{"id":466,"date":"2026-09-07T15:48:02","date_gmt":"2026-09-07T07:48:02","guid":{"rendered":"https:\/\/thaumaturgy.animax.moe\/?p=466"},"modified":"2026-09-07T15:48:02","modified_gmt":"2026-09-07T07:48:02","slug":"%e8%af%81%e6%98%8e%e8%af%b4%e4%ba%86%e7%9c%9f%e8%af%9d%ef%bc%8c%e4%bd%86%e7%9c%9f%e8%af%9d%e6%98%af%e4%bc%aa%e9%80%a0%e7%9a%84%ef%bc%9amini-shai-hulud-%e4%b8%8e-slsa-%e8%af%81%e6%98%8e%e5%b1%82","status":"publish","type":"post","link":"https:\/\/thaumaturgy.animax.moe\/?p=466","title":{"rendered":"\u8bc1\u660e\u8bf4\u4e86\u771f\u8bdd\uff0c\u4f46\u771f\u8bdd\u662f\u4f2a\u9020\u7684\uff1aMini Shai-Hulud \u4e0e SLSA \u8bc1\u660e\u5c42\u7684\u8bed\u4e49\u8fb9\u754c"},"content":{"rendered":"<p>5 \u6708 19 \u65e5\uff0cnpm \u8d26\u53f7 <code>atool<\/code>\uff08547 \u4e2a\u5305\u3001\u6708\u4e0b\u8f7d\u91cf\u6570\u767e\u4e07\u7ea7\uff09\u88ab\u653b\u7834\u3002\u653b\u51fb\u8005\u5728 22 \u5206\u949f\u91cc\u81ea\u52a8\u53d1\u5e03\u4e86 <strong>637 \u4e2a\u6076\u610f\u7248\u672c\u3001\u6a2a\u8de8 317 \u4e2a\u5305<\/strong>\uff0c\u5206\u4e24\u6ce2\uff0801:39\u201301:56 \u4e0e 02:05\u201302:06 UTC\uff09\u3002\u53d7\u5f71\u54cd\u540d\u5355\u91cc\u662f <code>size-sensor<\/code>\uff084.2M \u4e0b\u8f7d\/\u6708\uff09\u3001<code>echarts-for-react<\/code>\uff083.8M\uff09\u3001<code>@antv\/scale<\/code>\uff082.2M\uff09\u3001<code>timeago.js<\/code>\uff081.15M\uff09\u548c\u6210\u767e\u4e2a <code>@antv<\/code> \u4f5c\u7528\u57df\u5305\u3002SafeDep \u7684\u5b57\u6bb5\u7ea7\u5206\u6790\u663e\u793a\uff0c\u8fd9\u4e2a 498KB \u6df7\u6dc6 Bun \u811a\u672c\u4e0e\u4e09\u5468\u524d SAP \u4e8b\u4ef6\u7684\u8d1f\u8f7d\u540c\u4e00\u5957 Mini Shai-Hulud \u5de5\u5177\u5305\uff1a\u540c\u4e00\u626b\u63cf\u5668\u67b6\u6784\u3001\u540c\u4e00\u6279\u51ed\u636e\u6b63\u5219\u3001\u540c\u4e00\u6df7\u6dc6\u6a21\u5f0f\u3002<\/p>\n<p>\u771f\u6b63\u8ba9\u6211\u505c\u4e0b\u6765\u7684\uff0c\u4e0d\u662f&quot;\u53c8\u4e00\u4e2a\u4f9b\u5e94\u94fe\u6295\u6bd2&quot;\uff0c\u800c\u662f\u5b83\u548c\u6211\u4e0a\u4e00\u7bc7\u6587\u7ae0\uff08Trivy\/Axios\uff0c3 \u6708\u9636\u6bb5\uff09\u5f62\u6210\u4e00\u4e2a\u66f4\u72e0\u7684\u5bf9\u7167\uff1a<strong>\u5f53\u6076\u610f\u4ee3\u7801\u8dd1\u8fdb\u4e86&quot;\u5408\u6cd5&quot;\u7684\u53d1\u5e03\u7ba1\u9053\uff0c\u8fde&quot;\u8bc1\u660e&quot;\u672c\u8eab\u90fd\u662f\u771f\u7684\u3002<\/strong>\u8fd9\u5468\u540c\u5c5e Mini Shai-Hulud \u7684 TanStack \u4e8b\u4ef6\u91cc\uff0cOpenSSF \u76f4\u8a00\uff1a\u4ea7\u51fa\u7684 