{"id":95989,"date":"2020-10-06T01:43:14","date_gmt":"2020-10-05T23:43:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele"},"modified":"2020-10-06T01:43:14","modified_gmt":"2020-10-05T23:43:14","slug":"v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","title":{"rendered":"NPM-i reposisioonis on tuvastatud neli paketti, mis edastavad kasutaja andmeid","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

NPM-i hoidlas tuvastatud<\/a><\/noindex> tugevusaktiivne tegevus neljas paketis, sealhulgas preinstall-skript, mis saatis paketi installimise ajal GitHubi kommentaari IP-aadressi, asukoha, sisselogimise, CPU-mudeli ja kasutaja kodukausta kohta. Kahjustav kood avati paketides electorn<\/a><\/noindex> (255 allalaadimist), lodashs<\/a><\/noindex> (78 allalaadimist), loadyaml<\/a><\/noindex> (48 allalaadimist) ja loadyml<\/a><\/noindex> (37 allalaadimist). <\/p>\n

\"NPM-i<\/a><\/noindex><\/center><\/p>\n

Probleemsed paketid olid NPM-is saadaval 17. kuni 24. augustini ja neid levitati typosquatting<\/a><\/noindex>, st sarnaste nimede andmisega teiste populaarsete teekide nimedega, lootes, et kasutaja teeb kirjutamisvea nime sisestamisel v\u00f5i ei m\u00e4rka erinevusi mooduli loendist valimisel. Allalaadimise arvu p\u00f5hjal langes umbes 400 kasutajat sellele trikkile, enamik neist segas electorn'i ja electron'i. Praegu on paketid electorn ja loadyaml juba<\/a><\/noindex> eemaldatud<\/a><\/noindex> NPM-i administraatori poolt eemaldatud, samas kui paketid lodashs ja loadyml eemaldas autor.<\/p>\n

Kuritegevuse motiivid on teadmata, kuid oletatakse, et info lekkimine l\u00e4bi GitHubi (kommentaar saadeti l\u00e4bi Issue ning kustutati \u00fche p\u00e4eva jooksul) v\u00f5is toimuda katse k\u00e4igus, et hinnata meetodi t\u00f5husust, v\u00f5i oli see osa mitmeastmelisest r\u00fcnnakust. Esimeses etapis koguti andmeid ohvrite kohta ning teises, mis j\u00e4i ellu viimata blokeerimise t\u00f5ttu, kavas r\u00fcndajatelt uuenduse v\u00e4ljaandmine, mis sisaldaks uues v\u00e4ljaandes ohtlikumat pahavara v\u00f5i tagauks.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 preinstall-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0435\u0440\u0435\u0434 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u043f\u0430\u043a\u0435\u0442\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b \u043d\u0430 GitHub \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u043e\u0431 IP-\u0430\u0434\u0440\u0435\u0441\u0435, \u043c\u0435\u0441\u0442\u043e\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0438, \u043b\u043e\u0433\u0438\u043d\u0435, \u043c\u043e\u0434\u0435\u043b\u0438 CPU \u0438 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u044b\u043b \u043d\u0430\u0439\u0434\u0435\u043d \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 electorn (255 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a), lodashs (78 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a), loadyaml (48 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a) \u0438 loadyml (37 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0431\u044b\u043b\u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u044b \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":95990,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-95989","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47NPM-repositooriumis on tuvastatud neli paketti, mis edastavad kasutajaandmeid | ProHoster","description":"NPM-repositooriumis tuvastati neljas paketis pahatahtlik tegevus, mis sisaldas preinstall-skripti, mis enne paketi installimist saatis GitHubi kommentaari, mis sisaldas IP-aadressi, asukoha, kasutajanime, CPU mudeli ja kasutaja kodukausta teavet. Pahavara kood leiti paketist electorn (255 allalaadimist), lodashs (78 allalaadimist), loadyaml (48 allalaadimist) ja loadyml (37 allalaadimist). Probleemsed paketid olid \u00fcles laaditud","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0447\u0435\u0442\u044b\u0440\u0435 \u043f\u0430\u043a\u0435\u0442\u0430, \u043f\u0435\u0440\u0435\u0441\u044b\u043b\u0430\u044e\u0449\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435 | ProHoster","og:description":"\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 preinstall-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0435\u0440\u0435\u0434 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u043f\u0430\u043a\u0435\u0442\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b \u043d\u0430 GitHub \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u043e\u0431 IP-\u0430\u0434\u0440\u0435\u0441\u0435, \u043c\u0435\u0441\u0442\u043e\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0438, \u043b\u043e\u0433\u0438\u043d\u0435, \u043c\u043e\u0434\u0435\u043b\u0438 CPU \u0438 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u044b\u043b \u043d\u0430\u0439\u0434\u0435\u043d \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 electorn (255 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a), lodashs (78 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a), loadyaml (48 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a) \u0438 loadyml (37 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0431\u044b\u043b\u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u044b \u0432","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-05T23:43:14+00:00","article:modified_time":"2020-10-05T23:43:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95989","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:53:27","updated":"2022-10-03 07:39:09"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/95989","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=95989"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/95989\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/95990"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=95989"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=95989"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=95989"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}