[B! npm] rryuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

rryu id:rryu

npmã«é–¢ã™ã‚‹rryuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

â€˜-â€˜ ã¨ã„ã†åå‰ã®ã€ä¸èº«ãŒç„¡ã„ã®ã«70ä¸‡å›žãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã•ã‚Œã¦ã‚‹è¬Žã®npmãƒ‘ãƒƒã‚±ãƒ¼ã‚¸
â€“ ã¨ã„ã†åå‰ã® JavaScript/TypeScript ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã«ã¤ã„ã¦è¦å‘Šã‚’ç™ºã—ã¦ã„ã‚‹è¨˜äº‹ãŒè©±é¡Œã¨ãªã£ã¦ã„ã¾ã™ã€‚ ã“ã®ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã€ä¸èº«ã¯ã»ã¨ã‚“ã©ç©ºã§ã€Readme ã¨ã€dev ã§ TypeScript ã‚’å‹•ã‹ã›ã‚‹ã‚ˆã†ã«ã™ã‚‹ãƒ©ã‚¤ãƒ–ãƒ©ãƒªç¾¤ã‚’å‘¼ã¶ç®‡æ‰€ã ã‘ã®ã‚‚ã®ã€‚ ã—ã‹ã—ã€ã“ã® â€œ-â€ ã‚’ä½¿ã£ã¦ã„ã‚‹ä»–ã® npm ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ãŒ 50å€‹ä»¥ä¸Šã‚ã‚Šã€ç´„ä¸€å¹´å‰ã®å…¬é–‹æ™‚ã‹ã‚‰ã®ãƒˆãƒ¼ã‚¿ãƒ«ã®ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰æ•°ã¯72ä¸‡å›žã«ã‚‚ãªã‚Šã¾ã™ã€‚ ã—ã‹ã—ã€â€-â€ ã‚’èªã¿è¾¼ã‚“ã§ã„ã‚‹ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã‚’è¦‹ã¦ã¿ã¦ã‚‚ã€â€-â€ ãŒå¿…è¦ãã†ã«ã¯è¦‹ãˆã¾ã›ã‚“ã€‚ è¦å‘Šè¨˜äº‹ã§ã¯ã€ã“ã®ç„¡åã®ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ãŒå¯†ã‹ã«ä½¿ã‚ã‚Œã‚‹ã‚ˆã†ã«ãªã£ãŸåŽŸå› ãŒã€npm ã‚³ãƒžãƒ³ãƒ‰ã®ã‚³ãƒžãƒ³ãƒ‰ãƒ©ã‚¤ãƒ³ã‚’æ‰“ã¤ã¨ãã®ãƒŸã‚¹ã‚¿ã‚¤ãƒ—ã«ã‚ã‚‹ã®ã§ã¯ãªã„ã‹ã¨ã®ä»®èª¬ã‚’ç«‹ã¦ã¦ã„ã¾ã™ã€‚ ã¤ã¾ã‚Šã€someFlag ã¨ã„ã†ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã‚’ä½¿ã„ npm i -someFlag somepackage ã¨æ‰“ã¤ã¹ãã¨ã“ã‚
rryu 2021/08/04
ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã€Œ-ã€ãŒç„¡ã„ã¨ã„ã†è¬Žã®ã‚¨ãƒ©ãƒ¼ã«å¯¾ã—ã¦ã€Œ-ã€ã¨ã„ã†ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã‚’ä½œã‚‹ã“ã¨ã§è§£æ±ºã—ãŸã¨ã„ã†å¯èƒ½æ€§ã‚‚â€¦

