Mapakeji mana akaonekwa muNPM repository iyo yekumberi mushandisi data

MuNPM repository kuzivikanwa chiitiko chakashata mumapakeji mana, kusanganisira preinstall script, iyo, isati yaisa pasuru, yakatumira chirevo kuGitHub neruzivo nezve IP kero yemushandisi, nzvimbo, login, CPU modhi, uye dhairekitori repamba. Kodhi yakaipa yawanikwa mumapasuru Electorn (255 downloads), lodashs (78 downloads), loadyaml (48 downloads) uye loadyml (37 downloads).

Mapakeji mana akaonekwa muNPM repository iyo yekumberi mushandisi data

Dambudziko mapakeji akatumirwa kuNPM kubva Nyamavhuvhu 17 kusvika Nyamavhuvhu 24 kuti igovere kushandiswa typequatting, i.e. nekupihwa kwemazita akafanana nemazita emamwe maraibhurari ane mukurumbira aine tarisiro yekuti mushandisi achaita typo paanenge achinyora zita kana kuti haaone mutsauko pakusarudza module kubva pane iyo rondedzero. Tichitarisa nehuwandu hwekudhawunirodha, vangangosvika mazana mana vashandisi vakadonha nekuda kwehunyengeri uhu, vazhinji vavo vakavhiringa maelectorn neelectronic. Parizvino maelectorn uye loadyaml mapakeji kare kubviswa ne NPM manejimendi, uye lodash uye loadyml mapakeji akabviswa nemunyori.

Zvikonzero zvevapambi hazvizivikanwe, asi zvinofungidzirwa kuti ruzivo rwakaburitswa kuburikidza neGitHub (chirevo chakatumirwa kuburikidza neChinyorwa uye chakabviswa mukati memaawa makumi maviri nemana) chinogona kunge chakaitwa panguva yekuyedza kuongorora kushanda kwenzira, kana kurwiswa kwakarongwa mumatanho akati wandei, kwekutanga kwakaunganidzwa dhata pamusoro pevakabatwa, uye yechipiri, iyo isina kuitwa nekuda kwekuvharira, vapambi vakaronga kuburitsa imwe update yaizosanganisira ine ngozi yakaipa kodhi kana backdoor mukati. kuburitswa kutsva.

Source: opennet.ru

Voeg