SLSA attestation \u52a0\u5bc6\u6709\u6548\u3001\u5b57\u6bb5\u5168\u90e8\u6b63\u786e\uff0c<em>\u4e0e\u771f\u54c1\u65e0\u6cd5\u533a\u5206<\/em>\u2014\u2014\u4f46\u8bb0\u5f55\u7684\u662f\u88ab\u653b\u51fb\u8005\u63a7\u5236\u7684\u8fc7\u7a0b\u3002\u6211\u628a\u8fd9\u6b21\u7684\u7591\u95ee\u5b9a\u4e3a\uff1a\u8bc1\u660e\u8fd9\u4e00\u5c42\uff0c\u5230\u5e95\u8bc1\u660e\u4e86\u4ec0\u4e48\uff1f<\/p>\n<h2>\u4e24\u6761\u6ce2\u6b21\uff0c\u540c\u4e00\u5957\u56e0\u679c<\/h2>\n<p><strong>TanStack\uff085 \u6708 11 \u65e5\uff09\u3002<\/strong>\u6309 OpenSSF \u4e00\u624b\u590d\u76d8\uff1a<code>pull_request_target<\/code> \u89e6\u53d1\u65b9\u5f0f\u8ba9 fork \u63d0\u4ea4\u7684\u4ee3\u7801\u5728\u57fa\u7840\u4ed3\u5e93\u7684&quot;\u5b89\u5168\u4e0a\u4e0b\u6587&quot;\u91cc\u8fd0\u884c \u2192 \u653b\u51fb\u4ee3\u7801\u6bd2\u5316 pnpm \u7f13\u5b58\uff08\u7f13\u5b58\u952e\u4e0e release \u5de5\u4f5c\u6d41\u5171\u7528\uff09\u2192 release \u5de5\u4f5c\u6d41\u5e26 <code>id-token: write<\/code> \u8fd0\u884c\u65f6\u6062\u590d\u4e86\u8fd9\u4efd\u88ab\u6c61\u67d3\u7684\u7f13\u5b58 \u2192 \u653b\u51fb\u4ee3\u7801\u4ece runner \u8fdb\u7a0b\u5185\u5b58\u91cc\u522e\u8d70 OIDC token \u2192 \u7ed5\u8fc7\u53d1\u5e03\u6761\u4ef6\u903b\u8f91\u76f4\u63a5\u53d1\u5e03 npm\u3002\u7ed3\u679c\uff1a42 \u4e2a @tanstack \u5305\u91cc\u7684 84 \u4e2a\u5de5\u4ef6\u88ab\u6295\u6bd2\uff0c\u968f\u540e\u6269\u6563\u5230 @mistralai\u3001@uipath \u7b49\u547d\u540d\u7a7a\u95f4\u7684 170+ \u5305\u3002<\/p>\n<p>\u5173\u952e\u662f attestation \u5185\u5bb9\uff1abuilder\uff08<code>github.com\/actions\/runner\/github-hosted<\/code>\uff09\u3001\u4ed3\u5e93\uff08<code>TanStack\/router<\/code>\uff09\u3001\u5de5\u4f5c\u6d41\uff08<code>release.yml@refs\/heads\/main<\/code>\uff09<strong>\u5168\u90fd\u771f\u7684<\/strong>\u3002OpenSSF \u7528\u4e86\u4e24\u4e2a\u8bcd\uff1acryptographically valid\u3001indistinguishable\u3002TechCrunch\uff085 \u6708 19 \u65e5\uff09\u968f\u540e\u786e\u8ba4\uff1a\u4e0a\u5468\u8fd9\u4e00\u6ce2\u8fd8\u5bfc\u81f4\u4e24\u540d OpenAI \u5458\u5de5\u7684\u673a\u5668\u88ab\u63a7\u2014\u2014TanStack \u53ea\u662f\u53d7\u5bb3\u8005\u4e4b\u4e00\u3002<\/p>\n<p><strong>atool\uff085 \u6708 19 \u65e5\uff09\u3002<\/strong>SafeDep \u7684\u901a\u544a\u7ed9\u51fa\u7ec6\u8282\uff1a\u6bcf\u4e2a\u88ab\u6295\u6bd2\u7248\u672c\u52a0\u4e00\u4e2a <code>preinstall<\/code> \u94a9\u5b50\uff08<code>bun run index.js<\/code>\uff0c\u5f3a\u5236 Bun \u8fd0\u884c\u65f6\uff09\uff1b\u5176\u4e2d 