{"id":95989,"date":"2020-10-06T01:43:14","date_gmt":"2020-10-05T23:43:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele"},"modified":"2020-10-06T01:43:14","modified_gmt":"2020-10-05T23:43:14","slug":"v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","title":{"rendered":"In de NPM-repository zijn vier pakketten gevonden die gebruikersgegevens verzenden","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>In de NPM-repository <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.sonatype.com\/sonatype-spots-malicious-npm-packages\">gedetecteerd<\/a><\/noindex> is kwaadaardige activiteit ontdekt in vier pakketten die een preinstall-script bevatten, dat voor de installatie van het pakket een bericht naar GitHub stuurde met informatie over het IP-adres, de locatie, de gebruikersnaam, het CPU-model en de home directory van de gebruiker. Kwaadaardige code werd aangetroffen in de pakketten <noindex><a rel=\"nofollow\" href=\"https:\/\/www.npmjs.com\/package\/electorn\">electorn<\/a><\/noindex> (255 downloads), <noindex><a rel=\"nofollow\" href=\"https:\/\/www.npmjs.com\/package\/lodashs\">lodashs<\/a><\/noindex> (78 downloads), <noindex><a rel=\"nofollow\" href=\"https:\/\/www.npmjs.com\/package\/loadyaml\">loadyaml<\/a><\/noindex> (48 downloads) en <noindex><a rel=\"nofollow\" href=\"https:\/\/www.npmjs.com\/package\/loadyml\">loadyml<\/a><\/noindex> (37 downloads). <\/p>\n<p><center><noindex><a rel=\"nofollow\" href=\"https:\/\/blog.sonatype.com\/hs-fs\/hubfs\/image4.png?width=936&#038;name=image4.png\"><img decoding=\"async\" alt=\"In de NPM-repository zijn vier pakketten gevonden die gebruikersgegevens verzenden\" src=\"\/wp-content\/uploads\/2020\/10\/4962be56e2cb5fcc9877efca75c97d8f.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p>Probleem-pakketten waren in NPM geplaatst van 17 tot 24 augustus om verspreid te worden met <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=44576\">typografische misleidingen<\/a><\/noindex>, dat wil zeggen met namen die lijken op die van andere populaire bibliotheken, zodat gebruikers een typfout maken bij het intypen van de naam of de verschillen niet opmerken bij het kiezen van een module uit de lijst. Aan het aantal downloads te zien, zijn ongeveer 400 gebruikers in deze valstrik getrapt, waarvan de meesten electorn met electron verwarden. Momenteel zijn de pakketten electorn en loadyaml <noindex><a rel=\"nofollow\" href=\"https:\/\/www.npmjs.com\/advisories\/1563\">al<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.npmjs.com\/advisories\/1562\">verwijderd<\/a><\/noindex> door de NPM-beheerder, terwijl de pakketten lodashs en loadyml door de auteur zijn verwijderd.<\/p>\n<p>De motieven van de aanvallers zijn onbekend, maar het wordt verondersteld dat de gegevenslek via GitHub (de opmerking werd via een issue verzonden en binnen een dag verwijderd) mogelijk is uitgevoerd als een experiment om de effectiviteit van de methode te beoordelen, of dat een meerfasige aanval was gepland, waarvan de eerste fase bestond uit het verzamelen van gegevens over de slachtoffers, en in de tweede fase, die niet gerealiseerd kon worden door blokkering, de aanvallers van plan waren een update uit te brengen met daarin meer gevaarlijke kwaadaardige code of een backdoor.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Bron: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53836\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 preinstall-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0435\u0440\u0435\u0434 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u043f\u0430\u043a\u0435\u0442\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b \u043d\u0430 GitHub \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u043e\u0431 IP-\u0430\u0434\u0440\u0435\u0441\u0435, \u043c\u0435\u0441\u0442\u043e\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0438, \u043b\u043e\u0433\u0438\u043d\u0435, \u043c\u043e\u0434\u0435\u043b\u0438 CPU \u0438 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u044b\u043b \u043d\u0430\u0439\u0434\u0435\u043d \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 electorn (255 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a), lodashs (78 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a), loadyaml (48 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a) \u0438 loadyml (37 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0431\u044b\u043b\u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u044b \u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":95990,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-95989","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 preinstall-\u0441\u043a\u0440\u0438\u043f\u0442.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/nl\/blog\/news\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"nl_NL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0447\u0435\u0442\u044b\u0440\u0435 \u043f\u0430\u043a\u0435\u0442\u0430, \u043f\u0435\u0440\u0435\u0441\u044b\u043b\u0430\u044e\u0449\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 preinstall-\u0441\u043a\u0440\u0438\u043f\u0442.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/nl\/blog\/news\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-05T23:43:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-05T23:43:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47In de NPM-repository zijn vier pakketten ontdekt die gebruikersgegevens versturen | ProHoster","description":"In de NPM-repository is kwaadaardige activiteit ontdekt in vier pakketten die een preinstall-script bevatten.","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0447\u0435\u0442\u044b\u0440\u0435 \u043f\u0430\u043a\u0435\u0442\u0430, \u043f\u0435\u0440\u0435\u0441\u044b\u043b\u0430\u044e\u0449\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435 | ProHoster","og:description":"\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 preinstall-\u0441\u043a\u0440\u0438\u043f\u0442.","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-05T23:43:14+00:00","article:modified_time":"2020-10-05T23:43:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95989","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:53:27","updated":"2022-10-03 07:39:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/95989","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=95989"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/95989\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media\/95990"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=95989"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=95989"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=95989"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}