Gulu latsopano la mapaketi oyipa a NPM omwe adapangidwa kuti aziwukira makampani aku Germany Bertelsmann, Bosch, Stihl ndi DB Schenker awululidwa. Kuwukiraku kumagwiritsa ntchito njira yosakanikirana yodalira, yomwe imayambitsa kuphatikizika kwa mayina odalira pagulu komanso m'malo amkati. M'mapulogalamu omwe amapezeka pagulu, achiwembu amapeza njira zofikira kuzinthu zamkati za NPM zotsitsidwa kuchokera kunkhokwe zamakampani, kenaka amayika mapaketi okhala ndi mayina omwewo ndi manambala amtundu watsopano m'nkhokwe yapagulu ya NPM. Ngati pamisonkhano malaibulale amkati sanalumikizidwe momveka bwino ndi malo awo omwe amasungidwa, woyang'anira phukusi la npm amawona kuti malo osungira anthu ndi ofunika kwambiri ndikutsitsa phukusi lokonzedwa ndi wowukirayo.
Mosiyana ndi zoyeserera zomwe zidalembedwa kale zowononga phukusi lamkati, zomwe nthawi zambiri zimachitidwa ndi ofufuza zachitetezo kuti alandire mphotho pozindikira zomwe zili pachiwopsezo chamakampani akuluakulu, mapaketi omwe apezeka alibe zidziwitso zakuyesa ndipo amaphatikizanso ma code oyipa omwe amatsitsa ndikuyendetsa backdoor kwa chiwongolero chakutali cha omwe akhudzidwa.
Mndandanda wamaphukusi omwe akukhudzidwa ndi chiwonongekocho sichinanenedwe; mwachitsanzo, maphukusi a gxm-reference-web-auth-server, ldtzstxwzpntxqn ndi lznfjbhurpjsqmr amatchulidwa, omwe adayikidwa pansi pa akaunti ya boschnodemodules munkhokwe ya NPM ndi mtundu watsopano. manambala 0.5.70 ndi 4.0.49 kuposa phukusi loyambirira lamkati. Sizikudziwikabe kuti owukirawo adakwanitsa bwanji kupeza mayina ndi mitundu ya malaibulale amkati omwe sanatchulidwe m'malo otsegulira. Amakhulupirira kuti chidziwitsocho chinapezedwa chifukwa cha kutuluka kwa chidziwitso chamkati. Ofufuza omwe amayang'anira kufalitsa kwa mapaketi atsopano adanenedwa kwa oyang'anira a NPM kuti maphukusi oyipa adadziwika patatha maola 4 atasindikizidwa.
Zosintha: Code White inanena kuti kuukiraku kudachitika ndi wogwira ntchito ngati njira yofananira pakuwukira kwamakasitomala. Pakuyesa, zochita za owukira enieni zidayesedwera kuyesa mphamvu zachitetezo chomwe chakhazikitsidwa.
Source: opennet.ru