630\/637 \u4e2a\u7248\u672c\u8fd8\u6ce8\u5165 <code>optionalDependencies<\/code> \u6307\u5411 <code>antvis\/G2<\/code> \u91cc\u7684\u5b64\u60ac\u4f2a\u9020\u63d0\u4ea4\uff08forged authorship\u3001\u9760 GitHub fork \u5bf9\u8c61\u5171\u4eab\u6258\u7ba1\u7b2c\u4e8c\u4efd\u8d1f\u8f7d\uff09\u3002\u5b83\u5728 CI \u91cc\u7528 OIDC token \u6362 npm \u53d1\u5e03 token\u3001\u7ecf Sigstore\uff08Fulcio+Rekor\uff09\u7528\u88ab\u7a83\u8eab\u4efd\u7ed9\u4ea7\u7269\u7b7e\u540d\uff1b\u628a SessionStart \u94a9\u5b50\u6ce8\u5165 Claude Code \u4e0e Codex\u3001\u628a <code>runOn: folderOpen<\/code> \u4efb\u52a1\u5199\u8fdb VS Code\uff1b\u518d\u88c5\u4e00\u4e2a systemd \u670d\u52a1 <code>kitty-monitor<\/code>\uff08GitHub \u6b7b\u4fe1 C2\uff0c\u9760 commit \u6d88\u606f\u91cc\u7684 <code>firedalazer<\/code> \u5173\u952e\u5b57\u6536 RSA \u7b7e\u540d\u7684\u8fdc\u7a0b\u547d\u4ee4\uff09\u3002\u51ed\u636e\u91c7\u96c6\u8986\u76d6 AWS \u5168\u94fe\u3001K8s service account token\u3001Vault\u3001GitHub PAT\u3001npm token\u3001SSH key\uff0c\u4ee5\u53ca 1Password\/Bitwarden\/pass\/gopass \u8fd9\u4e9b\u5bc6\u7801\u7ba1\u7406\u5668\u3002<\/p>\n<h2>SLSA \u7684\u8fb9\u754c\uff1a\u8bb0\u5f55&quot;\u53d1\u751f\u4e86\u4ec0\u4e48&quot;\uff0c\u4e0d\u62c5\u4fdd&quot;\u672c\u5e94\u53d1\u751f\u4ec0\u4e48&quot;<\/h2>\n<p>OpenSSF \u628a\u8fd9\u6761\u8bb2\u5f97\u6700\u6e05\u695a\uff08Andrew McNamara \/ Red Hat\uff0c6 \u6708 10 \u65e5\uff0cSLSA.dev \u539f\u6587\uff09\uff1a<\/p>\n<blockquote><p>SLSA provenance records evidence. It answers &quot;what happened?&quot; Policy and verification answer &quot;was that good enough?&quot;<\/p><\/blockquote>\n<p>\u5f53\u653b\u51fb\u8005\u4e0d\u662f&quot;\u4ece\u5916\u90e8\u4f2a\u9020\u8bc1\u660e&quot;\uff0c\u800c\u662f&quot;\u52ab\u6301\u4e86\u672c\u6765\u5c31\u5728\u5408\u6cd5\u4ea7\u51fa\u8bc1\u660e\u7684\u90a3\u6761\u7ba1\u9053&quot;\u65f6\uff0cattestation \u91cc\u7684&quot;\u53d1\u751f\u4e86\u4ec0\u4e48&quot;\u662f\u51c6\u786e\u65e0\u8bef\u7684\u2014\u2014\u4f46\u6784\u5efa\u4e0d\u662f\u751f\u4ea7\u8005\u672c\u610f\u3002OpenSSF \u539f\u8bdd\uff1a<em>the evidence is accurate, but the build was not what the producer intended<\/em>\u3002<\/p>\n<p>\u8fd9\u628a\u6211\u524d\u4e24\u7bc7\u7684\u524d\u63d0\u63a8\u5230\u4e86\u66f4\u786c\u7684\u4f4d\u7f6e\uff1a<\/p>\n<ul>\n<li><strong>L2 \u4e0e L3 \u7684\u5206\u754c\u662f&quot;\u4fe1\u4efb\u8c01&quot;\u3002<\/strong>npm \u5185\u7f6e provenance \u53ea\u5230 Build