{"id":139659,"date":"2025-07-21T11:12:05","date_gmt":"2025-07-21T09:12:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami"},"modified":"2025-07-21T11:12:05","modified_gmt":"2025-07-21T09:12:05","slug":"fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami","title":{"rendered":"Petuskeem on v\u00f5imaldanud mitu populaarsest NPM-pakettidest kontrolli alla saada.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Javascript-raamatukogusid uurides tuvastati kalastamisr\u00fcnnak, mille raames saadeti NPM-teenuse nimel teade, mis teatas vajadusest kinnitada oma e-posti aadress. R\u00fcnnak v\u00f5imaldas kurjategijatel saada \u00fche suurima JavaScript-projekti NPM-tokenid ning v\u00e4lja anda kahjulikku koodi sisaldavaid uuendusi viiele NPM-paketile, millel on kokku umbes 100 miljonit allalaadimist n\u00e4dalas.       <\/p>\n<p>Saadetud teatis oli stiliseeritud t\u00fc\u00fcpiliste NPM teavituste j\u00e4rgi, mis saadetakse aadressilt \"support@npmjs.org\", kuid lingina oli kasutatud domeeni \"npnjs.com\" asemel \"npmjs.com\" (kolmas t\u00e4ht \"n\" asemel \"m\"). R\u00fcndajad kasutasid \u00e4ra ps\u00fchholoogilist efekti, mille t\u00f5ttu aju, oodates oodatud tulemust, ei m\u00e4rka mitteolulisi moonutusi, n\u00e4iteks t\u00e4htede sarnaste vahetamist v\u00f5i t\u00e4htede j\u00e4rjestuse muutmist s\u00f5nas. Linki j\u00e4rgides avanes npmjs.com t\u00e4pne koopia (t\u00f5en\u00e4oliselt oli seadistatud vahetus, mis p\u00fc\u00fcdis kinni juurdep\u00e4su tokeni).    <center><img decoding=\"async\" alt=\"Petuskeem on v\u00f5imaldanud mitu populaarsest NPM-pakettidest kontrolli alla saada.\" src=\"\/wp-content\/uploads\/2025\/07\/0d5e2613f7265b3fcca6ee367c0ecac9.png\" style=\"display:block;margin: 0 auto;\" \/><\/center>    <\/p>\n<p>R\u00fcnnaku k\u00e4igus loodi uusi paketiversioone:  <\/p>\n<ul>\n<li class=\"l\"> eslint-config-prettier: 8.10.1, 9.1.1, 10.1.6, 10.1.7.\n<li class=\"l\"> eslint-plugin-prettier: 4.2.2, 4.2.3.\n<li class=\"l\"> synckit: 0.11.9.\n<li class=\"l\"> @pkgr\/core: 0.2.8.\n<li class=\"l\"> napi-postinstall: 0.3.1.  <\/ul>\n<p>Loobitudse v\u00e4ljaannetes lisati kahjulik kood, mis r\u00fcndas Windows'i platvormiga kasutajaid. Tehtud muudatused laadisid alla raamatukogu node-gyp.dll, mis sisaldas funktsionaalsust s\u00fcsteemi kaugk\u00e4skude t\u00e4itmiseks.     <\/p>\n<p>Saatev isik m\u00e4rkis, et ta oli kalastamise ohver umbes tund p\u00e4rast esimese kaebuse laekumist kahtlaste v\u00e4ljaannete kohta. Ta t\u00fchistas koheselt juurutustokeni, vahetas paroolid ning m\u00e4rkis probleemsed versioonid vananenud, et v\u00e4ltida nende allalaadimist automatiseeritud koostamiss\u00fcsteemide poolt, ja saatis probleemi versioonide eemaldamiseks NPM-i tugiteenistusele taotluse.     <\/p>\n<p>Ei ole t\u00e4psustatud, kui palju kasutajaid j\u00f5udis alla laadida kahjulikud versioonid (n\u00e4iteks oli kahjulik versioon paketist eslint-plugin-prettier reposse umbes kaks p\u00e4eva). Eelmise n\u00e4dala jooksul oli paketil eslint-config-prettier 30 miljonit allalaadimist ja seda kasutati s\u00f5ltuvusena 11 762 paketi juures, paketil eslint-plugin-prettier \u2014 21 miljonit allalaadimist (8 468 s\u00f5ltuvat paketti), synckit \u2014 18 miljonit, @pkgr\/core \u2014 16 miljonit ja napi-postinstall \u2014 10 miljonit.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=63610\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0444\u0438\u0448\u0438\u043d\u0433-\u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 NPM \u0431\u044b\u043b\u043e \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u044f\u044e\u0449\u0435\u0435 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u044c \u0441\u0432\u043e\u0439 email. \u041f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c NPM-\u0442\u043e\u043a\u0435\u043d\u044b \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 JavaScript-\u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u043f\u044f\u0442\u0438 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432 \u0441\u0443\u043c\u043c\u0435 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u043e\u043a\u043e\u043b\u043e 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e. \u041e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0435 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u043c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u0441\u0442\u0438\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":139660,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-139659","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0444\u0438\u0448\u0438\u043d\u0433-\u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 NPM \u0431\u044b\u043b\u043e \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u044f\u044e\u0449\u0435\u0435 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u044c \u0441\u0432\u043e\u0439 email.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0424\u0438\u0448\u0438\u043d\u0433 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 NPM-\u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0444\u0438\u0448\u0438\u043d\u0433-\u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 NPM \u0431\u044b\u043b\u043e \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u044f\u044e\u0449\u0435\u0435 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u044c \u0441\u0432\u043e\u0439 email.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-07-21T09:12:05+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-07-21T09:12:05+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Phishing andis kontrolli mitme populaarse NPM-paketi \u00fcle | ProHoster","description":"JavaScript'i raamatukogude hooldamiseks on tuvastatud haavatavus, mille k\u00e4igus saadeti NPM-i teenuse nimel teade, mis teavitas kasutajaid e-posti aadressi kinnitamise vajadusest.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0424\u0438\u0448\u0438\u043d\u0433 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 NPM-\u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0444\u0438\u0448\u0438\u043d\u0433-\u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 NPM \u0431\u044b\u043b\u043e \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u044f\u044e\u0449\u0435\u0435 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u044c \u0441\u0432\u043e\u0439 email.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-07-21T09:12:05+00:00","article:modified_time":"2025-07-21T09:12:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"139659","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:55:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:55:19","updated":"2026-01-23 13:55:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/139659","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=139659"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/139659\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/139660"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=139659"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=139659"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=139659"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}