- I-worm ekhethekile eyaziwa ngokuthi i-Miasma iphumelele ukungena ezindaweni zokugcina i-Microsoft GitHub ezingu-73 ezisemthethweni, okuhlanganisa nengqalasizinda ebalulekile ye-Azure.
- I-malware ihlose ngqo onjiniyela abasebenzisa ama-ejenti okubhala ikhodi asebenzisa i-AI njenge-Claude Code kanye ne-Cursor njenge-vector yayo eyinhloko yokusebenza.
- Abacwaningi bezokuphepha bathole inqubo eyimfihlo ebizwa ngokuthi 'iPhantom Gyp' evumela umthwalo ukuthi udlule izikena zokuphepha ze-npm zendabuko.
- Izinhlangano ezithintekile ziyanxuswa ukuthi zishintshe ngokushesha iziqinisekiso zamafu kanye nomlando we-audit repository commit ukuze kutholakale izinguquko ezingagunyaziwe.
Umphakathi wezobuchwepheshe okwamanje ucubungula imiphumela yokwephulwa kwe -supply chain okuyinkimbinkimbi okuqondise ezindaweni eziningi zentuthuko ezidumile zeMicrosoft. Kuleli sonto, inhlangano enonya iphumelele ekuphazamiseni izindawo zokugcina ezingama-73 ezinhlanganweni ezine ezinkulu, okuhlanganisa i-Azure ne-MicrosoftDocs, okuwuphawu lwesinye sezehlakalo zokuphepha ezibaluleke kakhulu zonyaka. Ngenkathi izinhlelo ze-GitHub ezenzakalelayo zikwazile ukunciphisa izimpahla ezithintekile ngaphakathi kwefasitela elifushane kakhulu lemizuzwana eyi-105, uhlobo lokungena luphakamisa ushintsho endleleni abahlaseli ababuka ngayo ipayipi lentuthuko yesimanje.
Okwenza lesi sigameko esithile sihluke ekubanjweni kwezindawo zokugcina ngaphambilini ukuthembela kwaso ekuthandweni okwandayo kobuhlakani bokwenziwa embonini yesofthiwe. Ngokungafani ne-malware yendabuko eqala ngesikhathi sokufakwa kwephakheji, lolu songo luhlala lungasebenzi kuze kube yilapho unjiniyela evula iphrojekthi esebenzisa i-ejenti yokufaka ikhodi esebenzisa i-AI. Amathuluzi afana ne-Cursor, i-Claude Code, ne-Gemini CLI, adinga izimvume ezibanzi zokuhlaziya nokusebenzisa iziqeshana zekhodi, aba yindlela yokulethwa engahlosiwe yomthwalo onobungozi. Lokhu kumelela icala lokuqala elibhalwe phansi lapho abasizi be-AI basetshenziswa khona njenge-vector yokusebenza yezinga eliyinhloko.
Ukuqonda Ukwakheka Kobuchwepheshe beMiasma
Ngobuchwepheshe obubizwa ngokuthi i-Miasma, lesi sibungu siwukuphindaphindwa okuthuthukisiwe kwe- Mini Shai-Hulud codebase ebonwe ngaphambilini ezinkundleni ezingaphansi komhlaba. Ukuhlasela kwaqala ezinyangeni ezedlule ngokuqoqa iziqinisekiso zonjiniyela, okwavumela abasongeli ukuthi bafake umthwalo ongu-4.3 MB ngaphansi kwesimo sokubuyekezwa kokuthembela okuvamile. Lezi zivumelwano zenzelwe ukubukeka zingenangozi ngokuphelele emehlweni enyama, ngokuvamile ziphawulwe ngamalebula anjenge-'skip ci' ukugwema ukuqala izinqubo ezithile zokwakha ezenzakalelayo ngenkathi kulinde ukusebenzisana kwabantu nge-IDE noma i-AI CLI.
Uma indawo iyasebenza, i-worm isebenza njengomvuni wokuqinisekisa onamandla owenzelwe izindawo zemvelo ezinamafu amaningi. Ihlelwe ukukhipha amathokheni abucayi kumaqembu e-AWS, Azure, Google Cloud Platform, kanye ne-Kubernetes. Ngemva kokuqoqa lezi zimfihlo, i-malware idala ngokuzenzakalelayo izindawo zokugcina ezintsha zomphakathi ukuze ikhiphe idatha bese isebenzisa izimvume ezibiwe ukuze isakazeke ngokufaka ikhodi enonya kunoma iyiphi enye indawo yokugcina umsebenzisi osengozini anokufinyelela kuyo kokubhala.
