{"id":170684,"date":"2026-05-15T00:24:32","date_gmt":"2026-05-14T22:24:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-42-npm-paketa-tanstack-integrirovan-samorasprostranyayushhijsya-cherv"},"modified":"2026-05-15T00:24:32","modified_gmt":"2026-05-14T22:24:32","slug":"v-42-npm-paketa-tanstack-integrirovan-samorasprostranyayushhijsya-cherv","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/v-42-npm-paketa-tanstack-integrirovan-samorasprostranyayushhijsya-cherv","title":{"rendered":"The self-replicating worm is integrated into 42 NPM packages of TanStack","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
D\u016fsledkem kompromitace procesu vytv\u00e1\u0159en\u00ed release na z\u00e1klad\u011b GitHub Actions v projektu TanStack \u00fato\u010dn\u00edk\u016fm poda\u0159ilo zve\u0159ejnit v repozit\u00e1\u0159i NPM 84 \u0161kodliv\u00e9 verze, pokr\u00fdvaj\u00edc\u00ed 42 NPM bal\u00ed\u010dk\u016f z bal\u00ed\u010dkov\u00e9 sady TanStack. N\u011bkter\u00e9 z kompromitovan\u00fdch bal\u00ed\u010dk\u016f m\u011bly v\u00edce ne\u017e 10 milion\u016f sta\u017een\u00ed t\u00fddn\u011b. <\/p>\n
P\u0159\u00edstup k publikaci vyd\u00e1n\u00ed byl z\u00edsk\u00e1n kv\u016fli nespr\u00e1vn\u00e9mu nastaven\u00ed pull_request_target \u201ePwn Request\u201c v GitHub Actions (uveden\u00ed masky v nastaven\u00ed vedlo k spu\u0161t\u011bn\u00ed pull_request_target pro pull-requesty ve t\u0159et\u00edch fork\u00e1ch), zne\u010di\u0161t\u011bn\u00ed cache GitHub Actions skrze fork a mo\u017enosti extrakce OIDC tokenu z pam\u011bti b\u011b\u017e\u00edc\u00edho b\u011b\u017ece (Runner.Worker) prost\u0159ednictv\u00edm \u010dten\u00ed obsahu \/proc\/\/mem. <\/p>\n
\u0160kodliv\u00e9 NPM bal\u00ed\u010dky byly publikov\u00e1ny 11. kv\u011btna od 22:20 do 22:26 (MSK), zaznamen\u00e1ny po 20 minut\u00e1ch a blokov\u00e1ny po hodinu a p\u016fl. Pro ka\u017ed\u00fd z posti\u017een\u00fdch NPM bal\u00ed\u010dk\u016f byly vyd\u00e1ny dv\u011b \u0161kodliv\u00e9 verze, do kter\u00fdch byl integrov\u00e1n k\u00f3d k aktivaci \u010derva mini-shai-hulud, kter\u00fd hledal tokeny a p\u0159ihla\u0161ovac\u00ed \u00fadaje v aktu\u00e1ln\u00edm prost\u0159ed\u00ed. V p\u0159\u00edpad\u011b, \u017ee byl nalezen token p\u0159ipojen\u00ed k repozit\u00e1\u0159i NPM, \u010derv automaticky publikoval nov\u00e9 \u0161kodliv\u00e9 release pro bal\u00ed\u010dky vyv\u00edjen\u00e9 v aktu\u00e1ln\u00edm prost\u0159ed\u00ed, \u010d\u00edm\u017e zas\u00e1hl strom z\u00e1vislost\u00ed. T\u00edmto zp\u016fsobem bylo posti\u017eeno v\u00edce ne\u017e 400 NPM bal\u00ed\u010dk\u016f, kter\u00e9 v z\u00e1vislostech pou\u017e\u00edvaly bal\u00ed\u010dky TanStack. <\/p>\n
Worm byl um\u00edst\u011bn ve souboru router_init.js a aktivoval se p\u0159i ru\u010dn\u00ed instalaci napaden\u00e9ho bal\u00ed\u010dku v\u00fdvoj\u00e1\u0159em nebo automatizovan\u011b v prost\u0159ed\u00ed kontinu\u00e1ln\u00ed integrace pomoc\u00ed p\u0159\u00edkaz\u016f \u201enpm install\u201c, \u201epnpm install\u201c nebo \u201eyarn install\u201c. Po aktivaci worm vyhled\u00e1val v syst\u00e9mu tokeny k NPM (~\/.npmrc), AWS, GCP, Azure, HashiCorp a Kubernetes K8s a tak\u00e9 uzam\u010den\u00e9 SSH kl\u00ed\u010de. Nalezen\u00e9 \u00fadaje byly odes\u00edl\u00e1ny \u00fato\u010dn\u00edk\u016fm p\u0159es decentralizovan\u00fd P2P messenger getsession.org. <\/p>\n
Ve wormu byla navr\u017eena destruktivn\u00ed opat\u0159en\u00ed v p\u0159\u00edpad\u011b odvol\u00e1n\u00ed zachycen\u00e9ho NPM tokenu \u2014 v syst\u00e9mu se nastavoval periodick\u00fd b\u011bh skriptu ~\/.local\/bin\/gh-token-monitor.sh, kter\u00fd ka\u017ed\u00fdch 60 sekund kontroloval aktivitu tokenu pomoc\u00ed dotazu na api.github.com\/user a v p\u0159\u00edpad\u011b odvol\u00e1n\u00ed tokenu vykonal p\u0159\u00edkaz \u201erm -rf ~\/\u201c. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"