{"id":103932,"date":"2022-05-02T15:37:01","date_gmt":"2022-05-02T13:37:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi"},"modified":"2022-05-02T15:37:01","modified_gmt":"2022-05-02T13:37:01","slug":"opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi","title":{"rendered":"Un analyseur a \u00e9t\u00e9 publi\u00e9, r\u00e9v\u00e9lant 200 paquets malveillants dans NPM et PyPI.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Le fonds OpenSSF (Open Source Security Foundation), form\u00e9 par l'organisation Linux Foundation et visant \u00e0 renforcer la s\u00e9curit\u00e9 des logiciels open source, a pr\u00e9sent\u00e9 le projet ouvert Package Analysis, qui d\u00e9veloppe un syst\u00e8me d'analyse de la pr\u00e9sence de code malveillant dans les paquets. Le code du projet est \u00e9crit en Go et est distribu\u00e9 sous la licence Apache 2.0. Une analyse pr\u00e9liminaire des d\u00e9p\u00f4ts NPM et PyPI \u00e0 l'aide des outils propos\u00e9s a permis d'identifier plus de 200 paquets malveillants auparavant non d\u00e9tect\u00e9s.    <\/p>\n<p>La plupart des probl\u00e8mes identifi\u00e9s dans les paquets manipulent le chevauchement des noms avec des d\u00e9pendances internes non publiques des projets (attaque de confusion de d\u00e9pendance) ou utilisent des m\u00e9thodes de typesquatting (assignation de noms similaires \u00e0 des biblioth\u00e8ques populaires), et d\u00e9clenchent \u00e9galement des scripts durant l'installation qui se connectent \u00e0 des h\u00f4tes externes. Selon les d\u00e9veloppeurs de Package Analysis, la majorit\u00e9 des paquets probl\u00e9matiques identifi\u00e9s ont probablement \u00e9t\u00e9 cr\u00e9\u00e9s par des chercheurs en s\u00e9curit\u00e9 participant \u00e0 des programmes de r\u00e9compense pour la d\u00e9couverte de vuln\u00e9rabilit\u00e9s (bug bounty), car les donn\u00e9es envoy\u00e9es se limitent au nom d'utilisateur et au syst\u00e8me, et les actions sont clairement exprim\u00e9es, sans tenter de dissimuler leur comportement.      <\/p>\n<p>Parmi les paquets avec une activit\u00e9 malveillante, on note :  <\/p>\n<ul>\n<li class=\"l\"> Le paquet PyPI discordcmd, qui a enregistr\u00e9 l'envoi de requ\u00eates atypiques vers raw.githubusercontent.com, l'API Discord et ipinfo.io. Ce paquet t\u00e9l\u00e9chargeait du code de porte d\u00e9rob\u00e9e depuis GitHub et l'installait dans le r\u00e9pertoire du client Windows de Discord, puis lan\u00e7ait un processus de recherche de tokens Discord dans le syst\u00e8me de fichiers et les envoyait vers un serveur Discord externe contr\u00f4l\u00e9 par les attaquants.\n<li class=\"l\"> Le paquet NPM colorsss, qui tentait \u00e9galement d'envoyer \u00e0 l'ext\u00e9rieur <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/fr\/server\/\"   title=\"serveur\" data-wpil-keyword-link=\"linked\">serveur<\/a> les tokens du compte Discord.\n<li class=\"l\"> Le paquet NPM @roku-web-core\/ajax \u2014 au cours de l'installation, il a envoy\u00e9 des donn\u00e9es syst\u00e8me et a lanc\u00e9 un gestionnaire (reverse shell), acceptant les connexions externes et ex\u00e9cutant des commandes.\n<li class=\"l\"> Le paquet PyPI secrevthree \u2014 lan\u00e7ait un reverse shell lors de l'importation d'un certain module.\n<li class=\"l\"> Le paquet NPM random-vouchercode-generator \u2014 apr\u00e8s l'importation de la biblioth\u00e8que, il envoyait une requ\u00eate \u00e0 un serveur externe, qui retournait une commande et le moment auquel il fallait l'ex\u00e9cuter.      <\/ul>\n<p>Le travail d'Analyse de Paquets consiste \u00e0 analyser les textes sources des paquets de code pour \u00e9tablir des connexions r\u00e9seau, acc\u00e9der \u00e0 des fichiers et ex\u00e9cuter des commandes. De plus, il suit l'\u00e9volution de l'\u00e9tat des paquets pour d\u00e9terminer l'ajout d'inserts malveillants dans une version d'un logiciel initialement inoffensif. Pour surveiller l'apparition de nouveaux paquets dans les d\u00e9p\u00f4ts et apporter des modifications aux paquets d\u00e9j\u00e0 publi\u00e9s, on utilise l'outil Package Feeds, qui uniformise le travail avec les d\u00e9p\u00f4ts NPM, PyPI, Go, RubyGems, Packagist, NuGet et Crate.      <\/p>\n<p>L'Analyse de Paquets comprend trois composants de base, qui peuvent \u00eatre utilis\u00e9s ensemble ou s\u00e9par\u00e9ment :   <\/p>\n<ul>\n<li class=\"l\"> Un planificateur qui lance des analyses de paquets en fonction des donn\u00e9es provenant de Package Feeds.\n<li class=\"l\"> Un analyseur qui v\u00e9rifie directement le paquet et \u00e9value son comportement en utilisant des m\u00e9thodes d'analyse statique et de tra\u00e7age dynamique. La v\u00e9rification s'effectue dans un environnement isol\u00e9.\n<li class=\"l\"> Un t\u00e9l\u00e9chargeur qui place les r\u00e9sultats de l'analyse dans le stockage BigQuery.    <\/ul>\n<p>Source : <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=57123\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0424\u043e\u043d\u0434 OpenSSF (Open Source Security Foundation), \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Linux Foundation \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 Package Analysis, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Go \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 Apache 2.0. \u041f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 NPM \u0438 PyPI \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u0432\u044b\u044f\u0432\u0438\u0442\u044c \u0431\u043e\u043b\u0435\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103932","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0424\u043e\u043d\u0434 OpenSSF (Open Source Security Foundation), \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Linux Foundation \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 Package Analysis, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0430\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440, \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 200 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 NPM \u0438 PyPI | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0424\u043e\u043d\u0434 OpenSSF (Open Source Security Foundation), \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Linux Foundation \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 Package Analysis, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-05-02T13:37:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-05-02T13:37:01+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Un analyseur a d\u00e9tect\u00e9 200 paquets malveillants dans NPM et PyPI | ProHoster","description":"La fondation OpenSSF (Open Source Security Foundation), cr\u00e9\u00e9e par la Linux Foundation et visant \u00e0 am\u00e9liorer la s\u00e9curit\u00e9 des logiciels open source, a pr\u00e9sent\u00e9 le projet ouvert Package Analysis, qui d\u00e9veloppe le syst\u00e8me.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0430\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440, \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 200 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 NPM \u0438 PyPI | ProHoster","og:description":"\u0424\u043e\u043d\u0434 OpenSSF (Open Source Security Foundation), \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Linux Foundation \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 Package Analysis, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-05-02T13:37:01+00:00","article:modified_time":"2022-05-02T13:37:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103932","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-25 10:46:15","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-05-02 13:37:58","updated":"2026-01-25 10:46:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/103932","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=103932"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/103932\/revisions"}],"predecessor-version":[{"id":172983,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/103932\/revisions\/172983"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=103932"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=103932"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=103932"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}