Isu Lokugwema 'i-Phantom Gyp'
Ubuhlakani bobuchwepheshe obusemuva kwalo mkhankaso busekukwazini kwawo ukuhlala ungabonakali kumathuluzi okuqapha ukuphepha ajwayelekile. Iningi lama-scan okuphepha e-npm alungiselelwe ukubuka izikripthi 'zokufaka kusengaphambili' noma 'zokufaka ngemuva' ezisolisayo ngaphakathi kwamafayela ephakheji. Kodwa-ke, iMiasma igwema lawa ma-hook ngokuphelele, ikhetha ukusebenzisa ifayela le-binding.gyp ukuze iqalise ukusebenza kwekhodi ngesikhathi sesigaba sokwakha. Le ndlela, manje ebizwa ngokuthi 'i-Phantom Gyp' ngabahlaziyi bemboni, isebenzisa indawo engaboni kahle emipayipini eminingi ye-CI/CD engaqapheli ukucushwa kokwakha okuphansi ngamandla afanayo namafayela e-manifest.
Lo mcimbi empeleni uyisinyathelo sesithathu esikhulu seqembu le-Miasma esikhathini esifushane kakhulu, kulandela iziteleka eziphumelelayo ngokumelene nezikhala zamagama ze-npm kanye nemitapo yolwazi yedatha evulekile ethandwayo. Ukwenyuka kwengqalasizinda ye-Microsoft kusikisela umzamo ohlelekile kakhulu wokukhulisa umthelela ongezansi . Ngokuqondisa amaphrojekthi afana ne-Azure Search OpenAI demo kanye nokuqaliswa kwemisebenzi ehlukahlukene eqinile, abahlaseli bahlose isisekelo sentuthuko yesimanje yamafu, okungenzeka bafinyelele amakhulu ezinkulungwane zabasebenzisi ngabanye kanye nezinhlelo zebhizinisi.
Ukulungiswa Okusheshayo Nokuphepha Konjiniyela
Kulabo abasanda kubhala noma ukusebenzisana nama-repository ahlobene ne-Azure, isincomo esivela kochwepheshe bezokuphepha ukuthi baphathe zonke izimfihlo zemvelo zasendaweni njengezingase zivezwe. Kubalulekile ukushintshanisa zonke izinkinobho ze-API namathokheni okufinyelela komuntu siqu ngokushesha, ikakhulukazi lezo ezihlobene nabahlinzeki bamafu kanye nokubhaliswa kwamaphakheji. Ngaphezu kwalokho, abathuthukisi kufanele bahlole amalogi abo omsebenzi we-GitHub ukuze bathole noma yiziphi izindawo zokugcina eziqanjwe ngendlela engavamile, njengalezo ezikhuluma 'nge-Spreading Blight,' okuyizinkomba ezaziwayo zokutheleleka kwe-Miasma okusebenzayo okuzama ukukhipha idatha.
Lokhu kwephulwa kwemithetho kusebenza njengesikhumbuzo esicacile sezindlela zokuphepha ezisetshenziswa ngokushesha ekusetshenzisweni kwamathuluzi okukhiqiza e-AI. Ngenxa yokuthi ama-ejenti e-AI asebenza ngokuba nokufinyelela okujulile kokufunda nokusebenzisa ikhodi ngaphakathi kwendawo yokusebenza yonjiniyela, adala indawo ebanzi yokuhlasela abenzi bobubi abakulungele ukuyisebenzisa. Ukuqhubekela phambili, imboni ingadinga ukushintshela ekuqinisekisweni kobuqotho okuqinile, njengokusayina okuphoqelekile kanye nezindawo ze-sandbox zokuhlaziywa kwe-AI, ukuqinisekisa ukuthi ukulula kokubhala ikhodi okuzenzakalelayo akuzi ngezindleko zokuyekethisa okuphelele kwesistimu.
Ukulawulwa okusheshayo ngabahlinzeki beplatifomu kuvimbele inhlekelele enkulu kakhulu, kodwa ubuthakathaka obuyisisekelo bezintambo zokuhlinzeka ekusebenzeni okuqhutshwa yi-AI busalokhu buyisithiyo esikhulu. Njengoba amaqembu okuthuthukisa eqhubeka nokuhlanganisa abasizi abazenzakalelayo emisebenzini yawo yansuku zonke, ukugxila kumele kushintshele ekuqinisekiseni ubuqotho besitoreji ngaphambi kokuvumela noma iyiphi ikhodi yangaphandle ukuthi isebenzisane namathuluzi anelungelo eliphezulu. Ukuqapha ekuqapheni ukusetshenziswa kweziqinisekiso kanye nokwamukela indlela yokungathembeki nhlobo ekuthembekeni kweqembu lesithathu kuzoba ukuzivikela okuphumelelayo kakhulu esizukulwaneni esilandelayo se-malware ezisakazela ngokwayo enkathini yamafu.
