{"id":112714,"date":"2024-01-05T15:10:15","date_gmt":"2024-01-05T13:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/eksperiment-s-sozdaniem-npm-paketa-zavisimogo-ot-vseh-paketov-v-repozitorii"},"modified":"2024-01-05T15:10:15","modified_gmt":"2024-01-05T13:10:15","slug":"eksperiment-s-sozdaniem-npm-paketa-zavisimogo-ot-vseh-paketov-v-repozitorii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/eksperiment-s-sozdaniem-npm-paketa-zavisimogo-ot-vseh-paketov-v-repozitorii","title":{"rendered":"Eksperyment z tworzeniem pakietu NPM zale\u017cnego od wszystkich pakiet\u00f3w w repozytorium","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jeden z deweloper\u00f3w pakiet\u00f3w JavaScript przeprowadzi\u0142 eksperyment, tworz\u0105c i publikuj\u0105c w repozytorium NPM pakiet \u201eeverything\u201d, kt\u00f3ry obejmuje jako zale\u017cno\u015bci wszystkie istniej\u0105ce pakiety w repozytorium. Aby to zrealizowa\u0107, pakiet \u201eeverything\u201d \u0142\u0105czy si\u0119 bezpo\u015brednimi zale\u017cno\u015bciami z pi\u0119cioma pakietami \u201e@everything-registry\/chunk-N\u201d, kt\u00f3re z kolei wi\u0105\u017c\u0105 si\u0119 jako zale\u017cno\u015bci z ponad 3000 pakiet\u00f3w \u201esub-chunk-N\u201d, z kt\u00f3rych ka\u017cdy wi\u0105\u017ce si\u0119 z 800 istniej\u0105cymi pakietami w repozytorium. <\/p>\n

Publikacja \u201eeverything\u201d w NPM doprowadzi\u0142a do dw\u00f3ch interesuj\u0105cych efekt\u00f3w. Po pierwsze, pakiet \u201eeverything\u201d sta\u0142 si\u0119 swoistym narz\u0119dziem do przeprowadzania atak\u00f3w DoS, poniewa\u017c pr\u00f3ba jego zainstalowania prowadzi do pobrania milion\u00f3w pakiet\u00f3w umieszczonych w NPM i wyczerpania dost\u0119pnej przestrzeni dyskowej lub zatrzymania proces\u00f3w budowania. Statystyki wskazuj\u0105, \u017ce pakiet NPM zosta\u0142 pobrany oko\u0142o 250 razy, ale nic nie stoi na przeszkodzie, aby doda\u0107 go jako zale\u017cno\u015b\u0107 do innego pakietu po zhakowaniu konta dewelopera w celu przeprowadzenia dywersji. Ponadto nieumy\u015blnie atakowi uleg\u0142y niekt\u00f3re us\u0142ugi i narz\u0119dzia zajmuj\u0105ce si\u0119 monitorowaniem i sprawdzaniem nowych pakiet\u00f3w publikowanych w NPM. <\/p>\n

Po drugie, publikacja pakietu \u201eeverything\u201d faktycznie zablokowa\u0142a mo\u017cliwo\u015b\u0107 usuni\u0119cia jakichkolwiek pakiet\u00f3w w NPM, kt\u00f3re znalaz\u0142y si\u0119 w jego li\u015bcie zale\u017cno\u015bci. Pakiet z NPM mo\u017ce zosta\u0107 usuni\u0119ty przez autora tylko wtedy, gdy nie jest ju\u017c u\u017cywany jako zale\u017cno\u015b\u0107 innych pakiet\u00f3w, ale po publikacji \u201eeverything\u201d wszystkie pakiety w repozytorium zosta\u0142y obj\u0119te jego zale\u017cno\u015bciami. Co ciekawe, usuni\u0119cie samego pakietu \u201eeverything\u201d r\u00f3wnie\u017c zosta\u0142o zablokowane, poniewa\u017c 9 lat temu w repozytorium opublikowano testowy pakiet \u201eeverything-else\u201d, w kt\u00f3rym w li\u015bcie zale\u017cno\u015bci znajduje si\u0119 wpis \u201eeverything\u201d. Tak wi\u0119c pakiet \u201eeverything\u201d po publikacji znalaz\u0142 si\u0119 w zale\u017cno\u015bci innego pakietu.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0434\u0438\u043d \u0438\u0437 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 JavaScript-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u0440\u043e\u0432\u0451\u043b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442 \u0441 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435\u043c \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u0435\u043c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u043f\u0430\u043a\u0435\u0442\u0430 «everything», \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0432\u0441\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438. \u0414\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0439 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442 «everything» \u0441\u0432\u044f\u0437\u0430\u043d \u043f\u0440\u044f\u043c\u044b\u043c\u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0441 \u043f\u044f\u0442\u044c\u044e \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 «@everything-registry\/chunk-N», \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043f\u0440\u0438\u0432\u044f\u0437\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u043a \u0431\u043e\u043b\u0435\u0435 3000 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 «sub-chunk-N», \u0432 \u043a\u0430\u0436\u0434\u043e\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0430 \u043a 800 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112714","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Eksperyment z utworzeniem pakietu NPM, zale\u017cnego od wszystkich pakiet\u00f3w w repozytorium | ProHoster","description":"Jeden z tw\u00f3rc\u00f3w pakiet\u00f3w JavaScript przeprowadzi\u0142 eksperyment zwi\u0105zany z utworzeniem i umieszczeniem w repozytorium NPM pakietu \"everything\", kt\u00f3ry pokrywa zale\u017cno\u015bciami wszystkie istniej\u0105ce pakiety w repozytorium.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/eksperiment-s-sozdaniem-npm-paketa-zavisimogo-ot-vseh-paketov-v-repozitorii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u042d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442 \u0441 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435\u043c NPM-\u043f\u0430\u043a\u0435\u0442\u0430, \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u043e\u0442 \u0432\u0441\u0435\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 | ProHoster","og:description":"\u041e\u0434\u0438\u043d \u0438\u0437 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 JavaScript-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u0440\u043e\u0432\u0451\u043b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442 \u0441 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435\u043c \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u0435\u043c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u043f\u0430\u043a\u0435\u0442\u0430 "everything", \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0432\u0441\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/eksperiment-s-sozdaniem-npm-paketa-zavisimogo-ot-vseh-paketov-v-repozitorii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-05T13:10:15+00:00","article:modified_time":"2024-01-05T13:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/112714","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=112714"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/112714\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=112714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=112714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=112714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}