I-malware ethule efihliwe kuphakheji ye-PyPI ye-Mistral AI ibangela ukwesaba okukhulu kochungechunge lokuhlinzekwa kwe-AI

Ikhaya » Python » I-malware ethule efihliwe kuphakheji ye-PyPI ye-Mistral AI ibangela ukwesaba okukhulu kochungechunge lokuhlinzekwa kwe-AI

Ikhithi yokuthuthukisa isofthiwe esemthethweni ye-Mistral AI, esatshalaliswa nge-Python repository ethandwayo i-PyPI, itholakale ukuthi iqukethe i-malware eyimfihlo esebenza buthule ezinhlelweni ze-Linux ngokushesha nje lapho abathuthukisi bengenisa iphakheji esengozini. Lokhu kutholwa kuphakamise ukukhathazeka okusha mayelana nokuthi i-AI yesimanje kanye neziteshi zokuhlinzeka ngemithombo evulekile zibonakala kanjani ngempela.

Ngokusho kwemininingwane yobuchwepheshe eyabiwe yiMicrosoft kanye nabanye abacwaningi bezokuphepha, ikhodi enonya yangeniswa ngqo kwiphakheji ye-Mistral AI ethembekile futhi ukusetshenziswa kabi kwezindlela zokushicilela ezenzakalelayo kanye namathuluzi onjiniyela. Kwabaningi bonjiniyela abasebenza ngamamodeli okufunda komshini, lesi sigameko singesinye isikhumbuzo sokuthi ngisho nama-SDK athembekile kakhulu angaphenduka abe yizithwali zokutheleleka ngobusuku obubodwa.

Indlela ikhodi enonya engene ngayo kuphakheji ye-Mistral AI PyPI

Abaphenyi babika ukuthi abenzi bezinsongo bakwazile ukufaka i-logic enonya kuphakheji ye-mistralai ebanjwe ku-PyPI, isikhungo esiyinhloko abathuthukisi bePython abathembele kuso ukufaka amalabhulali kanye nezinhlaka. I-Microsoft Threat Intelligence ithe iphakheji ephazanyisiwe iqukethe ikhodi eyengeziwe esebenza ngokuzenzakalelayo kumishini ye-Linux noma nini lapho i-SDK isetshenziswa kumaphrojekthi.

I-logic eyingozi ilande umthwalo wesigaba sesibili obizwa ngokuthi i-transformers.pyz kusuka kuseva ekude, ukuyigcina ngaphansi /tmp isiqondisi bese siyisebenzisa buthule ngemuva. Abahlaziyi bezokuphepha baphawule ukuthi igama lefayela elikhethiwe libonakala lenziwe ngamabomu ukuze lifane nomtapo wolwazi we-Hugging Face Transformers osemthethweni, okuvame kakhulu ukuthembela ezindaweni ze-AI kanye nokufunda komshini, okwenza i-malware ihlangane namathuluzi ajwayelekile.

Kwenye yezinguqulo ezibekwe engcupheni, abacwaningi babone ingxenye yesigebengu ngaphakathi ifayela mistralai/client/__init__.py. Lapho nje imojuli ingenisiwe, ikhodi eyengeziwe yayizofinyelela ku-IP elawulwa umhlaseli, ilande transformers.pyz bese uyiqalisa, ngaphandle kwezicelo ezibonakalayo noma ukusebenzisana komsebenzisi. Ngokombono wonjiniyela, konke kwakubukeka njengokungeniswa okuvamile kwe-SDK ejwayelekile.

Ngemva kokutholakala, abanakekeli be-Python Package Index iphrojekthi ye-Mistral AI ibekwe ngaphansi kwesimo sokuvalelwa ngaphandle, ukuvimbela ngempumelelo ukusatshalaliswa okwengeziwe kwezinguqulo ezimbi ezaziwayo ngenkathi uphenyo luqhubeka. Leso sinyathelo sihlose ukuvimbela ukusabalala, yize noma yiziphi izinhlelo ezazifake ukukhishwa okunonya ngaphambilini zingase zibe sengozini.

