Kotahi noa te ngoikoretanga, he mōkihi kino e huna ana i roto i ngā miriona, ka taea te whakararu i te haumarutanga o ngā tono maha, ka whakararu i ngā mahi pakihi me te tūmataitinga o ngā kaiwhakamahi. I roto i tēnei whenua morearea i tīmata ai tā mātou tīma i Xygeni i tētahi mahi haumarutanga, e whakaatu ana i tētahi mea tino kitea i wehi ai te tini engari he iti noa iho i taea te whakaū: te noho mai o ngā mōkihi npm kino i roto i te tuara o tā tātou pūnaha matihiko.
Mai i te 13 ki te 15 o Hānuere, 2024, i werohia e tā mātou matawai Kitenga Waehere Kino motuhake te arai o te noho noa, ā, i huraina ehara i te kotahi, engari he tekau ngā mōkihi npm tinihanga. Ehara ēnei i te mahi hē matapōkere engari he kaupapa, i hangaia ia mea hei tuku raraunga tairongo ki ngā kokonga pōuri o te ipurangi. Ehara tēnei whakakitenga i te karanga whakaoho noa; he karanga mārama ki te mahi mā ngā kaipupuri katoa o te tukanga whakawhanake pūmanawa.
I taua wā, he mea nui tonu taua rahinga. I te tau 2026, kua kore e pērā i nāianei. Ngā putanga hou o tā mātou Whakarāpopototanga Waehere Kino Ki te whakaū i te 100-200+ ngā mōkihi kino i ia wiki puta noa i te npm me te PyPI anake, ka puta ake he nui ake i tēnei matapihi e toru-rā i tēnei rā. Kāore i ngaro ngā tikanga tango me te karo i tuhia i raro nei; kua whakawhanakehia noa iho i te tauine kāore i whakaarohia i te tīmatanga o te tau 2024.
Hei paionia i roto i te haumarutanga tukutuku, mā te tirohanga ahurei a Xygeni ka taea e mātou te kite i ēnei tūmomo riri, engari kia mārama hoki ki ō rātou pānga. He tohu tēnei pūrongo ki tā mātou committe tiaki i te rohe mamati o te kimi i ngā taunakitanga kino i roto i te waehere hei karo i te hurihanga i ngā whakaekenga a meake nei.
Hono mai ki a mātou i a mātou e ruku hohonu ana ki ngā taipitopito uaua o ēnei pakanga, e wetewete ana i ngā tikanga a ngā kaiwhakaeke, ā, ko te mea nui, e whakamārama ana me pēhea e taea ai e ngā pakihi te whakapakari i ō rātou parepare ki ēnei tūmomo riri kino.
Te Kitenga Tuatahi: Te Pakaru o Aurora Webmail Pro
Ko te kitenga tuatahi i roto i tā mātou rangahau ko te mōkihi i tapaina ko aurora-mēra-pro, i tukuna ake ki te rēhita NPM e tētahi kaiwhakamahi me te ingoa kē 0x379c. I muri tata mai i tēnei kitenga ka kitea ētahi atu mōkihi e whā, i tukuna katoatia e te kaituhi kotahi i mua i te whakamutua o ā rātou mahi e ngā mahi haumarutanga a te rēhita.
Kei roto i ēnei mōkihi blog_2021@1.1.1, heatwallet@10.1.1, newbooking@1.1.1, a pecko@1.0.1I te tirotirohia, i kitea he rite tonu te waehere kino kei roto i ia mōkihi e aro ana ki te tango i ngā mōhiohio tairongo a te kaiwhakamahi.
Ka whakahokia mai e te kaupapa ngā mōhiohio tairongo o te pūnaha e pā ana ki te kaiwhakamahi me te pūnaha, ā, ka hangaia he hexdump me aua raraunga. Kātahi ka tāruatia ngā raraunga, ā, mō ia poraka, ka tukuna he tono GET ki tētahi pae o waho, ko te ara i uru atu ko ia o ngā poraka kua hangaia.
Te Whakakitenga Tuarua: Ngā Rautaki Kanorau i roto i te Horapa o ngā Waehere Kino
I te kitenga o te puranga tuatahi, i whakaatuhia e tā mātou rangahau ētahi atu mōkihi NPM e whā, i tohatohahia puta noa i te rēhita e ētahi kaiwhakamahi motuhake e toru.
