Telegram Group & Telegram Channel
🚨 Атака Π½Π° PyPI, npm ΠΈ RubyGems: сотни врСдоносных ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ² Π² ΠΎΡ„ΠΈΡ†ΠΈΠ°Π»ΡŒΠ½Ρ‹Ρ… рССстрах

πŸ” Π˜ΡΡΠ»Π΅Π΄ΠΎΠ²Π°Ρ‚Π΅Π»ΠΈ ΠΎΠ±Π½Π°Ρ€ΡƒΠΆΠΈΠ»ΠΈ ΠΌΠ°ΡΡΠΎΠ²ΡƒΡŽ кампанию ΠΏΠΎ Ρ€Π°Π·ΠΌΠ΅Ρ‰Π΅Π½ΠΈΡŽ врСдоносных Π±ΠΈΠ±Π»ΠΈΠΎΡ‚Π΅ΠΊ Π² популярных экосистСмах:

πŸ§ͺ Π§Ρ‚ΠΎ ΠΏΡ€ΠΎΠΈΠ·ΠΎΡˆΠ»ΠΎ:
β€’ На npm ΠΎΠΏΡƒΠ±Π»ΠΈΠΊΠΎΠ²Π°Π½Ρ‹ Ρ„Π΅ΠΉΠΊΠΎΠ²Ρ‹Π΅ вСрсии Π±ΠΈΠ±Π»ΠΈΠΎΡ‚Π΅ΠΊ Π²Ρ€ΠΎΠ΄Π΅ Hardhat, ΠΊΡ€Π°Π΄ΡƒΡ‰ΠΈΠ΅ ΠΏΡ€ΠΈΠ²Π°Ρ‚Π½Ρ‹Π΅ ΠΊΠ»ΡŽΡ‡ΠΈ ΠΈ .env
β€’ Π’ PyPI появились ΠΊΠ»ΠΎΠ½Ρ‹ requests, urllib3 ΠΈ Π΄Ρ€., с врСдоносными вставками
β€’ Π’ RubyGems β€” Π±ΠΎΠ»Π΅Π΅ 700 ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ², ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΡƒΡŽΡ‰ΠΈΡ… тайпосквоттинг (`activesupportt`, httpartyy ΠΈ Ρ‚.Π΄.)

🎯 ЦСль β€” Ρ€Π°Π·Ρ€Π°Π±ΠΎΡ‚Ρ‡ΠΈΠΊΠΈ. ΠŸΠ°ΠΊΠ΅Ρ‚Ρ‹ ΡΠΎΠ±ΠΈΡ€Π°ΡŽΡ‚:
– ΠΌΠ½Π΅ΠΌΠΎΠ½ΠΈΠΊΠΈ
– ΠΏΡ€ΠΈΠ²Π°Ρ‚Π½Ρ‹Π΅ ΠΊΠ»ΡŽΡ‡ΠΈ
– ΠΊΠΎΠ½Ρ„ΠΈΠ³ΠΈ AWS/GCP
– ΡΠΈΡΡ‚Π΅ΠΌΠ½ΡƒΡŽ ΠΈΠ½Ρ„ΠΎΡ€ΠΌΠ°Ρ†ΠΈΡŽ

πŸ›‘ Π§Ρ‚ΠΎ Π΄Π΅Π»Π°Ρ‚ΡŒ:
– ΠŸΡ€ΠΎΠ²Π΅Ρ€ΡΠΉ названия ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ² (тайпосквоттинг β€” Π³Π»Π°Π²Π½Ρ‹ΠΉ ΠΏΡ€ΠΈΡ‘ΠΌ)
– Запускай pip audit, npm audit, bundler audit
– Π˜ΡΠΏΠΎΠ»ΡŒΠ·ΡƒΠΉ Π²ΠΈΡ€Ρ‚ΡƒΠ°Π»ΡŒΠ½Ρ‹Π΅ окруТСния ΠΈ ΠΌΠΈΠ½ΠΈΠΌΡƒΠΌ ΠΏΡ€Π°Π²
– Подпиши зависимости, Π³Π΄Π΅ это Π²ΠΎΠ·ΠΌΠΎΠΆΠ½ΠΎ (Π½Π°ΠΏΡ€ΠΈΠΌΠ΅Ρ€, Ρ‡Π΅Ρ€Π΅Π· Sigstore)

πŸ“Œ ΠŸΠΎΠ΄Ρ€ΠΎΠ±Π½Π΅Π΅



group-telegram.com/pythonl/4852
Create:
Last Update:

🚨 Атака Π½Π° PyPI, npm ΠΈ RubyGems: сотни врСдоносных ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ² Π² ΠΎΡ„ΠΈΡ†ΠΈΠ°Π»ΡŒΠ½Ρ‹Ρ… рССстрах

πŸ” Π˜ΡΡΠ»Π΅Π΄ΠΎΠ²Π°Ρ‚Π΅Π»ΠΈ ΠΎΠ±Π½Π°Ρ€ΡƒΠΆΠΈΠ»ΠΈ ΠΌΠ°ΡΡΠΎΠ²ΡƒΡŽ кампанию ΠΏΠΎ Ρ€Π°Π·ΠΌΠ΅Ρ‰Π΅Π½ΠΈΡŽ врСдоносных Π±ΠΈΠ±Π»ΠΈΠΎΡ‚Π΅ΠΊ Π² популярных экосистСмах:

