Исходное сообщение
"Атака на немецкие компании через NPM-пакеты" Отправлено Аноним, 13-Май-22 10:59
Судя по всему, это был пентестер, а подстановка была запланированной проверкой: On Wednesday, just hours before both JFrog and ReversingLabs posted blogs here and here, a penetration testing boutique named Code White took credit for the packages. “Tnx for your excellent analysis,” the firm said in a tweet that addressed Snyk and cited its blog post from last month. “And don't worry, the ‘malicious actor’ is one of our interns 😎 who was tasked to research dependency confusion as part of our continuous attack simulations for clients. To clarify your questions: we're trying to mimic realistic threat actors for dedicated clients as part of our Security Intelligence Service and we brought our ‘own’ package manager that supports yarn and npm.” Источник: https://arstechnica.com/information-technology/2022/05/backd.../

Ваше сообщение
Имя*:
EMail:	Для отправки ответов на email укажите знак ! перед адресом, например, !user@host.ru (!! - не показывать email). Более тонкая настройка отправки ответов производится в профиле зарегистрированного участника форума.
Заголовок*:
Сообщение*:	> Судя по всему, это был пентестер, а подстановка была запланированной проверкой: > On Wednesday, just hours before both JFrog and ReversingLabs posted blogs here > and here, a penetration testing boutique named Code White took credit > for the packages. > “Tnx for your excellent analysis,” the firm said in a tweet that > addressed Snyk and cited its blog post from last month. “And > don't worry, the ‘malicious actor’ is one of our interns 😎 > who was tasked to research dependency confusion as part of our > continuous attack simulations for clients. To clarify your questions: we're trying > to mimic realistic threat actors for dedicated clients as part of > our Security Intelligence Service and we brought our ‘own’ package manager > that supports yarn and npm.” > Источник: https://arstechnica.com/information-technology/2022/05/backdoor-in-public-repository-used-new-form-of-attack-to-target-big-firms/
	Введите код, изображенный на картинке: