{"id":45090,"date":"2026-08-07T02:22:58","date_gmt":"2026-08-06T17:22:58","guid":{"rendered":"https:\/\/jore2.com\/?p=45090"},"modified":"2026-08-07T02:22:58","modified_gmt":"2026-08-06T17:22:58","slug":"ai-49263-how-we-took-malware-advisories-beyond-npm","status":"publish","type":"post","link":"https:\/\/jore2.com\/?p=45090","title":{"rendered":"npm\uc744 \ub118\uc5b4\uc120 \uc545\uc131 \ud328\ud0a4\uc9c0 \uacbd\uace0: \uacf5\uae09\ub9dd \ubcf4\uc548\uc758 \uc0c8\ub85c\uc6b4 \uae30\uc900\uc774 \ub418\ub294 \uc774\uc720"},"content":{"rendered":"<div class=\"jore2-editor-byline\">\n<p><strong>\uae40\ub3c4\uc724<\/strong><\/p>\n<\/div>\n<p>\uc18c\ud504\ud2b8\uc6e8\uc5b4 \uac1c\ubc1c\uc790\ub4e4\uc774 \uac00\uc7a5 \ub450\ub824\uc6cc\ud558\ub294 \uc21c\uac04 \uc911 \ud558\ub098\ub294 \uc790\uc2e0\uc774 \uc758\uc874\ud558\ub294 \ub77c\uc774\ube0c\ub7ec\ub9ac\uac00 \uac11\uc790\uae30 \uc545\uc131 \ucf54\ub4dc\ub97c \ud488\uace0 \uc788\ub2e4\ub294 \uc0ac\uc2e4\uc744 \uc54c\uac8c \ub418\ub294 \uac83\uc785\ub2c8\ub2e4. \uacfc\uac70\uc5d0\ub294 \uc774\ub7ec\ud55c \uacbd\uace0\uac00 \uc8fc\ub85c npm \ud328\ud0a4\uc9c0\uc5d0 \uad6d\ud55c\ub418\uc5b4 \uc788\uc5c8\uc9c0\ub9cc, \ucd5c\uadfc GitHub \uac00 \ubc1c\ud45c\ud55c \uc0c8\ub85c\uc6b4 \uc2dc\uc2a4\ud15c\uc740 \uc774 \ubc94\uc704\ub97c \ud6e8\uc52c \ub354 \ub113\ud614\uc2b5\ub2c8\ub2e4.<\/p>\n<p>\uc774\uc81c npm \uc744 \ub118\uc5b4 \ub2e4\uc591\ud55c \ud328\ud0a4\uc9c0 \uad00\ub9ac\uc790\uc640 \uc0dd\ud0dc\uacc4 \uc804\ubc18\uc73c\ub85c \uc545\uc131 \ud328\ud0a4\uc9c0 \uacbd\uace0\uac00 \ud655\uc7a5\ub41c \uac83\uc785\ub2c8\ub2e4. \uc774 \ubcc0\ud654\ub294 \ub2e8\uc21c\ud55c \uae30\ub2a5 \ucd94\uac00\uac00 \uc544\ub2c8\ub77c \uacf5\uae09\ub9dd \ubcf4\uc548\uc758 \ud328\ub7ec\ub2e4\uc784\uc744 \ubc14\uafb8\ub294 \uc911\uc694\ud55c \uc804\ud658\uc810\uc73c\ub85c \ud3c9\uac00\ubc1b\uace0 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<p>## OpenSSF \ub370\uc774\ud130 \uc5f0\ub3d9\uc73c\ub85c \uc644\uc131\ub41c paranoid \ud30c\uc774\ud504\ub77c\uc778<\/p>\n<p>GitHub \uac00 \uc774 \ubcc0\ud654\ub97c \uc8fc\ub3c4\ud55c \ud575\uc2ec \ub3d9\ub825\uc740 OpenSSF \uc758 malicious-packages \ub370\uc774\ud130\ub97c \uc5b4\ub4dc\ubc14\uc774\uc9c0\ub9ac \ub370\uc774\ud130\ubca0\uc774\uc2a4\uc5d0 \uc9c1\uc811 \uc5f0\ub3d9\ud55c \uac83\uc785\ub2c8\ub2e4. \uc774\uc804\uae4c\uc9c0\ub294 \uac01 \ud328\ud0a4\uc9c0 \uad00\ub9ac\uc790\uac00 \uc790\uccb4\uc801\uc73c\ub85c \uc545\uc131 \ucf54\ub4dc\ub97c \ud0d0\uc9c0\ud558\uace0 \uacbd\uace0\ub97c \ubc1c\ub839\ud558\ub294 \ubc29\uc2dd\uc774 \uc8fc\ub97c \uc774\ub918\uc2b5\ub2c8\ub2e4.