{"id":95989,"date":"2020-10-06T01:43:14","date_gmt":"2020-10-05T23:43:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele"},"modified":"2020-10-06T01:43:14","modified_gmt":"2020-10-05T23:43:14","slug":"v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","title":{"rendered":"\u00cen depozitul NPM au fost identificate patru pachete care transmit date despre utilizator","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen depozitul NPM a fost identificat\u0103<\/a><\/noindex> a fost identificat\u0103 activitate mali\u021bioas\u0103 \u00een patru pachete, care includeau un script preinstall, ce trimitea pe GitHub un comentariu cu informa\u021bii despre adresa IP, loca\u021bie, numele de utilizator, modelul CPU \u0219i directorul personal al utilizatorului \u00eenainte de instalarea pachetului. Codul mali\u021bios a fost g\u0103sit \u00een pachete electorn<\/a><\/noindex> (255 desc\u0103rc\u0103ri), lodashs<\/a><\/noindex> (78 desc\u0103rc\u0103ri), loadyaml<\/a><\/noindex> (48 desc\u0103rc\u0103ri) \u0219i loadyml<\/a><\/noindex> (37 desc\u0103rc\u0103ri). <\/p>\n

\"\u00cen<\/a><\/noindex><\/center><\/p>\n

Pachetele problematice au fost publicate \u00een NPM \u00eentre 17 \u0219i 24 august pentru a fi distribuite folosind type squatting<\/a><\/noindex>, adic\u0103 acord\u00e2nd nume asem\u0103n\u0103toare cu titluri de biblioteci populare, astfel \u00eenc\u00e2t utilizatorul s\u0103 fac\u0103 o gre\u0219eal\u0103 de tipar \u00een timpul introducerii numelui sau s\u0103 nu observe diferen\u021bele, aleg\u00e2nd un modul din list\u0103. Judec\u00e2nd dup\u0103 num\u0103rul de desc\u0103rc\u0103ri, aproximativ 400 de utilizatori au c\u0103zut \u00een aceast\u0103 capcan\u0103, majoritatea confuz\u00e2nd electorn cu electron. \u00cen prezent, pachetele electorn \u0219i loadyaml este deja<\/a><\/noindex> au fost eliminate<\/a><\/noindex> sunt gestionate de administra\u021bia NPM, iar pachetele lodashs \u0219i loadyml au fost \u0219terse de autor.<\/p>\n

Motivele atacatorilor sunt necunoscute, dar se presupune c\u0103 scurgerea de informa\u021bii prin GitHub (comentariul era trimis prin Issue \u0219i \u0219ters \u00een decurs de o zi) ar fi putut fi efectuat\u0103 ca parte a unui experiment pentru evaluarea eficien\u021bei metodei, sau ar fi fost planificat\u0103 o atac \u00een mai multe etape, \u00een prima dintre care se str\u00e2ngeau date despre victime, iar \u00een a doua, care nu a fost pus\u0103 \u00een aplicare din cauza bloc\u0103rii, atacatorii inten\u021bionau s\u0103 lanseze o actualizare cu includerea \u00eentr-o nou\u0103 versiune a unui cod mali\u021bios sau a unui backdoor.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 preinstall-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0435\u0440\u0435\u0434 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u043f\u0430\u043a\u0435\u0442\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b \u043d\u0430 GitHub \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u043e\u0431 IP-\u0430\u0434\u0440\u0435\u0441\u0435, \u043c\u0435\u0441\u0442\u043e\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0438, \u043b\u043e\u0433\u0438\u043d\u0435, \u043c\u043e\u0434\u0435\u043b\u0438 CPU \u0438 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u044b\u043b \u043d\u0430\u0439\u0434\u0435\u043d \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 electorn (255 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a), lodashs (78 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a), loadyaml (48 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a) \u0438 loadyml (37 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0431\u044b\u043b\u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u044b \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":95990,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-95989","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00cen depozitul NPM au fost identificate patru pachete care transmit date despre utilizator | ProHoster","description":"\u00cen depozitul NPM a fost identificat\u0103 activitate mali\u021bioas\u0103 \u00een patru pachete, care includeau un script preinstall.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0447\u0435\u0442\u044b\u0440\u0435 \u043f\u0430\u043a\u0435\u0442\u0430, \u043f\u0435\u0440\u0435\u0441\u044b\u043b\u0430\u044e\u0449\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435 | ProHoster","og:description":"\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 preinstall-\u0441\u043a\u0440\u0438\u043f\u0442.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-repozitorii-npm-vyyavleny-chetyre-paketa-peresylayushhie-dannye-o-polzovatele","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-05T23:43:14+00:00","article:modified_time":"2020-10-05T23:43:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95989","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:53:27","updated":"2022-10-03 07:39:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/95989","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=95989"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/95989\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/95990"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=95989"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=95989"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=95989"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}