TL, DR
Shai-Hulud 3.0 shine sabon ci gaban malware na shai-hulud npm, a tsutsar sarkar samar da kayayyaki mai yaɗuwa da kanta cin zarafin fakitin npm don satar takardun shaida, yaɗa ta atomatik, da kuma yin sulhu CI/CD Muhalli. Ba kamar raƙuman ruwa na baya ba, Shai-Hulud 3.0 yana inganta dabarun yaɗa shi, yana kai hari ga shahararrun ɗakunan karatu na frontend, kuma yana hanzarta kamuwa da cuta ta hanyar cin zarafin alamun masu kula.
Sakamakon haka, wannan manhajar shai-hulud ta sake tabbatar da cewa hare-haren sarkar samar da kayayyaki ta zamani ba sa dogara da sifili-kwanaki, sai dai a kan sarrafa kansa, cin zarafin amana, da kuma ayyukan masu haɓakawa.
Menene Shai-Hulud 3.0?
Shai-Hulud 3.0 shine karo na uku da aka tabbatar da cewa an fara amfani da manhajar shai-hulud npm, bayan tsutsar Shai-Hulud ta asali da kuma babban fashewar Shai-Hulud 2.0.
Duk da haka, wannan sigar ba ta gabatar da wani sabon salo na musamman ba. Madadin haka, tana inganta inganci, ɓoyewa, da kuma niyya. A wata ma'anar, Shai-Hulud 3.0 yana inganta tsarin harin sarkar samar da kayayyaki maimakon sake ƙirƙira shi.
Mafi mahimmanci, malware yana ci gaba da aiki a matsayin tsutsa, ba a matsayin kunshin cutarwa na lokaci ɗaya ba.
Dalilin da yasa Shai-Hulud 3.0 ke da mahimmanci ga Tsaron npm
Da farko kallo, Shai-Hulud 3.0 na iya kama da "wani sabon kunshin npm mai cutarwa." Duk da haka, wannan zato shine ainihin dalilin da ya sa wannan kamfen ɗin ya yi nasara.
Saboda tsarin halittu na npm ya dogara sosai akan:
- amincewa ta zahiri
- shigarwa ta atomatik
- takardun shaidar mai kula da su
- CI/CD pipelines
Alamar da aka yi wa illa guda ɗaya na iya faɗaɗa cikin sauri zuwa cikakken barkewar cutar malware ta sarkar samar da kayayyaki ta npm.
Sakamakon haka, malware na shai-hulud ba ya buƙatar amfani da shi. Yana mayar da hankali kan ayyukan da aka saba yi.
Shai-Hulud 3.0 Attack Vector: Yadda npm Malware Ya Yaɗu
Kamuwa da cuta ta farko ta hanyar Malicious npm Package
Malware na shai-hulud npm yana shiga cikin tsarin ta hanyar fakitin trojan da aka buga a ƙarƙashin asusun masu kula da su na halal ko na masu laifi.
A cikin guguwar Shai-Hulud 3.0, masu bincike sun lura da kamuwa da cuta ta hanyar dogaro da jama'a, gami da fakitin da ke mayar da hankali kan gaba kamar:
Saboda waɗannan fakitin suna da kyau a cikin jadawalin dogaro, fan ɗin shigarwa guda ɗaya yana fitowa cikin sauri a cikin ayyukan.
Girbi da Takardar Shaida da Yaɗuwar Tsutsa
Da zarar an shigar da shi, Shai-Hulud 3.0 yana aiwatar da rubutun da ke lalata tsarin rayuwa yayin install or postinstall.
A wannan lokacin, malware yana buƙatar:
- yana bincika fayilolin gida da masu canjin muhalli
- yana cire alamun npm da takardun shaidar GitHub
- gano ma'ajiyar bayanai da fakitin da za a iya isa gare su
Saboda haka, kamuwa da cuta nan take ya sauya daga sulhun gida to Yaɗuwar yanayin ƙasa baki ɗaya.
Sake Bugawa ta atomatik a Faɗin Fayilolin Masu Kulawa
Bayan samun takardar shaidar, malware na shai-hulud npm yana lissafa duk fakitin da mai kula da abin ya shafa ya mallaka ta hanyar shirye-shirye.
Sai, ta:
- yana saka lambar mugunta cikin sabbin siga
- sake buga waɗannan sigar ta atomatik
- yana mayar da kowanne wanda aka zalunta zuwa sabon wurin rarrabawa
Saboda, Alamar da aka sata ɗaya na iya kamuwa da ƙwayoyin npm da dama ko ɗaruruwan cikin sa'o'i.
