هک شدن مخزن Packagist: به خطر افتادن بیش از دوازده بسته PHP با ۵۰۰ میلیون نصب
?? ????? ??????? ?????? ???? ???? ????? ???? ???? ?????????? PHP Packagist ??? ??? ?? ?? “?????” ?? ???? ???? ??????? ?? ?????? ?????? ???? ???? ??? ? ??? ?? ?????? ???? ?? ?? ??? ?? ??? ?????? ??? ?? ?? ????? ????? ???.
Nils Adermann ?? Packagist ?????????? ???[?]: “???? ?? ?? ?? ??????? ?? ?? ??? ??? ????? ??? ? ??????? ???? ?? composer.json[2] ?? ?? ???? ??? ??????? ???? ??? ???????? ??? ??? ????? ????? ????? ????. ??? URL ??? ???? ????? ????? ?? ?? ????? ????????? ????? ????.”
???? ?????? ?? ??? ???? ???? ?????? ??????? ?? ?? ????? ?????? ????? ???? Doctrine ?????? ?????????. ??? ????? ?? ? ?? ???? ?? ???. ???? ???? ???????? ????????? ?? ??? ??? ???:
- acmephp/acmephp
- acmephp/core
- acmephp/ssl
- doctrine/doctrine-cache-bundle
- doctrine/doctrine-module
- doctrine/doctrine-mongo-odm-module
- doctrine/doctrine-orm-module
- doctrine/instantiator
- growthbook/growthbook
- jdorn/file-system-cache
- jdorn/sql-formatter
- khanamiryan/qrcode-detector-decoder
- object-calisthenics/phpcs-calisthenics-rules
- tga/simhash-php
???? ?????? Ax Sharma ?? ???? Bleeping Computer ????????? ??? ???[?] ?? ??? ??????? ???? ?? ???? ???? ?????? ?? ??? ?????? “neskafe3v1” ?? ???? ???? ????? ??? ????? ??? ???.
?????? ?????? ?????? ????? ????? ???? Packagist ???? ?? ?? ?? ??? ??????? ?? ?? ?? ???? GitHub ????? ?????????? ???????? ? ?????? ???? ???? ??? ??? ?? ?? ???????? Composer ????? ??????.
??????????? ??????????? ?? ??? ???? ??? ?? ?????????????? ?? ??????? ?? ?????? ???????? ???? ????????? ?? ?????? ?????? ????? ?????? ???????.
Packagist ??? ?? ??? ????? ???? ????? ????? ??? ? ??? ??????? ??????? ???? ? ???????? ????? ?? ? ?? ???? ??????? ????. ?????? ?? ??????? ???????? ?? ????? ???? ?????????? (?FA) ?? ???? ???? ???? ???????? ??? ???? ????.
Adermann ???????? ???: “?? ??? ?????? ?? ???? ???? ?? ?????? ???? ????? ??????? ??????? ?? ?? ????? ???? ?? ???? ????????? ?? ????? ??? ???? ???. ????? ?? ?????? ???? ???? ??????? ?????.”
??? ????? ????? ???? ??????? ?? ???? ????? ???? Aqua ?????? ??????? ? ????? ????????? ???? ?? ?? ???? ??? ?? ??? ?????? artifact ? ??? ?? ????? ????? ??????? ?????? ??????? ???? ???.
???????????? ?????? ???? ?? ????? ?????? ?????????? ?? ???????? ????? ?????? ?????? ?? ???? ?????? ??????? ?? ?????? ???? ??????? ? ????? ???????? ????? ?? ???????? ????????? ???? ????? ???? ??????? ?? ????? ???? ???? ?????????? ???? ?????.
?????? Mor Weinberger ? Assaf Morag ????? ??? ????? ??? ????? ??[?]: “?? ???? ?? ??? ?????? ?????? ????? ?????? ?? ????? ?????? ????? ?????? ?? ??????? ????? ????? secret ??? ?????? ? ?????? ???? ?? ?? ??? ???? ?? ???????? ???? ?? ???? ???? ?????? ????? ????????? ? ??????? ???? ??? ????? ????????? (SDLC) ???.”
?????
[?] https://blog.packagist.com/packagist-org-maintainer-account-takeover
[?] https://thehackernews.com/2022/10/researchers-report-supply-chain.html
[?] https://www.bleepingcomputer.com/news/security/researcher-hijacks-popular-packagist-php-packages-to-get-a-job
[?] https://blog.aquasec.com/250m-artifacts-exposed-via-misconfigured-registries
[?] https://thehackernews.com/2023/05/packagist-repository-hacked-over-dozen.html
???? : ???? ??? ??????? ????? ????????