npm
ãƒªãƒ³ã‚¯
2018/11/27ã«åˆ¤æ˜Žã—ãŸnpmãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ä¹—ã£å–ã‚Šã«ã¤ã„ã¦ - Qiita
æ¦‚è¦ event-streamã¨ã„ã†npmãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã«æ”»æ’ƒã‚³ãƒ¼ãƒ‰ãŒæ··å…¥ã•ã‚Œã¾ã—ãŸã€‚æ”»æ’ƒã‚³ãƒ¼ãƒ‰ã¯flatmap-streamã¨ã„ã†ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã«å«ã¾ã‚Œã¦ãŠã‚Šã€event-stream ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã¯ã“ã® flatmap-stream ã¸ã®ä¾å˜æ€§ã‚’è¿½åŠ ã•ã‚Œã‚‹å½¢ã§é–“æŽ¥çš„ã«æ”»æ’ƒã‚³ãƒ¼ãƒ‰ã®å®Ÿè¡Œã‚’è¡Œã†çŠ¶æ…‹ã«ãªã£ã¦ã„ã¾ã—ãŸã€‚ æ”»æ’ƒã‚³ãƒ¼ãƒ‰ãŒåˆ†æžã•ã‚ŒãŸçµæžœã€copayã¨ã„ã†Bitcoinã‚¦ã‚©ãƒ¬ãƒƒãƒˆã‹ã‚‰ã‚¯ãƒ¬ãƒ‡ãƒ³ã‚·ãƒ£ãƒ«ã‚’ç›—ã‚€ã“ã¨ã‚’ç›®çš„ã¨ã•ã‚Œã¦ã„ãŸã“ã¨ãŒç¢ºèªã•ã‚Œã¦ã„ã¾ã™ã€‚ å‚è€ƒãƒªãƒ³ã‚¯ èª¿æŸ»ãŒè¡Œã‚ã‚Œã¦ã„ã‚‹GitHub Issue HackerNewsã‚¹ãƒ¬ãƒƒãƒ‰ Details about the event-stream incident - The npm Blog å½±éŸ¿ã‚’ã†ã‘ãŸãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ [email protected] flatm [email protected] flatm [email protected] ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸
rryu 2018/11/27
event-streamã®ä½œè€…ãŒãƒ¡ãƒ³ãƒ†æ”¾ç½®ã—ã¦ã„ã‚‹æ™‚ã«å¼•ãç¶™ã„ã§ãã‚Œã‚‹äººãŒæ¥ãŸã¨æ€ã£ãŸã‚‰ãã‚ŒãŒæ‚ªæ„ã‚ã‚‹äººã ã£ãŸã¨ã„ã†æ„Ÿã˜ã‚‰ã—ã„ã€‚ãƒ¡ãƒ³ãƒ†ãƒŠãŒå¤‰ã‚ã£ãŸã‚‰åˆ¥ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸æ‰±ã„ã«ã™ã¹ããªæ°—ãŒã™ã‚‹ã€‚

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

npm
ãƒªãƒ³ã‚¯
2018/07/12 ã«ç™ºç”Ÿã—ãŸã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆ ([email protected]) ã«ã¤ã„ã¦ - Qiita
2018 å¹´ 7 æœˆ 12 æ—¥ã«ã€ESLint é–‹ç™ºãƒãƒ¼ãƒ ãŒç®¡ç†ã™ã‚‹ npm ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã«æ‚ªæ„ã‚ã‚‹ã‚³ãƒ¼ãƒ‰ãŒæŒ¿å…¥ã•ã‚Œã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆãŒã‚ã‚Šã¾ã—ãŸã€‚ ESLint ã‹ã‚‰ã®ã‚¢ãƒŠã‚¦ãƒ³ã‚¹: https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes npm ã‹ã‚‰ã®ã‚¢ãƒŠã‚¦ãƒ³ã‚¹: https://status.npmjs.org/incidents/dn7c1fgrr7ng ä»¥ä¸‹ã®å ´åˆã« npm install ã‚’å®Ÿè¡Œã—ãŸãƒ¦ãƒ¼ã‚¶ãƒ¼ã® npm ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã¸ã®ãƒã‚°ã‚¤ãƒ³æƒ…å ± (ã‚¢ã‚¯ã‚»ã‚¹ãƒˆãƒ¼ã‚¯ãƒ³) ãŒç›—ã¾ã‚ŒãŸæã‚ŒãŒã‚ã‚Šã¾ã™ (ç›—ã¾ã‚ŒãŸã‚¢ã‚¯ã‚»ã‚¹ãƒˆãƒ¼ã‚¯ãƒ³ã¯ã™ã§ã«ç„¡åŠ¹åŒ–ã•ã‚Œã¦ã„ã¾ã™)ã€‚ æ—¥æœ¬æ™‚é–“ã® 18:49 ã‹ã‚‰ 19:25 ã®ç´„ 1 æ™‚é–“ã®ã‚ã„ã ã« npm install ã‚’å®Ÿè¡Œã—ã€eslint-config-e
rryu 2018/07/13
å®Ÿè¡Œæ™‚ã«ã‚¨ãƒ©ãƒ¼ã«ãªã£ã¦ç™ºè¦šã—ãŸã¨ã„ã†ã“ã¨ã¯æ–°ã—ã„ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚’ãƒªãƒªãƒ¼ã‚¹ã—ã¦ã‚‚ãƒ¡ãƒ³ãƒ†ãƒŠã®äººã¯æ°—ã¥ã‘ãªã„ã®ã‹â€¦

