{"id":102213,"date":"2021-11-05T03:36:51","date_gmt":"2021-11-05T01:36:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-npm-paket-coa-naschityvayushhij-9-mln-zagruzok-v-nedelyu-vnedreno-vredonosnoe-po"},"modified":"2021-11-05T03:36:51","modified_gmt":"2021-11-05T01:36:51","slug":"v-npm-paket-coa-naschityvayushhij-9-mln-zagruzok-v-nedelyu-vnedreno-vredonosnoe-po","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/v-npm-paket-coa-naschityvayushhij-9-mln-zagruzok-v-nedelyu-vnedreno-vredonosnoe-po","title":{"rendered":"N\u00eb paket\u00ebn NPM coa, e cila ka 9 milion shkarkime n\u00eb jav\u00eb, \u00ebsht\u00eb futur malware.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Sfiduesit arrit\u00ebn t\u00eb merrnin kontrollin mbi paket\u00ebn NPM coa dhe publikuan p\u00ebrdit\u00ebsimet 2.0.3, 2.0.4, 2.1.1, 2.1.3 dhe 3.1.3, q\u00eb p\u00ebrmbajn\u00eb ndryshime t\u00eb d\u00ebmshme. Paketa coa, e cila ofron funksione p\u00ebr analizimin e argumenteve t\u00eb komand\u00ebs, ka rreth 9 milion shkarkime n\u00eb jav\u00eb dhe p\u00ebrdoret si nj\u00eb var\u00ebsi n\u00eb 159 paketa t\u00eb tjera NPM, duke p\u00ebrfshir\u00eb react-scripts dhe vue\/cli-service. Administrata e NPM ka hequr tashm\u00eb l\u00ebshimin me ndryshime t\u00eb d\u00ebmshme dhe ka bllokuar publikimin e versioneve t\u00eb reja deri n\u00eb rikthimin e aksesit n\u00eb depozitat e zhvilluesit kryesor. <\/p>\n
Sulmi \u00ebsht\u00eb realizuar p\u00ebrmes kompromitimit t\u00eb llogaris\u00eb s\u00eb zhvilluesit t\u00eb projektit. Ndryshimet e d\u00ebmshme t\u00eb shtuara jan\u00eb t\u00eb ngjashme me ato q\u00eb u p\u00ebrdor\u00ebn n\u00eb sulmin e dy jav\u00ebve m\u00eb par\u00eb ndaj p\u00ebrdoruesve t\u00eb paket\u00ebs NPM UAParser.js, por jan\u00eb kufizuar vet\u00ebm n\u00eb platform\u00ebn Windows (n\u00eb blloqet e ngarkes\u00ebs p\u00ebr Linux dhe macOS jan\u00eb l\u00ebn\u00eb z\u00ebvend\u00ebsime bosh). N\u00eb sistemin e p\u00ebrdoruesit rregullohej nj\u00eb skedar ekzekutiv nga nj\u00eb host i jasht\u00ebm p\u00ebr t\u00eb realizuar minimin e kripto-monedh\u00ebs Monero (u p\u00ebrdor miner XMRig) dhe u instalua nj\u00eb bibliotek\u00eb p\u00ebr kapjen e fjal\u00ebkalimeve. <\/p>\n
Gjat\u00eb formimit t\u00eb paket\u00ebs me kod t\u00eb d\u00ebmsh\u00ebm u b\u00eb nj\u00eb gabim, i cili \u00e7oi n\u00eb d\u00ebshtimin e instalimit t\u00eb paket\u00ebs, prandaj problemi u identifikua shpejt dhe p\u00ebrhapja e p\u00ebrdit\u00ebsimit t\u00eb d\u00ebmsh\u00ebm u bllokua n\u00eb nj\u00eb faz\u00eb t\u00eb hershme. P\u00ebrdoruesit duhet t\u00eb sigurohen q\u00eb kan\u00eb instaluar versionin coa 2.0.2 dhe \u00ebsht\u00eb e preferueshme t\u00eb shtojn\u00eb n\u00eb package.json t\u00eb projekteve t\u00eb tyre lidhjen me versionin funksional n\u00eb rast t\u00eb nj\u00eb kompromitimi t\u00eb p\u00ebrs\u00ebritur. npm dhe yarn: \"resolutions\": { \"coa\": \"2.0.2\" }, pnpm: \"pnpm\": { \"overrides\": { \"coa\": \"2.0.2\" } } \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"