Si pasivizohen gjithnj\u00eb e m\u00eb shum\u00eb rastet e kapjes s\u00eb repositor\u00ebve t\u00eb projekteve t\u00eb m\u00ebdha dhe promovimit t\u00eb kodit t\u00eb d\u00ebmsh\u00ebm p\u00ebrmes kompromitimit t\u00eb llogarive t\u00eb zhvilluesve, kompania GitHub po introdukton verifikimin e avancuar t\u00eb llogarive n\u00eb t\u00eb gjith\u00eb platform\u00ebn. Ve\u00e7mas, p\u00ebr mbajt\u00ebsit dhe administrator\u00ebt e 500 pakove m\u00eb t\u00eb njohura NPM, do t\u00eb implementohet nj\u00eb autentifikim dyfaktor i detyruesh\u00ebm n\u00eb fillim t\u00eb vitit t\u00eb ardhsh\u00ebm. <\/p>\n
Nga 7 dhjetori 2021 deri m\u00eb 4 janar 2022 do t\u00eb realizohet transferimi i t\u00eb gjith\u00eb mbajt\u00ebsve, q\u00eb kan\u00eb t\u00eb drejta publikimi p\u00ebr pakot NPM, por nuk p\u00ebrdorin autentifikimin dyfaktor, n\u00eb p\u00ebrdorimin e verifikimit t\u00eb avancuar t\u00eb llogarive. Verifikimi i avancuar p\u00ebrfshin nevoj\u00ebn e futjes s\u00eb nj\u00eb kodi t\u00eb vet\u00ebm, q\u00eb d\u00ebrgohet n\u00eb email gjat\u00eb tentativ\u00ebs p\u00ebr t'u hyr\u00eb n\u00eb faqen npmjs.com ose gjat\u00eb kryerjes s\u00eb nj\u00eb operacioni t\u00eb autentifikuar n\u00eb mjetin npm. <\/p>\n
Verifikimi i avancuar nuk z\u00ebvend\u00ebson, por vet\u00ebm shton verifikimin e dyfisht\u00eb opional t\u00eb m\u00ebparsh\u00ebm, ku k\u00ebrkohet konfirmimi p\u00ebrmes fjal\u00ebkalimeve t\u00eb rastit (TOTP). Kur aktivizohet verifikimi i dyfisht\u00eb, verifikimi i avancuar p\u00ebrmes email-it nuk aplikohet. Duke filluar nga 1 shkurt 2022, do t\u00eb filloj\u00eb procesi i kalimit n\u00eb verifikimin e detyruesh\u00ebm t\u00eb dyfisht\u00eb p\u00ebr 100 paketat m\u00eb t\u00eb njohura NPM, t\u00eb cilat kan\u00eb numrin m\u00eb t\u00eb madh t\u00eb var\u00ebsive. Pas p\u00ebrfundimit t\u00eb migrimit t\u00eb 100-\u00ebs s\u00eb par\u00eb, ndryshimi do t\u00eb p\u00ebrfshij\u00eb 500 paketat m\u00eb t\u00eb njohura sipas numrit t\u00eb var\u00ebsive NPM. <\/p>\n
P\u00ebrve\u00e7 skem\u00ebs aktuale t\u00eb verifikimit t\u00eb dyfisht\u00eb bazuar n\u00eb aplikacione p\u00ebr gjenerimin e fjal\u00ebkalimeve t\u00eb rastit (Authy, Google Authenticator, FreeOTP, etj.), n\u00eb prill 2022 planifikohet t\u00eb shtohet mund\u00ebsia e p\u00ebrdorimit t\u00eb \u00e7el\u00ebsave harduerik\u00eb dhe skaner\u00ebve biometrik\u00eb, p\u00ebr t\u00eb cilat ka mb\u00ebshtetje p\u00ebr protokollin WebAuthn, si dhe mund\u00ebsia p\u00ebr regjistrimin dhe menaxhimin e faktor\u00ebve t\u00eb ndrysh\u00ebm t\u00eb verifikimit. <\/p>\n
Kujtojm\u00eb se sipas nj\u00eb studimi t\u00eb realizuar n\u00eb vitin 2020, vet\u00ebm 9.27% e menaxher\u00ebve t\u00eb paketave p\u00ebrdorin autentifikimin me dy faktor\u00eb p\u00ebr t\u00eb mbrojtur aksesin, dhe n\u00eb 13.37% t\u00eb rasteve, kur regjistroheshin llogari t\u00eb reja, zhvilluesit p\u00ebrpiqeshin t\u00eb rip\u00ebrdornin fjal\u00ebkalime t\u00eb kompromentuara, t\u00eb cilat figuronin n\u00eb rrjedhjet e njohura t\u00eb fjal\u00ebkalimeve. Gjat\u00eb kontrollit t\u00eb siguris\u00eb s\u00eb fjal\u00ebkalimeve t\u00eb p\u00ebrdorura, arrit\u00ebm