TL; DR
E ono wiki te roa o te mahi a te kaiwhakahaere npm kotahi ki te whakaputa i ngā mōkihi "whai hua" rūpahu TypeScript pērā i ts-form-utils, ts-project-lint, a ts-enum-helper.
Ahakoa e whakaatu ana ngā mōkihi i ngā āwhina whakamana iti e āhua tika ana, ka whakahaerehia te kawenga tūturu i te tāutanga, i te tono tuatahi rānei, ā, ka mahi i te tānga tapumati manaaki, te kimi whakahaere GitHub, te tārua putunga, me te tango i te waehere pūtake.
E aro nui ana te pūmanawa kino ki ngā whakahaere GitHub whai uara nui, tae atu ki ngā maha Shopify ngā putunga, kātahi ka puranga, ka tango i ngā rākau pūtake ka taea te toro atu ki tētahi pūwāhi kohinga pokapū.
Hei wāhanga o te tukanga mahi taupatupatu, ko te kawenga committe whakahoki i te kōnae sa ki ngā putunga o ngā patunga i te wā e whakaari ana i te tuakiri waehere motuhake a Google google-labs-jules[bot].
I aru mātou i te kaupapa — i tapaina ko JulesJacker — puta noa i ngā whānuitanga o ngā kaiwhakaputa me te iti rawa e rima ngā whakatupuranga kawenga, tae atu ki ngā momo whakamuna me ngā momo e mōhio ana ki te pouaka onepu.
Ko te momo hou rawa e aro nui ana ki ngā hanganga tātari pūmanawa kino: ka whakahohe noa i roto i ngā taiao tātari, ka tahae i ngā tohu pūkete ratonga raraunga kapua, ā, ka tirotiro i ngā papa whakahaere Kubernetes me ngā peere rokiroki kapua.
Ko te IOC matua e tohaina ana puta noa i ngā whakatupuranga kawenga katoa ko te pito mutunga kohinga. aaronstack[.]com/jules-collect.
Te kaha: tino kino.
Te Whakaeke: Te Āhua o tana Mahi
He rite tonu te tauira e whai ana i ia mōkihi JulesJacker. mōkihi.json e pānuitia ana he āwhina TypeScript pai me te raihana MIT, kāore hoki he putunga pūtake hono. Ko te taurangi.js ka kaweake i ētahi mahi tūturu, mahi tonu — ngā reta īmēra, ngā mahere enum, ngā ripanga ture miro — kia kite ai te kaiwhakawhanake e kawemai ana i te mōkihi i ngā whanonga whaitake. Kei hea te kino: i roto i te i muri i te tāutanga matau, i roto rānei i tētahi poraka i raro i te taurangi.js e whakahaere ana i te wā e hiahiatia ana te kōwae.
Kua whanake haere ngā kawenga i roto i ngā wāhanga o roto kua tau mārama (ka tapaina e te kaiwhakahaere āna ake kaupapa telemetry sc1-, sc3-, sc4-, me ērā atu), ā, ko te mātakitaki i taua whanaketanga te huarahi mārama ki te mārama ki te kaupapa.
Whakatipuranga 1–2: te tirotiro me te tahae git-config
Ko ngā mōkihi tuatahi he tahae mōhiohio māmā noa iho. I te tāutanga i kohia e rātou ngā taurangi taiao, te kōnae manaaki GitHub CLI, me te whirihoranga git ā-ao (git config –ao whānui –rārangi, git mamao -v), kātahi ka TUKU te paihere ki te pito mutunga kohinga. Nā tēnei i whakatū te waitohu a te kaiwhakahaere: he kōrero uhi "Ngā taputapu whakamana puka TypeScript", he tohu tuku ki tētahi rohe kotahi, me te hiahia ki ngā tohu tuakiri kaiwhakawhanake kaua ki ngā raraunga kaihoko.
