{"id":149530,"date":"2025-11-25T17:11:58","date_gmt":"2025-11-25T15:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov"},"modified":"2025-11-25T17:11:58","modified_gmt":"2025-11-25T15:11:59","slug":"pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","title":{"rendered":"Shai-Hulud'i ussal on kompromiteeritud 600 NPM-paketti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

NPM-repositooriumis on fikseeritud teine r\u00fcnnak paketide vastu, mis on l\u00e4bi viidud iseeneslikult leviva Shai-Hulud'i ussi modifikatsiooni abil, mis lisab s\u00f5ltuvustesse pahavara. R\u00fcnnaku tulemusena on avaldatud 605 pahatahtliku v\u00e4ljaannet, millel on kokku \u00fcle 100 miljoni allalaadimise. <\/p>\n

R\u00fcnnaku korraldamiseks haarasid kurjategijad seadmete haldaja konto andmed \u00fche populaarse paketi kaudu, mida kasutab paljude pakettide s\u00f5ltuvusena. Kasutades varastatud kontot, avaldasid r\u00fcndajad paketi v\u00e4ljaande, millele oli lisatud kood, et aktiveerida uss, kui m\u00f5jutatud pakett installitakse s\u00f5ltuvusena. K\u00e4ivitatud uss otsib k\u00e4imasolevas keskkonnas logindata, laadides ja k\u00e4ivitades TruffleHog'i utiliidi. <\/p>\n

Kui NPM katalooge \u00fchendavad tokenid tuvastatakse, postitab uss automaatselt uusi pahavara versioone praeguses keskkonnas arendatavate paketide jaoks. Selle viisi kaudu nakatatakse kogu s\u00f5ltuvuste puu ahelas. Peale NPM tokeni salvestab uss ka GitHubi ja pilveteenuste AWS, Azure ning GCP (Google Cloud Platform) juurdep\u00e4\u00e4suv\u00f5tmed, samuti keskkonnamuutujad ja muud konfidentsiaalsed andmed, mille TruffleHog skanner tuvastada suudab. <\/p>\n

Leitud s\u00fcsteemis konfidentsiaalsed andmed laaditakse GitHubi l\u00e4bi juhuslike nimedega repode loomise (n\u00e4iteks «qzx15djl71alh6p80h») ja fraasiga «Sha1-Hulud: Teine Tulemine» kirjelduses, samuti kodeerituna kuvatakse need GitHub Actionsi logides. Loomisel olevas repodes on JSON-formaadis fail (n\u00e4iteks jsonactionsSecrets.json v\u00f5i contents.json), milles on rida base64 meetodiga kodeeritud s\u00fcsteemi, keskkonnamuutujate ja j\u00e4\u00e4dvustatud andmete kohta. Andmete edastamiseks s\u00fcsteemidest, mis kasutavad pidevat integreerimist GitHubi baasil, loob uss GitHub Actionsi k\u00e4sitleja nimega «.github\/workflows\/formatter_123456789.yml» ja seadistab runneri nimega SHA1HULUD. <\/p>\n

Erinevused sarnaste septembrik\u00fcsimuste vahel seisnevad pahatahtliku koodi asendamise erinevas meetodis paketis. Uusloomise pahatahtlikes v\u00e4ljalaskmistes kuulutatakse v\u00e4lja JavaScripti platvormi Bun toe rakendamine. Faili package.json sektsiooni «preinstall», mis m\u00e4\u00e4ratleb skriptid, mis k\u00e4ivitatakse enne installimise alustamist, lisatakse k\u00e4sk «node setup_bun.js».

\"Shai-Hulud'i<\/center> <\/p>\n

Failis «setup_bun.js» on obfuseeritud skripti «bun_environment.js» t\u00e4itmiseks kood, mis sisaldab ussikoodi. Edasi levimiseks leiab uss pakettide koodid, teeb muudatusi failis package.json (suurendab versiooninumbrit ja lisab kutse setup_bun.js), lisab failid setup_bun.js ja bun_environment.js, pakendab paketi uuesti ja k\u00e4ivitab k\u00e4su «npm publish» uue v\u00e4lja andmiseks. <\/p>\n

Kompromiteeritud populaarsete pakettide seas: @zapier\/zapier-sdk (2,8 miljonit allalaadimist n\u00e4dalas), @posthog\/core (2,8 miljonit), posthog-node (1,5 miljonit), @asyncapi\/specs (1,4 miljonit), @postman\/tunnel-agent (1,2 miljonit). Arvatakse, et r\u00fcnnak algas paketi @asyncapi\/specs kompromiteerimisega.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u0442\u043e\u0440\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM, \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0430\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0430\u043c\u043e\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0447\u0435\u0440\u0432\u044f Shai-Hulud, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 605 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0443\u0442\u0451\u043c \u0444\u0438\u0448\u0438\u043d\u0433\u0430 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u043b\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":149531,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-149530","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Shai-Huludi ussi abil on ohustatud 600 NPM-paketti | ProHoster","description":"Teise r\u00fcnnaku eest NPM-i hoidlate paketidele, mille viib l\u00e4bi Shai-Hulud isekopeerivuss\u00fcsteem, mis sisestab s\u00f5ltuvustesse pahavara. R\u00fcnnaku tulemusena on avaldatud pahatahtlikke v\u00e4ljaandeid 605 paketist, mille koguhulk \u00fcletab 100 miljonit allalaadimist. R\u00fcnnaku teostamiseks on kurjategijad pettuse teel haaranud \u00fche populaarse paketi valvuri konto s\u00e4tteid, mida kasutatakse s\u00f5ltuvusena.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e 600 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u0442\u043e\u0440\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM, \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0430\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0430\u043c\u043e\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0447\u0435\u0440\u0432\u044f Shai-Hulud, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 605 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0443\u0442\u0451\u043c \u0444\u0438\u0448\u0438\u043d\u0433\u0430 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u043b\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-11-25T15:11:59+00:00","article:modified_time":"2025-11-25T15:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"149530","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:12:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 16:12:19","updated":"2026-01-23 16:12:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/149530","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=149530"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/149530\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/149531"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=149530"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=149530"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=149530"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}