s\u00f5ltuvustes avastatud<\/a><\/noindex> kahjustav kood, mis ilmneb paketi installimise katsete ajal purescript<\/a><\/noindex>. Kahjustav kood on sisse ehitatud s\u00f5ltuvuste kaudu load-from-cwd-or-npm<\/a><\/noindex> ja rate-map<\/a><\/noindex>. Oluline on, et selliste s\u00f5ltuvustega pakettide hooldamise eest vastutas algne PureScripti installeri npm-paketi autor, kes hooldas seda npm-paketti kuni hiljuti, kuid umbes kuu tagasi anti paketile \u00fcle teiste hooldajate. <\/p>\n

Probleemi avastas \u00fcks paketi uusi hooldajaid, kellele \u00f5igused hooldamiseks anti p\u00e4rast pikka vaidlust ja ebameeldivaid arutelusid algse PureScripti npm-paketi autori ja uute hooldajate vahel. Uued hooldajad vastutavad PureScripti komileerija eest ning n\u00f5udsid, et npm-paketti koos selle installijaga peaks hooldama sama meeskond, mitte keegi teine. Algne PureScripti npm-paketi autor ei olnud pikka aega n\u00f5us, kuid l\u00f5puks leppis ta ning andis juurde p\u00e4\u00e4su repo. Samas j\u00e4id m\u00f5ned s\u00f5ltuvused tema kontrolli alla.<\/p>\n

Eelmisel n\u00e4dalal ilmus PureScripti komileerija versioon 0.13.2 ja
\nUute hooldajate poolt oli ette valmistatud vastav npm-paketi uuendus, mille installijates tuvastati pahavara. PureScript'i npm-paketi installija postilt eemaldatud autor teatas, et tema konto oli teadmata r\u00fcndajate poolt kompromiteeritud. Sellegipoolest piirdusid pahavara tegevused praeguses vormis vaid paketi installimise sabotaa\u017eiga, mis sai uutelt hooldajatelt esimeseks versiooniks. Pahatahtlikud tegevused piirdusid silmusena vea teavitamisega, kui \u00fcritati installida paketti k\u00e4suga «npm i -g purescript» ilma, et toimuks selget pahavara tegevust.<\/p>\n

Tuvastati kaks r\u00fcnnakut. M\u00f5ni tund p\u00e4rast uue purescript npm-paketi ametlikku v\u00e4ljalaskmist l\u00f5petati kellegi poolt s\u00f5ltuvuse load-from-cwd-or-npm uus versioon 3.0.2, mille muudatused viisid selleni, et kutsumine loadFromCwdOrNpm() tagastas vajalikud binaarfailid loendi asemel PassThrough<\/a><\/noindex>, mis peegeldas sissese tulevaid p\u00fchendusi v\u00e4ljundv\u00e4\u00e4rtustena. <\/p>\n

Neli p\u00e4eva p\u00e4rast seda, kui arendajad olid probleemide allika tuvastanud ja olid valmis v\u00e4ljastama uuenduse, et eemaldada load-from-cwd-or-npm s\u00f5ltuvused, avaldasid kurjategijad uue uuenduse load-from-cwd-or-npm 3.0.4, milles kahjulik kood eemaldati. Sellegipoolest ilmus peaaegu kohe uuendus teisele s\u00f5ltuvusele rate-map 1.0.3, milles lisati parandusi, mis blokeerivad callback-kutse \u00fcleslaadimiseks. See t\u00e4hendab, et m\u00f5lema s\u00f5ltuvuse uutes versioonides load-from-cwd-or-npm ja rate-map muudatused olid selgelt saboteerimise iseloomuga. Veelgi enam, kahjulikus koodis oli kontroll, mis aktiveeris vigaseid tegevusi ainult uute toetajate v\u00e4ljaande installeerimise korral ega avaldunud vanade versioonide installimisel.<\/p>\n

Arendajad lahendasid probleemi, v\u00e4ljastades uuenduse, milles probleemsed s\u00f5ltuvused eemaldati. Et v\u00e4ltida kompromiteeritud koodi j\u00e4\u00e4kide sattumist kasutajate s\u00fcsteemidesse p\u00e4rast probleemse PureScript versiooni installimist, on soovitatav kustutada node_modules kataloogide sisu ja package-lock.json failid ning seej\u00e4rel seadistada minimi versiooniks purescript 0.13.2.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u043a npm-\u043f\u0430\u043a\u0435\u0442\u0443 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u043e\u043c PureScript \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 purescript. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432\u0441\u0442\u0440\u043e\u0435\u043d \u0447\u0435\u0440\u0435\u0437 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 load-from-cwd-or-npm \u0438 rate-map. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0430\u0432\u0442\u043e\u0440 npm-\u043f\u0430\u043a\u0435\u0442\u0430 \u0441 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0442\u043e\u0440\u043e\u043c PureScript, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u043f\u043e\u0440 \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0441\u044f \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u0434\u0430\u043d\u043d\u043e\u0433\u043e npm-\u043f\u0430\u043a\u0435\u0442\u0430, \u043d\u043e \u043e\u043a\u043e\u043b\u043e \u043c\u0435\u0441\u044f\u0446\u0430 \u043d\u0430\u0437\u0430\u0434 \u043f\u0430\u043a\u0435\u0442 \u043f\u0435\u0440\u0435\u0448\u0451\u043b \u043a \u0434\u0440\u0443\u0433\u0438\u043c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u043c. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36164","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PureScript installeriga npm-paketi s\u00f5ltuvustes tuvastatud kahjulikud muutused | ProHoster","description":"PureScript installeriga npm-paketi s\u00f5ltuvustes avastati kahjulik kood, mis avaldub.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/v-zavisimostyah-k-npm-paketu-s-ustanovshhikom-purescript-vyyavleny-vredonosnye-izmeneniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u043a npm-\u043f\u0430\u043a\u0435\u0442\u0443 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u043e\u043c PureScript \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0412 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u043a npm-\u043f\u0430\u043a\u0435\u0442\u0443 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u043e\u043c PureScript \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0439\u0441\u044f.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/v-zavisimostyah-k-npm-paketu-s-ustanovshhikom-purescript-vyyavleny-vredonosnye-izmeneniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:09:56+00:00","article:modified_time":"2019-10-31T19:09:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36164","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 02:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:49:43","updated":"2026-01-22 02:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=36164"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36164\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=36164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=36164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=36164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}