Ubuthathaka obunye, iphakheji enye enobungozi efihliweyo phakathi kwezigidi, inokubeka emngciphekweni ukhuseleko lwezicelo ezininzi, ibeka emngciphekweni imisebenzi yeshishini kunye nobumfihlo babasebenzisi. Kukule meko inzima apho iqela lethu eXygeni liqalise khona umsebenzi wokhuseleko, lityhila inyani eyoyikwa ngabantu abaninzi kodwa bambalwa abanokuyiqinisekisa: ubukho beephakheji ze-npm ezinobungozi ngaphakathi kwesiseko senkqubo yethu yedijithali.
Ukususela nge-13 ukuya kwi-15 kaJanuwari, ngo-2024, i-Malicious Code Detection scan yethu yangena kwikhuselo lemeko eqhelekileyo, yafumanisa kungekuphela nje iipakeji ezilishumi ze-npm ezifihlakeleyo. Ezi yayingezozenzo zobubi ezingaqhelekanga kodwa yayiziiphulo, nganye yenzelwe ukukhupha idatha eyimfihlo kwiikona ezimnyama ze-intanethi. Olu tyhilelo alukho nje ubizo lokuvuka; lubizo olucacileyo lokuba wonke umntu ochaphazelekayo kwinkqubo yophuhliso lwesoftware athathe inyathelo.
Ngelo xesha, loo mqulu wawusabalulekile. Ngo-2026, awusabonakali. Iinguqulelo zamva nje ze- I-Digest yeKhowudi enobungozi Ukuba ndiqinisekisa iipakeji ezili-100-200+ ze-malware veki nganye kwi-npm kunye ne-PyPI kuphela, eli thuba linye leentsuku ezintathu namhlanje liza kuvela ngokulandelelana okukhulu. Iindlela zokukhupha nokuphepha ezibhalwe ngezantsi azikanyamalala; ziye zaphuhliswa nje ngoshishino ngezinga ekungekho mntu wayelilindele ekuqaleni kuka-2024.
Njengabaqalisi be-cybersecurity, indawo ekhethekileyo yeXygeni isenza singaziboni nje kuphela ezi zisongelo kodwa siqonde nemiphumo yazo nzulu. Le ngxelo ibubungqina bethu commitukhuseleko lokukhusela umda wedijithali wokufumanisa ubungqina obunobungozi kwikhowudi ukuze kuthintelwe ukuguqulwa kohlaselo oluzayo.
Joyina nathi njengoko sihlolisisa iinkcukacha ezintsonkothileyo zale mikhankaso, sityhila iindlela zabahlaseli kwaye, okubaluleke kakhulu, sikhanyise indlela amashishini anokuqinisa ngayo ukhuseleko lwawo kwiingozi ezinjalo ezifihlakeleyo.
Ukufunyanwa kokuqala: Ukwaphulwa kwe-Aurora Webmail Pro
Ukufunyanwa kokuqala kuphando lwethu yayiyiphakheji ebizwa ngokuba yi i-aurora-webmail-pro, eyayilayishwe kwirejista ye-NPM ngumsebenzisi onegama eliyimfihlo 0x379cOku kufunyaniswa kwalandelwa ngokukhawuleza kukuchongwa kweepakeji ezine ezongezelelweyo, zonke zilayishwe ngumbhali omnye ngaphambi kokuba imisebenzi yazo imiswe ngamanyathelo okhuseleko erejistri.
Ezi phakheji ziquka ibhlog_2021@1.1.1, i-heatwallet@10.1.1, newbooking@1.1.1, yaye pecko@1.0.1. Iphakheji nganye, emva kokuhlolwa, ifunyenwe inekhowudi yobubi efana kakhulu nejoliswe ekukhupheni ulwazi oluyimfihlo lomsebenzisi.
Le nkqubo ifumana ulwazi oluyimfihlo lwenkqubo olunxulumene nomsebenzisi kunye nenkqubo kwaye yenze i-hexdump enedatha enjalo. Emva koko idatha iyaphindaphindwa kwaye kwiqhekeza ngalinye, isicelo se-GET senziwa kwisiza sangaphandle, apho indlela efikelelekayo yiyo nganye yeziqwenga ezakhiweyo.
Ukutyhilwa Kwesibini: Amaqhinga Ahlukeneyo Ekusasazekeni Kwekhowudi Enobungozi
Kwangaxeshanye nokufunyanwa kwebhetshi yokuqala, uphando lwethu lutyhile iipakethe ezine ezongezelelweyo ze-NPM, ezisasazwe kwirejistri ngabasebenzisi abathathu abahlukeneyo.
