{"id":103914,"date":"2022-04-29T15:36:47","date_gmt":"2022-04-29T13:36:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-repozitorii-npm-pozvolyayushhaya-dobavit-soprovozhdayushhego-bez-podtverzhdeniya"},"modified":"2022-04-29T15:36:47","modified_gmt":"2022-04-29T13:36:47","slug":"uyazvimost-v-repozitorii-npm-pozvolyayushhaya-dobavit-soprovozhdayushhego-bez-podtverzhdeniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-repozitorii-npm-pozvolyayushhaya-dobavit-soprovozhdayushhego-bez-podtverzhdeniya","title":{"rendered":"Vulnerabilitate \u00een depozitul NPM, permi\u021b\u00e2nd ad\u0103ugarea unui \u00eenso\u021bitor f\u0103r\u0103 confirmare.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen repository-ul de pachete NPM a fost identificat\u0103 o problem\u0103 de securitate care permite proprietarului pachetului s\u0103 adauge orice utilizator \u00een calitate de \u00eentre\u021bin\u0103tor, f\u0103r\u0103 a ob\u021bine consim\u021b\u0103m\u00e2ntul acestuia \u0219i f\u0103r\u0103 a-l informa despre aceast\u0103 ac\u021biune. Problema este agravat\u0103 de faptul c\u0103, dup\u0103 ce un utilizator ter\u021b a fost ad\u0103ugat ca \u00eentre\u021bin\u0103tor, autorul ini\u021bial al pachetului ar putea s\u0103 se elimine din lista de \u00eentre\u021bin\u0103tori, iar utilizatorul ter\u021b r\u0103m\u00e2nea singura persoan\u0103 responsabil\u0103 pentru pachet. <\/p>\n

Problema putea fi exploatat\u0103 de c\u0103tre creatorii de pachete mali\u021bioase pentru a ad\u0103uga \u00eentre\u021bin\u0103tori cunoscu\u021bi sau companii mari, \u00een scopul de a c\u00e2\u0219tiga \u00eencrederea utilizatorilor \u0219i de a crea iluzia c\u0103 dezvoltatorii reputa\u021bi sunt responsabili pentru acel pachet, de\u0219i \u00een realitate nu au nicio leg\u0103tur\u0103 cu acesta \u0219i nici m\u0103car nu \u0219tiu de existen\u021ba sa. De exemplu, un atacator ar fi putut publica un pachet mali\u021bios, schimba \u00eentre\u021bin\u0103torul \u0219i invita utilizatorii s\u0103 testeze o nou\u0103 dezvoltare a unei companii mari. Aceast\u0103 vulnerabilitate putea fi de asemenea utilizat\u0103 pentru a compromite reputa\u021bia anumitor dezvoltatori, prezent\u00e2ndu-i ca ini\u021biatori ai unor ac\u021biuni dubioase \u0219i ac\u021biuni mali\u021bioase. <\/p>\n

Compania GitHub a fost notificat\u0103 despre problem\u0103 pe 10 februarie \u0219i a remediat-o pe npmjs.com pe 26 aprilie, prin introducerea unei confirm\u0103ri obligatorii din partea utilizatorilor pentru acceptarea ader\u0103rii la un alt proiect. Dezvoltatorilor unui num\u0103r mare de pachete NPM li s-a recomandat s\u0103 verifice dac\u0103 \u00een lista pachetelor de\u021binute exist\u0103 leg\u0103turi ad\u0103ugate f\u0103r\u0103 consim\u021b\u0103m\u00e2ntul lor.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0443 \u043f\u0430\u043a\u0435\u0442\u0430 \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0432 \u0447\u0438\u0441\u043b\u043e \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0431\u0435\u0437 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043e\u0442 \u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441\u043e\u0433\u043b\u0430\u0441\u0438\u044f \u0438 \u0431\u0435\u0437 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043e \u0441\u043e\u0432\u0435\u0440\u0448\u0451\u043d\u043d\u043e\u043c \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0443\u0433\u0443\u0431\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u043e\u0441\u043b\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u0447\u0438\u0441\u043b\u043e \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445, \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0430\u0432\u0442\u043e\u0440 \u043f\u0430\u043a\u0435\u0442\u0430 \u043c\u043e\u0433 \u0443\u0434\u0430\u043b\u0438\u0442\u044c \u0441\u0435\u0431\u044f \u0438\u0437 \u0441\u043f\u0438\u0441\u043a\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0441\u044f \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u043b\u0438\u0446\u043e\u043c, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103914","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een repository-ul NPM, care permite ad\u0103ugarea unui \u00eentre\u021bin\u0103tor f\u0103r\u0103 confirmare | ProHoster","description":"\u00cen repository-ul de pachete NPM a fost identificat\u0103 o problem\u0103 de securitate care permite proprietarului pachetului s\u0103 adauge orice utilizator \u00een calitate de \u00eentre\u021bin\u0103tor, f\u0103r\u0103 a ob\u021bine consim\u021b\u0103m\u00e2ntul acestuia \u0219i f\u0103r\u0103 a-l informa.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-repozitorii-npm-pozvolyayushhaya-dobavit-soprovozhdayushhego-bez-podtverzhdeniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0431\u0435\u0437 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0443 \u043f\u0430\u043a\u0435\u0442\u0430 \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0432 \u0447\u0438\u0441\u043b\u043e \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0431\u0435\u0437 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043e\u0442 \u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441\u043e\u0433\u043b\u0430\u0441\u0438\u044f \u0438 \u0431\u0435\u0437 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043e.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-repozitorii-npm-pozvolyayushhaya-dobavit-soprovozhdayushhego-bez-podtverzhdeniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-04-29T13:36:47+00:00","article:modified_time":"2022-04-29T13:36:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103914","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-25 10:42:57","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-04-29 13:37:06","updated":"2026-01-25 10:42:57","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103914","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=103914"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103914\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=103914"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=103914"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=103914"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}