Yankho lofulumira: Kuukira kwa unyolo wamagetsi wa Npm kumagwira ntchito poika ndalama mu akaunti yodalirika ya woyang'anira kapena CI/CD token, kufalitsa mtundu woyipa wa phukusi lomwe opanga mapulogalamu amalidalira kale, ndikulola zolemba za phukusilo kukhazikitsa kapena logic ya worm kuchita zina zonse. Pakati pa Ogasiti 2025 ndi pakati pa 2026, njira iyi idapanga mafunde akulu kwambiri a npm package supply chain attacks m'mbiri ya registry, kuphatikiza chalk/debug hijack, the Nyongolotsi ya Shai-Hulud, ndi pulogalamu yaumbanda ya dziko lonse yobisika mu phukusi lomwe limatsitsidwa nthawi 100 miliyoni pa sabata. Kukonza si kusanthula khodi ikafika. Ikugwira ma phukusi oipa asanayikidwe ndikuyang'ana pipeline chifukwa cha khalidwe lenileni lomwe zigawenga izi zimagawana.
Kukhazikitsa kulikonse ndi chizindikiro cha kudalirana, ndipo owukira amadziwa izi
Wopanga mapulogalamu akuyendetsa npm kukhazikitsa. Kumbuyo kwa lamulo limodzi limenelo kuli mtengo wodalira womwe uli ndi mazana, nthawi zina zikwizikwi, ambiri a iwo amalembedwa ndi kusamalidwa ndi anthu omwe wopanga mapulogalamu sadzakumana nawo. Palibe amene amawunikanso mtengowo mzere ndi mzere. Palibe amene ali ndi nthawi yochita zimenezo.
Kudalira kumeneko ndiye cholinga. N'kotsika mtengo kuti wowukira apeze munthu mmodzi wosunga ma npm ndi ma download 2.6 biliyoni pa sabata kuposa kupeza zero-day mu firewall ya Fortune 500. Ziwopsezo za Npm supply chain zimagwiritsa ntchito njira yosagwirizana imeneyi, ndipo mafunde a 2025-2026 akuwonetsa momwe ntchitoyo yakulira: kuyambira kusokoneza typosquatting yokha kupita ku mphutsi zodzibalalitsa zokha omwe amafalitsa ma phukusi awoawo oipa mwachangu kuposa momwe munthu aliyense angachitire.
Chomwe chimawerengedwa ngati kuukira kwa npm supply chain
Kuukira kwa npm supply chain ndi chochitika chilichonse chomwe wowukira amaika code yoyipa mu kugawa kwa npm pipeline m'malo molowa mu codebase ya munthu amene akufuna kusokoneza, kotero kuti pulogalamu yaumbanda imabwera ngati yosinthidwa nthawi zonse. Malo olowera nthawi zambiri amakhala chimodzi mwa zinthu zitatu: ziphaso zobedwa za woyang'anira, kusindikiza kobedwa kapena CI/CD chizindikiro, kapena kapangidwe kowonongeka pipeline zomwe zimanyengedwa kuti zifalitsidwe m'malo mwa wowukirayo. Chifukwa ma phukusi a npm amakoka ma transitive dependencies okha, phukusi limodzi lokha lomwe lasokonekera limatha kufikira mapulogalamu omwe sanatchulepo kuti ndi odalira mwachindunji.
Nthawi: ziwopsezo zazikulu kwambiri za npm supply chain za 2025-2026
Kachitidwe kamene kali kumbuyo kwa kuukira kulikonse kwa phukusi la npm
Chotsani mfundo zenizeni, ndipo pafupifupi chochitika chilichonse pamwambapa chimatsatira njira zinayi zomwezo:
- Kunyalanyaza umunthu, osati dongosolo. Wosamalira wachinyengo, chizindikiro cha npm chotuluka, GitHub PAT yobedwa, kapena chizindikiro cha OIDC chochotsedwa CI/CD kukumbukira kwa wothamanga. Wowukirayo saswa kaundula. Amabwereka kiyi ya winawake.
- Sindikizani pansi pa dzina lomwe opanga mapulogalamu amalikhulupirira kale. Palibe chifukwa cholemba zilembo ngati dzina lenileni la phukusi likugwira ntchito. Ichi ndi chomwe chimapangitsa kuti ziwopsezozi zikhale zothandiza kwambiri polimbana ndi zosintha zokha pipelines: zosinthazi zikuwoneka zovomerezeka kwathunthu.
