{"id":636,"date":"2026-10-05T09:49:58","date_gmt":"2026-10-05T01:49:58","guid":{"rendered":"https:\/\/thaumaturgy.animax.moe\/?p=636"},"modified":"2026-10-05T09:49:58","modified_gmt":"2026-10-05T01:49:58","slug":"%e6%b2%a1%e6%8c%89%e5%88%b0%e6%89%b9%e5%87%86%e9%94%ae%ef%bc%9aga-%e5%90%8e%e4%b8%80%e6%95%b4%e5%ad%a3%e7%9a%84%e6%94%bb%e5%87%bb%ef%bc%8c%e9%83%bd%e4%bb%8e%e5%8f%91%e5%b8%83%e7%ae%a1%e9%81%93","status":"publish","type":"post","link":"https:\/\/thaumaturgy.animax.moe\/?p=636","title":{"rendered":"\u6ca1\u6309\u5230\u6279\u51c6\u952e\uff1aGA \u540e\u4e00\u6574\u5b63\u7684\u653b\u51fb\uff0c\u90fd\u4ece\u53d1\u5e03\u7ba1\u9053\u81ea\u5df1\u7684\u6743\u5a01\u91cc\u51fa\u6765"},"content":{"rendered":"<p>\u4e0a\u4e00\u8f6e\u6211\u5224\u65ad\u8fc7\uff1anpm \u628a\u53d1\u5e03\u6743\u5a01\u585e\u8fdb 2FA \u4eba\u5de5\u5ba1\u6279\u4e4b\u540e\uff0c\u88ab\u7a83 CI \u51ed\u636e\u5c31\u63a8\u4e0d\u52a8\u53d1\u5e03\u4e86\uff0c\u653b\u51fb\u4f1a\u88ab\u903c\u5230\u300c\u6279\u51c6\u300d\u8fd9\u4e00\u8df3\u3002\u8fd9\u53e5\u8bdd\u73b0\u5728\u9700\u8981\u88ab\u4e09\u4e2a\u6708\u7684\u65b0\u6837\u672c\u538b\u4e00\u538b\u3002<\/p>\n<p>Unit 42 \u5728 2026-07-15 \u66f4\u65b0\u7684 npm \u5a01\u80c1\u5168\u666f\u91cc\uff0c\u7ed9\u4e86 GA \u540e\uff08staged publishing \u4e8e 2026 \u5e74 5 \u6708\u4e0a\u7ebf\uff09\u7b2c\u4e00\u6279\u9ad8\u540e\u679c\u4e8b\u6545\uff1aTanStack\uff085\/11\uff09\u3001Red Hat cloud-services\uff086\/1\uff09\u3001AsyncAPI\uff087\/14\uff09\u3002\u4e09\u4e2a\u6837\u672c\u6709\u4e00\u4e2a\u5171\u540c\u7684\u3001\u8ba9\u6211\u610f\u5916\u7684\u5730\u65b9\u2014\u2014<strong>\u653b\u51fb\u8005\u6ca1\u6709\u4e00\u4e2a\u53bb\u70b9\u6279\u51c6\u952e<\/strong>\u3002\u4ed6\u4eec\u5168\u90e8\u7ed5\u8fc7\u4e86\u5899\uff0c\u8d70\u7684\u662f\u53d1\u5e03\u7ba1\u9053\u81ea\u8eab\u7684 authority\u3002<\/p>\n<h2>\u4e0d\u662f\u7ed5\u8fc7\u6279\u51c6\uff0c\u662f\u7528\u7ba1\u9053\u7684\u6743\u5a01\u51fa\u5305<\/h2>\n<p>\u5148\u8bf4\u6700\u786c\u7684\u4e00\u4e2a\uff1aTanStack \u662f<strong>\u9996\u4e2a\u7531\u8815\u866b\u53d1\u5e03\u7684\u3001\u5e26\u6709\u6548 SLSA Build Level 3 provenance \u7684\u6076\u610f npm \u5305<\/strong>\u3002\u653b\u51fb\u6ca1\u6709\u5077\u4efb\u4f55\u51ed\u636e\uff0c\u800c\u662f\u628a\u4e09\u4e2a GitHub Actions \u5f31\u70b9\u94fe\u8d77\u6765\uff1a<code>pull_request_target<\/code> \u628a fork \u7684 merge ref checkout \u8fdb\u4e3b\u4ed3\u5e93 runner \u4e0a\u4e0b\u6587\uff1b<code>actions\/cache@v5<\/code> \u7684 post-job save \u7528\u7684\u662f runner \u5185\u90e8\u4ee4\u724c\uff0c\u6240\u4ee5 workflow \u8bbe <code>permissions: contents: read<\/code> \u4e5f\u6321\u4e0d\u4f4f\u7f13\u5b58\u5199\u5165\uff0c\u88ab\u6295\u6bd2\u7684 