Kusava netariro kumwe chete, pasuru imwe chete ine utsinye yakavanzwa pakati pemamiriyoni evanhu, inogona kukanganisa kuchengetedzeka kwemapurogiramu akawanda, zvichiisa panjodzi mashandiro ebhizinesi uye kuvanzika kwevashandisi. Ndimo mune iyi mamiriro asina kugadzikana apo timu yedu yeXygeni yakatanga chirongwa chekuchengetedza, ichiburitsa chokwadi chakaoma icho vazhinji vaitya asi vashoma vaigona kusimbisa: kuvapo kwemapakeji ane utsinye eNpm mukati memusana wenzvimbo yedu yedhijitari.
Kubva musi wa13 Ndira kusvika 15, 2024, scan yedu yeMalicious Code Detection yakaburitsa pachena mamiriro ezvinhu, ikawana kwete rimwe chete, asi mapakeji gumi ehusiku. Aya akanga asiri mabasa ekusaziva asi mapurojekiti, rimwe nerimwe rakagadzirirwa kuburitsa ruzivo rwakavanzika kumakona erima einternet. Kuzivisa uku hakusi kungomutsa vanhu; asi kudana pachena kuti munhu wese ane chekuita nekugadzira software aite chimwe chinhu.
Panguva iyoyo, bhuku iroro rakanga richiri kuzivikanwa. Muna 2026, harisisiri kuzivikanwa. Zvinyorwa zvedu zvechangobva kuitika Kuongororwa kweMakodhi Akaipa Kana zvikaonekwa kuti mapurogiramu ekurwisa ane 100-200+ pavhiki panpm nePyPI chete, iyi hwindo remazuva matatu nhasi ringangoonekwa zvakanyanya. Maitiro ekubvisa nekunzvenga akanyorwa pazasi haana kunyangarika; angove maindasitiri padanho risingatarisirwi nevanhu kutanga kwa2024.
Sevanhu vekutanga mukuchengetedza cybersecurity, nzvimbo yakasarudzika yeXygeni inotibvumira kwete kungoona njodzi idzi chete asiwo kunzwisisa zvadzinoreva zvakadzama. Mushumo uyu unoratidza kuti tiri commitKuchengetedza muganhu wedhijitari wekuona humbowo hune hutsinye mukodhi kudzivirira kushandurwa mukurwisa kunotevera.
Tibatanei patinoongorora zvakadzama zvemishandirapamwe iyi, tichitsanangura nzira dzevanorwisa uye, chinonyanya kukosha, tichijekesa kuti mabhizinesi angasimbisa sei dziviriro yavo kubva mukutyisidzira kwakadaro.
Kuwanikwa Kwekutanga: Kuputswa kweAurora Webmail Pro
Kuwanikwa kwekutanga mukuferefeta kwedu kwaive package inonzi aurora-webmail-pro, iyo yakaiswa kuNPM registry nemushandisi ane zita rekuti 0x379cKuwanikwa uku kwakakurumidza kuteverwa nekuzivikanwa kwemapakeji mana ekuwedzera, ese akaiswa nemunyori mumwe chete mabasa avo asati amiswa nematanho ekuchengetedza erejistra.
Mapakeji aya aisanganisira blog_2021@1.1.1, heatwallet@10.1.1, newbooking@1.1.1, uye pecko@1.0.1Pakaongororwa, pakawanikwa kuti pasuru yega yega ine kodhi yakaipa yakafanana nechinangwa chekuburitsa ruzivo rwevashandisi rwakavanzika.
Purogiramu iyi inotora ruzivo rwese rwesystem rwunoenderana nemushandisi uye system uye inogadzira hexdump ine data rakadaro. Zvadaro data rinodzokororwa uye pachikamu chimwe nechimwe, chikumbiro cheGET chinoitwa kune imwe saiti yekunze, uko nzira inowanikwa iri chimwe nechimwe chezvidimbu zvakavakwa.
Kufumurwa Kwechipiri: Matekiniki Akasiyana-siyana muKupararira kweMakodhi Akaipa
Panguva imwe chete nekuwanikwa kwechikwata chekutanga, kuferefeta kwedu kwakaratidza mamwe mapakeji mana eNPM, akagoverwa murejista yese nevashandisi vatatu vakasiyana.