<\/p>\n<p>\ud558\uc9c0\ub9cc \uc774\ub807\uac8c \ub418\uba74 \ub3d9\uc77c\ud55c \uc545\uc131 \ucf54\ub4dc\uac00 \ub2e4\ub978 \uc774\ub984\uc774\ub098 \ub2e4\ub978 \ud3ec\ub9f7\uc73c\ub85c \uc874\uc7ac\ud560 \ub54c \uac1c\ubc1c\uc790\ub4e4\uc740 \ub193\uce58\uae30 \uc27d\uc2b5\ub2c8\ub2e4. GitHub \ub294 \uc774\ub7ec\ud55c \uac04\uadf9\uc744 \uba54\uc6b0\uae30 \uc704\ud574 OpenSSF \uac00 \uc218\uc9d1\ud55c \ub370\uc774\ud130\ub97c \uae30\ubc18\uc73c\ub85c \ud30c\uc774\ud504\ub77c\uc778\uc744 \uad6c\ucd95\ud588\uc2b5\ub2c8\ub2e4.<\/p>\n<p>\uc774 \ud30c\uc774\ud504\ub77c\uc778\uc740 \ub9c8\uce58 paranoid \ud558\ub4ef \ubaa8\ub4e0 \uac00\ub2a5\uc131\uc744 \uc758\uc2ec\ud558\uba70 \ub370\uc774\ud130\ub97c \uac80\uc99d\ud558\ub294 \ubc29\uc2dd\uc73c\ub85c \uc124\uacc4\ub418\uc5c8\uc2b5\ub2c8\ub2e4.<\/p>\n<p>\uad6c\uccb4\uc801\uc73c\ub85c \ubcf4\uba74 \uc774 \uc2dc\uc2a4\ud15c\uc740 \ub2e8\uc21c\ud788 \ub370\uc774\ud130\ub97c \uac00\uc838\uc624\ub294 \uac83\uc744 \ub118\uc5b4, \uac01 \ud328\ud0a4\uc9c0\uc758 \uc774\ub825\uacfc \ubcc0\uc870 \uc5ec\ubd80\ub97c \uc2ec\uce35\uc801\uc73c\ub85c \ubd84\uc11d\ud569\ub2c8\ub2e4. \uac1c\ubc1c\uc790\uac00 \ud2b9\uc815 \ubc84\uc804\uc744 \ub2e4\uc6b4\ub85c\ub4dc\ud560 \ub54c \uc2dc\uc2a4\ud15c\uc740 \ubc31\uadf8\ub77c\uc6b4\ub4dc\uc5d0\uc11c \ud574\ub2f9 \ud328\ud0a4\uc9c0\uac00 \uc545\uc131 \ucf54\ub4dc \ubaa9\ub85d\uc5d0 \uc788\ub294\uc9c0 \uc2e4\uc2dc\uac04\uc73c\ub85c \ub300\uc870\ud569\ub2c8\ub2e4.<\/p>\n<p>\ub9cc\uc57d \uc758\uc2ec\uc2a4\ub7ec\uc6b4 \ud328\ud134\uc774 \ud3ec\ucc29\ub418\uba74 \uc989\uc2dc \uacbd\uace0\uac00 \ub728\uace0, \uc0ac\uc6a9\uc790\ub294 \ud574\ub2f9 \ud328\ud0a4\uc9c0\ub97c \ub300\uccb4\ud558\uac70\ub098 \uc5c5\ub370\uc774\ud2b8\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \uc774\ub7ec\ud55c \uc790\ub3d9\ud654\ub41c \uac80\uc99d \uacfc\uc815\uc740 \uc218\ub3d9\uc73c\ub85c \ud655\uc778\ud558\ub358 \uacfc\uac70 \ubc29\uc2dd\uc5d0 \ube44\ud574 \ud6e8\uc52c \ube60\ub974\uace0 \uc815\ud655\ud569\ub2c8\ub2e4.<\/p>\n<p>\ud2b9\ud788 \ub300\uaddc\ubaa8 \ud504\ub85c\uc81d\ud2b8\ub97c \uc6b4\uc601\ud558\ub294 \uae30\uc5c5\ub4e4\uc5d0\uac8c\ub294 \uc778\uc801 \uc624\ub958\ub97c \uc904\uc5ec\uc8fc\ub294 \uac15\ub825\ud55c \ubc29\ud328\uac00 \ub429\ub2c8\ub2e4.<\/p>\n<p>## \uacf5\uae09\ub9dd \ubcf4\uc548\uc758 \uc0c8\ub85c\uc6b4 \uae30\uc900\uacfc \uac1c\ubc1c\uc790\uc758 \ub300\uc751 \uc804\ub7b5<\/p>\n<p>\uc774\uc81c \uac1c\ubc1c\uc790\ub4e4\uc740 npm \uc5d0\ub9cc \uc758\uc874\ud558\uc9c0 \uc54a\uace0\ub3c4 \uc804\uccb4 \uacf5\uae09\ub9dd\uc758 \uc548\uc804\uc131\uc744 \ud55c\ub208\uc5d0 \ud655\uc778\ud560 \uc218 \uc788\uac8c \ub418\uc5c8\uc2b5\ub2c8\ub2e4. \uc774\ub294 \ud2b9\ud788 \uba40\ud2f0 \uc5b8\uc5b4 \ud658\uacbd\uc744 \uc0ac\uc6a9\ud558\ub294 \ud604\ub300\uc801\uc778 \uac1c\ubc1c \uc6cc\ud06c\ud50c\ub85c\uc6b0\uc5d0 \ud070 \ubcc0\ud654\ub97c \uc90d\ub2c8\ub2e4.