Isigaxa se-Dependabot sashicilela i-worm. Amaphakheji angama-22.

Lokho okuhlanganiswa yile vidiyo

• I-bot, umuntu, i-worm
• Kwenzeka kanjani, kungani i-npm ikuvumela, ubani okufanele asolwe
• Ulwandlekho: i-cache enobuthi
• 21:48 — isigaxa se-Dependabot
• Kungani kusebenza

Umbhalo obhaliwe ohunyushwe

Kuhunyushwe kusuka ekulandiseni kokuqala kwesiNgisi. Umsindo namazwibela atholakalayo alawulwa yi-YouTube.

I-bot, umuntu, i-worm

0:00 I-bot ivula isicelo sokudonsa; umuntu uyasihlanganisa emizuzwini engamashumi amabili nane kamuva. Emizuzwini engamashumi ayisishiyagalolunye nanhlanu ngemuva kwalokho, i-worm isishicilele izinguqulo eziyikhulu neshumi ze- amaphakheji, njengaye. I-postmortem ye-TanStack inezitembu zesikhathi zangaphambili, ezesondlozi elingezansi inazo zonke ezinye, kanti i-Hacker News iyinika amaphuzu ayinkulungwane neshumi nanye negama: Mini Shai-Hulud. Kwenzeka kanjani, kungani i-npm ikuvumela, ubani okufanele asolwe.

Kwenzeka kanjani, kungani i-npm ikuvumela, ubani okufanele asolwe

0:21 Lokhu kunguThe Daily Diff, i-postmortem. Meyi 11, ekuseni. I-fork eqanjwe kabusha ivula isicelo sokudonsa ngokumelene ne-TanStack Router. Ivala kungakapheli ihora, kodwa i-workflow yokulinganisa isivele yasebenzisa ikhodi yayo futhi

Ulwandlekho: i-cache enobuthi

0:33 yalondoloza i-cache enobuthi ngaphansi kokhiye i-workflow yokukhishwa ezoyisebenzisa. Neshumi nesishiyagalolunye namashumi amabili. Ukuhlanganiswa okusemthethweni kwenza ukukhishwa. I-cache ibuyela, i-binary ifunda imemori ye-runner, iphakamisa ithokheni yokushicilela, futhi ishicilele izinguqulo ezingamashumi ayisishiyagalombili nane kumaphakheji angamashumi amane nambili amaphakheji, anobufakazi obusemthethweni. Ukuhlolwa kuyehluleka. Iyashicilela noma kunjalo. Neshumi nesishiyagalolunye namashumi amane nesithupha, umcwaningi we-StepSecurity ufaka inkinga; ngo-9 UTC konke kuphelelwe yisikhathi futhi iseluleko sikhishiwe.

0:55 Ukuphelelwa yisikhathi akukho: i-npm iyala ukungashicileli lutho olunezibambelelo, ngakho kuhlala kufakiwe amahora. Amashumi amabili nanye namashumi amane nesishiyagalombili. Ephrojethini ye-aviation-data enezinkanyezi eziyisishiyagalolunye, I-Dependabot ivula isicelo sayo esivamile sokudonsa: yenyusa iqembu le-dev-dependencies, izibuyekezo eziyishumi nantathu. Ezimbili yizinguqulo ze-TanStack ezinobuthi. Amashumi amabili nambili neshumi nambili: kuhlanganisiwe. I-workflow yokushicilela yenza i-npm C-I ngethoni ku-

21:48 — isigaxa se-Dependabot

1:15 indawo; iscript sokulungisa siyifunda, kanti ngamashumi amabili nambili neshumi nesikhombisa i-worm iyashicilela njengaye. Izingxenye ezinhlanu zephakheji ngalinye ithokheni elifinyelela kulo, ngisho nephrojekthi endala eseceleni: ithokheni elilodwa elidala lakho konke. Izingxenye eziyikhulu neshumi emizuzwini engamashumi ayisishiyagalolunye nanhlanu. Uthola nge-imeyili, ngemuva kwamabili. Kungani kusebenza. Okokuqala: i-npm install yenza izikripthi zempilo zabantu abangabazi ngokuzenzakalelayo, nescript sokulungisa sokuncika ku-git sibalulekile.