- Yendetsani musanayiwonenso aliyense. Zolemba zoyikira zolakwika, zolipira zobisika, kapena khodi yogona yomwe imagwira ntchito pokhapokha ngati pali zinthu zinazake, imagwira ntchito nthawi yomweyo. npm kukhazikitsa imagwira ntchito, nthawi zambiri pa laputopu ya wopanga mapulogalamu, kale kwambiri isanawonedwe ndi kusanthula kwachitetezo komwe kwakonzedwa.
- Pitirizani ndipo, mochulukira, pitirizani kufalikira. Shai-Hulud ndi mbadwa zake amagwiritsa ntchito ziphaso zomwe amaba kuti afalitse phukusi lotsatira loopsa lokha, zomwe zimapangitsa kuti mgwirizano umodzi ukhale wogwirizana ndi anthu onse.
Chifukwa chake chitetezo chachizolowezi chimaphonya
Zida zambiri za AppSec zinapangidwa kuti ziwunikire zomwe zili kale mu repository: ma CVE odziwika, ma static code patterns, mavuto a layisensi. Izi ndizofunikira, koma zimafika mochedwa kwambiri pa gulu la kuukira ili. Pofika nthawi yomwe scanner ikuwona kudalira, script yoyika ikhoza kukhala itayamba kale kugwira ntchito pa makina opanga mapulogalamu. Antivirus yachikhalidwe ndi EDR amawona makina ogwiritsira ntchito, osati ma package registries, kotero alibe lingaliro la "kutulutsidwa kwatsopano kwa npm" ngati gawo la chiopsezo. Ndipo monga momwe zochitika za TanStack ndi Red Hat zikusonyezera, ngakhale maumboni omanga-integration monga SLSA provenance Musathandize ngati wowukirayo walemba movomerezeka chizindikiro chomwe chamusayina: siginechayo ndi yovomerezeka, phukusili likadali loipa.
Kusiyana komwe kukuchitika pakati pa npm supply chain kukuchitika kumadalira makamaka nthawi yofalitsa ndi nthawi yoyika, pulogalamu yaumbanda isanasainidwe komanso phukusi lisanayende kulikonse komwe scanner yachikhalidwe ingayang'ane.
Momwe mungaletsere kuukira kwa unyolo wotsatira wa npm
Zina mwa izi ndi njira zomwe gulu lililonse la mainjiniya lingagwiritse ntchito masiku ano:
- Kudalira kwa pini ndi commit mafayilo otsekeka, kotero zosintha zokha sizingabweretse mtundu woipa womwe wangofalitsidwa kumene.
- Letsani kapena sandbox postinstall scripts mwachisawawa; ma phukusi ambiri safunika kugwiritsa ntchito ma code osafunikira panthawi yokhazikitsa.
- Kulimbikitsa MFA yothandizidwa ndi hardware pa maakaunti ofalitsa a npm, kutseka njira yeniyeni ya phishing yomwe inasokoneza choko, debug, ndi akaunti ya Qix.
- Kokani ndi kuzungulira CI/CD zizindikiro mwamphamvu, ndipo ganizirani ma tokeni a OIDC mu kukumbukira kwa runner ngati chiphaso choyenera kutetezedwa, osati tsatanetsatane wa kukhazikitsa.
- Yang'anirani mawonekedwe a unlock-inject-relock in CI/CD: lamulo loteteza nthambi lalephera, a commit kukankhidwa, lamuloli layatsidwanso, zonse pawindo lolimba. Ndi chizindikiro chobwerezabwereza cha pipeline-kukwaniritsa mgwirizano wa unyolo wopereka zinthu.
Kumene dongosolo la njira limathera
Kulamulira njira zogwirira ntchito kumachepetsa kufalikira kwa zinthu. Sichigwira phukusi loipa nthawi yomwe chimafalitsidwa, ndipo sichigwira nyongolotsi yomwe ikufalikira kale kudzera mu graph mwachangu kuposa momwe munthu angachitire. Umenewo ndiye gawo lomwe Xygeni's Supply Chain Security imapangidwira.