<\/p>\n<p>\uc608\ub97c \ub4e4\uc5b4 \ud30c\uc774\uc36c\uacfc \uc790\ubc14\uc2a4\ud06c\ub9bd\ud2b8\ub97c \ub3d9\uc2dc\uc5d0 \uc0ac\uc6a9\ud558\ub294 \ud504\ub85c\uc81d\ud2b8\uc5d0\uc11c \ud55c\ucabd \uc5b8\uc5b4\uc758 \ud328\ud0a4\uc9c0\uac00 \uc545\uc131\ud654\ub418\uba74 \uc804\uccb4 \uc2dc\uc2a4\ud15c\uc774 \uc704\ud5d8\uc5d0 \ucc98\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \uc0c8\ub85c\uc6b4 \uc5b4\ub4dc\ubc14\uc774\uc9c0\ub9ac \uc2dc\uc2a4\ud15c\uc740 \uc774\ub7ec\ud55c \uad50\ucc28 \uc624\uc5fc \uac00\ub2a5\uc131\uc744 \uc904\uc5ec\uc90d\ub2c8\ub2e4.<\/p>\n<p>\uac1c\ubc1c\uc790\ub294 \uc774\uc81c \ud2b9\uc815 \ud328\ud0a4\uc9c0 \uad00\ub9ac\uc790\uc758 \uacbd\uace0\ub97c \uae30\ub2e4\ub9ac\uc9c0 \uc54a\uace0\ub3c4 GitHub \ud50c\ub7ab\ud3fc \uc804\uccb4\uc5d0\uc11c \ud1b5\ud569\ub41c \ubcf4\uc548 \uc815\ubcf4\ub97c \uc5bb\uc744 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<p>\ud558\uc9c0\ub9cc \uc774 \uc2dc\uc2a4\ud15c\uc774 \uc644\ubcbd\ud558\ub2e4\uace0 \ub2e8\uc815\ud558\uae30\uc5d0\ub294 \uc544\uc9c1 \uace0\ub824\ud560 \uc810\ub4e4\uc774 \uc788\uc2b5\ub2c8\ub2e4. \ub370\uc774\ud130\uac00 \uc2e4\uc2dc\uac04\uc73c\ub85c \uc5c5\ub370\uc774\ud2b8\ub418\ub354\ub77c\ub3c4 \uc0c8\ub85c\uc6b4 \uc545\uc131 \ucf54\ub4dc\uac00 \ub4f1\uc7a5\ud558\ub294 \uc18d\ub3c4\uac00 \ub354 \ube60\ub97c \uc218 \uc788\uae30 \ub54c\ubb38\uc785\ub2c8\ub2e4.<\/p>\n<p>\ub610\ud55c, \uc624\ud0d0\uc9c0 \uac00\ub2a5\uc131\ub3c4 \uc644\uc804\ud788 \ubc30\uc81c\ud560 \uc218\ub294 \uc5c6\uc2b5\ub2c8\ub2e4. \ub530\ub77c\uc11c \uac1c\ubc1c\uc790\ub4e4\uc740 \uc2dc\uc2a4\ud15c\uc774 \uc8fc\ub294 \uacbd\uace0\ub97c \ub9f9\uc2e0\ud558\uae30\ubcf4\ub2e4, \uc911\uc694\ud55c \uc5c5\ub370\uc774\ud2b8 \uc804\uc5d0\ub294 \uc9c1\uc811 \ucf54\ub4dc \ub9ac\ubdf0\ub97c \ubcd1\ud589\ud558\ub294 \uac83\uc774 \uc88b\uc2b5\ub2c8\ub2e4.<\/p>\n<p>\ubcf4\uc548 \ub3c4\uad6c\ub294 \ubcf4\uc870 \uc218\ub2e8\uc77c \ubfd0, \ucd5c\uc885\uc801\uc778 \ud310\ub2e8\uc740 \uac1c\ubc1c\uc790\uc758 \uc219\ub828\ub3c4\uc5d0 \ub2ec\ub824 \uc788\ub2e4\ub294 \uc810\uc744 \uc78a\uc9c0 \ub9d0\uc544\uc57c \ud569\ub2c8\ub2e4.<\/p>\n<p>\uc55e\uc73c\ub85c \uc8fc\ubaa9\ud574\uc57c \ud560 \uc810\uc740 \uc774 \uc2dc\uc2a4\ud15c\uc774 \uc5b4\ub5bb\uac8c \ub2e4\ub978 \ud328\ud0a4\uc9c0 \uad00\ub9ac\uc790\uc640 \uc5f0\ub3d9\ub420\uc9c0\uc785\ub2c8\ub2e4. \ud604\uc7ac\ub294 npm \uacfc OpenSSF \ub370\uc774\ud130\ub97c \uc911\uc2ec\uc73c\ub85c \uc791\ub3d9\ud558\uc9c0\ub9cc, \ud5a5\ud6c4 PyPI, Maven, Go Modules \ub4f1 \ub2e4\ub978 \uc0dd\ud0dc\uacc4\ub85c\ub3c4 \ud655\uc7a5\ub420 \uac00\ub2a5\uc131\uc774 \ub192\uc2b5\ub2c8\ub2e4.