Ib pawg tshiab ntawm cov phiaj xwm phem NPM tsim rau kev tawm tsam ntawm German tuam txhab Bertelsmann, Bosch, Stihl thiab DB Schenker tau tshaj tawm. Kev tawm tsam siv txoj kev sib xyaw ua ke, uas tswj kev sib tshuam ntawm cov npe nyob hauv cov chaw khaws ntaub ntawv pej xeem thiab sab hauv. Hauv cov ntawv thov uas muaj rau pej xeem, cov neeg tawm tsam pom cov kab ntawm kev nkag mus rau hauv NPM pob khoom rub tawm los ntawm cov chaw khaws khoom lag luam, thiab tom qab ntawd tso cov pob khoom nrog tib lub npe thiab cov lej tshiab dua rau hauv pej xeem NPM repository. Yog tias thaum lub sij hawm sib sau ua ke cov tsev qiv ntawv sab hauv tsis tau txuas nrog lawv cov chaw khaws cia hauv qhov chaw, tus thawj tswj hwm pob npm suav tias cov chaw khaws ntaub ntawv pej xeem yog qhov tseem ceeb dua thiab rub tawm cov pob npaj los ntawm tus neeg tawm tsam.
Tsis zoo li cov ntaub ntawv yav dhau los sim ua rau cov pob khoom sab hauv, feem ntau yog ua los ntawm cov kws tshawb fawb txog kev nyab xeeb kom tau txais khoom plig rau kev txheeb xyuas qhov tsis zoo hauv cov khoom lag luam ntawm cov tuam txhab loj, cov pob khoom kuaj pom tsis muaj cov ntawv ceeb toom txog kev sim thiab suav nrog obfuscated ua haujlwm siab phem code uas rub tawm thiab ua haujlwm. backdoor rau tej thaj chaw deb tswj ntawm qhov cuam tshuam ib. system.
Cov npe dav dav ntawm pob khoom koom nrog hauv kev tawm tsam tsis tau tshaj tawm; ua piv txwv, tsuas yog cov pob gxm-reference-web-auth-server, ldtzstxwzpntxqn thiab lznfjbhurpjsqmr tau hais, uas tau tshaj tawm hauv qab boschnodemodules tus account hauv NPM repository nrog cov tshiab dua. tus lej 0.5.70 thiab 4.0.49. 4 dua li cov pob khoom sab hauv qub. Nws tseem tsis tau paub meej tias cov neeg tawm tsam tau tswj xyuas cov npe thiab cov qauv ntawm cov tsev qiv ntawv sab hauv uas tsis tau hais hauv cov chaw khaws cia qhib. Nws ntseeg tau tias cov ntaub ntawv tau txais los ntawm cov ntaub ntawv sab hauv. Cov kws tshawb fawb soj ntsuam kev tshaj tawm cov pob ntawv tshiab tau tshaj tawm rau NPM cov thawj coj tias cov pob ntawv tsis zoo raug txheeb xyuas XNUMX teev tom qab lawv tau tshaj tawm.
Hloov tshiab: Code White tau hais tias qhov kev tawm tsam tau ua los ntawm nws cov neeg ua haujlwm ua ib feem ntawm kev sib koom ua ke ntawm kev tawm tsam ntawm cov neeg siv khoom vaj tse. Thaum lub sijhawm sim, cov kev ua ntawm cov neeg tawm tsam tiag tiag tau simulated los ntsuas qhov ua tau zoo ntawm kev ntsuas kev nyab xeeb.
Tau qhov twg los: opennet.ru