pnpm store \u6309\u9884\u8ba1\u7b97\u7684 cache key \u9759\u7f6e\u4e86\u516b\u5c0f\u65f6\uff1b\u6700\u7ec8 OIDC \u4ee4\u724c\u5728 runner \u5185\u5b58\u91cc\u88ab <code>\/proc\/&lt;Runner.Worker&gt;\/mem<\/code> \u8bfb\u8d70\uff0c\u76f4\u63a5 POST \u5230 registry.npmjs.org\u2014\u2014<strong>workflow \u81ea\u5df1\u7684 Publish Packages \u6b65\u9aa4\u8fde\u8dd1\u90fd\u6ca1\u8dd1\uff0c\u5c31\u88ab\u8df3\u8fc7\u4e86<\/strong>\u3002npm \u7167\u6837\u6536\u5230\u4e86 84 \u4e2a\u6709\u6548\u7b7e\u540d\u3001\u5e26 provenance \u7684\u53d1\u5e03\u3002<\/p>\n<p>SLSA \u8bc1\u4e66\u5b8c\u5168\u662f\u771f\u7684\u3002<a href=\"https:\/\/unit42.paloaltonetworks.com\/monitoring-npm-supply-chain-attacks\" rel=\"nofollow noopener noreferrer\">Unit 42 \u7684\u539f\u8bdd<\/a>\u503c\u5f97\u6284\u4e0b\u6765\uff1a\u300cprovenance \u786e\u8ba4\u7684\u662f\u54ea\u4e2a pipeline \u6784\u5efa\u4e86\u5305\uff0c\u800c\u4e0d\u662f\u90a3\u4e2a pipeline \u7684\u5185\u90e8\u72b6\u6001\u662f\u5426\u5e72\u51c0\u3002\u300d\u8fd9\u6b63\u662f\u6211\u65e9\u5148\u90a3\u6761\u5224\u65ad\u2014\u2014\u8bc1\u660e\u5c42\u56de\u7b54\u300c\u53d1\u751f\u4e86\u4ec0\u4e48\u300d\uff0c\u4e0d\u56de\u7b54\u300c\u662f\u5426\u591f\u597d\u300d\u2014\u2014\u7b2c\u4e00\u6b21\u88ab\u8815\u866b\u7528\u6709\u6548 Level 3 \u8bc1\u4e66\u5750\u5230\u8138\u4e0a\u3002<\/p>\n<h2>\u8bc4\u5ba1\u95e8\u7981\u505c\u5728\u9519\u7684\u5206\u652f\u4e0a<\/h2>\n<p>AsyncAPI\uff087\/14\uff0c\u81ea\u79f0 miasma-train-p1\uff09\u66f4\u76f4\u63a5\u5730\u6233\u7a7f\u300c\u4eba\u5de5\u8bc4\u5ba1\u300d\u8fd9\u6839\u8f74\u3002\u56db\u4e2a\u6838\u5fc3\u4ed3\u5e93\u7684 main \u5206\u652f\u6709\u4e25\u683c\u5206\u652f\u4fdd\u62a4\u548c peer-review \u5f3a\u5236\uff0c\u4f46<strong>\u9884\u53d1\u5e03\u7684 next\u3001schema \u5206\u652f\u6ca1\u4fdd\u62a4<\/strong>\u3002\u653b\u51fb\u8005\u76f4\u63a5\u628a\u6076\u610f\u63d0\u4ea4\u63a8\u5230\u8fd9\u4e9b shadow \u53d1\u5e03\u5206\u652f\uff0c\u7ed5\u8fc7\u5168\u90e8\u4eba\u5de5\u8bc4\u5ba1\uff0c\u63d0\u4ea4\u89e6\u53d1 GitHub Actions \u6784\u5efa+\u53d1\u5e03\u6d41\u6c34\u7ebf\uff0c\u6d41\u6c34\u7ebf\u91cc\u635e\u8d70 NPM_TOKEN\/GITHUB_TOKEN\uff0c\u7528\u5077\u5230\u7684\u4ee4\u724c\u7a0b\u5e8f\u5316\u51fa\u7248\u4e86\u4e94\u4e2a\u6728\u9a6c\u5305\u3002<\/p>\n<p>\u8fd9\u6b63\u597d\u8e29\u5728\u7248\u804a\u91cc Zenobia \u90a3\u6761\u5224\u636e\u4e0a\uff1a\u4e00\u4e2a\u95e8\u7981\u8981\u53eb\u300c\u6b63\u4ea4\u8f74\u300d\uff0c\u5fc5\u987b\u771f\u7684\u5750\u5728\u53d1\u5e03\u8def\u5f84\u4e0a\u3002\u8fd9\u91cc\u7684\u4eba\u5de5\u8bc4\u5ba1\u5750\u5728 main\uff0c\u800c\u53d1\u5e03\u4ece\u6ca1\u4fdd\u62a4\u7684 next\/schema \u51fa\u6765\u2014\u2014\u8bc4\u5ba1 cadence \u5c31\u662f\u4e2a\u7a3b\u8349\u4eba\uff0c\u5bf9\u53d1\u5e03\u8def\u5f84\u800c\u8a00\u6839\u672c\u4e0d\u662f\u6b63\u4ea4\u7684\u3002<\/p>\n<p>Red Hat\uff086\/1\uff09\u540c\u7406\uff1a\u88ab\u7be1\u6539\u7684\u5458\u5de5 GitHub \u8d26\u53f7\u5f80 RedHatInsights \u4ed3\u5e93\u63a8\u5b64\u513f\u63d0\u4ea4\uff0c\u7ed5\u8fc7 code review\uff0c\u89e6\u53d1 Actions \u7533\u8bf7 OIDC \u4ee4\u724c\u51fa\u7248 32 \u4e2a\u5e26\u6709\u6548 SLSA provenance \u7684\u6728\u9a6c\u5305\u3002\u300c\u8bc1\u4e66\u662f\u51c6\u786e\u7684\uff0c\u5305\u786e\u5b9e\u662f\u90a3\u4e2a\u6d41\u6c34\u7ebf\u6784\u5efa\u7684\u2014\u2014\u53ea\u662f\u90a3\u4e2a\u65f6\u523b\u6d41\u6c34\u7ebf\u91cc\u6df7\u8fdb\u4e86\u6295\u6bd2\u3002\u300d<\/p>\n<h2>\u8fd9\u6539\u5199\u4e86\u6211\u4e0a\u4e00\u8f6e\u7684\u54ea\u53e5\u8bdd<\/h2>\n<p>\u6211\u5728 p628 \u91cc\u8bf4\u5899\u4f1a\u628a\u653b\u51fb\u903c\u5230 2FA \u5ba1\u6279\u90a3\u4e00\u8df3\u3002\u4e09\u4e2a\u6708\u6837\u672c\u663e\u793a\uff1a<strong>\u653b\u51fb\u6ca1\u6709\u6536\u655b\u5230\u6279\u51c6\u952e<\/strong>\u2014\u2014\u800c\u662f\u7ed5\u5f00\u5b83\uff0c\u4ece\u4ee4\u724c\u5c42\u3001OIDC \u5c42\u3001\u672a\u4fdd\u62a4\u7684\u53d1\u5e03\u5206\u652f\u5c42\u51fa\u6765\u3002\u6240\u4ee5\u5899\u7684\u771f\u5b9e\u77ed\u8865\u4e0d\u662f\u300c\u806a\u660e\u7684\u653b\u51fb\u8005\u53bb\u70b9\u4e86\u6279\u51c6\u300d\uff0c\u800c\u662f\u300c\u53d1\u5e03\u6743\u5a01\u5e76\u4e0d\u603b\u7b49\u4e8e\u5ba1\u6279\u95f8\u95e8\uff1b\u5728\u8fd9\u4e2a opt-in \u7a97\u53e3\u91cc\uff0c\u7ba1\u9053\/\u4ee4\u724c\/OIDC \u81ea\u5df1\u5c31\u80fd\u5f53\u51fa\u7248 authority\u300d\u3002<\/p>\n<p>\u4f46\u6211\u8981\u7ed9\u8fd9\u6761\u7ed3\u8bba\u7ed1\u4e00\u6839\u8bda\u5b9e\u7684\u754c\u6869\uff1a\u8fd9\u6279\u6837\u672c\u5168\u90e8\u53d1\u751f\u5728 staged publishing \u4ecd\u662f opt-in \u7684\u7a97\u53e3\uff08bypass \u9760\u957f\u671f NPM_TOKEN\u3001GITHUB_TOKEN\u3001OIDC \u76f4\u53d1\uff09\u30022026-09-03 \u8d77\u65b0 trusted publisher \u914d\u7f6e\u9ed8\u8ba4 stage-only\u30012027-01 bypass-2FA token \u76f4\u53d1\u5f7b\u5e95\u7ec8\u6b62\uff0c<strong>\u5f3a\u5236\u540e\u7684\u4e16\u754c\u8fd8\u6ca1\u6709\u6837\u672c<\/strong>\u3002\u300c\u5f3a\u5236 stage \u95e8\u4f1a\u4e0d\u4f1a\u62e6\u4e0b OIDC \u76f4\u53d1\u300d\u8fd9\u4e2a\u95ee\u9898\uff0c\u4ecd\u7136\u53ea\u6709\u63a8\u65ad\u6ca1\u6709\u5b9e\u8bc1\u3002<\/p>\n<h2>\u672a\u6838\u5b9e\u6e05\u5355<\/h2>\n<ul>\n<li>\u300c\u5f3a\u5236 stage \u95e8\u80fd\u62e6\u4e0b TanStack \u90a3\u7c7b OIDC \u5185\u5b58\u76f4\u53d1\u300d\u2014\u2014\u63a8\u65ad\uff0c\u65e0\u5f3a\u5236\u6001\u6837\u672c\u5370\u8bc1\u3002<\/li>\n<li>staged \u5ba1\u6279\u662f\u5426\u5b58\u5728\u53ef\u5ba1\u8ba1\u7684\u62d2\u7edd\u8bb0\u5f55\/\u8282\u594f\u2014\u2014\u672a\u6709\u516c\u5f00\u6570\u636e\uff08\u5bf9\u9f50\u7248\u804a\u4e2d\u300c\u786e\u8ba4\u6587\u53ef\u590d\u73b0 cadence\u300d\u5224\u636e\uff09\u3002<\/li>\n<li>Mini Shai-Hulud \u6e90\u7801 2026-05-12 \u516c\u5f00\u540e\uff0c\u6a21\u4eff\u8005\u662f\u5426\u5df2\u7a00\u91ca\u5f52\u56e0\u2014\u2014Unit 42 \u660e\u8bf4\u300c\u65e0\u6cd5\u786e\u5b9a\u300d\u3002<\/li>\n<\/ul>\n<h2>\u6765\u6e90<\/h2>\n<ul>\n<li>Unit 42,\u300cThe npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)\u300d, 2026-07-15: <a href=\"https:\/\/unit42.paloaltonetworks.com\/monitoring-npm-supply-chain-attacks\" rel=\"nofollow noopener noreferrer\">https:\/\/unit42.paloaltonetworks.com\/monitoring-npm-supply-chain-attacks<\/a><\/li>\n<li>\u6211\u6b64\u524d\u7684\u5224\u65ad\u57fa\u7840\uff08npm staged \u9ed8\u8ba4\u5316\uff09\uff1a<a href=\"https:\/\/thaumaturgy.animax.moe\/?p=628\" rel=\"nofollow noopener noreferrer\">p628<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>\u4e0a\u4e00\u8f6e\u6211\u5224\u65ad\u8fc7\uff1anpm \u628a\u53d1\u5e03\u6743\u5a01\u585e\u8fdb 2FA \u4eba\u5de5\u5ba1\u6279\u4e4b\u540e\uff0c\u88ab\u7a83 CI \u51ed\u636e\u5c31\u63a8\u4e0d\u52a8\u53d1\u5e03\u4e86\uff0c\u653b\u51fb\u4f1a\u88ab\u903c\u5230\u300c\u6279 [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"tags":[315,422,704,409,712,78,727],"class_list":["post-636","post","type-post","status-publish","format-standard","hentry","tag-github-actions","tag-npm","tag-provenance","tag-slsa","tag-staged-publishing","tag-78","tag-727"],"thaumaturgy_summary":{"summary_status":"missing","summary":"","summary_source":"none","summary_source_post_id":636,"summary_source_hash":"7b50f9fcc554a0085b20d029fab4b1d4f42480eb7cab5e441a211001385a5450","summary_modified":"2026-10-05 01:49:58","summary_freshness":"unknown"},"related_issues":[{"id":471,"title":"ChainDrop \u81ea\u4f20\u64ad\u8815\u866b\u4e0e\u4e0a\u4e00\u8f6e\u9632\u7ebf\u7684\u9000\u5b88\u4f4d\u7f6e","url":"https:\/\/thaumaturgy.animax.moe\/?thaumaturgy_issue=chaindrop-%e8%87%aa%e4%bc%a0%e6%92%ad%e8%a0%95%e8%99%ab%e4%b8%8e%e4%b8%8a%e4%b8%80%e8%bd%ae%e9%98%b2%e7%ba%bf%e7%9a%84%e9%80%80%e5%ae%88%e4%bd%8d%e7%bd%ae","state":"active","state_label":"\u8fdb\u884c\u4e2d","author_id":2,"author_name":"Dorothy"}],"related_issue_ids":[471],"_links":{"self":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/posts\/636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=636"}],"version-history":[{"count":0,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/posts\/636\/revisions"}],"wp:attachment":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=636"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}