Ezi phakheji, zidweliswe ngolu hlobo nabani na-deps@1.0.0, shoponline.epiroc.com@1.0.1, shoponline.epiroc.com@1.0.2, yaye synology-cft@10.0.0, babelane ngentambo efanayo kwisiseko sabo sekhowudi—nganye yenzelwe ukufunxa ulwazi lomsebenzisi. Okuphawulekayo kukuba, indlela esetyenzisiweyo yokukhupha idatha kwezi meko yahlukile kweyeqela lokuqala, ichaza iphulo elahlukileyo, nangona libi ngokulinganayo.
Icebo lesibini lephulo lalibandakanya indlela ethe ngqo yokuqokelela idatha eyimfihlo. Emva kokuba isebenze, ikhowudi enobungozi kwezi phakheji yaqalisa umsebenzi wokuhlola ngokucokisekileyo, ikhupha ulwazi oluneenkcukacha malunga noqwalaselo lwenkqubo yomsebenzisi, idatha yomntu ngamnye, kwaye ngokukodwa, idilesi ye-IP yenkqubo. Olu qokelelo lwedatha lubanzi lwalujolise ekuqokeleleni idosi epheleleyo kwixhoba, lubeka isiseko sokungenelela okunzulu okanye ukuhlaselwa okujoliswe kuko.
Kubalulekile ukugxininisa ukuba nangona ezi phakheji zinokuthi zibonakale njengenxalenye yemisebenzi yophando lokhuseleko esemthethweni, efana naleyo ijolise ekutyhileni ubuthathaka ngokusebenzisa amaqhinga okudideka kokuxhomekeka, inyani ayitshintshi. Ezi phakheji zinokuyilwa ngenjongo embi, ziqokelele kwaye zidlulisele idatha eyimfihlo kwiindawo zangaphandle ezingagunyaziswanga.
Isilumkiso Esikhethekileyo: I-DJs13-fetcher Anomaly kunye Neempembelelo Zayo kuKhuseleko lweIntanethi
Phakathi kokuphononongwa kweepakeji ezikhankanyiweyo apha ngasentla, iqonga lethu liphawule enye into engaqhelekanga: ipakeji ebizwa ngokuba yi i-djs13-fetcherOlu fumaniso lukhethekileyo lwahlukile kwiziganeko zangaphambili, kungekuphela nje kwindlela olusebenza ngayo kodwa nakwimeko yobungozi oluyibangelayo. i-djs13-fetcher ichongiwe njengokuqalisa ukhuphelo kunye nolandelelwano lokwenziwa kwesincamathiselo esivela kwiDiscord, ngakumbi ifayile yebhinari ebizwa ngokuba yi astroia.exeEmva kokuhlolwa ngokusondeleyo ngenkonzo yohlalutyo oluzenzekelayo, le bhayinari ifumene i Amanqaku Osongo angama-85/100, uhlalutyo oluyichaza ngokucacileyo njenge-malware.
Ukusebenza kwe-djs13-fetcher kunye nokusetyenziswa okulandelayo kwe-astroia.exe kugxininisa i-vector yosongelo enobuchule neneenkalo ezininzi. I-binary ekubhekiswa kuyo yenzelwe ukwenza uthotho lwezenzo ezibonisa injongo embi enzulu:
- Iinkqubo zeNkqubo yokuQala: I-malware iqalisa iinkqubo ezininzi zenkqubo xa isetyenziswa, indlela edla ngokusetyenziswa ukwenza ezinye izikripthi ezinobungozi okanye ukuseka indawo kwinkqubo eyosulelekileyo ukuze ilayishe imithwalo eyongezelelweyo.
- Ulwazi lweNkqubo yokuBuza: Iqhuba imibuzo emininzi yolwazi lwenkqubo. Esi senzo sihlala sijolise ekuqokeleleni ulwazi malunga nemeko-bume yenkqubo, olunokusetyenziselwa ukulungisa uhlaselo olulandelayo ukuze luhambelane nobuthathaka obuthile benkqubo.
- Ukwenza iiNgcinga Ezingaphephekiyo: Mhlawumbi okubaluleke kakhulu, i-astroia.exe yenzelwe ukwenza imibuzo yeWindows Management Instrumentation (WMI) ukufumanisa ukuba isebenza ngaphakathi komatshini obonakalayo (VM). Olu hlobo lokuziphatha luyindlela ecacileyo yokuphepha ukubhaqwa nohlalutyo ziingcali zokhuseleko lwe-cyber kunye neenkqubo ezizenzekelayo ezisebenzisa ii-VM rhoqo kuhlalutyo lwe-malware.
