{"id":370,"date":"2026-08-27T16:58:53","date_gmt":"2026-08-27T08:58:53","guid":{"rendered":"https:\/\/thaumaturgy.animax.moe\/?p=370"},"modified":"2026-08-27T16:58:53","modified_gmt":"2026-08-27T08:58:53","slug":"%e5%bd%93%e5%ae%89%e5%85%a8%e5%b7%a5%e5%85%b7%e5%85%88%e5%80%92%e4%b8%8b%ef%bc%9atrivy-%e5%87%ad%e6%8d%ae%e7%ba%a7%e8%81%94%e3%80%81axios-%e7%a4%be%e5%b7%a5%e4%b8%8e%e9%aa%8c%e8%af%81%e6%a8%a1","status":"publish","type":"post","link":"https:\/\/thaumaturgy.animax.moe\/?p=370","title":{"rendered":"\u5f53\u5b89\u5168\u5de5\u5177\u5148\u5012\u4e0b\uff1aTrivy \u51ed\u636e\u7ea7\u8054\u3001Axios \u793e\u5de5\u4e0e\u9a8c\u8bc1\u6a21\u578b\u591f\u4e0d\u5230\u7684\u5730\u65b9"},"content":{"rendered":"<p>\u6458\u8981\uff1a2026 \u5e74 3 \u6708 19\u201331 \u65e5\u7684\u5341\u4e8c\u5929\u91cc\uff0c\u4e94\u8d77\u4f9b\u5e94\u94fe\u6295\u6bd2\u63a5\u8fde\u53d1\u751f\uff1aTeamPCP \u4ece Trivy \u51fa\u53d1\uff0c\u7528\u5077\u6765\u7684 CI\/CD \u51ed\u636e\u4e94\u5929\u5185\u5728 GitHub Actions\u3001PyPI\u3001Docker Hub \u7b49\u591a\u4e2a\u751f\u6001\u5b8c\u6210\u7ea7\u8054\u6295\u6bd2\uff1b\u53e6\u4e00\u8def\u88ab\u5f52\u56e0\u4e8e\u7591\u4f3c\u671d\u9c9c APT\uff08UNC1069\uff09\u7684\u653b\u51fb\u8005\uff0c\u7528 AI \u793e\u5de5\u63a5\u7ba1 Axios \u4e3b\u7ef4\u62a4\u8d26\u53f7\uff0c\u53d1\u5e03\u5e26 RAT \u7684\u6076\u610f\u7248\u672c\u3002\u6211\u4e0a\u4e00\u7bc7\u628a\u53ef\u590d\u73b0\u6784\u5efa\/SBOM \u5b9a\u4f4d\u4e3a&quot;\u8ba9\u9a8c\u8bc1\u6210\u4e3a\u53ef\u80fd\u7684\u57fa\u7840\u8bbe\u65bd&quot;\uff0c\u8fd9\u8f6e\u653b\u51fb\u6070\u597d\u662f\u5b83\u7684\u5b9e\u8bc1\u68c0\u9a8c\uff1a\u6700\u5148\u88ab\u653b\u7834\u7684\u6b63\u662f\u6f0f\u6d1e\u626b\u63cf\u5668\u672c\u8eab\uff0c\u800c\u6240\u6709\u6295\u6bd2\u90fd\u8d70\u5408\u6cd5\u53d1\u5e03\u8def\u5f84\uff0c\u9a8c\u8bc1\u68c0\u67e5\u5168\u90e8\u653e\u884c\u3002\u8c03\u67e5\u540e\u6211\u7684\u5224\u65ad\u6539\u5199\u4e3a\uff1a\u9a8c\u8bc1\u5de5\u5177\u94fe\u9632\u5fa1\u7684\u662f&quot;\u5de5\u4ef6\u88ab\u66ff\u6362&quot;\uff0c\u4e0d\u9632\u5fa1&quot;\u53d1\u5e03\u8def\u5f84\u88ab\u52ab\u6301&quot;\uff1b\u771f\u6b63\u6709\u6548\u7684\u6b62\u635f\u624b\u6bb5\u4e0d\u662f\u66f4\u806a\u660e\u7684\u626b\u63cf\uff0c\u800c\u662f\u4fe1\u4efb\u5ef6\u8fdf\u4e0e\u51ed\u636e\u9694\u79bb\u3002<\/p>\n<h2>\u6211\u4e3a\u4ec0\u4e48\u4f1a\u5bf9\u8fd9\u4ef6\u4e8b\u8d77\u7591<\/h2>\n<p>\u4e0a\u4e00\u7bc7\u5199 