t\u00eb fitonim akses n\u00eb 12% t\u00eb llogarive n\u00eb NPM (13% e paketave) p\u00ebr shkak t\u00eb p\u00ebrdorimit t\u00eb fjal\u00ebkalimeve t\u00eb parashikueshme dhe triviale, si p.sh. '123456'. Midis problemeve ishin 4 llogari p\u00ebrdoruesish nga Top20 paketat m\u00eb t\u00eb njohura, 13 llogari nga paketat q\u00eb shkarkoheshin m\u00eb shum\u00eb se 50 milion her\u00eb n\u00eb muaj, 40 \u2013 mbi 10 milion shkarkime n\u00eb muaj dhe 282 me m\u00eb shum\u00eb se 1 milion shkarkime n\u00eb muaj. Duke marr\u00eb parasysh shkarkimet e moduleve p\u00ebrmes zinxhir\u00ebve t\u00eb var\u00ebsis\u00eb, kompromentimi i llogarive t\u00eb pasigurta mund t\u00eb kishte goditur gjithsej deri n\u00eb 52% t\u00eb t\u00eb gjitha moduleve n\u00eb NPM. \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0443\u0447\u0430\u0441\u0442\u0438\u0432\u0448\u0438\u043c\u0438\u0441\u044f \u0441\u043b\u0443\u0447\u0430\u044f\u043c\u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0432\u0432\u043e\u0434\u0438\u0442 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439. \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 500 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0433\u043e\u0434\u0430 \u0431\u0443\u0434\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f. \u0421 7 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430 \u043f\u043e 4 \u044f\u043d\u0432\u0430\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u0431\u0443\u0434\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102521","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub zbaton verifikimin e detyruesh\u00ebm t\u00eb llogarive n\u00eb NPM | ProHoster","description":"P\u00ebr shkak t\u00eb rritjes s\u00eb rasteve t\u00eb kapjes s\u00eb repository-ve t\u00eb projekteve t\u00eb m\u00ebdha dhe p\u00ebrhapjes s\u00eb kodit t\u00eb d\u00ebmsh\u00ebm p\u00ebrmes kompromitimit t\u00eb llogarive t\u00eb zhvilluesve, kompania GitHub po introdukton verifikimin e zgjeruar n\u00eb t\u00eb gjith\u00eb platform\u00ebn.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 \u0432 NPM \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 | ProHoster","og:description":"\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0443\u0447\u0430\u0441\u0442\u0438\u0432\u0448\u0438\u043c\u0438\u0441\u044f \u0441\u043b\u0443\u0447\u0430\u044f\u043c\u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0432\u0432\u043e\u0434\u0438\u0442 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-08T13:36:53+00:00","article:modified_time":"2021-12-08T13:36:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102521","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-08 13:38:11","updated":"2022-09-27 14:40:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102521","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=102521"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102521\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=102521"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=102521"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=102521"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"