{"id":105307,"date":"2022-10-14T15:36:38","date_gmt":"2022-10-14T13:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah"},"modified":"2022-10-14T15:36:38","modified_gmt":"2022-10-14T13:36:38","slug":"ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah","title":{"rendered":"Sulmi n\u00eb NPM, i cili lejon t\u00eb p\u00ebrcaktohet pranija e pakove n\u00eb depot private.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb NPM \u00ebsht\u00eb zbuluar nj\u00eb mang\u00ebsi q\u00eb lejon identifikimin e paketave n\u00eb repository t\u00eb mbyllura. Problemi ndodh p\u00ebr shkak t\u00eb nj\u00eb kohe t\u00eb ndryshme reagimi kur k\u00ebrkohet nj\u00eb paket\u00eb ekzistuese dhe nj\u00eb paket\u00eb joekzistuese nga nj\u00eb p\u00ebrdorues i jasht\u00ebm q\u00eb nuk ka qasje n\u00eb repository. Kur nuk ka qasje p\u00ebr \u00e7do paket\u00eb n\u00eb repository private, serveri registry.npmjs.org kthen nj\u00eb gabim me kodin \"404\", por n\u00eb rastin e ekzistenc\u00ebs s\u00eb nj\u00eb pakete me emrin e k\u00ebrkuar, gabimi jepet me nj\u00eb vones\u00eb t\u00eb dukshme. Sulmuesi mund t\u00eb shfryt\u00ebzoj\u00eb k\u00ebt\u00eb karakteristik\u00eb p\u00ebr t\u00eb p\u00ebrcaktuar pranin\u00eb e paket\u00ebs duke provuar emra paketash p\u00ebrmes fjalor\u00ebve. <\/p>\n
P\u00ebrcaktimi i emrave t\u00eb paketeve n\u00eb depo private mund t\u00eb k\u00ebrkohet p\u00ebr t\u00eb kryer nj\u00eb sulm p\u00ebrmes bashkimit t\u00eb var\u00ebsive, duke manipuluar p\u00ebrputhjen e emrave t\u00eb var\u00ebsive n\u00eb depo publike dhe t\u00eb brendshme. Duke ditur se cilat paketa NPM t\u00eb brendshme jan\u00eb t\u00eb pranishme n\u00eb depo t\u00eb korporatave, sulmuesi mund t\u00eb vendos\u00eb paketa me t\u00eb nj\u00ebjtin em\u00ebr dhe numra versioni m\u00eb t\u00eb rinj n\u00eb depo publike NPM. N\u00ebse gjat\u00eb nd\u00ebrtimit bibliotekat e brendshme nuk lidhen qart\u00eb n\u00eb cil\u00ebsime me depo t\u00eb tyre, menaxheri i paketeve npm do ta konsideroj\u00eb depo publike si m\u00eb prioritar dhe do t\u00eb ngarkoj\u00eb paket\u00ebn t\u00eb p\u00ebrgatitur nga sulmuesi. <\/p>\n
GitHub \u00ebsht\u00eb njoftuar p\u00ebr problemin n\u00eb mars, por refuzoi t\u00eb shtoj\u00eb mbrojtje nga sulmi, duke iu referuar kufizimeve arkitekturore. Kompanive q\u00eb p\u00ebrdorin depo private u rekomandohet t\u00eb kontrollojn\u00eb rregullisht p\u00ebr shfaqjen e emrave p\u00ebrputh\u00ebs n\u00eb depo publike ose t\u00eb krijojn\u00eb n\u00ebnshkrime me emrat q\u00eb p\u00ebrs\u00ebrisin emrat e paketeve n\u00eb depo private, p\u00ebr t'i penguar keqb\u00ebr\u00ebsit t\u00eb vendosin paketat e tyre me emra p\u00ebrputh\u00ebs. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"