<\/p>\n<p>\ub9cc\uc57d \ubaa8\ub4e0 \uc8fc\uc694 \ud328\ud0a4\uc9c0 \uad00\ub9ac\uc790\uac00 \uc774 \ud45c\uc900\uc744 \ub530\ub974\uac8c \ub41c\ub2e4\uba74 \uc18c\ud504\ud2b8\uc6e8\uc5b4 \uacf5\uae09\ub9dd \ubcf4\uc548\uc740 \ud68d\uae30\uc801\uc73c\ub85c \uc548\uc815\ud654\ub420 \uac83\uc785\ub2c8\ub2e4. \uac1c\ubc1c\uc790\ub4e4\uc740 \ub354 \uc774\uc0c1 \uac01\uae30 \ub2e4\ub978 \ud3ec\ub9f7\uc758 \ubcf4\uc548 \uacf5\uc9c0\ub97c \uc77c\uc77c\uc774 \ucc59\uae30\uc9c0 \uc54a\uc544\ub3c4 \ub418\uba70, \ud1b5\ud569\ub41c \ubdf0\uc5d0\uc11c \uc704\ud5d8 \uc694\uc18c\ub97c \uad00\ub9ac\ud560 \uc218 \uc788\uac8c \ub429\ub2c8\ub2e4.<\/p>\n<p>\uc774\ub7ec\ud55c \ubcc0\ud654\ub294 \ub2e8\uc21c\ud55c \uae30\uc220\uc801 \uc5c5\ub370\uc774\ud2b8\ub97c \ub118\uc5b4, \uc18c\ud504\ud2b8\uc6e8\uc5b4 \uacf5\uae09\ub9dd \ubcf4\uc548\uc758 \ud22c\uba85\uc131\uc744 \ub192\uc774\ub294 \uc0ac\ud68c\uc801 \uc758\ubbf8\ub3c4 \uc9c0\ub2d9\ub2c8\ub2e4. \uae30\uc5c5\ub4e4\uc740 \uc790\uc2e0\uc774 \uc0ac\uc6a9\ud558\ub294 \uc624\ud508 \uc18c\uc2a4 \ub77c\uc774\ube0c\ub7ec\ub9ac\uc758 \ucd9c\ucc98\uc640 \uc548\uc804\uc131\uc744 \ub354 \uba85\ud655\ud558\uac8c \uc99d\uba85\ud560 \uc218 \uc788\uac8c \ub429\ub2c8\ub2e4.<\/p>\n<p>\uc774\ub294 \ucd5c\uc885 \uc81c\ud488\uc73c\ub85c \uc774\uc5b4\uc9c0\ub294 \ubaa8\ub4e0 \ub2e8\uacc4\uc5d0\uc11c \uc2e0\ub8b0\ub97c \uc313\ub294 \uae30\ubc18\uc774 \ub429\ub2c8\ub2e4. \uac1c\ubc1c\uc790 \ucee4\ubba4\ub2c8\ud2f0 \uc804\uccb4\uac00 \ub354 \uc548\uc804\ud55c \ud658\uacbd\uc744 \ud5a5\ud574 \ub098\uc544\uac00\uace0 \uc788\ub2e4\ub294 \uc2e0\ud638\ub85c \ud574\uc11d\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<p>\uc774\uc81c npm \uc744 \ub118\uc5b4\uc120 \uc545\uc131 \ud328\ud0a4\uc9c0 \uacbd\uace0\ub294 \ub2e8\uc21c\ud55c \uae30\ub2a5\uc774 \uc544\ub2cc, \ud604\ub300 \uc18c\ud504\ud2b8\uc6e8\uc5b4 \uac1c\ubc1c\uc758 \ud544\uc218 \uc778\ud504\ub77c\ub85c \uc790\ub9ac \uc7a1\uc744 \uac83\uc785\ub2c8\ub2e4.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\uae30\uc874\uc5d0 npm \uc0dd\ud0dc\uacc4\uc5d0\ub9cc \uad6d\ud55c\ub418\ub358 \uc545\uc131 \ud328\ud0a4\uc9c0 \uacbd\uace0\uac00 \uc774\uc81c GitHub \uc5b4\ub4dc\ubc14\uc774\uc9c0\ub9ac \ub370\uc774\ud130\ubca0\uc774\uc2a4 \uc804\uccb4\ub85c \ud655\uc7a5\ub418\uc5c8\uc2b5\ub2c8\ub2e4. OpenSSF \uc758 \ub370\uc774\ud130\ub97c \uae30\ubc18\uc73c\ub85c \ud55c \uc774 \ubcc0\ud654\ub294 \uac1c\ubc1c\uc790\ub4e4\uc774 \ub354 \ub113\uc740 \ubc94\uc704\uc758 \uc18c\ud504\ud2b8\uc6e8\uc5b4 \uacf5\uae09\ub9dd \uc704\ud611\uc744 \uc2e4\uc2dc\uac04\uc73c\ub85c \ud30c\uc545\ud560 \uc218 \uc788\uac8c \ud569\ub2c8\ub2e4.