{"id":104558,"date":"2022-06-30T09:37:00","date_gmt":"2022-06-30T07:37:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/packj-instrumentarij-dlya-vyyavleniya-vredonosnyh-bibliotek-na-yazykah-python-i-javascript"},"modified":"2022-06-30T09:37:00","modified_gmt":"2022-06-30T07:37:01","slug":"packj-instrumentarij-dlya-vyyavleniya-vredonosnyh-bibliotek-na-yazykah-python-i-javascript","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/packj-instrumentarij-dlya-vyyavleniya-vredonosnyh-bibliotek-na-yazykah-python-i-javascript","title":{"rendered":"Packj \u2014 strumenti per identificare librerie dannose in Python e JavaScript","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Gli sviluppatori della piattaforma Packj, che analizza la sicurezza delle librerie, hanno pubblicato un toolkit open-source da riga di comando che consente di identificare costrutti rischiosi nei pacchetti, che possono essere associati all'implementazione di attivit\u00e0 dannose o alla presenza di vulnerabilit\u00e0 sfruttate per attaccare progetti che utilizzano i pacchetti considerati («supply chain»). \u00c8 supportato il controllo dei pacchetti nei linguaggi Python e JavaScript, pubblicati nei repository PyPi e NPM (questo mese pianificano di aggiungere il supporto per Ruby e RubyGems). Il codice del toolkit \u00e8 scritto in Python e distribuito con licenza AGPLv3. <\/p>\n

Durante l'analisi di 330.000 pacchetti utilizzando lo strumento proposto nel repository PyPi sono stati rilevati 42 pacchetti dannosi con backdoor e 2.400 pacchetti a rischio. Durante l'esame viene eseguita un'analisi statica del codice per identificare le caratteristiche dell'API e viene valutata la presenza di vulnerabilit\u00e0 note, segnalate nel database OSV. Per l'analisi dell'API viene utilizzato il pacchetto MalOSS. Il codice dei pacchetti viene analizzato per la presenza di modelli tipici utilizzati normalmente nel software dannoso. I modelli sono stati preparati sulla base dello studio di 651 pacchetti con attivit\u00e0 dannosa confermata. <\/p>\n

Vengono anche identificati attributi e metadati che aumentano il rischio di un uso improprio, come l'esecuzione di blocchi tramite «eval» o «exec», la generazione di nuovo codice durante l'esecuzione, l'uso di tecniche di offuscamento e nascosto del codice (obfuscated), manipolazioni delle variabili ambiente, accessi non autorizzati a file, riferimento a risorse di rete negli script di installazione (setup.py), uso di type-squatting (assegnazione di nomi simili a quelli di librerie popolari), identificazione di progetti obsoleti e abbandonati, indicazione di email e siti web inesistenti, mancanza di un repository pubblico con il codice. <\/p>\n

In aggiunta, si segnala il rilevamento da parte di altri ricercatori di sicurezza di cinque pacchetti dannosi nel repository PyPi, che inviavano dati a un server esterno. server<\/a> il contenuto delle variabili d'ambiente con l'ottimizzazione per il furto di token AWS e sistemi di integrazione continua: loglib-modules (presentati come moduli della legittima libreria loglib), pyg-modules, pygrata e pygrata-utils (presentati come integrazioni della legittima libreria pyg) e hkg-sol-utils. <\/ul>\n

\"Packj<\/center>
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Packj, \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0440\u0438\u0441\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0438\u043b\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b («supply chain»). \u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043d\u0430 \u044f\u0437\u044b\u043a\u0430\u0445 Python \u0438 JavaScript, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u0445 PyPi \u0438 NPM (\u0432 \u044d\u0442\u043e\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":104559,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104558","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Packj \u2014 strumento per rilevare librerie dannose in Python e JavaScript | ProHoster","description":"Gli sviluppatori della piattaforma Packj, che analizza la sicurezza delle librerie, hanno pubblicato un tool da riga di comando open source che permette di identificare costrutti rischiosi nei pacchetti che potrebbero essere correlati a.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/packj-instrumentarij-dlya-vyyavleniya-vredonosnyh-bibliotek-na-yazykah-python-i-javascript","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Packj \u2014 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u043d\u0430 \u044f\u0437\u044b\u043a\u0430\u0445 Python \u0438 JavaScript | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Packj, \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0440\u0438\u0441\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/packj-instrumentarij-dlya-vyyavleniya-vredonosnyh-bibliotek-na-yazykah-python-i-javascript","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-06-30T07:37:01+00:00","article:modified_time":"2022-06-30T07:37:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104558","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-06-30 07:37:58","updated":"2022-09-29 19:12:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/104558","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=104558"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/104558\/revisions"}],"predecessor-version":[{"id":172993,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/104558\/revisions\/172993"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/104559"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=104558"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=104558"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=104558"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}