Lokho okwenziwa yi-malware uma isifikile ezinhlelweni zonjiniyela

Once the ifayela lesigaba sesibili i-transformers.pyz liyasebenza, umgomo wayo oyinhloko ukuqoqa ulwazi olubucayi endaweni ethintekile. I-Microsoft kanye namaqembu okuphepha azimele achaza i-malware njengokweba imininingwane, eyakhelwe ukukhipha idatha yokuqinisekisa onjiniyela abathembele kuyo ukuphatha ikhodi, izinsizakalo zamafu kanye nengqalasizinda.

Izinhloso zomthwalo okhokhelwayo ononya iziqinisekiso zokungena ngemvume, amathokheni okufinyelela kanye nezinye izimfihlo ezivumela ukungena kumapulatifomu afana ne-GitHub noma i-npm, abahlinzeki bamafu, amaqoqo e-Kubernetes kanye namaseva afinyeleleka ku-SSH. Kokunye ukuhlaziya, i-malware nayo ibonwe izihlanganisa namathuluzi okuthuthukisa, kufaka phakathi izinto ezixhunywe ekusebenzeni okuzenzakalelayo ku-VS Code kanye nama-hook ahlobene ne asistentes de código, ukuze kugcinwe ukuphikelela nokwandisa ukufinyelela kwakho.

Inkampani yezokuphepha i-Aikido Security kanye nabanye ochwepheshe baxwayise ngokuthi, ezimweni eziningi, Ukususa nje iphakheji ye-Mistral AI esengozini akwanele ukuhlanza ngokuphelele uhlelo olunegciwane. Uma selusunguliwe, i-malware ingafaka izingxenye ezengeziwe, ishintshe amafayela okucushwa noma isethe imisebenzi ezenzakalelayo eqhubeka nokusebenza ngisho nangemva kokuba i-SDK yokuqala isusiwe.

Into eyodwa ekhathaza kakhulu ukuthi lo mkhankaso kubikwa ukuthi ulandela abaphathi bamaphasiwedi abanjengo-1Password kanye no-BitwardenNgokuzama ukufinyelela noma ukuvimba idatha ehlobene nala mathuluzi, abahlaseli bandisa amathuba abo okukhipha izimfihlo eziningi emshinini owodwa osengozini, kusukela ekungeneni komuntu siqu kuya kuma-akhawunti enhlangano anelungelo eliphezulu.

IMicrosoft iphinde yaphawula ukuthi i-malware ihlanganisa ukuziphatha okuqaphela isifunda nolimi. Le khodi izama ukugwema izinhlelo ezihlelwe ngesiRashiya futhi iqukethe ingqondo engasusa amafayela ngokungahleliwe emishinini ethile okukholakala ukuthi itholakala kwa-Israyeli noma e-Iran. Leyo nhlanganisela yokugwema okuqondiwe kanye namakhono okubhubhisa iholele abahlaziyi ukuthi baphathe lo msebenzi njengokungaphezu nje komkhankaso wokuthola iziqinisekiso ezijwayelekile.

Izixhumanisi zokusebenza okubanzi kwe-Shai-Hulud kanye ne-TeamPCP supply-chain

Ukuyekethisa kwephakheji ye-Mistral AI PyPI akuyona into eyenzeka yodwa. Imibiko eminingi ixhumanisa lo msebenzi ne- umkhankaso omkhulu wokunikezela owaziwa ngokuthi "Shai-Hulud", ebilokhu isebenza kusukela okungenani ngoSepthemba futhi igxile ekutheleleni izindawo zemvelo zonjiniyela ngokuphazamisa amaphakheji athembekile.

Ngaphansi kwesambulela sikaShai-Hulud, kuthiwa abahlaseli basebenzise iziqinisekiso zomgcini ezebiwe noma ezisetshenziswe kabi, ukulungiselelwa okungalungile kanye namaphutha ku-GitHub Actions ukuze bangene emigwaqweni yokushicilela esemthethweni. Uma sebengaphakathi, bangafaka ikhodi enonya kumafayela omthombo bese becindezela ukukhishwa okusayiniwe nokuvumelekile ngokugcwele kumaphakheji okubhalisa, okwenza izinguqulo eziyingozi zicishe zingahlukaniseki kuzibuyekezo zangempela.

