{"id":142759,"date":"2025-09-10T11:11:58","date_gmt":"2025-09-10T09:11:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/atakuyushhie-poluchili-kontrol-nad-npm-paketami-proekta-duckdb-i-opublikovali-vredonosnye-vypuski"},"modified":"2025-09-10T11:11:58","modified_gmt":"2025-09-10T09:11:58","slug":"atakuyushhie-poluchili-kontrol-nad-npm-paketami-proekta-duckdb-i-opublikovali-vredonosnye-vypuski","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/atakuyushhie-poluchili-kontrol-nad-npm-paketami-proekta-duckdb-i-opublikovali-vredonosnye-vypuski","title":{"rendered":"R\u00fcndajad said kontrolli DuckDB projekti NPM-pakettide \u00fcle ja avaldasid pahatahtlikke v\u00e4ljalase.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

18 NPM-paketi kompromiteerimise lugu, millel on kokku \u00fcle 2 miljardi laadimise n\u00e4dalas, j\u00e4tkub. \u00dcksikasjalikult tuvastati sarnane h\u00e4kkimine DuckDB projekti NPM-pakettide kasutajate andmete pettuse kaudu. DuckDB paketid said samuti versioonid, mis sisaldasid pahatahtlikku koodi, mis asendas maksete detailid kr\u00fcptoraha kaudu, kuid r\u00fcnnak tuvastati kiiresti ning pahatahtlike pakettide laadimised j\u00e4\u00e4dvustati vaid \u00fcksikutes kogustes. Esialgsete andmete kohaselt suudeti eile koos 18 NPM-paketi r\u00fcnnakuga laadida \u00fcle 2,5 miljoni korda kahjustatud versioone. <\/p>\n

Teises kalastamisr\u00fcnnakus kompromiteeritud paketid: <\/p>\n

Pakett N\u00e4dalased laadimised Tippkuni S\u00f5ltuvused Pahavaraga versioon duckdb 242 tuhat 611.3.3 @duckdb\/duckdb-wasm 170 tuhat 431.3.3 @duckdb\/node-api 81 tuhat 336.2.2 @duckdb\/node-bindings 82 tuhat 11.29.2 @coveops\/abi 55102.0.1 <\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u0441 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0435\u0439 18 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432 \u0441\u0443\u043c\u043c\u0435 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0431\u043e\u043b\u0435\u0435 2 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u043e\u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435. \u0412\u044b\u044f\u0432\u043b\u0435\u043d \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0439 \u0437\u0430\u0445\u0432\u0430\u0442 \u0447\u0435\u0440\u0435\u0437 \u0444\u0438\u0448\u0438\u043d\u0433 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e NPM-\u043f\u0430\u043a\u0435\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 DuckDB. \u0414\u043b\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 DuckDB \u0442\u0430\u043a\u0436\u0435 \u0431\u044b\u043b\u0438 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u044e\u0449\u0438\u043c \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u0440\u0435\u043a\u0432\u0438\u0437\u0438\u0442\u043e\u0432 \u043f\u0440\u0438 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0438 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \u0447\u0435\u0440\u0435\u0437 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b, \u043d\u043e \u0430\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u0440\u0430\u0437\u0443 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0438 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043b\u0438\u0448\u044c \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-142759","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 R\u00fcndajad said kontrolli DuckDB projekti NPM-pakettide \u00fcle ja avaldasid pahatahtlikud v\u00e4ljalasked | ProHoster","description":"18 NPM-paketi kompromiteerimise lugu, millel on kokku \u00fcle 2 miljardi laadimise n\u00e4dalas, j\u00e4tkub.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/atakuyushhie-poluchili-kontrol-nad-npm-paketami-proekta-duckdb-i-opublikovali-vredonosnye-vypuski","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 NPM-\u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 DuckDB \u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 | ProHoster","og:description":"\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u0441 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0435\u0439 18 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432 \u0441\u0443\u043c\u043c\u0435 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0431\u043e\u043b\u0435\u0435 2 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u043e\u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/atakuyushhie-poluchili-kontrol-nad-npm-paketami-proekta-duckdb-i-opublikovali-vredonosnye-vypuski","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-09-10T09:11:58+00:00","article:modified_time":"2025-09-10T09:11:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"142759","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 14:42:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:42:20","updated":"2026-01-23 14:42:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/142759","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=142759"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/142759\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=142759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=142759"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=142759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}