Mapakeji aya, akanyorwa se chero ani zvake-deps@1.0.0, shoponline.epiroc.com@1.0.1, shoponline.epiroc.com@1.0.2, uye synology-cft@10.0.0, vaigovana tambo yakafanana mu codebase yavo—imwe neimwe yakagadzirwa kuti ibvise ruzivo rwemushandisi. Zvinonyanya kukosha kuti nzira yakashandiswa pakusefa data muzviitiko izvi yakasiyana neyeboka rekutanga, zvichiratidza mushandirapamwe wakasiyana, kunyange zvazvo wakaipa zvakaenzana.
Nzira yechipiri yemushandirapamwe uyu yaisanganisira nzira yakananga yekuunganidza data rakavanzika. Mushure mekushanda, kodhi yakaipa iri mumapakeji aya yakatanga basa guru rekuongorora, ichitora ruzivo rwakadzama nezvemagadzirirwo esystem yemushandisi, data remushandisi wega, uye zvakanyanya, kero yeIP yesystem. Kuunganidzwa uku kwakazara kwedata kwaive nechinangwa chekuunganidza faira rakazara pamusoro pemunhu akabatwa, kugadzira nzira yekupinda kwakadzika kana kurwiswa kwakanangana.
Zvakakosha kusimbisa kuti kunyangwe paine mukana wekuti mapakeji aya aratidzike sechikamu chezviitiko zvekutsvaga zvekuchengetedza zviri pamutemo, zvakaita seizvo zvinovavarira kuburitsa pachena kusasimba kuburikidza nemaitiro eDependency Confusion, chokwadi hachina kuchinja. Mapakeji aya anogona kugadzirwa nechinangwa chakaipa, achiunganidza nekutumira ruzivo rwakavanzika kune masangano ekunze asina mvumo.
Yambiro Yakakosha: Kusarongeka kweDJs13-fetcher uye Zvazvinoreva paKuchengetedzwa Kwemakombiyuta
Pakati pekuongororwa kwemapakeji ataurwa pamusoro apa, puratifomu yedu yakaratidza chimwe chinhu chisina kujairika: pakeji inonzi djs13-fetcherKuwanikwa uku kwakasiyana nezvakaitika kare, kwete chete mukushanda kwayo asiwo mungozi yainokonzera. djs13-fetcher yakaonekwa seyakatanga kurodha pasi uye kutevedzana kwechinhu chakabatanidzwa kubva kuDiscord, kunyanya faira re binary rainzi astroia.exeMushure mekunyatsoongorora kuburikidza nebasa rekuongorora otomatiki, iyi binary yakawana a Chibodzwa cheNjodzi che85/100, chiyero chinoiisa muchikamu chayo se malware.
Kushanda kwedjs13-fetcher uye kuteverwa kweastroia.exe zvinoratidza nzira yekutyisidzira ine mativi akawanda. Binary iri kutaurwa nezvayo yakagadzirirwa kuita zviito zvakasiyana-siyana zvinoratidza chinangwa chezvakaipa chakadzama:
- Maitiro eSisitimu yeKubereka Vana: Malware iyi inotanga maitiro akawanda ehurongwa painoshandiswa, nzira inowanzo shandiswa kuita mamwe manyorerwo ane hukasha kana kuti kuisa nzvimbo pahurongwa hwacho kuti huwedzere kubhadharwa.
- Kubvunza Ruzivo rweSisitimu: Inoita mibvunzo yakawanda yeruzivo rwesisitimu. Chiito ichi chinowanzo shandiswa kuunganidza ruzivo pamusoro penzvimbo yesisitimu, iyo inogona kushandiswa kugadzirisa kurwiswa kunotevera kunoenderana nekusasimba kwesisitimu.
- Kuita Maneuvers Anonzvenga: Zvichida chinonyanya kukosha ndechekuti astroia.exe yakagadzirirwa kuita mibvunzo yeWindows Management Instrumentation (WMI) kuti ione kana iri kushanda mukati memuchina wevirtual (VM). Maitiro aya chiito chakajeka chekunzvenga, chakagadzirirwa kudzivirira kuonekwa nekuongorora nenyanzvi dzekuchengetedza cyber uye masisitimu anoshanda otomatiki anowanzo shandisa maVM pakuongorora malware.
