Telegram Group & Telegram Channel
🚨 Атака Π½Π° PyPI, npm ΠΈ RubyGems: сотни врСдоносных ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ² Π² ΠΎΡ„ΠΈΡ†ΠΈΠ°Π»ΡŒΠ½Ρ‹Ρ… рССстрах

πŸ” Π˜ΡΡΠ»Π΅Π΄ΠΎΠ²Π°Ρ‚Π΅Π»ΠΈ ΠΎΠ±Π½Π°Ρ€ΡƒΠΆΠΈΠ»ΠΈ ΠΌΠ°ΡΡΠΎΠ²ΡƒΡŽ кампанию ΠΏΠΎ Ρ€Π°Π·ΠΌΠ΅Ρ‰Π΅Π½ΠΈΡŽ врСдоносных Π±ΠΈΠ±Π»ΠΈΠΎΡ‚Π΅ΠΊ Π² популярных экосистСмах:

πŸ§ͺ Π§Ρ‚ΠΎ ΠΏΡ€ΠΎΠΈΠ·ΠΎΡˆΠ»ΠΎ:
β€’ На npm ΠΎΠΏΡƒΠ±Π»ΠΈΠΊΠΎΠ²Π°Π½Ρ‹ Ρ„Π΅ΠΉΠΊΠΎΠ²Ρ‹Π΅ вСрсии Π±ΠΈΠ±Π»ΠΈΠΎΡ‚Π΅ΠΊ Π²Ρ€ΠΎΠ΄Π΅ Hardhat, ΠΊΡ€Π°Π΄ΡƒΡ‰ΠΈΠ΅ ΠΏΡ€ΠΈΠ²Π°Ρ‚Π½Ρ‹Π΅ ΠΊΠ»ΡŽΡ‡ΠΈ ΠΈ .env
β€’ Π’ PyPI появились ΠΊΠ»ΠΎΠ½Ρ‹ requests, urllib3 ΠΈ Π΄Ρ€., с врСдоносными вставками
β€’ Π’ RubyGems β€” Π±ΠΎΠ»Π΅Π΅ 700 ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ², ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΡƒΡŽΡ‰ΠΈΡ… тайпосквоттинг (`activesupportt`, httpartyy ΠΈ Ρ‚.Π΄.)

🎯 ЦСль β€” Ρ€Π°Π·Ρ€Π°Π±ΠΎΡ‚Ρ‡ΠΈΠΊΠΈ. ΠŸΠ°ΠΊΠ΅Ρ‚Ρ‹ ΡΠΎΠ±ΠΈΡ€Π°ΡŽΡ‚:
– ΠΌΠ½Π΅ΠΌΠΎΠ½ΠΈΠΊΠΈ
– ΠΏΡ€ΠΈΠ²Π°Ρ‚Π½Ρ‹Π΅ ΠΊΠ»ΡŽΡ‡ΠΈ
– ΠΊΠΎΠ½Ρ„ΠΈΠ³ΠΈ AWS/GCP
– ΡΠΈΡΡ‚Π΅ΠΌΠ½ΡƒΡŽ ΠΈΠ½Ρ„ΠΎΡ€ΠΌΠ°Ρ†ΠΈΡŽ

πŸ›‘ Π§Ρ‚ΠΎ Π΄Π΅Π»Π°Ρ‚ΡŒ:
– ΠŸΡ€ΠΎΠ²Π΅Ρ€ΡΠΉ названия ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ² (тайпосквоттинг β€” Π³Π»Π°Π²Π½Ρ‹ΠΉ ΠΏΡ€ΠΈΡ‘ΠΌ)
– Запускай pip audit, npm audit, bundler audit
– Π˜ΡΠΏΠΎΠ»ΡŒΠ·ΡƒΠΉ Π²ΠΈΡ€Ρ‚ΡƒΠ°Π»ΡŒΠ½Ρ‹Π΅ окруТСния ΠΈ ΠΌΠΈΠ½ΠΈΠΌΡƒΠΌ ΠΏΡ€Π°Π²
– Подпиши зависимости, Π³Π΄Π΅ это Π²ΠΎΠ·ΠΌΠΎΠΆΠ½ΠΎ (Π½Π°ΠΏΡ€ΠΈΠΌΠ΅Ρ€, Ρ‡Π΅Ρ€Π΅Π· Sigstore)

πŸ“Œ ΠŸΠΎΠ΄Ρ€ΠΎΠ±Π½Π΅Π΅



group-telegram.com/pythonl/4852
Create:
Last Update:

🚨 Атака Π½Π° PyPI, npm ΠΈ RubyGems: сотни врСдоносных ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ² Π² ΠΎΡ„ΠΈΡ†ΠΈΠ°Π»ΡŒΠ½Ρ‹Ρ… рССстрах

πŸ” Π˜ΡΡΠ»Π΅Π΄ΠΎΠ²Π°Ρ‚Π΅Π»ΠΈ ΠΎΠ±Π½Π°Ρ€ΡƒΠΆΠΈΠ»ΠΈ ΠΌΠ°ΡΡΠΎΠ²ΡƒΡŽ кампанию ΠΏΠΎ Ρ€Π°Π·ΠΌΠ΅Ρ‰Π΅Π½ΠΈΡŽ врСдоносных Π±ΠΈΠ±Π»ΠΈΠΎΡ‚Π΅ΠΊ Π² популярных экосистСмах:

πŸ§ͺ Π§Ρ‚ΠΎ ΠΏΡ€ΠΎΠΈΠ·ΠΎΡˆΠ»ΠΎ:
β€’ На npm ΠΎΠΏΡƒΠ±Π»ΠΈΠΊΠΎΠ²Π°Π½Ρ‹ Ρ„Π΅ΠΉΠΊΠΎΠ²Ρ‹Π΅ вСрсии Π±ΠΈΠ±Π»ΠΈΠΎΡ‚Π΅ΠΊ Π²Ρ€ΠΎΠ΄Π΅ Hardhat, ΠΊΡ€Π°Π΄ΡƒΡ‰ΠΈΠ΅ ΠΏΡ€ΠΈΠ²Π°Ρ‚Π½Ρ‹Π΅ ΠΊΠ»ΡŽΡ‡ΠΈ ΠΈ .env
β€’ Π’ PyPI появились ΠΊΠ»ΠΎΠ½Ρ‹ requests, urllib3 ΠΈ Π΄Ρ€., с врСдоносными вставками
β€’ Π’ RubyGems β€” Π±ΠΎΠ»Π΅Π΅ 700 ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ², ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΡƒΡŽΡ‰ΠΈΡ… тайпосквоттинг (`activesupportt`, httpartyy ΠΈ Ρ‚.Π΄.)

🎯 ЦСль β€” Ρ€Π°Π·Ρ€Π°Π±ΠΎΡ‚Ρ‡ΠΈΠΊΠΈ. ΠŸΠ°ΠΊΠ΅Ρ‚Ρ‹ ΡΠΎΠ±ΠΈΡ€Π°ΡŽΡ‚:
– ΠΌΠ½Π΅ΠΌΠΎΠ½ΠΈΠΊΠΈ
– ΠΏΡ€ΠΈΠ²Π°Ρ‚Π½Ρ‹Π΅ ΠΊΠ»ΡŽΡ‡ΠΈ
– ΠΊΠΎΠ½Ρ„ΠΈΠ³ΠΈ AWS/GCP
– ΡΠΈΡΡ‚Π΅ΠΌΠ½ΡƒΡŽ ΠΈΠ½Ρ„ΠΎΡ€ΠΌΠ°Ρ†ΠΈΡŽ

πŸ›‘ Π§Ρ‚ΠΎ Π΄Π΅Π»Π°Ρ‚ΡŒ:
– ΠŸΡ€ΠΎΠ²Π΅Ρ€ΡΠΉ названия ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ² (тайпосквоттинг β€” Π³Π»Π°Π²Π½Ρ‹ΠΉ ΠΏΡ€ΠΈΡ‘ΠΌ)
– Запускай pip audit, npm audit, bundler audit
– Π˜ΡΠΏΠΎΠ»ΡŒΠ·ΡƒΠΉ Π²ΠΈΡ€Ρ‚ΡƒΠ°Π»ΡŒΠ½Ρ‹Π΅ окруТСния ΠΈ ΠΌΠΈΠ½ΠΈΠΌΡƒΠΌ ΠΏΡ€Π°Π²
– Подпиши зависимости, Π³Π΄Π΅ это Π²ΠΎΠ·ΠΌΠΎΠΆΠ½ΠΎ (Π½Π°ΠΏΡ€ΠΈΠΌΠ΅Ρ€, Ρ‡Π΅Ρ€Π΅Π· Sigstore)

πŸ“Œ ΠŸΠΎΠ΄Ρ€ΠΎΠ±Π½Π΅Π΅

BY Python/ django




Share with your friend now:
group-telegram.com/pythonl/4852

View MORE
Open in Telegram


Telegram | DID YOU KNOW?

Date: |

Pavel Durov, Telegram's CEO, is known as "the Russian Mark Zuckerberg," for co-founding VKontakte, which is Russian for "in touch," a Facebook imitator that became the country's most popular social networking site. One thing that Telegram now offers to all users is the ability to β€œdisappear” messages or set remote deletion deadlines. That enables users to have much more control over how long people can access what you’re sending them. Given that Russian law enforcement officials are reportedly (via Insider) stopping people in the street and demanding to read their text messages, this could be vital to protect individuals from reprisals. In view of this, the regulator has cautioned investors not to rely on such investment tips / advice received through social media platforms. It has also said investors should exercise utmost caution while taking investment decisions while dealing in the securities market. In 2018, Russia banned Telegram although it reversed the prohibition two years later. The company maintains that it cannot act against individual or group chats, which are β€œprivate amongst their participants,” but it will respond to requests in relation to sticker sets, channels and bots which are publicly available. During the invasion of Ukraine, Pavel Durov has wrestled with this issue a lot more prominently than he has before. Channels like Donbass Insider and Bellum Acta, as reported by Foreign Policy, started pumping out pro-Russian propaganda as the invasion began. So much so that the Ukrainian National Security and Defense Council issued a statement labeling which accounts are Russian-backed. Ukrainian officials, in potential violation of the Geneva Convention, have shared imagery of dead and captured Russian soldiers on the platform.
from ar


Telegram Python/ django
FROM American