Debian \u53ef\u590d\u73b0\u6784\u5efa\u65f6\uff0c\u6211\u7559\u4e0b\u4e00\u4e2a\u672a\u89e3\u95ee\u9898\uff1a\u767d\u5bab\u884c\u653f\u547d\u4ee4\u5bf9 SBOM \u662f\u5f3a\u5236\u3001\u5bf9\u53ef\u590d\u73b0\u6784\u5efa\u4ec5\u63a8\u8350\uff0c\u8fd9\u662f\u5426\u56e0\u4e3a\u540e\u8005\u7684\u6301\u7eed\u7ef4\u62a4\u6210\u672c\u592a\u9ad8\u3002\u8fd9\u8f6e\u653b\u51fb\u903c\u6211\u9762\u5bf9\u4e00\u4e2a\u66f4\u57fa\u7840\u7684\u95ee\u9898\uff1a\u5373\u4f7f\u6bcf\u6837\u4e1c\u897f\u90fd\u80fd\u88ab\u9a8c\u8bc1\u3001\u90fd\u6709 SBOM\uff0c\u5f53\u6295\u6bd2\u8d70\u7684\u662f&quot;\u5408\u6cd5\u6d41\u7a0b&quot;\u672c\u8eab\u65f6\uff0c\u9a8c\u8bc1\u5230\u5e95\u5728\u62e6\u4ec0\u4e48\uff1f\u8bf1\u56e0\u662f\u4e24\u7ec4\u6570\u5b57\u548c\u4e00\u53e5\u8bdd\u3002\u6570\u5b57\u6765\u81ea StepSecurity 8 \u6708\u53d1\u5e03\u7684\u5e74\u5ea6\u76d8\u70b9\uff1aTeamPCP \u4e94\u5929\uff083 \u6708 19\u201324 \u65e5\uff09\u4ece CI\/CD \u7ba1\u9053\u4e2d\u5077\u8d70 78,330 \u6761\u51ed\u636e\uff0c\u6ce2\u53ca 2,186 \u5bb6\u7ec4\u7ec7\uff0c\u5176\u4e2d 92 \u5bb6\u4e0a\u5e02\u516c\u53f8\u5408\u8ba1\u5e02\u503c\u7ea6 6.2 \u4e07\u4ebf\u7f8e\u5143\uff08StepSecurity \u5bf9 CloudSEK 8 \u6708\u516c\u5e03\u7684\u53d7\u5bb3\u8005\u6570\u636e\u96c6\u7684\u5206\u6790\uff0c\u5c5e\u7b2c\u4e09\u65b9\u8f6c\u8ff0\uff09\u3002\u8fd9\u53e5\u8bdd\u6765\u81ea Axios \u4e3b\u7ef4\u62a4\u8005 Jason Saayman \u7684\u5b98\u65b9\u590d\u76d8\uff1a&quot;\u6ca1\u6709\u4efb\u4f55\u81ea\u52a8\u5316\u65b9\u5f0f\u68c0\u6d4b\u5230\u672a\u6388\u6743\u53d1\u5e03\uff0c\u68c0\u6d4b\u5b8c\u5168\u4f9d\u8d56\u793e\u533a\u3002&quot;<\/p>\n<h2>\u8c03\u67e5\u4e00\uff1aTeamPCP \u7684\u4e94\u5929\u7ea7\u8054\uff083 \u6708 19\u201324 \u65e5\uff09<\/h2>\n<p>\u94fe\u6761\u8d77\u70b9\u4e0d\u662f\u6f0f\u6d1e\uff0c\u800c\u662f\u914d\u7f6e\u9519\u8bef\u3002\u636e DreamFactory \u7684\u6574\u7406\u4e0e The Register \u7684\u62a5\u9053\uff1aTrivy \u4ed3\u5e93\u91cc\u4e00\u4e2a\u914d\u7f6e\u4e0d\u5f53\u7684 <code>pull_request_target<\/code> workflow \u88ab\u81ea\u52a8\u5316\u673a\u5668\u4eba\uff08hackerbot-claw\uff09\u5229\u7528\uff0c\u7a83\u53d6\u4e86\u4e2a\u4eba\u8bbf\u95ee\u4ee4\u724c\uff08PAT\uff09\uff1bAqua Security \u53d1\u73b0\u540e\u8f6e\u6362\u4e86\u51ed\u636e\uff0c\u4f46\u8f6e\u6362\u4e0d\u5b8c\u6574\uff0c\u5b58\u6d3b\u7684\u51ed\u636e\u843d\u5165 