<\/p>\n","protected":false},"author":7,"featured_media":45089,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8858],"tags":[3346,28910,28909,8879,28911],"class_list":["post-45090","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai","tag-github","tag-openssf","tag-28909","tag-8879","tag-28911"],"featured_image_urls":{"full":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/08\/0000035572-001-20221206200602587-scaled.png",2560,1440,false],"thumbnail":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/08\/0000035572-001-20221206200602587-150x150.png",150,150,true],"medium":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/08\/0000035572-001-20221206200602587-300x169.png",300,169,true],"medium_large":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/08\/0000035572-001-20221206200602587-768x432.png",640,360,true],"large":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/08\/0000035572-001-20221206200602587-1024x576.png",640,360,true],"1536x1536":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/08\/0000035572-001-20221206200602587-1536x864.png",1536,864,true],"2048x2048":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/08\/0000035572-001-20221206200602587-2048x1152.png",2048,1152,true],"morenews-large":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/08\/0000035572-001-20221206200602587-825x575.png",825,575,true],"morenews-medium":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/08\/0000035572-001-20221206200602587-590x410.png",590,410,true]},"author_info":{"info":["\uae40\ub3c4\uc724"]},"category_info":"<a href=\"https:\/\/jore2.com\/?cat=8858\" rel=\"category\">AI<\/a>","tag_info":"AI","comment_count":"0","_links":{"self":[{"href":"https:\/\/jore2.com\/index.php?rest_route=\/wp\/v2\/posts\/45090","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jore2.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jore2.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jore2.com\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/jore2.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=45090"}],"version-history":[{"count":0,"href":"https:\/\/jore2.com\/index.php?rest_route=\/wp\/v2\/posts\/45090\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jore2.com\/index.php?rest_route=\/wp\/v2\/media\/45089"}],"wp:attachment":[{"href":"https:\/\/jore2.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=45090"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jore2.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=45090"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jore2.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=45090"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}