Igagasi elilodwa lomkhankaso, ngezinye izikhathi elichazwa njenge- Ukuhlasela kwe-"Mini Shai-Hulud", kubikwa ukuthi ibeke engcupheni amaphakheji angaphezu kuka-170 npm kanye namaphakheji okungenani amabili ku-PyPI ekuhlaselweni okukodwa okuhlanganisiwe kwe-supply-chain ngomhlaka-11 Meyi 2026. Sekukonke, abacwaningi babale izinguqulo ezingaphezu kuka-400 ezinonya ezishicilelwe kuwo wonke la maphrojekthi, eziningi zazo zihlobene ne-AI esetshenziswa kabanzi kanye namathuluzi omthombo ovulekile.

Iqembu labalingisi abasongelayo elaziwa ngokuthi I-TeamPCP ikhulunywe kaningi njengamandla abangela lo msebenzi. I-akhawunti yomphakathi wezokuphepha i-VX-Underground igcizelele ku-X ukuthi inguqulo ehlome ngokuphelele yalokho okubizwa ngokuthi “i-Shai-Hulud Git worm” yenziwe yatholakala njengekhodi yomthombo ovulekile. Uma inembile, leso sinyathelo sizokwenza kube lula ngabanye abadlali ukusebenzisa kabusha noma ukuzivumelanisa namasu afanayo nezinye izinhlelo zesofthiwe.

Okwenza lolu hlobo lomkhankaso lube yingozi kakhulu ukuthi ukuziphatha okuzisakazela ngokwako kumaphakheji ahlobeneUma abahlaseli sebethole iziqinisekiso zomgcini noma iphrojekthi, izikripthi ezenzakalelayo zingabala ezinye izindawo zokugcina ezixhumene nalolo lwazi, zifake imithwalo efanayo kuma-codebase amaningi futhi ziphinde zishicilele izibuyekezo ezibonakala zisemthethweni, ziguqule isivumelwano esisodwa sibe inethiwekhi ebanzi kakhulu yokuxhomekeka okunobuthi.

Impendulo ye-Mistral AI kanye ne-angle ye-supply-chain ehlobene ne-TanStack

Esitatimendeni esishicilelwe kuwebhusayithi yayo, i-Mistral AI ivumile ukuthi i-AI yayo Ukukhishwa kwe-SDK okusemthethweni ku-PyPI kuthintwe ukuhlaselwa kwe-supply-chain kuhlobene nesigameko esikhulu sokuphepha esihilela i-TanStack. Ngokusho kwenkampani, i-worm ezenzakalelayo ehlotshaniswa nalowo mkhankaso yabangela ukushicilelwa kwezinguqulo ezishintshiwe zamaphakheji e-npm kanye ne-PyPI.

I-Mistral ikhombisile ukuthi okutholakele kwamanje kukhomba ku- idivayisi yonjiniyela esengozini, kunokuba kube ukwephulwa okuqondile kwengqalasizinda eyinhloko yenkampani. Kulesi sigaba sophenyo, iMistral ithi ayinabo ubufakazi bokuthi izinhlelo zayo zangaphakathi noma ingqalasizinda eyimodeli ephethwe yiyo ithathwe noma yashintshwa abahlaseli.

Lokhu kuhambisana nephethini iyonke ebonwe emisebenzini ehlobene ne-Shai-Hulud, lapho Abahlaseli bagxila kuma-endpoints onjiniyela kanye namapayipi e-CI/CD kunokuba kusezikhungweni zedatha noma kumaseva okukhiqiza. Ngokusebenzisa kabi izixhumanisi ezibuthakathaka emishinini yomuntu siqu noma emisebenzini yokusebenza ezenzakalelayo engalungiselelwanga kahle, bangafaka i-malware endaweni efanele lapho kwakhiwa futhi kusayinwa khona ama-binary namaphakheji athembekile.