Key tora kutora
Kuwanikwa kwemapakeji aya gumi e-npm ane njodzi, pamwe chete nechiitiko chakakosha chedjs13-fetcher, kwaive chiratidzo chekutanga chemaitiro ayo kubvira ipapo akawedzera kupfuura zvaitarisirwa nemunhu wese muna Ndira 2024.
Chokwadi ichi chakasimbisa, kunyangwe panguva iyoyo, basa rinokosha re Basa reKunyevera Kwekutanga reXygeniYakagadzirwa kuti iongorore uye inyevere nezvenjodzi dzinogona kuitika mumapakeji matsva e-npm kana angoburitswa, sevhisi yedu yakaratidza danho rakakura mukudzivirira kuchengetedzwa kwepamhepo panguva iyoyo, uye pfungwa dzayo dzakawedzera kukosha sezvo huwandu hwacho hwaiwedzera. Nekupa ruzivo rwekutanga rwezviratidzo zvinoratidza huipi, nguva refu isati yasvika. standard maitiro, tinopa vatengi vedu simba rekudzivirira nharaunda dzavo dzesoftware kubva pakupindwa kwemalware asati akonzera kukuvara. Rudzi urwu rwekuona ikozvino rwuri kuramba ruchienderera mberi: ona zvakawanikwa zvakasimbiswa vhiki rino mudura redu Kuongororwa kweMakodhi Akaipa.
Masangano anofanirwa kukoshesa kuiswa kwemitemo yakasimba yekuchengetedza, kubva pakuongorora makodhi nguva dzose kusvika kumidziyo yekuona yakaoma, kudzivirira kubva kumaitiro akaomarara anoshandiswa nevavengi vepaindaneti. Xygeni, tinoramba tiri commitTakazvipira kutungamira muhondo iyi iri kuenderera mberi, tichipa vatinoshanda navo pamwe nenharaunda yese ruzivo nezvishandiso zvinodiwa kudzivirira njodzi idzi.
FAQ
Mapakeji eNpm ane hutsinye achiri dambudziko riri kukura here muna 2026?
Ehe, zvakakosha. Chinyorwa ichi chakanyora mapakeji gumi e-npm ane njodzi akawanikwa kwemazuva matatu muna Ndira 2024. Xygeni's Malicious Code Digest ikozvino inosimbisa mapakeji ane njodzi anopfuura 100-200 vhiki rega rega munpm nePyPI, humbowo hwekuti nzira dzekubuditsa nekunzvenga dzakaonekwa pano dzawedzera zvakanyanya pane kunyangarika.
Ndingatarisa sei kana npm package ine hutsinye ndisati ndaiisa?
Simbisa nhoroondo yemuchengeti, tarisa mazuva ekuburitsa uye huwandu hwemadhawunirodha kuti uone kana paine zvisina kunaka, uye shandisa otomatiki scanning inoratidza maitiro ekubvisa uye maitiro ekudzivirira, kwete maCVE akajairika chete, sezvo akawanda mapakeji ane hukasha, kusanganisira ese gumi ataurwa pano, aive matsva panguva yekuwanikwa kwedata.
Ndingatarisa sei kana npm package ine hutsinye ndisati ndaiisa?
Simbisa nhoroondo yemuchengeti, tarisa mazuva ekuburitsa uye huwandu hwemadhawunirodha kuti uone kana paine zvisina kunaka, uye shandisa otomatiki scanning inoratidza maitiro ekubvisa uye maitiro ekudzivirira, kwete kungoenderana chete neCVE, sezvo akawanda mapakeji ane hukasha seari mumushumo uyu aive matsva panguva yekuwanikwa kwawo.
Mapakeji matsva e-npm ane hutsinye achiri kuwanikwa nguva dzose here?
Ehe. Xygeni's Kuongororwa kweMakodhi Akaipa inoburitsa mapakeji matsva akasimbiswa e-npm nePyPI vhiki rega rega; nzira dzekubuditsa nekubvisa ma VM dzakanyorwa mumushumo uyu wa2024 dzichiri kushandiswa mumapakeji akawanikwa nhasi.