Ko ēnei mōkihi, kua whakarārangihia hei tetahi-deps@1.0.0, shoponline.epiroc.com@1.0.1, shoponline.epiroc.com@1.0.2, a synology-cft@10.0.0, he miro noa iho i roto i tā rātou pūtake waehere—i hangaia ia miro hei tango i ngā mōhiohio kaiwhakamahi. He mea nui, ko te tikanga i whakamahia mō te tango raraunga i ēnei wā i rerekē mai i te tikanga tuatahi, e tohu ana i tētahi kaupapa motuhake, ahakoa he rite tonu te kino.
Ko te rautaki o tēnei pakanga tuarua he huarahi tika ake ki te kohikohi raraunga tairongo. I te whakahohenga, ka tīmata te waehere kino i roto i ēnei mōkihi ki tētahi kaupapa tirotiro whānui, e tango ana i ngā mōhiohio taipitopito mō te whirihoranga pūnaha a te kaiwhakamahi, ngā raraunga whaiaro a te kaiwhakamahi, me te wāhitau IP o te pūnaha. Ko te whāinga o tēnei kohikohinga raraunga whānui he kohikohi i tētahi kōnae katoa mō te patunga, hei whakarite i te tūāpapa mō ngā urutomo hohonu ake pea, ngā whakaekenga kua tohua rānei.
He mea nui kia whakanuia ahakoa te kaha o ēnei mōkihi ki te huna hei wāhanga o ngā mahi rangahau haumarutanga tika, pērā i ngā mea e whai ana ki te whakaatu i ngā ngoikoretanga mā roto i ngā rautaki Whakararuraru Whakawhirinaki, kei te noho tonu te āhua o te ao. Tērā pea ka hangaia ēnei mōkihi me te whakaaro kino, ka kohi puku, ka tuku raraunga tairongo ki ngā hinonga o waho kāore i whakamanahia.
Whakatūpato Motuhake: Te Āhua rerekē o te djs13-fetcher me ōna pānga ki te haumarutanga ipurangi
I waenganui i te tirotiro i ngā mōkihi kua whakahuatia ake nei, i tohua e tā mātou tūāpapa tētahi atu āhuatanga rerekē: he mōkihi e huaina ana ko djs13-fetcherHe rerekē tēnei kitenga i ngā kitenga o mua, ehara i te mea ko tana tikanga whakahaere anake engari ko te āhua o te mōrearea hoki e pā mai ana. djs13-fetcher i tautuhia hei tīmatanga i tētahi raupapa tango me te whakatinanatanga mō tētahi āpitihanga mai i Discord, inā koa he kōnae rua e kīia ana astroia.exe. I muri i te tirotiro tata atu mā te ratonga tātari aunoa, i whiwhi tēnei pūnaha rua i te Kaute Tūponotanga o te 85/100, he whakatauranga e whakarōpū mārama ana i tēnei hei pūmanawa kino.
Ko te whakahaeretanga o te djs13-fetcher me te whakatinanatanga o astroia.exe i muri mai e whakaatu ana i tētahi momo tūmomo riri matatau, maha-āhua hoki. I hangaia te pūnaha rua e pā ana ki tēnei hei mahi i tētahi raupapa mahi e tohu ana i tētahi whakaaro kino hōhonu:
- Ngā Tukanga Pūnaha Whakaputa UriKa tīmatahia e te pūmanawa kino ngā tukanga pūnaha maha i te wā e whakatinanahia ana, he tikanga e whakamahia ana hei whakahaere i ētahi atu tuhinga kino, hei whakatū rānei i tētahi tūranga ki runga i te pūnaha kua pangia mō ngā kawenga tāpiri.
- Te Uiui i ngā Mōhiohio PūnahaKa whakahaerehia e ia he uiuinga whānui mō ngā mōhiohio pūnaha. Ko te tikanga o tēnei mahi he kohikohi i ngā mōhiohio mō te taiao pūnaha, ka taea te whakamahi hei whakarite i ngā whakaekenga e whai ake nei ki ngā ngoikoretanga motuhake o te pūnaha.