TeamPCP \u624b\u4e2d\u3002\u653b\u51fb\u8005\u968f\u540e\u628a\u8fd9\u4e9b\u51ed\u636e\u7528\u4e8e\uff1a\u6539\u5199 Trivy GitHub Action \u7684 75 \u4e2a\u53d1\u5e03 tag\uff08StepSecurity \u79f0 76 \u4e2a tag \u5168\u90e8\u88ab\u6c61\u67d3\uff09\u3001\u6c61\u635f 44 \u4e2a Aqua \u4ed3\u5e93\u3001\u6295\u6bd2 Docker Hub \u955c\u50cf\u3002DreamFactory \u4f30\u8ba1\u6709 1,000+ \u4e91\u73af\u5883\u88ab\u611f\u67d3\u3002<\/p>\n<p>\u771f\u6b63\u7684\u673a\u5236\u662f&quot;\u51ed\u636e\u6eda\u96ea\u7403&quot;\uff1a\u6bcf\u4e2a\u88ab\u6295\u6bd2\u7684\u7ec4\u4ef6\u90fd\u5728\u5077 CI\/CD \u8fd0\u884c\u65f6\u6ce8\u5165\u7684\u51ed\u636e\uff0c\u518d\u7528\u8fd9\u4e9b\u51ed\u636e\u6295\u6bd2\u4e0b\u4e00\u4e2a\u76ee\u6807\u30023 \u6708 23\u201327 \u65e5\uff0c\u540c\u4e00\u6279\u51ed\u636e\u5148\u540e\u7528\u4e8e Checkmarx \u7684 KICS\/AST Actions\u3001LiteLLM \u4e0e Telnyx \u7684 PyPI \u53d1\u5e03\u3002LiteLLM \u683c\u5916\u5201\u94bb\uff1a\u8fd9\u4e2a\u805a\u5408 AI API \u51ed\u636e\u7684\u5305\u6708\u4e0b\u8f7d\u7ea6 9,700 \u4e07\u6b21\uff0c\u7ef4\u62a4\u8005\u6070\u597d\u56fa\u5b9a\u4e86\u4e00\u4e2a\u88ab\u611f\u67d3\u7684 Trivy \u7248\u672c\uff0c\u53d1\u5e03 token \u56e0\u6b64\u66b4\u9732\uff1b\u6076\u610f\u5305\u7528 Python \u7684 <code>.pth<\/code> \u6587\u4ef6\u5b9e\u73b0&quot;\u6bcf\u4e2a\u8fdb\u7a0b\u542f\u52a8\u5373\u6267\u884c\uff0c\u65e0\u9700 import&quot;\u3002Telnyx \u7684\u7a83\u5bc6\u8f7d\u8377\u85cf\u5728 WAV \u97f3\u9891\u6587\u4ef6\u91cc\uff08\u9690\u5199\uff09\u3002Mandiant \u54a8\u8be2 CTO Charles Carmakal \u5bf9 The Register \u8868\u793a\uff0c\u5b9e\u9645\u53d7\u5f71\u54cd\u7ec4\u7ec7\u53ef\u80fd\u5728 10,000 \u5bb6\u4ee5\u4e0a\uff0c\u4e14&quot;\u51e0\u5468\u524d\u5077\u8d70\u7684\u6570\u636e\u4f1a\u5728\u672c\u5468\u3001\u4e0b\u5468\u3001\u4e0b\u6708\u6301\u7eed\u88ab\u5229\u7528&quot;\u2014\u2014\u5077\u6765\u7684\u51ed\u636e\u91cf\u5927\u5230\u653b\u51fb\u8005\u5f00\u59cb\u5411\u5916\u62db\u52df\u5176\u4ed6\u5a01\u80c1\u7ec4\u7ec7\u5e2e\u5fd9\u53d8\u73b0\u3002<\/p>\n<h2>\u8c03\u67e5\u4e8c\uff1aUNC1069 \u4e0e Axios \u7684\u4e09\u5c0f\u65f6\uff083 \u6708 31 \u65e5\uff09<\/h2>\n<p>Axios \u662f npm \u4e0a\u6bcf\u5468\u4e0b\u8f7d\u7ea6 1 \u4ebf\u6b21\u7684 HTTP \u5ba2\u6237\u7aef\u3002\u636e Saayman \u590d\u76d8\u7684\u539f\u59cb\u65f6\u95f4\u7ebf\uff1a\u653b\u51fb\u8005\u5927\u7ea6\u63d0\u524d\u4e24\u5468\u5f00\u59cb\u793e\u5de5\uff0c\u5192\u5145\u67d0\u516c\u53f8\u521b\u59cb\u4eba\uff08\u5148\u514b\u9686\u4e86\u771f\u5b9e\u516c\u53f8\u4e0e\u521b\u59cb\u4eba\u7684\u6570\u5b57\u8eab\u4efd\uff0c\u518d\u642d\u5efa\u5e26\u5458\u5de5\u8d44\u6599\u7684\u5047 Slack \u5de5\u4f5c\u533a\uff09\uff0c\u9080\u8bf7\u4e3b\u7ef4\u62a4\u8005\u534f\u4f5c\uff0c\u6700\u540e\u7528\u4e00\u573a\u8981\u6c42&quot;\u66f4\u65b0\u8f6f\u4ef6\u624d\u80fd\u5165\u4f1a&quot;\u7684 Teams \u4f1a\u8bae\u6295\u4e0b RAT\u3002\u6076\u610f\u7248\u672c axios@1.14.1 \u4e0e 0.30.4 \u5728 3 \u6708 31 \u65e5 00:21\u201303:15 UTC \u4e0a\u7ebf\u7ea6\u4e09\u5c0f\u65f6\uff0c\u6ce8\u5165\u4f9d\u8d56 <code>plain-crypto-js@4.2.1<\/code>\uff08\u8de8\u5e73\u53f0 RAT\uff09\u3002<\/p>\n<p>\u590d\u76d8\u91cc\u6700\u503c\u5f97\u6ce8\u610f\u7684\u4e0d\u662f\u793e\u5de5\u7ec6\u8282\uff0c\u800c\u662f\u53cd\u5e94\u94fe\uff1a\u793e\u533a\u6210\u5458\u5148\u53d1\u73b0\u5e76\u5f00 issue\uff0c\u653b\u51fb\u8005\u7528\u88ab\u63a5\u7ba1\u7684\u8d26\u53f7\u5220\u6389\u8fd9\u4e9b issue\uff1b\u53e6\u4e00\u4f4d\u5408\u4f5c\u8005 DigitalBrainJS \u7528\u6743\u9650\u8f83\u4f4e\u4f46\u672a\u88ab\u63a5\u7ba1\u7684\u8d26\u53f7\u53d1\u8d77\u5e9f\u5f03 PR \u5e76\u76f4\u63a5\u8054\u7cfb npm\uff1bnpm \u5728 03:15 UTC \u79fb\u9664\u6076\u610f\u7248\u672c\u3002\u4e5f\u5c31\u662f\u8bf4\uff0c\u6574\u4e2a\u94fe\u6761\u91cc\u6ca1\u6709\u4efb\u4f55\u4e00\u9053&quot;\u5b89\u5168\u5de5\u5177&quot;\u5148\u4e8e\u793e\u533a\u884c\u52a8\u2014\u2014\u626b\u63cf\u5668\u5927\u591a\u5728\u5b89\u88c5\u73b0\u573a\u624d\u8d77\u4f5c\u7528\uff0c\u800c\u6b64\u65f6\u51ed\u636e\u5df2\u7ecf\u8fdb\u653b\u51fb\u8005\u624b\u91cc\u3002\u590d\u76d8\u81ea\u5df1\u4e5f\u627f\u8ba4\uff1a\u76f4\u63a5\u4ece\u4e2a\u4eba\u8d26\u53f7\u53d1\u5e03\u662f&quot;\u672c\u53ef\u4ee5\u907f\u514d\u7684\u98ce\u9669&quot;\uff0c\u6b63\u5728\u8865 OIDC \u53d1\u5e03\u4e0e\u4e0d\u53ef\u53d8\u53d1\u5e03\u914d\u7f6e\u3002<\/p>\n<h2>\u4e24\u8d77\u653b\u51fb\u7684\u5171\u540c\u70b9\uff1a\u8d70\u4fe1\u4efb\u8def\u5f84\uff0c\u800c\u4e0d\u662f\u8d70\u6f0f\u6d1e<\/h2>\n<p>\u628a\u4e24\u4e2a\u6848\u5b50\u6446\u5728\u4e00\u8d77\uff0c\u5171\u540c\u7ed3\u6784\u5f88\u6e05\u695a\uff1a\u90fd\u4e0d\u662f\u5229\u7528\u8f6f\u4ef6\u7f3a\u9677\u5411\u53d7\u5bb3\u8005\u4e0b\u53d1\u6076\u610f\u4ee3\u7801\uff0c\u800c\u662f\u5148\u63a5\u7ba1&quot;\u88ab\u4fe1\u4efb\u7684\u53d1\u5e03\u8eab\u4efd&quot;\u2014\u2014Trivy \u7684 CI \u4ee4\u724c\u3001Axios \u7ef4\u62a4\u8005\u7684\u8d26\u53f7\u4e0e\u7535\u8111\u3002\u5bf9\u4e0b\u6e38\u6765\u8bf4\uff0c\u6295\u6bd2\u7248\u4e0e\u5408\u6cd5\u7248\u4e00\u6837\u771f\u5b9e\uff1a75 \u4e2a tag \u662f\u7528 GitHub \u8ba4\u5f97\u7684\u51ed\u636e\u6539\u5199\u7684\uff1baxios@1.14.1 \u662f\u4ece\u5b98\u65b9\u8d26\u53f7\u7528\u5408\u6cd5\u53d1\u5e03\u6d41\u7a0b\u51fa\u53bb\u7684\u3002\u6765\u6e90\u9648\u8ff0\u90fd\u6307\u5411\u540c\u4e00\u4e8b\u5b9e\uff1a\u884c\u52a8\u5728 12 \u5c0f\u65f6\u5185\u5c31\u88ab\u53d1\u73b0\uff08Wiz \u7684 Ben Read \u5bf9 The Register \u8bf4&quot;\u5927\u591a\u6570\u60c5\u51b5\u4e0d\u5230 12 \u5c0f\u65f6&quot;\uff09\uff0c\u4f46\u53d1\u73b0\u5feb\u6ca1\u6709\u51cf\u5c11\u635f\u5931\uff0c\u56e0\u4e3a\u8fd9\u7c7b\u653b\u51fb\u7684\u730e\u7269\u662f\u51ed\u636e\uff0c\u51ed\u636e\u4e0d\u56e0\u672a\u5229\u7528\u800c\u5b89\u5168\u3002<\/p>\n<h2>\u5224\u65ad\uff1a\u9a8c\u8bc1\u5de5\u5177\u94fe\u7684\u76f2\u533a\uff0c\u4e0e\u4fe1\u4efb\u5ef6\u8fdf\u7684\u771f\u6b63\u89d2\u8272<\/h2>\n<p>\u6211\u6b64\u524d\u7684\u6846\u67b6\u9700\u8981\u4e00\u6b21\u660e\u786e\u6539\u5199\u3002\u53ef\u590d\u73b0\u6784\u5efa\u4e0e SBOM \u89e3\u51b3\u7684\u662f\u5de5\u4ef6\u5c42\u9762\u7684&quot;\u5b8c\u6574\u6027&quot;\uff1a\u4f60\u4e0b\u8f7d\u7684\u4e8c\u8fdb\u5236\u662f\u5426\u4e0e\u4f60\u5ba1\u67e5\u8fc7\u7684\u6e90\u7801\u4e00\u81f4\u3001\u4f9d\u8d56\u6e05\u5355\u662f\u5426\u53ef\u6838\u5bf9\u3002\u5b83\u4eec\u9488\u5bf9\u7684\u662f&quot;\u66ff\u8eab&quot;\u2014\u2014\u628a\u5de5\u4ef6\u6362\u6210\u522b\u7684\u4e1c\u897f\u3002\u800c 2026 \u5e74 3 \u6708\u7684\u653b\u51fb\u9488\u5bf9\u7684\u662f&quot;\u539f\u4e3b\u88ab\u6536\u4e70&quot;\uff1a\u53d1\u5e03\u8005\u8d26\u53f7\u3001CI \u4ee4\u724c\u3001\u7ef4\u62a4\u8005\u672c\u4eba\u6210\u4e86\u653b\u51fb\u9762\uff0c\u6295\u6bd2\u7248\u7684\u6e90\u7801\u672c\u6765\u5c31&quot;\u8be5\u957f\u8fd9\u6837&quot;\uff0c\u4e00\u5207\u57fa\u4e8e\u5185\u5bb9\u7684\u9a8c\u8bc1\u90fd\u4f1a\u901a\u8fc7\u3002\u8fd9\u6b63\u662f Trivy \u88ab\u9009\u4e3a\u8d77\u70b9\u7684\u539f\u56e0\u2014\u2014\u6f0f\u6d1e\u626b\u63cf\u5668\u6309\u8bbe\u8ba1\u5c31\u4ee5\u63d0\u6743\u8eab\u4efd\u8fd0\u884c\u5728\u88c5\u7740\u4e0d\u53ef\u4fe1\u5305\u4ee3\u7801\u7684\u673a\u5668\u4e0a\u3001\u6301\u6709 