Whakatipuranga 3: ngā tirotiro mawhiti hypervisor me te kernel
Kotahi te putanga o waenganui o te pakanga i huri kaha ki ngā whakaekenga hanganga. Engari i te tahae i te whirihoranga, i whakahaerehia he pūnaha tirotiro tirotiro. AF_VSOCK ngā kōhao, ngā rohe MMIO virtio, /dev/mem, me ngā haki whakapakeketanga o te kernel, tae atu ki ngā nganatanga tukinga kernel i whakaohohia e sysrq — whanonga e pā ana ki ngā nganatanga ki te pakaru i waho o tētahi mīhini mariko, i tētahi ipu rānei. Ko ngā tohu telemetry (s0-vmm-tirotiro, s1-vmm-vsock-fuzz, s2-vmm-mmio, te tirotiro-kernel-s3) i whakamārama i te whāinga. I arotahi mārama tēnei momo ki ngā taiao pouaka-onepu kapua me ngā taiao kaiwhakahaere-kore-tūmau — te momo VM rangitahi e hanga ana, e whakamātautau ana hoki i te waehere kāore i te pono.
Whakatipuranga 3 (SC3): te kutukutu tuhituhi whakawhiti-repo
I huri te pokapū kaha o te pakanga hei tahae repo e horapa ana i a ia anō. I te tāutanga, ka whakahaerehia e te kawenga he raupapa wā e rima ngā wāhanga:
- Mahinga 0 (~100 ms): tohu tapumati o te kaihautū — ingoa kaihautū, mōhiohio kaiwhakamahi, tuakiri git.
- Mahinga 1 (~3 hēkona): whakatauhia ko tēhea whakahaere te hunga i pāngia mā te tirotiro git mamao -v, kātahi ka rapu i tētahi waehere kua whakapūmautia ORG_CONFIG te urunga ki te ripanga me te repo whakamātautau me git ls-remote — i tukuna mā roto i tētahi takawaenga SSRF e whakahaerehia ana e te kaiwhakaeke i http://git@192.168.0.1:8080.
- Mahinga 2 (~10 hēkona): Tuhinga o mua ngā putunga katoa e taea ana te toro atu i roto i te rārangi ūnga, tarball me te gzip te rākau, whakakōwaea-base64, ka tangohia-wāhanga.
- Mahinga 3 (~45 hēkona): te "tohu urunga" — tāruatia he repo ka taea te tuhi, whakatakahia he kōnae ko SECURITY-POC.md te ingoa, ā, commit me te kaituhi kua whakatakotoria ki google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com> me te karere mahi: whakahou i te keteroki whakawhirinakitanga, kātahi ka pana ki te peka matua o te patunga.
Ehara te rārangi whāinga kua whakapūmautia i te mea whānui. Neke atu i te toru tekau ngā tāngata e whakarārangihia ana Shopify ngā whare putunga ingoa — Shopify/shopify, Shopify/tuakiri, Shopify/nama, Shopify/whare pupuri taonga, Shopify/ngā mea ngaro, Shopify/hanganga, Shopify/.github, me te tini ke atu — me tētahi whakahaere whakamātautau, AaronStackBarnes, e āhua nei ko te kaiwhakahaere te kaiwhakahaere, ā, e whakamahia ana hei ūnga tuhi.
Whakatipuranga 4 (SC4): kua whakamunatia, kua āraia hoki
Ko te putanga hou e anga atu ana ki ngā kaiwhakawhanake ka tāpirihia he paparanga rua o te karo i runga i te kutukutu SC3.
Tuatahi, kāore te kawenga e tukuna ana hei tuhinga māmā. Ko te ariā tūturu kei roto i tētahi poraka whakamuna AES-256-CBC, lib/.perf.dat, me te IV i roto i ōna tekau mā ono paita tuatahi. Ko te utauta i roto i taurangi.js hanga anō i te kī wetemunatanga mai i ngā kongakonga aho honohono, wetemunatia te poro, ā, whakahaerehia me Mahi hou(). Ka wehea ngā ingoa o ngā kōwae kia kore ai e pāngia e ngā matawai pūmau — me tono('crypt' + 'o'), me hiahia('f' + 's').
Tuarua, he mea ārai-kaihautū. Ka wetewetehia e tētahi momo ka oma ina ingoa os.host() rite tonu pouaka whakawhanake or ubuntu-fc-uvm (he taunoa Firecracker microVM) kei roto rānei te aho-iti pouaka whakawhanake. Tētahi atu kēti i te aroaro o te .jules/ kōpaki mahi:
Arā, kua hangaia te kawenga SC4 kia noho moe i runga i te pona a te kaiwhakawhanake noa, ā, kia ara ake i roto i te AI-agent aunoa anake. nga taiao pouaka kirikiri e hiahia ana te kaiwhakahaere ki te whakaae.
Te Whakakā i te Taiwhanga: te Rerekētanga Hanganga-Aromatawai
Ko te mōkihi hou rawa atu o te kaupapa, ts-enum-āwhina, kāore e whakaeke i ngā kaiwhakawhanake, i a Shopify rānei. postinstall.sh ka tuwhera me te kēti e whakaatu ana i te kēmu:
Kāore he mahi a te tuhinga mēnā kāore he taurangi taiao e hāngai ana ki tētahi tūāpapa tātari pūmanawa kino e whakatakotoria ana. Ina whakatakotoria, ka mōhio te kawenga kei te rere i roto i te pouaka onepu e wātea ana hei pahū me te ako i ngā mōkihi pērā i tēnei — ā, ka whakaeke anō.
Ka tangohia tuatahitia te tohu OAuth pūkete ratonga GCP mai i te tūmau raraunga tauira ka tangohia atu. Kātahi, mā te whakamahi i taua tohu, ka horoia te Papa whakahaere Kubernetes taea ki kubernetes.default.svc:
- e whakarārangi ana i ngā ClusterRoleBindings, ngā ClusterRole, me ngā Pūnga;
- ka tirotirohia ngā pod, ngā mea ngaro, me ngā mahere whirihora puta noa pūnaha-kube, Taunoa, kube-tūmatanui, rīhi-pūnga-kube, me te mokowā ingoa tātaritanga;
- Ka puta ngā karanga SelfSubjectAccessReview hei mahere i te mea e whakaaetia ana kia mahia e te tuakiri kua tahaetia.
Hei whakamutunga, ka whakamahia e ia ngā ingoa peere Google Cloud Storage i hangaia mai i tētahi ID kaupapa GCP kua whakapūmautia (kai-waitohu-onge-437603-p9) me te tau o te kaupapa, me te whakaaro i ngā huinga pēnei i te *-hanga, *-taonga, me etahi malysis- ngā kupu whakataki (ngā hua o te tātaritanga, ngā mōkihi-malysis, ngā matawai-malysis). Ka takiuruhia ia waehere me te tinana whakautu, ā, ka TUKUhia anō ki taua mea anō. kohi-jules pito mutunga.
Koinei te āhua onge o tētahi kawenga mekameka tuku i hangaia mō te whakaeke i te hanganga ake o ngā kaiwawao. Ko te kōrero uhi puta noa i te pakanga katoa — ko ngā wāhanga o ēnei ka puta i roto i ngā kawenga hei kōrero e whakaahua ana i te whanonga hei "PoC Rangahau Haumarutanga … te tuhi whakawhiti-repo mā te tohu git proxy kua whānuitia" — he rite tonu te whakamārama whaiaro, ahakoa ko te whāinga wā-oma he monorepo Shopify, he tūmau raraunga rānei o te rōpū tātari.
Te Wātaka me te Hekenga Whānui
Ehara a JulesJacker i te hinganga kotahi noa. He mahi pumau i ora mai i te tangohanga o te rēhita mā te whakarerekē noa i tōna ingoa.