πŸ§ͺ Π§Ρ‚ΠΎ ΠΏΡ€ΠΎΠΈΠ·ΠΎΡˆΠ»ΠΎ:
β€’ На npm ΠΎΠΏΡƒΠ±Π»ΠΈΠΊΠΎΠ²Π°Π½Ρ‹ Ρ„Π΅ΠΉΠΊΠΎΠ²Ρ‹Π΅ вСрсии Π±ΠΈΠ±Π»ΠΈΠΎΡ‚Π΅ΠΊ Π²Ρ€ΠΎΠ΄Π΅ Hardhat, ΠΊΡ€Π°Π΄ΡƒΡ‰ΠΈΠ΅ ΠΏΡ€ΠΈΠ²Π°Ρ‚Π½Ρ‹Π΅ ΠΊΠ»ΡŽΡ‡ΠΈ ΠΈ .env
β€’ Π’ PyPI появились ΠΊΠ»ΠΎΠ½Ρ‹ requests, urllib3 ΠΈ Π΄Ρ€., с врСдоносными вставками
β€’ Π’ RubyGems β€” Π±ΠΎΠ»Π΅Π΅ 700 ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ², ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΡƒΡŽΡ‰ΠΈΡ… тайпосквоттинг (`activesupportt`, httpartyy ΠΈ Ρ‚.Π΄.)

🎯 ЦСль β€” Ρ€Π°Π·Ρ€Π°Π±ΠΎΡ‚Ρ‡ΠΈΠΊΠΈ. ΠŸΠ°ΠΊΠ΅Ρ‚Ρ‹ ΡΠΎΠ±ΠΈΡ€Π°ΡŽΡ‚:
– ΠΌΠ½Π΅ΠΌΠΎΠ½ΠΈΠΊΠΈ
– ΠΏΡ€ΠΈΠ²Π°Ρ‚Π½Ρ‹Π΅ ΠΊΠ»ΡŽΡ‡ΠΈ
– ΠΊΠΎΠ½Ρ„ΠΈΠ³ΠΈ AWS/GCP
– ΡΠΈΡΡ‚Π΅ΠΌΠ½ΡƒΡŽ ΠΈΠ½Ρ„ΠΎΡ€ΠΌΠ°Ρ†ΠΈΡŽ

πŸ›‘ Π§Ρ‚ΠΎ Π΄Π΅Π»Π°Ρ‚ΡŒ:
– ΠŸΡ€ΠΎΠ²Π΅Ρ€ΡΠΉ названия ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ² (тайпосквоттинг β€” Π³Π»Π°Π²Π½Ρ‹ΠΉ ΠΏΡ€ΠΈΡ‘ΠΌ)
– Запускай pip audit, npm audit, bundler audit
– Π˜ΡΠΏΠΎΠ»ΡŒΠ·ΡƒΠΉ Π²ΠΈΡ€Ρ‚ΡƒΠ°Π»ΡŒΠ½Ρ‹Π΅ окруТСния ΠΈ ΠΌΠΈΠ½ΠΈΠΌΡƒΠΌ ΠΏΡ€Π°Π²
– Подпиши зависимости, Π³Π΄Π΅ это Π²ΠΎΠ·ΠΌΠΎΠΆΠ½ΠΎ (Π½Π°ΠΏΡ€ΠΈΠΌΠ΅Ρ€, Ρ‡Π΅Ρ€Π΅Π· Sigstore)

πŸ“Œ ΠŸΠΎΠ΄Ρ€ΠΎΠ±Π½Π΅Π΅

BY Python/ django




Share with your friend now:
group-telegram.com/pythonl/4852

View MORE
Open in Telegram


Telegram | DID YOU KNOW?

Date: |

Right now the digital security needs of Russians and Ukrainians are very different, and they lead to very different caveats about how to mitigate the risks associated with using Telegram. For Ukrainians in Ukraine, whose physical safety is at risk because they are in a war zone, digital security is probably not their highest priority. They may value access to news and communication with their loved ones over making sure that all of their communications are encrypted in such a manner that they are indecipherable to Telegram, its employees, or governments with court orders. "He has to start being more proactive and to find a real solution to this situation, not stay in standby without interfering. It's a very irresponsible position from the owner of Telegram," she said. What distinguishes the app from competitors is its use of what's known as channels: Public or private feeds of photos and videos that can be set up by one person or an organization. The channels have become popular with on-the-ground journalists, aid workers and Ukrainian President Volodymyr Zelenskyy, who broadcasts on a Telegram channel. The channels can be followed by an unlimited number of people. Unlike Facebook, Twitter and other popular social networks, there is no advertising on Telegram and the flow of information is not driven by an algorithm. At the start of 2018, the company attempted to launch an Initial Coin Offering (ICO) which would enable it to enable payments (and earn the cash that comes from doing so). The initial signals were promising, especially given Telegram’s user base is already fairly crypto-savvy. It raised an initial tranche of cash – worth more than a billion dollars – to help develop the coin before opening sales to the public. Unfortunately, third-party sales of coins bought in those initial fundraising rounds raised the ire of the SEC, which brought the hammer down on the whole operation. In 2020, officials ordered Telegram to pay a fine of $18.5 million and hand back much of the cash that it had raised. 'Wild West'
from vn


Telegram Python/ django
FROM American