1:39 Okwesibili: i-worm ifuna into eyodwa: ithokheni eshicilela ngaphandle kwesici sesibili. Bese ibuza irejista ukuthi yini enye leyo maintainer ephethe, futhi iphinde ishicilele konke ngaphakathi kwayo. Okwesithathu: akukho kulo chungechunge oluyimuntu.

Kungani kusebenza

1:51 I-bot iyaphakamisa, i-pipeline iyifaka, kanti i-worm iyabuyisela: yayo amagatsha e-dead-drop abizwa nge-dependabot slash github-actions slash fremen. git blame. Imanuwali yokufaka ye-npm, amaphesenti angamashumi amahlanu nanhlanu: izikripthi zisebenza lapho kufakwa, okuphelelwe yisikhathi kuhlala kufakiwe, amathokheni okudlulisa isici esibili akhona. I-CI ye-TanStack, amashumi amabili nanhlanu: i-workflow engahloliwe yokudonsa lapho i-target isebenza ikhodi ye-fork enokufinyelela kokubhala kwi-cache. Umnikelo wokunyuka, amashumi nanhlanu: izibuyekezo eziyishumi nantathu zihlanganisiwe emizuzwini engamashumi amabili nane, ithokheni egumbini.

2:17 I-Dependabot, ezinhlanu: ithembekile kangangokuthi i-worm igqoka imifaniswano yayo.

git blame

2:20 Ukwanda komonakalo: amaphakheji angamashumi amane nambili e-TanStack. Amashumi amabili nambili phansi, kusuka kuphrojekthi enezinkanyezi eziyisishiyagalolunye. Ngaphezu kwekhulu namashumi ayisithupha kuwo wonke ama-ecosystem uma i-worm ifinyelela eMistral. Yonke inguqulo engenhla yayinegunya elisebenzayo: yakhiwe yikhona okusemthethweni ipayiphi. Iqiniso. Isinqumo, i-postmortem: SHIP IT. Bobabili abaphathi bashicilela ama-postmortem anesitembu sesikhathi kungakapheli usuku; kungakapheli amathathu, ipayiphi elingezansi lifaka nge-ignore-scripts, lihlukanisa ukwakha ekushicileleni, futhi liwisa ithokheni elihlala isikhathi eside.

Ukwanda komonakalo

2:47 Izenzakalo ze-npm azihambanga. NgoMsombuluko: ignore-scripts ekufakeni, nethokheni yokushicilela ngaphandle komsebenzi oyi- uyiwenza. Ngithumele isigameko ongasavunyelwe ukukhuluma ngaso, emazwanini, noma ku-thedailydiff.dev. Futhi lokho kuyi-diff yanamuhla.

Isinqumo

3:00 NginguNiko wase-Axrisi. Hlanganisa ngokuzibophezela.

Imithombo

1. TanStack postmortem (Tanner Linsley, May 11, refined May 15)tanstack.com
2. TanStack "Hardening TanStack After the npm Compromise" (May 12)tanstack.com
3. TanStack/router#7383 — the StepSecurity detection issuegithub.com
4. Downstream incident post, @squawk/* (May 12)github.com
5. Downstream hardening post (May 14)github.com
6. The Dependabot PR #246 (opened 21:48 UTC, merged 22:12)github.com
7. @tan_stack advisory post, 21:19 UTCx.com
8. StepSecurity — worm internals, bypass_2fa search, Dependabot-style branch nameswww.stepsecurity.io
9. Socketsocket.dev
10. Aikido — "over 160 packages, including Mistral"www.aikido.dev
11. Hacker News (1,097 points)news.ycombinator.com