Wiz tau tshaj tawm cov txiaj ntsig ntawm nws qhov kev tshuaj xyuas ntawm tus kab mob Shai-Hulud 2, uas tau tshaj tawm cov kev phem tshaj tawm ntau dua 800 pob, suav nrog ntau dua 100 lab rub tawm, mus rau NPM chaw cia khoom. Tom qab txhim kho pob kab mob, cov kab mob ua kom nquag plias tshawb nrhiav cov ntaub ntawv rhiab, tshaj tawm cov kev phem tawm tshiab (thaum kuaj pom NPM phau ntawv qhia kev sib txuas token), thiab ua rau cov ntaub ntawv rhiab pom hauv lub kaw lus tuaj yeem siv tau los ntawm kev tsim cov chaw khaws ntaub ntawv tshiab ntawm GitHub.
Ntau tshaj 30 repositories uas muaj cov ntaub ntawv cuam tshuam los ntawm tus cab tau txheeb xyuas ntawm GitHub. Kwv yees li ntawm 70% ntawm cov chaw khaws ntaub ntawv no muaj cov ntaub ntawv content.json, 50% muaj cov ntaub ntawv truffleSecrets.json, thiab 80% muaj cov ntaub ntawv ib puag ncig.json, muaj cov yuam sij nkag, cov ntaub ntawv rhiab, thiab ib puag ncig hloov pauv tau pom ntawm lub kaw lus ntawm tus tsim tawm uas tau teeb tsa lub pob tsis zoo uas muaj cov kab mob. Cov chaw khaws cia no tseem muaj kwv yees li 400 yam haujlwmSecrets.json cov ntaub ntawv uas muaj cov yuam sij pom nyob rau hauv GitHub Actions ua haujlwm ib puag ncig.
Cov ntaub ntawv contents.json muaj ntau dua 500 daim ntawv pov thawj tshwj xeeb thiab cov cim rau kev txuas mus rau GitHub. Cov ntaub ntawv truffleSecrets.json muaj cov ntaub ntawv rhiab nrhiav pom los ntawm kev khiav TruffleHog cov nqi hluav taws xob ntawm qhov kev cuam tshuam. Lub tshuab hluav taws xob sau ntau dua 800 hom ntaub ntawv, suav nrog cov yuam sij nkag, cov yuam sij encryption, passwords, thiab tokens siv hauv ntau yam kev pabcuam, huab ib puag ncig, cov khoom lag luam, thiab kev tswj hwm cov ntaub ntawv. Nyob rau hauv tag nrho, ntau tshaj 400 cov ntaub ntawv tshwj xeeb tau pom nyob rau hauv truffleSecrets.json, ntawm uas kwv yees li 2.5% (~ 10000) tau txheeb xyuas.
Nws ntseeg tau tias cov ntaub ntawv tsis pub leej twg paub tuaj yeem dhau los ua qhov pib rau lub nthwv dej tshiab ntawm kev tawm tsam, ntau ntawm cov ntaub ntawv tseem siv tau. Piv txwv li, ib qho kev ntsuam xyuas tau pom tias 60% ntawm NPM nkag mus tokens ntes los ntawm cov kab mob kis los ntawm tus kab mob tseem siv tau.
Daim ntawv tshaj tawm kuj muab cov ntaub ntawv dav dav raws li kev tshuaj xyuas cov kev hloov pauv ib puag ncig los ntawm cov kab ke cuam tshuam. 23% ntawm cov kab mob tso tawm tshwm sim rau ntawm cov tshuab tsim tawm, thiab 77% tshwm sim hauv cov chaw sib koom ua ke tas mus li (60% GitHub Actions, 5% Jenkins, 5% GitLab CI, 3% AWS CodeBuild). 87% ntawm cov kab ke siv Linux, 12% — macOS thiab 1% - Windows. 76% ntawm cov khoom xa tawm yog nyob rau hauv cov thawv, 13% nyob rau hauv cov kab ke tseem ceeb.
60% ntawm tag nrho cov kab mob tshwm sim vim yog kev teeb tsa ntawm kev tso tawm tsis zoo ntawm @postman/tunnel-agent-0.6.7 thiab @asyncapi/specs-6.8.3 pob. Hauv 99% ntawm cov neeg mob, cov cab tau qhib los ntawm kev khiav "node setup_bun.js" hais kom ua, teev nyob rau hauv ntu preinstall ntawm package.json (qhov seem 1% yuav tshwm sim los ntawm kev sim sim).
Tau qhov twg los: opennet.ru