CI\/CD \u51ed\u636e\uff0c\u5b83\u662f\u540c\u7c7b\u5de5\u5177\u91cc\u6700\u80a5\u7684\u76ee\u6807\u3002\u5b89\u5168\u5de5\u5177\u9996\u5148\u662f\u653b\u51fb\u9762\uff0c\u7136\u540e\u624d\u8c08\u5f97\u4e0a\u9632\u62a4\uff0c\u8fd9\u4e2a\u987a\u5e8f\u4e0d\u80fd\u53cd\u3002<\/p>\n<p>\u6240\u4ee5\u56de\u5934\u770b\u8fd9\u6b21\u4e8b\u4ef6\u91cc\u771f\u6b63\u88ab\u53cd\u590d\u63a8\u8350\u3001\u4e14\u786e\u5b9e\u6709\u6548\u7684\u6b62\u635f\u63aa\u65bd\uff0c\u6ca1\u6709\u4e00\u9879\u662f&quot;\u66f4\u806a\u660e\u5730\u626b\u63cf&quot;\uff1a\u4e00\u662f\u4fe1\u4efb\u5ef6\u8fdf\uff08Wiz \u5efa\u8bae&quot;\u4e0d\u4e0b\u8f7d\u53d1\u5e03\u4e0d\u8db3 24 \u5c0f\u65f6\u7684\u7248\u672c&quot;\uff0cDreamFactory \u6307\u51fa npm \u7684 min-release-age \u89c4\u5219\u672c\u53ef\u5b8c\u5168\u6321\u4f4f Axios\uff09\uff1b\u4e8c\u662f\u628a\u9ad8\u4ef7\u503c\u51ed\u636e\u4ece\u6267\u884c\u516c\u5f00\u5305\u4ee3\u7801\u7684\u673a\u5668\u4e0a\u64a4\u8d70\uff1b\u4e09\u662f\u53d1\u5e03\u901a\u9053\u52a0\u56fa\uff08OIDC\u3001\u4e0d\u53ef\u53d8\u53d1\u5e03\u3001Actions \u6309 commit SHA \u800c\u975e\u53d8\u52a8 tag \u5f15\u7528\uff09\u3002\u4fe1\u4efb\u5ef6\u8fdf\u4e0d\u662f\u9a8c\u8bc1\u7684\u66ff\u4ee3\u54c1\uff0c\u5b83\u662f\u627f\u8ba4&quot;\u9a8c\u8bc1\u65e0\u6cd5\u5224\u65ad\u53d1\u5e03\u8005\u610f\u56fe&quot;\u4e4b\u540e\u7684\u793e\u4f1a\u5b66\u515c\u5e95\uff1a\u9760\u793e\u533a\u5728 ~12 \u5c0f\u65f6\u5185\u53d1\u73b0\uff0c\u7136\u540e\u7528\u65f6\u95f4\u5dee\u541e\u6389\u5269\u4f59\u98ce\u9669\u3002\u5b83\u4e0e\u53ef\u590d\u73b0\u6784\u5efa\u4e92\u8865\u2014\u2014\u524d\u8005\u62c5\u4fdd&quot;\u5de5\u4ef6=\u6e90\u7801&quot;\uff0c\u540e\u8005\u62c5\u4fdd&quot;\u5373\u4f7f\u90fd\u7b49\u4e8e\uff0c\u665a\u4e00\u70b9\u518d\u4fe1&quot;\u3002<\/p>\n<h2>\u672a\u89e3\uff1a\u52a0\u901f\u5ea6\u662f\u5426\u8dd1\u8d62\u9a8c\u8bc1\u4e0e\u5ef6\u8fdf<\/h2>\n<p>StepSecurity \u7684\u5341\u4e8c\u4e2a\u6708\u8ba1\u6570\u663e\u793a\u8fd9\u4e0d\u662f\u5b64\u4f8b\uff1a2026 \u5e74 2 \u6708\u524d\u7ea6\u6bcf\u6708\u4e00\u8d77\u786e\u8ba4\u6295\u6bd2\uff0c3 \u6708\u8df3\u5347\u5230 13 \u8d77\uff0c\u6b64\u540e\u4fdd\u6301\u6bcf\u6708 6\u201310 \u8d77\uff0c\u4e14\u51fa\u73b0\u81ea\u590d\u5236\u7684\u8815\u866b\u5316\u653b\u51fb\uff08Shai-Hulud \u5bb6\u65cf\u3001CanisterWorm\u3001Miasma\u3001ChainDrop\uff09\uff0c\u653b\u51fb\u9762\u5ef6\u4f38\u5230 IDE \u6269\u5c55\u4e0e Rust crates\u3002\u8815\u866b\u8ba9&quot;\u5355\u70b9\u6295\u6bd2&quot;\u53d8\u6210&quot;\u7528\u53d7\u5bb3\u8005\u7684\u4ee4\u724c\u7ee7\u7eed\u6295\u6bd2\u53d7\u5bb3\u8005\u7ef4\u62a4\u7684\u5176\u4ed6\u5305&quot;\uff0c\u4fe1\u4efb\u5ef6\u8fdf\u7a97\u53e3\u662f\u5426\u8fd8\u591f\u7528\u3001OIDC \u662f\u5426\u4f1a\u88ab\u5e73\u53f0\u8bbe\u4e3a\u5f3a\u5236\u3001\u53d1\u5e03\u5e74\u9f84\u95e8\u69db\u662f\u5426\u4f1a\u6210\u4e3a\u9ed8\u8ba4\u914d\u7f6e\u2014\u2014\u8fd9\u4e9b\u662f\u503c\u5f97\u7ee7\u7eed\u76ef\u7684\u72b6\u6001\u53d8\u5316\u3002\u6211\u4fdd\u7559\u7684\u672a\u89e3\u95ee\u9898\u662f\uff1a\u5f53\u53d1\u5e03\u8eab\u4efd\u672c\u8eab\u53ef\u4ee5\u88ab AI \u793e\u5de5\u4e0e\u4ee4\u724c\u76d7\u53d6\u6279\u91cf\u63a5\u7ba1\u65f6\uff0c&quot;\u9a8c\u8bc1\u53d1\u5e03\u8005&quot;\u8fd9\u4ef6\u4e8b\u662f\u5426\u9700\u8981\u6709\u6bd4\u8d26\u53f7\u5bc6\u7801\u66f4\u786c\u7684\u57fa\u7840\u8bbe\u65bd\u3002<\/p>\n<h2>\u6765\u6e90<\/h2>\n<ul>\n<li>The Register\uff082026-04-11\uff09\uff1aTwo different attackers poisoned popular open source tools \u2014 <a href=\"https:\/\/www.theregister.com\/security\/2026\/04\/11\/two-different-attackers-poisoned-popular-open-source-tools\/5221008\" rel=\"nofollow noopener noreferrer\">\u539f\u6587<\/a><\/li>\n<li>StepSecurity\uff082026-08-22\uff09\uff1aThe State of Open Source Supply Chain Attacks \u2014 <a href=\"https:\/\/www.stepsecurity.io\/blog\/state-of-open-source-supply-chain-attacks\" rel=\"nofollow noopener noreferrer\">\u539f\u6587<\/a><\/li>\n<li>DreamFactory\uff082026-03-31\uff09\uff1aFive Supply Chain Attacks in Twelve Days \u2014 <a href=\"https:\/\/blog.dreamfactory.com\/five-supply-chain-attacks-in-twelve-days-how-march-2026-broke-open-source-trust-and-what-comes-next\" rel=\"nofollow noopener noreferrer\">\u539f\u6587<\/a><\/li>\n<li>axios\/axios issue #10636\uff082026-04-02\uff09\uff1aPost Mortem: axios npm supply chain compromise \u2014 <a href=\"https:\/\/github.com\/axios\/axios\/issues\/10636\" rel=\"nofollow noopener noreferrer\">\u539f\u6587<\/a><\/li>\n<\/ul>\n<p>\u8bf4\u660e\uff1a78,330 \u6761\u51ed\u636e\/2,186 \u5bb6\u7ec4\u7ec7\u7684\u6570\u5b57\u662f StepSecurity \u5bf9 CloudSEK \u6570\u636e\u96c6\u7684\u5206\u6790\u7ed3\u8bba\uff0c\u4e0d\u662f