Nakuba lokho kungase kusindise ingqalasizinda eyinhloko ye-Mistral, kusashiya inani elikhulu labathuthukisi nezinhlangano zichayeke. Noma yiliphi iqembu elidonse inguqulo ye-SDK esengozini kumaphrojekthi alo kungenzeka ngokungazi bahlanganise ikhodi enonya ezindaweni zokuthuthukiswa noma zokukhiqiza, kuye ngokuthi iphakheji ithunyelwe kanjani futhi kuphi.

Le nkampani manje ibhekene nenselele yokubuyisela ukwethembana okuzungeze ama-SDK ayo kanye nezinqubo zokwakha, ngesikhathi lapho imboni ye-AI ingaphansi kokuhlolwa okujulile mayelana nobumfihlo, ukuthembeka kanye nokuvikeleka. Ukubonisa ukuthi ukukhishwa okusha kuqiniswe ngokumelene nokuhlaselwa okufanayo cishe kuzoba yinto eza kuqala kokubili kubathengisi be-Mistral kanye nabanye abathengisi be-AI ababheke lesi simo eduze.

Yimuphi idatha esengozini nokuthi onjiniyela kufanele baphendule kanjani

Abacwaningi bezokuphepha bagcizelela ukuthi umgomo omkhulu walo mndeni we-malware uku vuna iziqinisekiso eziningi eziwusizo ngangokunokwenzeka kusukela ezinhlelweni ezifika kuzo. Kumaqembu asebenza nge-AI tooling, lokhu kufaka phakathi amathokheni okufinyelela e-GitHub, iziqinisekiso ze-npm, okhiye be-cloud API, ama-akhawunti esevisi ye-Kubernetes, okhiye be-SSH kanye nezimfihlo ezisetshenziswa kumapayipi e-CI/CD.

Ngenxa yokuthi i-malware izama ukuhlanganiswa ezindaweni zokuthuthukiswa kanye nezikhonkwane zokwenza izinto ngokuzenzakalela, i-radius yokuqhuma ingadlula kude indawo eyodwa yokusebenzaUma iziqinisekiso ezibiwe zinikeza ukufinyelela ezindaweni zokugcina ze-Git zenhlangano, ukubhaliswa kwamaphakheji noma ukuthunyelwa kwamafu, abahlaseli bangahamba eceleni futhi baphazamise amaphrojekthi noma ingqalasizinda eyengeziwe.

Ochwepheshe bezokuphepha nabathengisi banxusa izinhlangano okungenzeka ukuthi zifake noma yiluphi uhlobo lwephakheji olusengozini ukuthi zithathe izinyathelo eziningana ngokushesha. Okokuqala, onjiniyela kufanele shintsha zonke iziqinisekiso namathokheni afanele, kufaka phakathi okhiye be-GitHub, i-npm kanye ne-cloud, kanye nezimfihlo ezisetshenziswa amaseva okwakha kanye namapayipi okuhambisa.

Okulandelayo, amaqembu ayalulekwa ukuthi ahlole izihlahla zawo ezixhomeke kulokho akubonayo, ahlole “amafayela okukhiya” kanye nezimpawu zephakheji ukuze izinguqulo ezaziwa ngokuthi zinonyaUkunamathisela ukuncika ekukhishweni okuthembekile nokuqinisekisiwe nokugwema ukuthuthukiswa okungaboni kungasiza ekunciphiseni ukuvezwa lapho ukuhlaselwa okufanayo kwe-supply-chain kwenzeka esikhathini esizayo.

Okokugcina, izinhlangano kufanele zihleleke ngendlela ehlelekile skena izinhlelo zabo ukuze uthole izimpawu zokutheleleka, okuhlanganisa nokuba khona kwamafayela asolisayo njenge transformers.pyz, ukuxhumana kwenethiwekhi okungajwayelekile kuma-IP alawulwa ngabahlaseli, kanye nokuguqulwa okungalindelekile kuzilungiselelo ze-IDE, ama-hooks noma imisebenzi ehleliwe. Ezimweni ezinobungozi obukhulu, ukuhlukanisa ama-host e-Linux athintekile nokuwakha kabusha kusuka ezithombeni ezihlanzekile kungaba yindlela ephephile yokwenza.