Xygeni's Chenjezo Loyambirira la MEW (Malware) imasanthula mosalekeza ma phukusi atsopano omwe amafalitsidwa ku npm, PyPI, ndi Maven, kugwira pulogalamu yaumbanda isanasainidwe m'malo moiyika pambuyo pake, ndikubwezeretsa ziwopsezo zotsimikizika Xygeni's injini yodzipezera yokha. Chiwotchi Chozimitsira Moto Imasanthula npm, PyPI, Maven, NuGet, ndi RubyGems nthawi yeniyeni ndipo imatseka ma installation oipa asanafike pa makina a wopanga mapulogalamu kapena pa build. CI/CD kuzindikira zolakwika ulonda pipelines za momwe zinthu zilili kumbuyo kwa zochitika monga mgwirizano wa TanStack, kuphatikizapo ndondomeko ya unlock-inject-relock, yokhala ndi njira yonse yowunikira. Ndipo chifukwa cha Xygeni's Kukonza ndi kukonza zinthu pogwiritsa ntchito AI Ngati mugwiritsanso ntchito zomwe zapezeka kuchokera ku ma scanner a chipani chachitatu, magulu safunika kuchotsa zida zomwe zilipo kuti atseke kusiyana kumeneku.
Mafunso Ofunsidwa Kawirikawiri: Kuukira kwa NPM Supply Chain
Kodi kuukira kwa npm supply chain ndi chiyani?
Ndi kuukira komwe ma code oyipa amafikira pulogalamu yofunidwa kudzera mu npm yodalirika m'malo mwa code ya omwe akufuna, nthawi zambiri chifukwa wowukirayo wawononga akaunti ya wosamalira, chizindikiro chofalitsa, kapena CI/CD pipelineidentity.
Kodi kuukira kwakukulu kwa npm supply chain kunali kotani?
Pogwiritsa ntchito blast radius, pulogalamu ya September 2025 ya chalk/debug hijack ndi imodzi mwa zazikulu kwambiri: Ma phukusi 18 okhala ndi zotsitsa 2.6 biliyoni sabata iliyonse adawonongeka kudzera mu akaunti imodzi yosungira ma phished. Ndi njira yatsopano, Shai-Hulud inali posinthira kwambiri, monga nyongolotsi yoyamba kudzifalitsa m'mbiri ya npm.
Kodi kuukira kwa npm package supply chain nthawi zambiri kumayamba bwanji?
Nthawi zambiri ndi chizindikiro chobedwa: wosamalira wachinyengo, chizindikiro chofalitsa chomwe chatuluka, kapena chobedwa CI/CD chiphaso monga chizindikiro cha OIDC chotengedwa kuchokera mu kukumbukira kwa wothamanga, osati kulowererapo kwaukadaulo ku npm yokha.
Kodi antivayirasi kapena EDR ingaletse kuukira kwa npm supply chain?
Sizodalirika. EDR imayang'anira makina ogwiritsira ntchito ndipo samvetsetsa zolembetsa zama phukusi, ndipo ma antivirus amachokera ku siginecha, zomwe zimalephera kuletsa pulogalamu yaumbanda yofalitsidwa isanasainidwe. Kuyimitsa gulu la ziwopsezo izi kumafuna kuyang'aniridwa pofika pofalitsa ndi kukhazikitsa, osati pofika pomaliza.
Kodi SLSA provenance kapena umboni womanga umaletsa izi?
Zikutsimikizira kuti pipeline Sizinasokonezedwe panthawi yomanga. Sizikutsimikizira kuti dzina lomwe linayambitsa kumangako silinasokonezedwe, monga momwe zochitika za TanStack ndi Red Hat zonse zinasonyezera ndi maumboni ovomerezeka ophatikizidwa ndi mapaketi oipa.
Kodi gulu lingazindikire bwanji phukusi loipa la npm lisanayikidwe?
Mwa kuyendetsa mosalekeza, kusanthula kwa pulogalamu yaumbanda isanasainidwe pa ma phukusi atsopano omwe atulutsidwa, zomwe ndi zomwe dongosolo lochenjeza za pulogalamu yaumbanda ndi pulogalamu yotetezera chitetezo cha deta zimapangidwa kuti zichite, m'malo mongodalira kokha kusanthula kwa ma code omwe ali kale m'malo osungiramo zinthu.
Koyambira
Kuukira kwa ma Npm supply chain sikukuchepa, ndipo mzere wa mafashoni kuyambira pomwe Shai-Hulud akuwonetsa kuti pali automation yambiri, osati zochepa. Magulu omwe ali pamalo abwino kwambiri pa kampeni yotsatira ndi omwe adasiya kuwona kukhazikitsa kulikonse kwa npm ngati chochitika chachizolowezi ndikuyamba kuonera registry, pipeline, ndi mapeto ngati malo amodzi olumikizirana.
Dongosolo la Xygeni's Developer likuphatikizapo MEW ndi Dependency Firewall malo osungiramo zinthu okwana 25 kwaulere. Ndi malo abwino oti muwone zomwe zili kale mumtengo wodalira.