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

npm
ãƒªãƒ³ã‚¯
npmjs.com ã§è‘—åã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã«ã‚ˆãä¼¼ãŸåå‰ã®ãƒžãƒ«ã‚¦ã‚§ã‚¢ãŒå¤§é‡ã«ç™ºè¦‹ã•ã‚ŒãŸ - Islands in the byte stream
Malicious packages in npm. Hereâ€™s what to do | Ivan Akulovâ€™s blog People found malicious packages in npm that work like real ones, are named similarly real ones, but collect and send your process environment to a third-party server when you install them è¨³: æ‚ªæ„ã®ã‚ã‚‹ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ãŒnpmã§ç™ºè¦‹ã•ã‚ŒãŸã€‚ãã‚Œã‚‰ã¯ã€å®Ÿéš›ã®ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã«ã‚ˆãä¼¼ãŸåå‰ã§åŒã˜ã‚ˆã†ã«å‹•ããŒã€ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«æ™‚ã«ãƒ—ãƒã‚»ã‚¹ã®ç’°å¢ƒå¤‰æ•°ã‚’å¤–éƒ¨ã®ã‚µãƒ¼ãƒã«é€ä¿¡ã™ã‚‹ã€‚ ç™ºè¦‹ã•ã‚ŒãŸãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã®ä¸€è¦§ã¯å…ƒã‚¨ãƒ³ãƒˆãƒªã‚’ã©ã†ãžã€‚ã“ã®ã‚ˆã†ãªãƒžãƒ«ã‚¦ã‚§ã‚¢ã§ã‚ã‚‹å½ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã®ä¸€ä¾‹ã‚’ã‚ã’ã‚‹ã¨ã€ ba
rryu 2017/08/02
é‚ã«ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ç•Œã«ã‚‚ãƒžãƒ«ã‚¦ã‚§ã‚¢ãŒâ€¦â€¦

npm

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
npmã€ä¸€è¦‹ç„¡æ„å‘³ãªãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã‚’æ¶ˆã—ãŸã‚‰1000ä»¶ã‚‚ã®ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ãŒä¾å˜ã™ã‚‹ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã§ã‚ã£ãŸã“ã¨ãŒåˆ¤æ˜Ž
npmã€ä¸€è¦‹ç„¡æ„å‘³ãªãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã‚’æ¶ˆã—ãŸã‚‰1000ä»¶ã‚‚ã®ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ãŒä¾å˜ã™ã‚‹ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã§ã‚ã£ãŸã“ã¨ãŒåˆ¤æ˜Ž npmãŒä¸€è¦‹ç„¡æ„å‘³ã«æ€ãˆã‚‹fsã¨ã„ã†ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã‚’SPAMã¨ã¿ãªã—ã¦å‰Šé™¤ã—ãŸã¨ã“ã‚ã€1000ä»¶ã»ã©ã®ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ãŒä¾å˜ã™ã‚‹ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã ã£ãŸã®ã§ã€å‰Šé™¤ã‚’å–ã‚Šæ¶ˆã—ãŸã€‚ npm, Inc. Status - "fs" unpublished and restored ä»Šæ—¥ã€æ•°åˆ†ã»ã©ã€"fs"ã¨ã„ã†ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ãŒã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‹ã‚‰SPAMã§ã‚ã‚‹ã¨ã„ã†å ±å‘Šã‚’å—ã‘ã¦ã€ãƒ¬ã‚¸ã‚¹ãƒˆãƒªã‹ã‚‰éžå…¬é–‹ã«ã•ã‚ŒãŸã€‚ã“ã‚Œã¯ç¾åœ¨å¾©æ—§ã•ã‚Œã¦ã„ã‚‹ã€‚ã“ã‚Œã¯ç§(@seldo)ã«ã‚ˆã‚‹äººç‚ºçš„ãªãƒŸã‚¹ã§ã‚ã‚‹ã€‚ç§ã¯éžå…¬é–‹ãŒå®‰å…¨ã§ã‚ã‚‹ã‹ã‚’ç¢ºèªã™ã‚‹å†…éƒ¨ã®ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã«å¾“ã£ã¦ã„ãªã‹ã£ãŸã€‚ãƒ“ãƒ«ãƒ‰ãŒé˜»å®³ã•ã‚ŒãŸãƒ¦ãƒ¼ã‚¶ãƒ¼ã«è¬ç½ªã™ã‚‹ã€‚ è©³ç´°ï¼š"fs"ã¨ã„ã†ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã¯ã€ç„¡æ„å‘³ãªãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã§ã‚ã‚‹ã€‚ã“ã‚Œã¯å˜ã«"I am fs"ã‚’ãƒã‚°ã«æ®‹ã—ã¦çµ‚äº†ã™ã‚‹ã€‚ã“ã®ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ãŒä½•
rryu 2016/08/24
fsãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã«ä¾å˜ã—ã¦ã„ã‚‹ã“ã¨ã‚’æ˜Žç¤ºã—ãŸãã¦æ›¸ã„ãŸã‚„ã¤ãŒã†ã£ã‹ã‚Šé€šã£ã¦ã—ã¾ã£ã¦ç”Ÿãæ®‹ã£ãŸã¨ã‹ãªã®ã ã‚ã†ã‹ã€‚

node.js

npm
ãƒªãƒ³ã‚¯
1