{"id":111737,"date":"2023-11-24T21:10:15","date_gmt":"2023-11-24T19:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-repozitorii-pypi-vyyavleno-okolo-5000-ostavlennyh-v-kode-sekretov-i-8-vredonosnyh-obfuskatorov"},"modified":"2023-11-24T21:10:15","modified_gmt":"2023-11-24T19:10:15","slug":"v-repozitorii-pypi-vyyavleno-okolo-5000-ostavlennyh-v-kode-sekretov-i-8-vredonosnyh-obfuskatorov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-repozitorii-pypi-vyyavleno-okolo-5000-ostavlennyh-v-kode-sekretov-i-8-vredonosnyh-obfuskatorov","title":{"rendered":"N\u00eb depozit\u00ebn PyPI jan\u00eb zbuluar rreth 5000 sekrete t\u00eb l\u00ebna n\u00eb kod dhe 8 obfuscator\u00eb t\u00eb d\u00ebmsh\u00ebm","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hulumtar\u00ebt e GitGuardian publikuan rezultatet e analiz\u00ebs s\u00eb t\u00eb dh\u00ebnave konfidenciale t\u00eb harruara nga zhvilluesit n\u00eb kodin e publikuar n\u00eb repozitorin e paketave Python, PyPI (Python Package Index). Pas shqyrtimit t\u00eb mbi 9.5 milion skedar\u00ebve dhe 5 milion l\u00ebshimeve t\u00eb paketave t\u00eb lidhura me 450,000 projekte, u identifikuan 56,866 raste t\u00eb rrjedhjes s\u00eb t\u00eb dh\u00ebnave konfidenciale. N\u00ebse merret parasysh vet\u00ebm t\u00eb dh\u00ebnat unike, pa dyfishim n\u00eb l\u00ebshime t\u00eb ndryshme, numri i rrjedhjeve t\u00eb identifikuara ishte 3,938, nd\u00ebrsa numri i projekteve q\u00eb p\u00ebrmbanin t\u00eb pakt\u00ebn nj\u00eb rrjedhje ishte 2,922. <\/p>\n

N\u00eb total jan\u00eb identifikuar mbi 150 lloje t\u00eb shkeljeve t\u00eb informacioneve t\u00eb ndjeshme, p\u00ebrfshir\u00eb fjal\u00ebkalimet e zakonshme, \u00e7el\u00ebsat kriptografik\u00eb, tokenet e aksesit n\u00eb sh\u00ebrbimet n\u00eb re, sistemet e integrimit t\u00eb vazhduesh\u00ebm dhe API. T\u00eb pakt\u00ebn 768 kredenciale mbet\u00ebn aktiv\u00eb n\u00eb momentin e zhvillimit t\u00eb studimit. Si shembuj t\u00eb shkeljeve t\u00eb njohura q\u00eb vazhdojn\u00eb t\u00eb jen\u00eb t\u00eb r\u00ebnd\u00ebsishme, p\u00ebrmenden \u00e7el\u00ebsat e aksesit n\u00eb Azure Active Directory, kredencialet p\u00ebr SSH, MongoDB, MySQL dhe PostgreSQL, \u00e7el\u00ebsat p\u00ebr GitHub OAuth App, Dropbox dhe Auth0, si dhe parametrat e hyrjes n\u00eb Coinbase dhe Twilio. <\/p>\n

Nga tipet e popullarizuara t\u00eb rrjedhjeve, p\u00ebrmenden tokenet p\u00ebr akses n\u00eb bota n\u00eb Telegram, numri i t\u00eb cilave u dyfishua n\u00eb fillim t\u00eb vitit 2021 dhe m\u00eb pas u dyfishua p\u00ebrs\u00ebri pranver\u00ebn e vitit 2023. Nj\u00eb rritje e vazhdueshme e rrjedhjeve \u00ebsht\u00eb regjistruar gjithashtu q\u00eb nga viti 2020 p\u00ebr \u00e7el\u00ebsat e aksesit n\u00eb Google API, nd\u00ebrsa q\u00eb nga viti 2022 p\u00ebr kredencialet e sistemit t\u00eb menaxhimit t\u00eb bazave t\u00eb t\u00eb dh\u00ebnave. Nga paketat, q\u00eb udh\u00ebheqin me numrin e rrjedhjeve, p\u00ebrmenden paketat chatllm dhe safire, n\u00eb t\u00eb cilat u harruan 209 \u00e7el\u00ebsa p\u00ebr OpenAI dhe 320 \u00e7el\u00ebsa p\u00ebr Google Cloud. <\/p>\n

Mes tipave t\u00eb skedar\u00ebve n\u00eb t\u00eb cil\u00ebt u identifikua numri m\u00eb i madh i rrjedhjeve, p\u00ebrve\u00e7 skedar\u00ebve me zgjatjen \".py\", dallohen skedar\u00ebt me zgjatjet .json (610 rrjedhje), .md (270), PKG-INFO (240), METADATA (210), .txt (170), si dhe skedar\u00ebt README (209) dhe skedar\u00ebt n\u00eb katalog\u00eb me emrin test (675). Shum\u00eb rrjedhje gjithashtu jan\u00eb t\u00eb lidhura me kujdesin e pamjaftuesh\u00ebm dhe gabimet n\u00eb konfigurimin e p\u00ebrjashtimit t\u00eb skedar\u00ebve gjat\u00eb krijimit t\u00eb paketave. P\u00ebr shembull, skedar\u00ebt me skedar\u00eb lokal\u00eb t\u00eb konfigurimit (.cookiecutterrc, .env, .pypirc etj.) mund t\u00eb p\u00ebrjashtohen nga repozitori Git p\u00ebrmes skedarit \".gitignore\", i cili nuk merret parasysh gjat\u00eb krijimit t\u00eb paket\u00ebs. N\u00eb ve\u00e7anti, n\u00eb repozitor \u00ebsht\u00eb gjetur 43 skedar\u00eb .pypirc, q\u00eb p\u00ebrmbajn\u00eb kredencialet p\u00ebr aksesin n\u00eb PyPI. N\u00eb 15 raste t\u00eb rrjedhjeve, zhvilluesit nuk kishin nd\u00ebrmend t\u00eb publikojn\u00eb paketat publikisht, fillimisht t\u00eb krijuara p\u00ebr p\u00ebrdorim t\u00eb brendsh\u00ebm, por i publikuan ato n\u00eb PyPI p\u00ebr shkak t\u00eb nj\u00eb gabimi. <\/p>\n

P\u00ebrve\u00e7 k\u00ebsaj, mund t\u00eb p\u00ebrmenden edhe dy ngjarje q\u00eb lidhen me PyPI: <\/p>\n