{"id":104558,"date":"2022-06-30T09:37:00","date_gmt":"2022-06-30T07:37:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/packj-instrumentarij-dlya-vyyavleniya-vredonosnyh-bibliotek-na-yazykah-python-i-javascript"},"modified":"2022-06-30T09:37:00","modified_gmt":"2022-06-30T07:37:01","slug":"packj-instrumentarij-dlya-vyyavleniya-vredonosnyh-bibliotek-na-yazykah-python-i-javascript","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/packj-instrumentarij-dlya-vyyavleniya-vredonosnyh-bibliotek-na-yazykah-python-i-javascript","title":{"rendered":"Packj \u2014 r\u012bku komplekts \u013caunpr\u0101t\u012bgu bibliot\u0113ku identific\u0113\u0161anai Python un JavaScript valod\u0101s","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Packj platform development team, which analyzes the security of libraries, has published an open command-line toolkit that allows identifying risky constructs in packages that may be related to the implementation of malicious activities or the presence of vulnerabilities used to attack projects utilizing these packages («supply chain»). The toolkit supports checking packages in Python and JavaScript languages housed in the PyPi and NPM directories (support for Ruby and RubyGems is also planned for this month). The toolkit's code is written in Python and distributed under the AGPLv3 license. <\/p>\n

Analiz\u0113jot 330 t\u016bksto\u0161us iepakojumu ar pied\u0101v\u0101to r\u012bku PyPi kr\u0101tuv\u0113, tika identific\u0113ti 42 \u013caunpr\u0101t\u012bgi iepakojumi ar aizmugures durv\u012bm un 2,4 t\u016bksto\u0161i riskantu iepakojumu. P\u0101rbaudes proces\u0101 tiek veikta statisk\u0101 koda anal\u012bze, lai identific\u0113tu API \u012bpatn\u012bbas, un nov\u0113rt\u0113ta zin\u0101mo ievainojam\u012bbu kl\u0101tb\u016btne, kas atz\u012bm\u0113ta OSV datu b\u0101z\u0113. API anal\u012bzei tiek izmantots MalOSS pakotne. Paket\u0113m tiek veikta anal\u012bze uz tipiskajiem paraugiem, kas parasti tiek izmantoti \u013caunpr\u0101t\u012bgaj\u0101 programm\u0113\u0161an\u0101. Paraugi sagatavoti, pamatojoties uz 651 iepakojumu ar apstiprin\u0101tu \u013caunpr\u0101t\u012bgu darb\u012bbu p\u0113t\u012bjumu. <\/p>\n

It also identifies attributes and metadata that increase the risk of non-targeted use, such as executing blocks via «eval» or «exec», generating new code during runtime, using obfuscation techniques, manipulating environment variables, unauthorized access to files, accessing network resources in installation scripts (setup.py), using typosquatting (assigning names similar to popular libraries), identifying outdated and abandoned projects, specifying non-existent email addresses and websites, and lacking a public code repository. <\/p>\n

Papildus j\u0101atz\u012bm\u0113, ka citi dro\u0161\u012bbas p\u0113tnieki ir identific\u0113ju\u0161i piecus \u013caunpr\u0101t\u012bgus iepakojumus PyPi kr\u0101tuv\u0113, kas s\u016bt\u012bja datus uz \u0101r\u0113jiem servera<\/a> vides main\u012bgo saturu, kas v\u0113rsta uz AWS un nep\u0101rtrauktas integr\u0101cijas sist\u0113mu piesavin\u0101\u0161anos: loglib-modules (pasniegta k\u0101 modu\u013ci par leg\u0101lo bibliot\u0113ku loglib), pyg-modules, pygrata un pygrata-utils (pasniegta k\u0101 papildu funkcijas leg\u0101lajai bibliot\u0113kai pyg) un hkg-sol-utils. <\/ul>\n

\"Packj<\/center>
\n
Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Packj, \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0440\u0438\u0441\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0438\u043b\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b («supply chain»). \u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043d\u0430 \u044f\u0437\u044b\u043a\u0430\u0445 Python \u0438 JavaScript, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u0445 PyPi \u0438 NPM (\u0432 \u044d\u0442\u043e\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":104559,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104558","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Packj \u2014 r\u012bks \u013caunpr\u0101t\u012bgu bibliot\u0113ku atkl\u0101\u0161anai Python un JavaScript valod\u0101s | ProHoster","description":"Packj platformas izstr\u0101d\u0101t\u0101ji, kuri analiz\u0113 bibliot\u0113ku dro\u0161\u012bbu, izlaida atv\u0113rtu komandrindas r\u012bku, kas \u013cauj atkl\u0101t riskantas konstrukcijas pakotn\u0113s, kas var b\u016bt saist\u012btas ar.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/packj-instrumentarij-dlya-vyyavleniya-vredonosnyh-bibliotek-na-yazykah-python-i-javascript","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Packj \u2014 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u043d\u0430 \u044f\u0437\u044b\u043a\u0430\u0445 Python \u0438 JavaScript | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Packj, \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0440\u0438\u0441\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/packj-instrumentarij-dlya-vyyavleniya-vredonosnyh-bibliotek-na-yazykah-python-i-javascript","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-06-30T07:37:01+00:00","article:modified_time":"2022-06-30T07:37:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104558","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-06-30 07:37:58","updated":"2022-09-29 19:12:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/104558","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=104558"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/104558\/revisions"}],"predecessor-version":[{"id":172993,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/104558\/revisions\/172993"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media\/104559"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=104558"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=104558"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=104558"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}