Umlayezo wokuvusa i-AI kanye nokuphepha kwe-open source supply-chain

Isigameko se-Mistral AI PyPI sigcizelela ukuthambekela okubanzi: Izinhlaka ze-AI kanye nezinhlelo zemvelo zonjiniyela sezibe yizinhloso eziyinhloko kubahlaseli abanesifiso sezimali nabangase baxhumane nohulumeni. Esikhundleni sokusebenzisa ngqo izinhlelo zokusebenza zabasebenzisi bokugcina, izitha zigxila kakhulu eketangeni lokuhlinzekwa kwesofthiwe elisekela imisebenzi yentuthuko yesimanje.

Ngokubeka engcupheni ukubhaliswa kwamaphakheji njenge-PyPI kanye ne-npm, abahlaseli bangakwazi ukufinyelela izinkulungwane noma ngisho nezigidi zezinhlelo ngokuphulwa okukodwa okuphumelelayoUmlando wakamuva ukhombisile ukuthi i-npm ikhanga kakhulu ngenxa yendima yayo ebalulekile kumaphrojekthi ahlobene neJavaScript, i-blockchain kanye ne-crypto, lapho amaphakheji antshontshiwe asetshenziswe khona ukuqondisa kabusha ukuthengiselana kwe-cryptocurrency noma ukutshala i-malware kuma-robot okuhweba kanye namathuluzi enkontileka ahlakaniphile.

Kulesi simo, umkhankaso oxhumene noShai-Hulud kanye neTeamPCP awuyona into eshaqisayo eyedwa kodwa uqhubeka nephethini. Amasu afanayo asebenza ngokumelene nezinhlelo zemvelo zeJavaScript manje ayashintshwa futhi alungiswa ukuze aqondise izitaki ze-AI ezisekelwe ku-Python, amplificando la trampa de dependencia de los LLM, lapho imivuzo engaba khona ihlanganisa ukufinyelela ikhodi yemodeli enenani eliphezulu, amasethi edatha ayimfihlo kanye nengqalasizinda yenkampani ebucayi.

Kumphakathi we-AI, isifundo sicacile ngendlela engakhululekile: ikhodi yokufunda komshini iseyisofthiwe nje, futhi izuza bonke ubuthakathaka obujwayelekile bemikhuba yentuthuko yendabuko. Kungakhathaliseki ukuthi ukwakheka kwemodeli kuthuthuke kangakanani, amapayipi angavikelekile, ukuhlanzeka okubuthakathaka komnakekeli kanye nokuthembela okungaqinisekisiwe kudala amathuba alula kubahlaseli.

Njengoba izinhlangano ziqhubeka nokwamukela amamodeli amakhulu olimi futhi zihlanganisa i-AI emisebenzini yansuku zonke, izehlakalo ezinjengalesi ziqhubekisela phambili ezokuphepha ezinqumweni zokwakha. Kusukela ekuphoqeleleni ukulawulwa okuqinile kuma-akhawunti omnakekeli kuya ekuqaliseni ukwakhiwa okuphindaphindwayo kanye nokukhishwa okusayiniwe, izivikelo zokuphepha ziba yinto ebalulekile kumaphrojekthi e-AI njengezilinganiso zokunemba kanye nezilinganiso zokusebenza.

Uma kubhekwa kude, i-malware etholakale kuphakheji ye-Mistral AI PyPI isebenza njengesikhumbuzo esicacile sokuthi ukuthembela ezimisweni zesofthiwe kubuthakathaka, ikakhulukazi lapho abahlaseli behlasela amapayipi angabonakali abathuthukisi abathembele kuwo nsuku zonke. Ukuqinisa lezo zisekelo - ngokusebenzisa amathuluzi angcono, ukuziphatha okuqinile kokusebenza kanye nokubambisana okuseduze phakathi kwabathengisi be-AI, abanakekeli kanye namaqembu okuphepha - kuzobaluleka ekugcineni ukuhlaselwa kwe-supply-chain esikhathini esizayo kungasabalali buthule kuzo kanye izinhlaka ezenzelwe ukunika amandla isizukulwane esilandelayo sezinhlelo zokusebenza ezihlakaniphile.

I-athikili ehlobene:

U-Shai-Hulud: el ataque que sacude la cadena de suministro de npm