{"id":36164,"date":"2019-10-31T22:09:56","date_gmt":"2019-10-31T19:09:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-zavisimostyah-k-npm-paketu-s-ustanovshhikom-purescript-vyyavleny-vredonosnye-izmeneniya\/"},"modified":"2019-10-31T22:09:56","modified_gmt":"2019-10-31T19:09:56","slug":"v-zavisimostyah-k-npm-paketu-s-ustanovshhikom-purescript-vyyavleny-vredonosnye-izmeneniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-zavisimostyah-k-npm-paketu-s-ustanovshhikom-purescript-vyyavleny-vredonosnye-izmeneniya","title":{"rendered":"Modific\u0103ri mali\u021bioase au fost identificate \u00een dependen\u021bele pachetului npm cu instalatorul PureScript","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen dependen\u021bele pachetului npm cu instalatorul PureScript a fost identificat<\/a><\/noindex> cod mali\u021bios care se manifest\u0103 la \u00eencercarea de a instala pachetul purescript<\/a><\/noindex>. Codul mali\u021bios este integrat prin dependen\u021be load-from-cwd-or-npm<\/a><\/noindex> \u0219i rate-map<\/a><\/noindex>. Este demn de remarcat c\u0103 \u00eentre\u021binerea pachetelor cu aceste dependen\u021be este realizat\u0103 de autorul ini\u021bial al pachetului npm cu instalatorul PureScript, care p\u00e2n\u0103 de cur\u00e2nd s-a ocupat de \u00eentre\u021binerea acestui pachet npm, dar acum o lun\u0103 pachetul a fost predat altor \u00eentre\u021bin\u0103tori. <\/p>\n

Problema a fost descoperit\u0103 de unul dintre noii \u00eentre\u021bin\u0103tori ai pachetului, c\u0103ruia drepturile de \u00eentre\u021binere au fost transferate dup\u0103 multe ne\u00een\u021belegeri \u0219i discu\u021bii nepl\u0103cute cu autorul ini\u021bial al pachetului npm purescript. Noii \u00eentre\u021bin\u0103tori sunt responsabili pentru compilatorul PureScript \u0219i au insistat c\u0103 pachetul npm cu instalatorul s\u0103 fie \u00eentre\u021binut de acelea\u0219i persoane \u0219i nu de ter\u021bi. Autorul pachetului npm cu instalatorul PureScript nu a fost de acord o perioad\u0103 lung\u0103, dar apoi a cedat \u0219i a transferat accesul la repository. Totu\u0219i, unele dependen\u021be au r\u0103mas sub conducerea lui.<\/p>\n

S\u0103pt\u0103m\u00e2na trecut\u0103 a fost lansat\u0103 versiunea 0.13.2 a compilatorului PureScript \u0219i
\nNoii mentori au preg\u0103tit o actualizare corespunz\u0103toare a pachetului npm cu instalator, \u00een care au fost identificate coduri mali\u021bioase \u00een dependen\u021be. Mentorul demis a declarat c\u0103 contul s\u0103u a fost compromis de atacatori necunoscu\u021bi. Cu toate acestea, \u00een forma sa actual\u0103, ac\u021biunile codului mali\u021bios s-au limitat doar la sabotarea instal\u0103rii pachetului, care a fost prima versiune de la noii mentori. Ac\u021biunile mali\u021bioase constau \u00een generarea unui ciclu cu un mesaj de eroare la \u00eencercarea de a instala pachetul cu comanda «npm i -g purescript» f\u0103r\u0103 a efectua activit\u0103\u021bi mali\u021bioase evidente.<\/p>\n

Au fost identificate dou\u0103 atacuri. La c\u00e2teva ore dup\u0103 lansarea oficial\u0103 a noii versiuni a pachetului npm purescript, cineva a formulat o nou\u0103 versiune a dependen\u021bei load-from-cwd-or-npm 3.0.2, modific\u0103rile din care au dus la faptul c\u0103 apelul loadFromCwdOrNpm() \u00een loc de lista necesar\u0103 pentru instalare a fi\u0219ierelor binare returna un flux PassThrough<\/a><\/noindex>, care oglinde\u0219te cererile de intrare ca valori de ie\u0219ire. <\/p>\n

