{"id":156092,"date":"2026-02-01T11:11:55","date_gmt":"2026-02-01T09:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone"},"modified":"2026-02-01T11:11:55","modified_gmt":"2026-02-01T09:11:55","slug":"atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","title":{"rendered":"En angripare lyckades infoga osynlig skadlig kod i Plone-repositoriet.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Utvecklarna av det \u00f6ppna inneh\u00e5llshanteringssystemet Plone, skrivet i Python och JavaScript\/NodeJS, har meddelat om en incident d\u00e4r skadlig kod har tillf\u00f6rts projektets git-repository p\u00e5 GitHub. Initialt uppt\u00e4cktes tre f\u00f6r\u00e4ndringar den 7 januari (1, 2, 3) som tillf\u00f6rde skadlig kod till projektets JavaScript-filer (1, 2, 3). En analys av incidenten visade att integreringen av den skadliga koden skedde genom att en av utvecklarens konto hade blivit komprometterat, vars \u00e5tkomsttoken hade f\u00e5ngats av angripare efter att skadlig programvara k\u00f6rts p\u00e5 hans system. <\/p>\n

Den 14 januari blev det komprometterade kontot blockerat och utvecklarna av projektet rekommenderades att analysera commitarna fr\u00e5n den 1 till 14 januari. Den 27 januari uppt\u00e4cktes att de observerade commitarna inte var det enda problemet och attacken hade p\u00e5verkat fem av projektets repositories (plone\/volto, plone\/mockup, plone\/plone.app.mosaic, plone\/critical-css-cli, plone\/plonetheme.barceloneta), d\u00e4r skadlig kod hade integrerats osynligt. I fallet med repositoryt plone.app.mosaic lyckades angriparna ers\u00e4tta master-grenen. Attacken genomf\u00f6rdes tv\u00e5 m\u00e5nader efter att utvecklarens \u00e5tkomsttoken hade f\u00e5ngats. <\/p>\n

F\u00f6r att integrera \u00e4ndringar anv\u00e4nde angriparna ist\u00e4llet f\u00f6r vanliga commits operationen «force push» (git push med alternativet «—force»), vilket g\u00f6r det m\u00f6jligt att tv\u00e5ngsm\u00e4ssigt ers\u00e4tta en gren i det externa arkivet med sitt inneh\u00e5ll och d\u00e4rmed skriva om \u00e4ndringshistoriken (efter ers\u00e4ttning visas historiken fr\u00e5n den gren som laddades upp av angriparen). F\u00f6r att f\u00f6rhindra s\u00e5dan manipulering av grenar i framtiden har utvecklarna av Plone implementerat regler i GitHub som blockerar operationer av «force push» f\u00f6r huvudgrenar och taggar. <\/p>\n

I arkivet plone.app.mosaic f\u00f6r att f\u00f6rsv\u00e5ra uppt\u00e4ckten av kompromettering, inf\u00f6rde angriparna en skadlig commit i master-grenen, som hade ett falskt datum \u2014 18 december, i tron att s\u00f6komr\u00e5det f\u00f6r skadlig kod skulle koncentrera sig p\u00e5 \u00e4ndringar som lagts till efter deras f\u00f6rsta aktivitet i arkivet. Den skadliga \u00e4ndringen presenterades i den insatta commiten som b\u00f6rjan p\u00e5 utvecklingen av en ny testutg\u00e5va, men f\u00f6rutom att versionsnumret i metadata \u00e4ndrades (fr\u00e5n 4.0.0a1 till 4.0.0a2.dev0), lades det skadliga koden till i den javascript-fil som anropades under byggsteget, prettier.config.js. F\u00f6r att d\u00f6lja \u00e4ndringarna vid visning i terminalen lades koden till p\u00e5 en rad med den legitima operationen och flyttades bort fr\u00e5n den synliga ytan med hj\u00e4lp av mellanslag. I GitHub-gr\u00e4nssnittet visades \u00e4ven denna kod inte som standard och kr\u00e4vde att knappen «Load Diff» skulle tryckas.

\"En<\/center> <\/p>\n

Attacken riktades i st\u00f6rre utstr\u00e4ckning mot projektets utvecklare \u00e4n mot anv\u00e4ndarna. De skadliga f\u00f6r\u00e4ndringarna kom inte med i utg\u00e5van. Den skadliga koden aktiverades vid byggprocessen, laddade upp exploit f\u00f6r att h\u00f6ja privilegier, st\u00e4llde in automatisk k\u00f6rning genom att kalla sina processer fr\u00e5n startskripten och m\u00f6jliggjorde fj\u00e4rrstyrning. servern<\/a>. Dessutom genomf\u00f6rde den installerade skadliga komponenten s\u00f6kningar och skickade konfidentiell information som \u00e5tkomsttoken, webbl\u00e4sarprofiler och nycklar till kryptovaluta-pl\u00e5nb\u00f6cker.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c Plone, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Python \u0438 JavaScript\/NodeJS, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430 GitHub \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0438\u0445\u0441\u044f 7 \u044f\u043d\u0432\u0430\u0440\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f (1, 2, 3), \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 JavaScript-\u0444\u0430\u0439\u043b\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 (1, 2, 3). \u0420\u0430\u0437\u0431\u043e\u0440 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":156093,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-156092","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Angriparna lyckades l\u00e4gga till osynlig skadlig kod i Plone-repositoryt | ProHoster","description":"Utvecklarna av det fria content management-systemet Plone, skrivet i Python och JavaScript\/NodeJS, tillk\u00e4nnagav en incident d\u00e4r skadlig kod lades till i projektets git-repository p\u00e5 GitHub.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 Plone | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c Plone, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Python \u0438 JavaScript\/NodeJS, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430 GitHub \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-02-01T09:11:55+00:00","article:modified_time":"2026-02-01T09:11:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"156092","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:49:15","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-01 09:11:56","updated":"2026-02-09 21:49:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/156092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=156092"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/156092\/revisions"}],"predecessor-version":[{"id":160399,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/156092\/revisions\/160399"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/156093"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=156092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=156092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=156092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}