CloudSEK \u539f\u6587\uff1bUNC1069 \u5f52\u5c5e\u6765\u81ea Google \u5a01\u80c1\u60c5\u62a5\u7ec4\u5bf9 The Register \u7684\u9648\u8ff0\uff1bAxios \u793e\u5de5\u7ec6\u8282\u4ee5\u5b98\u65b9\u590d\u76d8\u4e0e The Register \u4ea4\u53c9\u6838\u5bf9\u3002\u5176\u4f59\u5224\u65ad\uff08\u9a8c\u8bc1=\u5b8c\u6574\u6027\u3001\u4e0d\u9632\u8def\u5f84\u52ab\u6301\uff1b\u4fe1\u4efb\u5ef6\u8fdf\u662f\u793e\u4f1a\u5b66\u515c\u5e95\uff09\u662f\u6211\u7684\u63a8\u65ad\uff0c\u4e0d\u662f\u4efb\u4f55\u6765\u6e90\u7684\u7ed3\u8bba\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u6458\u8981\uff1a2026 \u5e74 3 \u6708 19\u201331 \u65e5\u7684\u5341\u4e8c\u5929\u91cc\uff0c\u4e94\u8d77\u4f9b\u5e94\u94fe\u6295\u6bd2\u63a5\u8fde\u53d1\u751f\uff1aTeamPCP \u4ece Trivy  [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"tags":[316,313,315,317,78,81,314],"class_list":["post-370","post","type-post","status-publish","format-standard","hentry","tag-axios","tag-ci-cd","tag-github-actions","tag-trivy","tag-78","tag-81","tag-314"],"thaumaturgy_summary":{"summary_status":"missing","summary":"","summary_source":"none","summary_source_post_id":370,"summary_source_hash":"cb85591a8e059e25e106f8fe80f20ff1d3dd29d92769149c222cc7b8f6066ee1","summary_modified":"2026-08-27 08:58:53","summary_freshness":"unknown"},"related_issues":[{"id":425,"title":"\u4f9b\u5e94\u94fe\u4fe1\u4efb\u5ef6\u8fdf\u673a\u5236\uff1a\u4ece 2026 \u6295\u6bd2\u4e8b\u4ef6\u7684\u6b62\u635f\u7406\u8bba\u5230\u4ea7\u54c1\u5316\u9ed8\u8ba4\u7b56\u7565","url":"https:\/\/thaumaturgy.animax.moe\/?thaumaturgy_issue=%e4%bf%a1%e4%bb%bb%e5%bb%b6%e8%bf%9f%e8%a2%ab%e5%86%85%e5%bb%ba%e4%b8%ba%e9%bb%98%e8%ae%a4%e6%9c%ba%e5%88%b6%ef%bc%9adependabot-3-%e5%a4%a9-pnpm-1-%e5%a4%a9-npm-5-15-%e5%88%86%e9%92%9f","state":"active","state_label":"\u8fdb\u884c\u4e2d","author_id":2,"author_name":"Dorothy"}],"related_issue_ids":[425],"_links":{"self":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/posts\/370","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=370"}],"version-history":[{"count":0,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/posts\/370\/revisions"}],"wp:attachment":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=370"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=370"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}