Shai-Hulud 3.0 vs Waves na Baya
Me Ya Canja a Shai-Hulud 3.0?
Duk da cewa manyan injina sun saba da su, Shai-Hulud 3.0 yana gabatar da wasu gyare-gyare masu mahimmanci.
Mafi mahimmanci:
- dabarun yaɗawa cikin sauri
- tsarin kayan aiki mai tsafta
- Haɗuwa mafi kyau tare da sabbin kayan aiki na halal
- rage hayaniya idan aka kwatanta da Shai-Hulud 2.0
Saboda haka, ganowa bisa ga suna ko CVEs kawai ba shi da tasiri.
| Aspect | Shai-Hulud 2.0 | Shai-Hulud 3.0 |
|---|---|---|
| Vector na Farko na Kamuwa da Cututtuka | Fakitin npm mara kyau tare da rubutun zagayowar rayuwa da aka riga aka shigar | Fakitin npm masu cutarwa suna lalata ingantattun ɗakunan karatu masu gani da kuma hanyoyin sabuntawa |
| manufa ta farko | tsarin halittu na npm da kuma CI/CD pipelines | Tsarin halittu na npm tare da mai da hankali kan injunan haɓakawa da masu amfani da ke ƙasa |
| Tsarin Yadawa | Satar takardun shaida ta biyo bayan sake buga fakiti ta atomatik | Amfani da takardar shaida tare da cin zarafin dogaro da aminci don faɗaɗa isa ga sauri |
| Cin Zarafin Lokacin Aiki | Shigar da Bun a kan tashi | Sake amfani da lokacin gudu na Node.js da ake da shi da kuma hanyoyin aiwatarwa masu aminci |
| CI/CD abuse | Ɓoyayyun ayyukan GitHub Actions da masu gudu masu ɗaukar nauyin kansu | Rage CI/CD hayaniya, ƙarin fifiko kan aiwatar da matakin ɓoye na kunshin |
| Halayyar Nauyin Aljihu | Manyan abubuwan da aka ɓoye na JavaScript da kuma nazarin muhalli | Ƙananan ayyuka, waɗanda aka yi niyya don mayar da hankali kan juriya da yaɗuwa |
| Manufa kan Takardun Shaida | Alamun GitHub, alamun npm, takardun shaidar girgije, sirrin CI | Manufofin takardar shaida iri ɗaya, tare da sake amfani da sauri da kuma fitar da abubuwa ba tare da an gani ba |
| Hayaniyar Aiki | Yana da hayaniya sosai: ƙirƙirar wurin ajiye kaya, allurar aiki, lodawa da yawa | Ƙarancin hayaniya: ƙarancin kayan tarihi da ake iya gani, waɗanda ke da wahalar gani ta hanyar bita da hannu |
| Tasirin Radius | Babban amma ana iya gano shi saboda girma da kayan tarihi | Zai iya zama mafi girma saboda ɓoyewa da cin zarafin kunshin da aka amince da shi |
| Kalubalen Tsaro | Tsaya CI/CD cin zarafi da kuma ɓoye takardun shaida | Gano mummunan hali a cikin fakitin da ba na halal ba |
Me Yasa Wannan Har Yanzu Tsutsa Iri Daya Ce?
Duk da waɗannan canje-canjen, Shai-Hulud 3.0 har yanzu iri ɗaya ne da tsutsar sarkar samar da kayayyaki ta npm.
Ya dogara ne akan:
- sake amfani da takardun shaida
- sake bugawa ta atomatik
- amincewa da dogaro
- CI/CD kisa
Saboda haka, duk wani yanayi da ya sanya fakitin npm ba tare da sarrafa halaye ba zai kasance a bayyane.
Alamomin Yarjejeniya
Ya kamata ƙungiyoyin tsaro da ke binciken malware na shai-hulud su nemi waɗannan alamu:
- kurakuran da ba a zata ba na sigar fakitin
- an ƙara rubutun zagayowar rayuwa ba tare da hujja ba
- ɓoye JavaScript blobs
- buƙatun hanyar sadarwa na fita yayin shigarwa
- npm ko GitHub Ana samun damar shiga alamun a lokacin shigarwa
- CI/CD ayyuka suna yin aiki ba zato ba tsammani bayan sabuntawar dogaro
Abu mai mahimmanci, babu ɗayan waɗannan da ke buƙatar CVE ya wanzu.
Me yasa Kayan Aikin Tsaro na NPM na Gargajiya Miss Shai-Hulud 3.0
Ganowa bisa CVE Ya Kasa
Saboda Shai-Hulud 3.0 yana keta haƙƙoƙin aiki na halal, na'urorin daukar hoto waɗanda ke mai da hankali kan raunin da aka sani kawai ba sa ganin wani abu mara kyau.