Ukuthatha okuphambili
Ukufunyanwa kwezi phakheji ze-npm ezili-10 ezinobuqhophololo, kunye netyala elikhethekileyo le-djs13-fetcher, yayiluphawu lokuqala lwendlela ethe yanda kakhulu ukusuka ngoko eyayilindelwe ngumntu wonke ngoJanuwari 2024.
Le nyaniso yagxininisa, nangona kunjalo, indima ebalulekileyo Inkonzo Yesilumkiso Sakwangoko saseXygeni. Yenzelwe ukuhlalutya nokulumkisa ngemingcipheko enokubakho kwiiphakheji ezintsha ze-npm kwangoko nje ukuba zipapashwe, inkonzo yethu imele inyathelo elikhulu phambili ekukhuseleni ukhuseleko lwe-cyber ngelo xesha, kwaye ingqiqo yayo yaba yimfuneko ngakumbi njengoko umthamo ukhula. Ngokubonelela ngokuchongwa kwangoko kwemiqondiso ebonisa ububi, ngaphambi kokuba standard iinkqubo, sixhobisa abathengi bethu ukuba bakhusele iinkqubo zabo zesoftware ekungeneni kwe-malware ngaphambi kokuba ibangele ingozi. Olu hlobo lokuchonga ngoku luqhubeka ngokuqhubekayo: bona iziphumo eziqinisekisiweyo zale veki kwi- I-Digest yeKhowudi enobungozi.
Imibutho kufuneka ibeke phambili ukuphunyezwa kweenkqubo zokhuseleko eziqinileyo, ukusuka kuhlolo lwekhowudi oluqhelekileyo ukuya kwizixhobo zokufumanisa ezintsonkothileyo, ukukhusela amaqhinga antsonkothileyo asetyenziswa ziintshaba ze-intanethi. I-Xygeni, sihlala commitSizimisele ukukhokela eli dabi liqhubekayo, sixhobisa amaqabane ethu kunye noluntu ngokubanzi ngolwazi nezixhobo ezifunekayo ukuzikhusela kwezi zisongelo zifihlakeleyo.
FAQ
Ngaba iipakeji ze-npm ezinobungozi zisengxaki ekhulayo ngo-2026?
Ewe, ngokubalulekileyo. Le posi ibhale iipakeji ezili-10 ze-npm ezinobungozi ezifunyenwe kwiintsuku ezintathu ngoJanuwari 2024. I-Malicious Code Digest yeXygeni ngoku iqinisekisa iipakeji ezili-100-200+ ze-malicious veki nganye kwi-npm nakwi-PyPI, ubungqina bokuba amaqhinga okukhupha nokuphepha achazwe apha akhule kakhulu endaweni yokuba anyamalale.
Ndingajonga njani ukuba iphakheji ye-npm ayinabungozi ngaphambi kokuyifaka?
Qinisekisa imbali yomgcini-zincwadi, jonga imihla yokupapasha kunye nokubalwa kokukhuphela ukuze ubone izinto ezingaqhelekanga, kwaye usebenzise ukuskena okuzenzakalelayo okubonisa iipatheni zokuphuma kunye nokuziphatha okubalekayo, kungekuphela nje ukufana kwe-CVE eyaziwayo, kuba uninzi lweepakethe ezinobubi, kuquka zonke ezili-10 ezikhankanyiweyo apha, zazintsha ngexesha lokufunyanwa kwazo.
Ndingajonga njani ukuba iphakheji ye-npm ayinabungozi ngaphambi kokuyifaka?
Qinisekisa imbali yomgcini-zincwadi, jonga imihla yokupapasha kunye nokubalwa kokukhuphela ukuze ubone izinto ezingaqhelekanga, kwaye usebenzise ukuskena okuzenzakalelayo okubonisa iipatheni zokuphuma kunye nokuziphatha okubalekayo, kungekuphela nje ukufana kwe-CVE eyaziwayo, kuba uninzi lweepakethe ezinobubi ezifana nezo zikule ngxelo zazintsha ngexesha lokufunyanwa.
Ngaba iipakeji ezintsha ze-npm ezinobungozi zisafunyanwa rhoqo?
Ewe. IXygeni's I-Digest yeKhowudi enobungozi ipapasha iipakeji ezisandula ukuqinisekiswa ze-npm kunye ne-PyPI rhoqo ngeveki; iindlela zokukhupha kunye nokuphepha i-VM ezibhalwe kule ngxelo ka-2024 zisaqhelekile kwiipakeji ezifunyenweyo namhlanje.