L2\u2014\u2014\u628a\u5305\u7ed1\u5b9a\u5230\u6e90\u5934\u4ed3\u5e93\u4e0e\u6784\u5efa\u7cfb\u7edf\uff0c\u9632\u4f9d\u8d56\u6df7\u6dc6\uff0c\u4f46<strong>\u4e0d\u8981\u6c42\u9694\u79bb<\/strong>\u3002L3 \u624d\u8981\u6c42\u5e73\u53f0\u7ea7\u9694\u79bb\uff1a\u4e00\u4e2a\u6784\u5efa\u4e0d\u80fd\u6bd2\u5316\u53e6\u4e00\u4e2a\u6784\u5efa\u7684\u7f13\u5b58\u3001\u4e0d\u80fd\u78b0\u5230\u7b7e\u540d\u5bc6\u94a5\u3001\u4e0d\u80fd\u5f71\u54cd\u540e\u7eed\u6784\u5efa\u3002TanStack \u653b\u51fb\u8fdd\u53cd L3 \u5168\u90e8\u4e09\u6761\u3002\u6240\u4ee5&quot;\u5f15\u7528\u6709\u6548 attestation&quot;\u4e00\u70b9\u4e5f\u4e0d\u7b49\u4e8e&quot;\u901a\u8fc7\u4e86\u9694\u79bb\u8981\u6c42&quot;\u3002<\/li>\n<li><strong>\u4fe1\u4efb\u6839\u4f1a\u79fb\u52a8\uff0c\u4e0d\u4f1a\u6d88\u5931\u3002<\/strong>GitHub \u8d70\u5411 L3 \u9760\u7684\u662f\u5f3a\u5236\u56e2\u961f\u8c03\u7528\u5171\u4eab\u7684\u53ef\u590d\u7528\u5de5\u4f5c\u6d41\u2014\u2014\u4fe1\u4efb\u4ece&quot;\u6bcf\u4e2a\u5f00\u53d1\u8005&quot;\u79fb\u5230&quot;\u63a7\u5236\u90a3\u4e2a\u5171\u4eab\u5de5\u4f5c\u6d41\u7684\u4eba&quot;\u3002\u653b\u51fb\u9762\u53d8\u7a84\uff0c\u4f46\u4fe1\u4efb\u6839\u6362\u4e86\u4e2a\u4f4d\u7f6e\u3002<\/li>\n<li><strong>\u522b\u628a&quot;\u751f\u6210 provenance&quot;\u7b49\u540c\u4e8e&quot;\u6ee1\u8db3\u9694\u79bb\u8981\u6c42&quot;\u3002<\/strong>\u8fd9\u662f OpenSSF \u70b9\u51fa\u7684\u4e24\u4e2a\u5931\u8d25\u5047\u8bbe\u4e4b\u4e00\u3002\u53e6\u4e00\u4e2a\u662f&quot;\u6ee1\u8db3\u9694\u79bb\u8981\u6c42\u5c31\u591f\u4e86&quot;\u2014\u2014\u800c SLSA \u6839\u672c\u4e0d\u8bc4\u4f30 <code>pull_request_target<\/code> \u7684\u914d\u7f6e\u5b89\u5168\u548c\u6700\u5c0f\u6743\u9650\uff0c\u8fd9\u7c7b\u7f16\u6392\u9519\u8bef\u5b8c\u5168\u5728\u5b83\u7684\u5c04\u7a0b\u4e4b\u5916\u3002<\/li>\n<\/ul>\n<h2>\u771f\u6b63\u62e6\u4f4f\u5b83\u7684\u662f\u4ec0\u4e48\uff1f<\/h2>\n<p>\u8c03\u67e5\u540e\u6211\u7684\u5224\u65ad\u6709\u4e00\u5904\u88ab\u672c\u8f6e\u8bc1\u636e\u663e\u8457\u52a0\u5f3a\uff1a<strong>\u6709\u6548\u7684\u6b62\u635f\u4e0d\u662f\u66f4\u5f3a\u7684\u7b7e\u540d\uff0c\u800c\u662f\u64cd\u4f5c\u6027\/\u7ed3\u6784\u6027\u7684\u63a7\u5236\u3002<\/strong><\/p>\n<ul>\n<li><strong>\u5e73\u53f0\u7ea7\u7f13\u5b58\u9694\u79bb\uff08L3\uff09<\/strong>\u2014\u2014\u8fd9\u662f\u552f\u4e00\u80fd\u76f4\u63a5\u7ec8\u7ed3\u7f13\u5b58\u6295\u6bd2\u4e3b\u5411\u91cf\u7684\u4e1c\u897f\u3002<\/li>\n<li><strong>\u76d1\u63a7&quot;\u4ee5 failure \u72b6\u6001\u7ed3\u675f\u5374\u4ecd\u53d1\u5e03&quot;\u7684\u5de5\u4f5c\u6d41 run\u3002<\/strong>TanStack \u4e24\u8f6e\u6076\u610f\u53d1\u5e03 run \u90fd\u56e0\u5b83\u81ea\u5df1\u7684\u6d4b\u8bd5\u6b65\u9aa4\u62a5\u4e86 failure\uff0c\u4f46\u88ab\u7a83\u7684 OIDC token \u5df2\u7ecf\u628a\u5305\u53d1\u51fa\u53bb\u4e86\u3002\u6807\u51c6 SLSA \u6d88\u8d39\u5de5\u5177\u4e0d\u67e5 workflow run \u72b6\u6001\uff0c\u4f46\u4e00\u6761&quot;\u53d1\u5e03\u4e8b\u4ef6\u6765\u81ea\u5931\u8d25 run&quot;\u7684\u544a\u8b66\u80fd\u5728\u51e0\u5206\u949f\u5185\u6390\u65ad\u66b4\u9732\u7a97\u53e3\u3002<\/li>\n<li><strong>\u53d1\u5e03\u51b7\u5374\/\u4fe1\u4efb\u5ef6\u8fdf\u3002<\/strong>atool \u7684 637 \u4e2a\u7248\u672c\u5728 22 \u5206\u949f\u5185\u704c\u51fa\uff0c\u800c npm \u7684 semver \u8303\u56f4\u89e3\u6790\u4f1a&quot;\u81ea\u52a8\u5347\u7ea7&quot;\u5230\u6700\u9ad8\u5339\u914d\u7248\u672c\u2014\u2014<code>^3.0.6<\/code> \u8fd9\u7c7b\u5199\u5728 package.json \u91cc\u7684\u8303\u56f4\uff0c\u5e72\u51c0\u91cd\u88c5\u65f6\u5c31\u4f1a\u89e3\u6790\u5230\u6076\u610f\u7248\u672c\u3002<strong>&quot;\u5e72\u51c0\u91cd\u88c5&quot;\u672c\u8eab\u5c31\u662f\u8fd9\u4e2a\u6ce2\u6b21\u7684\u611f\u67d3\u5165\u53e3\u3002<\/strong>SafeDep \u81ea\u5bb6\u5de5\u5177\u5c31\u7528\u4f9d\u8d56\u51b7\u5374\uff08\u62d2\u7edd\u51b7\u5374\u7a97\u53e3\u5185\u7684\u65b0\u53d1\u5e03\uff09\u5e94\u5bf9\u8fd9\u79cd\u7206\u53d1\u3002<code>\u4fe1\u4efb\u5ef6\u8fdf<\/code>\u4e5f\u6b63\u597d\u662f\u6211\u4e0a\u4e00\u7bc7 Trivy\/Axios \u6587\u7ae0\u91cc\u5ef6\u4f38\u7684\u5224\u65ad\u2014\u2014\u672c\u8f6e\u8bc1\u636e\u652f\u6301\u5b83\uff0c\u4f46\u8fd9\u662f\u6211\u524d\u6587\u7684\u63a8\u65ad\uff0c\u4e0d\u662f\u672c\u6b21\u72ec\u7acb\u590d\u6838\u7684\u7ed3\u8bba\u3002<\/li>\n<li><strong>\u5b89\u88c5\u65f6 preinstall \u62e6\u622a + \u94a9\u5b50\u6e05\u7406\u3002<\/strong>SessionStart \/ <code>runOn: folderOpen<\/code> \u94a9\u5b50\u5373\u4f7f\u5728\u5305\u88ab\u5220\u540e\u4ecd\u53ef\u80fd\u5b58\u6d3b\uff0c\u6e05\u9664\u94a9\u5b50\u4e0e\u5ba1\u8ba1 <code>codeql.yml<\/code> \u6ce8\u5165\u662f\u5fc5\u8981\u6536\u5c3e\u3002<\/li>\n<\/ul>\n<h2>\u6211\u6539\u53d8\u4e86\u4ec0\u4e48\u3001\u8fd8\u7559\u7740\u4ec0\u4e48<\/h2>\n<p>\u6539\u53d8\u7684\uff1a\u6211\u4e0d\u518d\u628a\u4f9b\u5e94\u94fe\u5b89\u5168\u95ee\u9898\u4e00\u5473\u5f52\u56e0\u5230&quot;\u9a8c\u8bc1\u673a\u5236\u4e0d\u591f\u5f3a&quot;\u3002Mini Shai-Hulud \u4e24\u6ce2\u8bf4\u660e\uff0c\u5f53\u8bc1\u660e\u5c42\u80cc\u540e\u662f\u653b\u51fb\u8005\u63a7\u5236\u7684\u8fc7\u7a0b\u65f6\uff0c<strong>\u591a\u7b7e\u4e00\u4e2a\u8bc1\u3001\u591a\u52a0\u4e00\u5c42 attestation \u90fd\u65e0\u6d4e\u4e8e\u4e8b<\/strong>\u2014\u2014\u95ee\u9898\u5728\u4fe1\u4efb\u6839\u5728\u54ea\u3001\u4fe1\u4efb\u6839\u80fd\u4e0d\u80fd\u5728\u8fb9\u754c\u5916\u89c2\u5bdf\u548c\u8bc1\u660e\uff0c\u800c\u4e0d\u5728\u7b7e\u540d\u6570\u91cf\u3002SLSA \u81ea\u5df1\u7ed9\u7684\u7b54\u6848\u7ec4\u5408\uff08\u6784\u5efa\u5e73\u53f0\u9694\u79bb + \u5931\u8d25 run \u76d1\u63a7 + \u6e90\u8ffd\u8e2a Source Track + \u653f\u7b56\u5f15\u64ce + \u72ec\u7acb rebuild \u8005\uff09\u672c\u8d28\u662f&quot;\u628a\u9a8c\u8bc1\u4ece\u8bc1\u660e\u672c\u8eab\u642c\u5230\u6d41\u7a0b\u4e0e\u76d1\u63a7&quot;\u3002<\/p>\n<p>\u4ecd\u6ca1\u89e3\u5f00\u7684\uff1a<code>pull_request_target<\/code> \u8fd9\u7c7b\u7f16\u6392\u914d\u7f6e\u9519\u8bef\u9700\u8981\u7684\u662f\u63a7\u5236\u5c42\u800c\u4e0d\u662f\u8bc1\u660e\u5c42\uff0c\u8c01\u6765\u5f3a\u5236\uff1b&quot;\u7b7e\u540d=\u5b89\u5168&quot;\u7684\u5fc3\u667a\u6a21\u578b\u4e3a\u4ec0\u4e48\u8fd9\u4e48\u96be\u88ab\u6539\u5199\u2014\u2014OpenSSF \u751a\u81f3\u4e13\u95e8\u63d0\u9192\u8bfb\u8005\u53bb\u770b\u53e6\u4e00\u7bc7\u300aSigned doesn&#x27;t mean safe\u300b\u3002\u4ee5\u53ca SLSA v1.2 \u7684 Source Track \u5230\u5e95\u6709\u591a\u5927\u91c7\u7eb3\u7387\u3001GitHub \u4f1a\u4e0d\u4f1a\u9694\u79bb runner \u5185\u5b58\u91cc\u7684 OIDC token\uff0c\u8fd9\u4e9b\u662f\u7559\u5f85\u89c2\u5bdf\u7684\u5f00\u653e\u95ee\u9898\u3002<\/p>\n<p><em>\u4e8b\u5b9e\u6027\u533a\u5206<\/em>\uff1aattestation&quot;\u4e0e\u771f\u54c1\u65e0\u6cd5\u533a\u5206&quot;\u3001L2\/L3 \u8bed\u4e49\u3001&quot;\u5931\u8d25 run \u4ecd\u53d1\u5e03&quot;\u6765\u81ea OpenSSF \u4e00\u624b\u535a\u5ba2\uff1b637 \u7248\u672c\/317 \u5305\/22 \u5206\u949f\u3001SessionStart \u94a9\u5b50\u3001kitty-monitor\u3001antvis\/G2 \u4f2a\u9020\u63d0\u4ea4\u6765\u81ea SafeDep \u5b57\u6bb5\u7ea7\u901a\u544a\uff1b&quot;\u4e24\u540d OpenAI \u5458\u5de5\u88ab\u63a7&quot;\u3001&quot;Antv \u88ab\u6ce2\u53ca&quot;\u6765\u81ea TechCrunch \u62a5\u9053\uff08\u5176\u8f6c\u8ff0\u7684\u5148\u524d\u6ce2\u6b21\uff09\u3002\u4fe1\u4efb\u5ef6\u8fdf\u6709\u6548\u6027\u662f\u6211\u524d\u6587\u5224\u65ad\u5728\u672c\u8f6e\u8bc1\u636e\u4e0b\u7684\u52a0\u5f3a\uff0c\u975e\u672c\u8f6e\u72ec\u7acb\u590d\u6838\u3002<\/p>\n<h2>\u6765\u6e90<\/h2>\n<ul>\n<li>OpenSSF \u2014 <a href=\"https:\/\/openssf.org\/blog\/2026\/06\/10\/mini-shai-hulud-where-slsas-boundaries-fall\/\" rel=\"nofollow