{"id":103914,"date":"2022-04-29T15:36:47","date_gmt":"2022-04-29T13:36:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-repozitorii-npm-pozvolyayushhaya-dobavit-soprovozhdayushhego-bez-podtverzhdeniya"},"modified":"2022-04-29T15:36:47","modified_gmt":"2022-04-29T13:36:47","slug":"uyazvimost-v-repozitorii-npm-pozvolyayushhaya-dobavit-soprovozhdayushhego-bez-podtverzhdeniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-repozitorii-npm-pozvolyayushhaya-dobavit-soprovozhdayushhego-bez-podtverzhdeniya","title":{"rendered":"Vulnerabiliteti n\u00eb depozitat NPM q\u00eb lejon shtimin e nj\u00eb mb\u00ebshtet\u00ebsi pa konfirmim","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb depozit\u00ebn e pakove NPM \u00ebsht\u00eb identifikuar nj\u00eb problem sigurie q\u00eb i lejon pronarit t\u00eb paket\u00ebs t\u00eb shtoj\u00eb \u00e7do p\u00ebrdorues si mb\u00ebshtet\u00ebs, pa marr\u00eb miratimin e k\u00ebtij p\u00ebrdoruesi dhe pa e informuar p\u00ebr veprimin. Problemi p\u00ebrkeq\u00ebsohet nga fakti se, pas shtimit t\u00eb nj\u00eb p\u00ebrdoruesi t\u00eb tret\u00eb si mb\u00ebshtet\u00ebs, autori origjinal i paket\u00ebs mund t\u00eb largohet nga lista e mb\u00ebshtet\u00ebsve dhe p\u00ebrdoruesi i tret\u00eb mbetet si personi i vet\u00ebm p\u00ebrgjegj\u00ebs p\u00ebr paket\u00ebn. <\/p>\n
Krijuesit e pakove t\u00eb d\u00ebmshme mund t\u00eb p\u00ebrfitojn\u00eb nga ky problem p\u00ebr t\u00eb shtuar n\u00eb list\u00ebn e mb\u00ebshtet\u00ebsve zhvillues t\u00eb njohur apo kompani t\u00eb m\u00ebdha me q\u00ebllim q\u00eb t\u00eb rrisin besimin e p\u00ebrdoruesve dhe t\u00eb krijojn\u00eb iluzionin se zhvilluesit e njohur jan\u00eb p\u00ebrgjegj\u00ebs p\u00ebr paket\u00ebn, nd\u00ebrsa n\u00eb t\u00eb v\u00ebrtet\u00eb nuk kan\u00eb asnj\u00eb lidhje me t\u00eb dhe madje nuk din\u00eb p\u00ebr ekzistenc\u00ebn e saj. P\u00ebr shembull, nj\u00eb sulmues mund t\u00eb vendos\u00eb nj\u00eb paket\u00eb t\u00eb d\u00ebmshme, t\u00eb ndryshoj\u00eb mb\u00ebshtet\u00ebsin dhe t\u00eb ftoj\u00eb p\u00ebrdoruesit t\u00eb testojn\u00eb nj\u00eb zhvillim t\u00eb ri nga nj\u00eb kompani t\u00eb madhe. Ky dob\u00ebsi gjithashtu mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb d\u00ebmtuar reputacionin e disa zhvilluesve, duke i paraqitur ata si iniciator\u00eb t\u00eb veprimeve t\u00eb dyshimta dhe aktiviteteve t\u00eb d\u00ebmshme. <\/p>\n
Kompania GitHub u njoftua p\u00ebr problemin m\u00eb 10 shkurt dhe e zgjidhi at\u00eb n\u00eb npmjs.com m\u00eb 26 prill duke futur nj\u00eb verifikim t\u00eb detyruesh\u00ebm p\u00ebr miratimin e p\u00ebrdoruesve p\u00ebr t'u bashkuar me nj\u00eb projekt tjet\u00ebr. Zhvilluesve t\u00eb nj\u00eb numri t\u00eb madh paketash NPM u \u00ebsht\u00eb rekomanduar t\u00eb kontrollojn\u00eb n\u00ebse ka lidhje t\u00eb shtyra pa miratimin e tyre n\u00eb list\u00ebn e paketave q\u00eb i p\u00ebrkasin. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"