{"id":149530,"date":"2025-11-25T17:11:58","date_gmt":"2025-11-25T15:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov"},"modified":"2025-11-25T17:11:58","modified_gmt":"2025-11-25T15:11:59","slug":"pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","title":{"rendered":"Shai-Hulud'i usaldusv\u00e4\u00e4rsuse kaudu on kompromiteeritud 600 NPM-paketti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

NPM-repositoriumi pakettide vastu on fikseeritud teine r\u00fcnnak, mille viis l\u00e4bi enesekeeruv Shai-Hulud'i usaldusv\u00e4\u00e4rsus, lisades s\u00f5ltuvustesse pahavara. R\u00fcnnaku k\u00e4igus on avaldatud 605 pahatahtlikku v\u00e4ljaannet, millel on kokku \u00fcle 100 miljoni allalaadimise. <\/p>\n

R\u00fcnnaku l\u00e4biviimiseks said kurjategijad kalastamise teel k\u00e4tte \u00fche populaarse paketi s\u00e4ilitaja konto parameetrid, mida kasutatakse s\u00f5ltuvusena paljude pakettide seas. Kasutades varastatud kontot, avaldasid r\u00fcndajad paketi v\u00e4ljaande, kuhu olid lisatud koodid, et aktiveerida usaldusv\u00e4\u00e4rsus, kui kahjustatud pakett installitakse s\u00f5ltuvustena. Aktiveeritud usaldusv\u00e4\u00e4rsus otsib aktiivses keskkonnas kasutajakontosid, laadides alla ja k\u00e4ivitades utiliidi TruffleHog. <\/p>\n

Kui NPM-katalooge \u00fchendav token tuvastatakse, avaldab usaldusv\u00e4\u00e4rsus automaatselt uusi pahatahtlikke v\u00e4ljaandeid pakettidele, mis arendatakse praeguses keskkonnas. Selle kaudu nakatatakse kogu s\u00f5ltuvuste puu. Peale NPM-tokene on usaldusv\u00e4\u00e4rsus salvestanud juurdep\u00e4\u00e4suv\u00f5tmed GitHub'i ja pilveteenuste AWS, Azure ning GCP (Google Cloud Platform) jaoks, samuti keskkonnamuutujad ja muud konfidentsiaalsed andmed, mille TruffleHog'i skanner suudab tuvastada. <\/p>\n

Leitud s\u00fcsteemis konfidentsiaalsed andmed paigutatakse GitHub'i luues repoziitooriume kaootiliste nimedega (n\u00e4iteks, «qzx15djl71alh6p80h») ja fraasi «Sha1-Hulud: The Second Coming» kirjelduses, samuti kodeeritult kuvatakse need GitHub Actions logides. Luues repoziitooriumi paigutatakse faili formaadis JSON (n\u00e4iteks jsonactionsSecrets.json v\u00f5i contents.json), milles on rida base64 meetodil kodeeritud teabega s\u00fcsteemi, keskkonnamuutujatega ja salvestatud andmetega. Teabe edastamiseks pideva integratsiooni s\u00fcsteemidest GitHub'i p\u00f5hjal loob uss GitHub Actions t\u00f6\u00f6tleja nimega «.github\/workflows\/formatter_123456789.yml» ja seadistab jooksja nimega SHA1HULUD. <\/p>\n

Erinevused sarnase septembri r\u00fcnnaku osas seisnevad teisene meetodi kasutuses kurja koodi sisestamiseks paketti. Uss loodud kuritegelikes v\u00e4ljalasketes on v\u00e4lja kuulutatud JavaScript'i platvormi Bun toimetamine. Faili package.json sektsiooni «preinstall» lisatakse k\u00e4sk «node setup_bun.js», mis m\u00e4\u00e4ratleb skriptid, mida k\u00e4ivitatakse enne installatsiooni algust.

\"Shai-Hulud'i<\/center> <\/p>\n

Failis «setup_bun.js» on olemas kodeeritud skripti «bun_environment.js» k\u00e4itamise kood, mis sisaldab ussi koodi. Edaspidiseks levitamiseks otsib uss pakettide koodi, muudab faili package.json (t\u00f5stab versiooninumbrit ja h\u00f5lmab setup_bun.js kutset), lisab failid setup_bun.js ja bun_environment.js, uuesti pakendab paketti ja k\u00e4ivitab k\u00e4su «npm publish» uue v\u00e4ljalaske paigutamiseks. <\/p>\n

Kompromiteeritud populaarsete pakettide seas: @zapier\/zapier-sdk (2,8 miljonit allalaadimist n\u00e4dalas), @posthog\/core (2,8 miljonit), posthog-node (1,5 miljonit), @asyncapi\/specs (1,4 miljonit), @postman\/tunnel-agent (1,2 miljonit). Eeldatakse, et r\u00fcnnak algas paketi @asyncapi\/specs kaasasoleva koodi kompromiteerimisest.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u0442\u043e\u0440\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM, \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0430\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0430\u043c\u043e\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0447\u0435\u0440\u0432\u044f Shai-Hulud, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 605 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0443\u0442\u0451\u043c \u0444\u0438\u0448\u0438\u043d\u0433\u0430 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u043b\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":149531,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-149530","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ussi Shai-Hulud abil on kompromiteeritud 600 NPM-paketti | ProHoster","description":"Teine r\u00fcnnak NPM-i paketid vastu on fikseeritud, kasutades iselevivat ussi Shai-Hulud, mis sisestab pahavara s\u00f5ltuvustesse.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e 600 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u0442\u043e\u0440\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM, \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0430\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0430\u043c\u043e\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0447\u0435\u0440\u0432\u044f Shai-Hulud, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-11-25T15:11:59+00:00","article:modified_time":"2025-11-25T15:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"149530","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:12:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 16:12:19","updated":"2026-01-23 16:12:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/149530","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=149530"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/149530\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/149531"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=149530"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=149530"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=149530"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}