Dup\u0103 4 zile, dup\u0103 ce dezvoltatorii au identificat sursa defec\u021biunilor \u0219i se preg\u0103teau s\u0103 lanseze o actualizare pentru a elimina load-from-cwd-or-npm din dependen\u021be, atacatorii au lansat o nou\u0103 actualizare load-from-cwd-or-npm 3.0.4, \u00een care codul mali\u021bios a fost eliminat. Cu toate acestea, aproape imediat a fost lansat\u0103 o actualizare a unei alte dependen\u021be rate-map 1.0.3, care a inclus o corec\u021bie ce blocheaz\u0103 apelurile callback pentru \u00eenc\u0103rcare. Adic\u0103, \u00een ambele cazuri, modific\u0103rile din noile versiuni load-from-cwd-or-npm \u0219i rate-map au avut caracter de sabotaj evident. Mai mult, \u00een codul mali\u021bios existau verific\u0103ri care activau ac\u021biuni defuncte doar la instalarea versiunilor recente de c\u0103tre noii \u00eentre\u021bin\u0103tori \u0219i nu se manifestau la instalarea versiunilor mai vechi.<\/p>\n

Dezvoltatorii au rezolvat problema prin lansarea unei actualiz\u0103ri \u00een care dependen\u021bele problematice au fost eliminate. Pentru a exclude ini\u021bierea codului compromis pe sistemele utilizatorilor dup\u0103 \u00eencercarea de instalare a versiunii problematice, se recomand\u0103 \u0219tergerea con\u021binutului directorilor node_modules \u0219i a fi\u0219ierelor package-lock.json, dup\u0103 care s\u0103 se seteze ca limit\u0103 inferioar\u0103 versiunea purescript 0.13.2.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u043a npm-\u043f\u0430\u043a\u0435\u0442\u0443 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u043e\u043c PureScript \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 purescript. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432\u0441\u0442\u0440\u043e\u0435\u043d \u0447\u0435\u0440\u0435\u0437 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 load-from-cwd-or-npm \u0438 rate-map. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0430\u0432\u0442\u043e\u0440 npm-\u043f\u0430\u043a\u0435\u0442\u0430 \u0441 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0442\u043e\u0440\u043e\u043c PureScript, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u043f\u043e\u0440 \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0441\u044f \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u0434\u0430\u043d\u043d\u043e\u0433\u043e npm-\u043f\u0430\u043a\u0435\u0442\u0430, \u043d\u043e \u043e\u043a\u043e\u043b\u043e \u043c\u0435\u0441\u044f\u0446\u0430 \u043d\u0430\u0437\u0430\u0434 \u043f\u0430\u043a\u0435\u0442 \u043f\u0435\u0440\u0435\u0448\u0451\u043b \u043a \u0434\u0440\u0443\u0433\u0438\u043c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u043c. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36164","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Modific\u0103ri mali\u021bioase identificate \u00een dependen\u021bele pachetului npm cu installerul PureScript | ProHoster","description":"Codul mali\u021bios a fost identificat \u00een dependen\u021bele pachetului npm cu installerul PureScript.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-zavisimostyah-k-npm-paketu-s-ustanovshhikom-purescript-vyyavleny-vredonosnye-izmeneniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u043a npm-\u043f\u0430\u043a\u0435\u0442\u0443 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u043e\u043c PureScript \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0412 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u043a npm-\u043f\u0430\u043a\u0435\u0442\u0443 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u043e\u043c PureScript \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0439\u0441\u044f.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-zavisimostyah-k-npm-paketu-s-ustanovshhikom-purescript-vyyavleny-vredonosnye-izmeneniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:09:56+00:00","article:modified_time":"2019-10-31T19:09:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36164","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 02:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:49:43","updated":"2026-01-22 02:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/36164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=36164"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/36164\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=36164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=36164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=36164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}