Akwai:
- babu wani aiki mai rauni
- babu API mara aminci
- babu gurɓataccen ƙwaƙwalwa
Madadin haka, akwai mummunan niyya da aka saka a cikin JavaScript na yau da kullun.
SBOM Ganuwa Bai Isa Ba
Hakazalika, SBOMs zan iya gaya muku abin da ka dogara, amma ba abin da yake yi a lokacin shigarwa.
Sakamakon haka, ganuwa ba tare da tilastawa ba ba ya hana tsutsar sarkar samar da kayayyaki.
Yadda Xygeni Ke Hana Kai Hare-haren Sarkar Samar da Kayayyaki na Shai-Hulud 3.0 npm
Wannan shine ainihin inda tsarin Xygeni yake da mahimmanci.
Gargaɗin Farko na Malware (MEW): Dakatar da npm Malware a Lokacin Bugawa
Gargaɗin Farko na Malware na Xygeni (MEW) ci gaba da duba sabbin fakitin npm da aka buga a ainihin lokaci.
MEW yana gano:
- abubuwan da suka ɓoye
- rubuce-rubucen zagayowar rayuwa masu ban tsoro
- ɗabi'ar tattara takardun shaida
- tsarin fayiloli mara kyau yana rubutu
- aikin cibiyar sadarwa da ba a zata ba
Mafi mahimmanci, MEW na iya toshe gine-gine ta atomatik, yana hana malware na shai-hulud npm shiga koyaushe. CI/CD.
Guardrails: Aiwatar da Halayyar Dogaro da Kai Lafiya
Xygeni Guardrails aiwatar da tsauraran manufofi a ciki pipelines.
Su:
- toshe fakitin npm masu cutarwa ko masu zargi
- hana ɓoyayyun rubutun shigarwa daga aiwatarwa
- dakatar da saukar da lokacin aiki yayin ginawa
- tilasta sahihancin fayil ɗin kullewa
A sakamakon haka, da pipeline yana tsayawa kafin tsutsar ta yi aiki.
CI/CD Tsaro: Kare Pipelines daga Cin Zarafi
Domin kuwa Shai-Hulud 3.0 sau da yawa yana juyawa zuwa CI/CD, Masu saka idanu na Xygeni pipelines don:
- canje-canje a tsarin aiki ba tare da izini ba
- tsarin aiwatarwa mara kyau
- izinin yin amfani da shi ba bisa ka'ida ba
- allurar aikin aiki da dogaro ke haifarwa
Idan halayen haɗari suka bayyana, Xygeni yana toshe hanyoyin pipeline nan take, a yanke motsi a gefe.
Kariyar Sirri: Rage Radius ɗin Bugawa
Tunda manhajar shai-hulud malware tana satar takardun shaida da ƙarfi, Xygeni kuma yana mai da hankali kan sirri.
Sanyi:
- gano sirrin da aka fallasa a cikin SDLC
- yana juya takardun shaidar haɗari masu haɗari ta atomatik
- yana aiwatar da ayyukan alamun aminci
Saboda haka, ko da malware yana aiki, sirrin da aka sata yana rasa ƙima da sauri.
Dalilin da yasa Shai-Hulud 3.0 ya tabbatar da cewa akwai wani sabon salo a cikinsa na dogon lokaci
A ƙarshe, Shai-Hulud 3.0 ya tabbatar da gaskiyar magana.
Hare-haren sarkar samar da kayayyaki ta npm ta zamani:
- yada ta atomatik
- motsa sauri fiye da bita na ɗan adam
- amfani da aminci, ba raunin da ya faru ba
- manufa pipelines, ba kawai lambar ba
Saboda haka, kare kai daga malware na shai-hulud npm yana buƙatar gano halaye da aiwatarwa, ba kawai duba ba.
Bayanin Ƙarshe: Dalilin da yasa Shai-Hulud 3.0 Har Yanzu Yana da Muhimmanci
Duk da cewa Shai-Hulud 3.0 bai gabatar da wani sabon salo mai ban sha'awa ba, yana wakiltar wani nau'in hari mai girma, mai maimaitawa, kuma mai iya daidaitawa.
A wata ma'anar, wannan ba zai zama karo na ƙarshe ba.
Ƙungiyoyin da suka dogara da tsaro mai amsawa za su ci gaba da bin diddigin kamuwa da cuta. Ƙungiyoyin da ke toshe halayen mugunta da wuri za su dakatar da tsutsar gaba ɗaya.
Banbancin kenan.