| A, no te | takahanga |
|---|---|
| Waenganui o Paenga-whāwhā 2026 | Ka puta ngā mōkihi tuatahi i raro i te whānuitanga o te kaiwhakaputa taketake: te mata o te TS-utility, te taiao me te git-config exfiltration. |
| Te tīmatanga o Mei 2026 | Kua whakaputaina te momo tirotiro hypervisor me te kernel-escape. |
| Waenganui ki te mutunga o Mei 2026 | Ka puta te kutukutu tuhituhi whakawhiti-repo SC3 i te taha o ngā kawenga e arohia ana e Shopify me google-labs-jules[bot] te whakataruna. Ka whakauruhia e SC4 ngā utauta whakamuna-AES me ngā utauta kua āraia e te manaaki. |
| Te mutunga o Mei 2026 | Ka tangohia e te npm te whānuitanga o te kaiwhakaputa taketake; ka whakatauhia e ngā ingoa mōkihi kia kore e whakamahia ngā kaipupuri-haumarutanga. |
| I taua wiki anō | Ka heke te kaiwhakahaere ki tētahi whānuitanga āhua rite tonu, ā, ka whakaputa anō i te kutukutu, tae atu ki te rerekētanga hanganga-tātari. |
Ko te hekenga te wāhanga e tika ana kia nohoia e ngā kaiwawao. Kāore te tango i te whānuitanga tuatahi i mutu ai te pakanga, i whakaroa rānei. Kua whakaritea kētia e te kaiwhakahaere he whānuitanga whakarara he rerekē tōna ingoa i te taketake mā te kotahi pūāhua, ā, i haere tonu te whakaputa i roto i taua wiki anō. I te wā e tuhia ana tēnei, ko te whānuitanga hou ngā taputapu-puka-ts (putanga 1.0.0 ki te 1.1.0), ko tōna ts-kaupapa-lint (1.0.0 me te 1.1.0), me te tūkotahi ts-enum-āwhina (1.0.0) ka taea tonu te tāuta.
Ngā Tohu o te Whakaaetanga
I whakaūtia ngā tohu katoa i raro nei ki te pūtake o te mōkihi.
| momo | tohu | Notes |
|---|---|---|
| Whatunga (C2) | aaronstack[.]com/jules-collect | Kotahi te pūwāhi kohinga puta noa i ia whakatipuranga; ka whiwhi i te telemetry JSON me ngā poraka tarball putunga base64-gzip. |
| Whatunga (māngai SSRF) | http://git@192.168.0.1:8080 | Ko te mua mō tētahi tohu git proxy kua whānuitia e whakamahia ana hei toro atu ki ngā putunga o ngā whakahaere ūnga. |
| Whatunga (kapua) | metadata.google.internal/computeMetadata/v1kubernetes.default.svcstorage.googleapis.com/storage/v1/b | Ka whakamahia anake e te momo hanganga-tātari mō te tahae tohu me te tirotiro i te papa-whakahaere a Kubernetes. |
| tuakiri | google-labs-jules[bot]161369871+google-labs-jules[bot]@users.noreply.github.com | Takahia commit i panaia te tuakiri kaituhi ki roto i ngā peka matua o te hunga i pāngia. |
| kōnae | lib/.perf.dat | He pūmau utunga kua whakamunatia ki te AES-256-CBC; kua rongoatia te IV i roto i ngā paita 16 tuatahi, ā, kua hangaia anō te kī kia hihiri i roto i index.js. |
| kōnae | SECURITY-POC.md | I taka iho, ā, commiti whakahokia ki ngā putunga patunga me te karere chore: update dependency cache. |
| kōnae | scripts/postinstall.sh | Kua āraia $MALYSIS_ANALYSIS_ID; e tautuhi ana i te rerekētanga arotahi-hanganga-tātari. |
| Haehau | os.hostname() ngā tirotiro mō devbox / ubuntu-fc-uvm | Te ārai i te taiao onepū me te AI-agent i mua i te wetewete me te whakatinanatanga o te kawenga. |
| Haehau | .jules/ a /app/.jules ngā pānui whaiaronga | Te arotahi mārama ki ngā taiao mokowā mahi ā-AI. |
| Haehau | sc1-, sc3-, sc4-, s0-vmm-recon | He tapanga wāhanga ine tauwhitiwhiti kua tautuhia e te kaiwhakahaere, he mea whai hua mō te kimi me te hopu. |
| Whāinga kapua | rare-signer-437603-p9malysis-* ngā whakapae pākete | Ko ngā tohu kaupapa GCP kua whakapūmautia me ngā tauira tataunga peere-rokiroki kua whakauruhia ki roto i te momo hanganga tātari. |
| Āhua mōkihi | Te mata o te mōkihi whaipainga TS, kāore he āpure putunga | Tauira pakanga pumau: ngā mōkihi whaipainga TypeScript rūpahu me ngā kawenga kino kua whakauruhia ki roto postinstall hooks tāpirihia rānei ki index.js. |