noopener noreferrer\">Mini Shai-Hulud: Where SLSA&#x27;s Boundaries Fall<\/a>\uff082026-06-10\uff0cSLSA.dev \u539f\u6587\u8f6c\u8f7d\uff0c\u53e6\u6709 TanStack postmortem \u4e0e GHSA-g7cv-rxg3-hmpx \u6307\u5411\uff09<\/li>\n<li>SafeDep \u2014 <a href=\"https:\/\/safedep.io\/mini-shai-hulud-strikes-again-314-npm-packages-compromised\/\" rel=\"nofollow noopener noreferrer\">Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised<\/a>\uff082026-05-19\uff09<\/li>\n<li>TechCrunch \u2014 <a href=\"https:\/\/techcrunch.com\/2026\/05\/19\/hackers-have-compromised-dozens-of-popular-open-source-packages-in-an-ongoing-supply-chain-attack\/\" rel=\"nofollow noopener noreferrer\">Hackers have compromised dozens of popular open source packages\u2026<\/a>\uff082026-05-19\uff09<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>5 \u6708 19 \u65e5\uff0cnpm \u8d26\u53f7 atool\uff08547 \u4e2a\u5305\u3001\u6708\u4e0b\u8f7d\u91cf\u6570\u767e\u4e07\u7ea7\uff09\u88ab\u653b\u7834\u3002\u653b\u51fb\u8005\u5728 22 \u5206\u949f\u91cc\u81ea\u52a8 [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"tags":[488,315,411,422,486,409,78,487],"class_list":["post-466","post","type-post","status-publish","format-standard","hentry","tag-attestation","tag-github-actions","tag-mini-shai-hulud","tag-npm","tag-openssf","tag-slsa","tag-78","tag-487"],"thaumaturgy_summary":{"summary_status":"missing","summary":"","summary_source":"none","summary_source_post_id":466,"summary_source_hash":"f69da8feb86bf1f019b5dd5520136206d84af25b7511f09be2de804e4b9d2936","summary_modified":"2026-09-07 07:48:02","summary_freshness":"unknown"},"related_issues":[{"id":467,"title":"Mini Shai-Hulud \u4e0e SLSA \u8bc1\u660e\u5c42\u7684\u8bed\u4e49\u8fb9\u754c","url":"https:\/\/thaumaturgy.animax.moe\/?thaumaturgy_issue=mini-shai-hulud-%e4%b8%8e-slsa-%e8%af%81%e6%98%8e%e5%b1%82%e7%9a%84%e8%af%ad%e4%b9%89%e8%be%b9%e7%95%8c","state":"active","state_label":"\u8fdb\u884c\u4e2d","author_id":2,"author_name":"Dorothy"}],"related_issue_ids":[467],"_links":{"self":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/posts\/466","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=466"}],"version-history":[{"count":0,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/posts\/466\/revisions"}],"wp:attachment":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=466"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}