- Te Mahi i ngā Mahi ĀraiKo te mea tino kitea pea, i hangaia a astroia.exe hei whakahaere i ngā patai Windows Management Instrumentation (WMI) hei kimi mēnā kei te rere i roto i tētahi mīhini mariko (VM). He mahi karo mārama tēnei whanonga, i hangaia hei karo i te kimi me te tātari e ngā tohunga haumarutanga tukutuku me ngā pūnaha aunoa e whakamahi ana i ngā VM mō te tātari pūmanawa kino.
Take take
Ko te kitenga o ēnei mōkihi npm kino tekau, me te kēhi motuhake o te djs13-fetcher, he tohu wawe tēnei o tētahi tauira kua horapa atu i tua atu i ngā mea i tumanakohia e te tangata i te marama o Hānuere 2024.
Ahakoa i taua wā, i whakaatu tonu tēnei āhuatanga i te tūranga nui o Ratonga Whakatūpato Moata a XygeniI hangaia hei tātari me te whakatūpato i ngā tūmomo riri pea i roto i ngā mōkihi npm hou i te wā tonu ka whakaputaina ai, ko tā mātou ratonga he peke whakamua nui i roto i ngā pareparenga haumarutanga tukutuku matatau i taua wā, ā, ko tōna arorau i nui ake te hiranga i te tipu haere o te rahinga. Mā te tuku i te kitenga wawe o ngā tohu tohu o te kino, kei mua noa atu i te standard ngā tikanga, ka whakamanahia e mātou ā mātou kiritaki ki te tiaki i ā rātou pūnaha pūmanawa mai i te urunga mai o ngā pūmanawa kino i mua i te pānga kino. Kei te haere tonu tēnei momo kitenga: tirohia ngā kitenga kua whakamanahia o tēnei wiki i roto i tā mātou Whakarāpopototanga Waehere Kino.
Me whakarite e ngā whakahaere te whakatinanatanga o ngā kawa haumarutanga pakari, mai i ngā arotake waehere auau ki ngā taputapu kimi matatau, hei tiaki i a rātou mai i ngā rautaki matatau e whakamahia ana e ngā hoariri ipurangi. I Xygeni, kei te noho tonu tātou committe ārahi i te whakaekenga i tēnei pakanga e haere tonu nei, me te whakarato i ō mātou hoa mahi me te hapori whānui ki ngā mātauranga me ngā taputapu e tika ana hei ārai atu i ēnei tūmomo riri kino.
FAQ
Kei te piki haere tonu te raru o ngā mōkihi npm kino i te tau 2026?
Āe, he mea nui. I tuhia e tēnei pou ngā mōkihi npm kino e 10 i kitea i roto i ngā rā e toru i te marama o Hānuere 2024. Inaianei kua whakaūhia e te Malicious Code Digest a Xygeni te 100-200+ mōkihi kino ia wiki puta noa i te npm me te PyPI, he taunakitanga kua tino piki haere ngā rautaki tango me te karo i tautuhia i konei, kaua i ngaro.
Me pēhea taku tirotiro mēnā he kino te mōkihi npm i mua i te tāutanga?
Manatokohia te hītori o te kaitiaki, tirohia ngā rā whakaputa me te maha o ngā tango mō ngā hapa, ā, whakamahia te matawai aunoa e tohu ana i ngā tauira tangohanga me ngā whanonga karo, kaua ko ngā taurite CVE e mōhiotia ana, nā te mea he mea hou te nuinga o ngā mōkihi kino, tae atu ki ngā mea e 10 kua hipokina i konei, i te wā i kitea ai.
Me pēhea taku tirotiro mēnā he kino te mōkihi npm i mua i te tāutanga?
Manatokohia te hītori o te kaitiaki, tirohia ngā rā whakaputa me te maha o ngā tango mō ngā hapa, ā, whakamahia te matawai aunoa e tohu ana i ngā tauira tangohanga me ngā whanonga karo, kaua ko ngā taurite CVE e mōhiotia ana, nā te mea he mea hou te nuinga o ngā mōkihi kino pērā i ngā mea kei roto i tēnei pūrongo i te wā i kitea ai.
Kei te kitea tonutia ngā mōkihi npm kino hou?
Āe. Nā Xygeni Whakarāpopototanga Waehere Kino e whakaputa ana i ngā mōkihi kino npm me PyPI hou kua whakapumautia i ia wiki; ko ngā tikanga exfiltration me te VM-exvasion kua tuhia i roto i tēnei pūrongo 2024 kei te noho noa i roto i ngā mōkihi kua kitea i tēnei rā.
