{"id":166951,"date":"2026-03-31T23:11:57","date_gmt":"2026-03-31T21:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/skomprometirovan-npm-paket-axios-imeyushhij-100-mln-zagruzok-v-nedelyu"},"modified":"2026-03-31T23:11:57","modified_gmt":"2026-03-31T21:11:57","slug":"skomprometirovan-npm-paket-axios-imeyushhij-100-mln-zagruzok-v-nedelyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/skomprometirovan-npm-paket-axios-imeyushhij-100-mln-zagruzok-v-nedelyu","title":{"rendered":"Kompromiteeritud NPM-pakett axios, millel on 100 miljonit allalaadimist n\u00e4dalas.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

R\u00fcndajad suutsid haarata hooldaja konto ja avaldasid kaks pahatahtlikku NPM-paketti axios, mis pakuvad HTTP-klienti brauserite ja Node.js jaoks. Pakett axios omab \u00fcle 100 miljoni allalaadimise n\u00e4dalas ning seda kasutatakse s\u00f5ltuvusena 174 000 muus paketis. Pahatahtlikud muudatused integreeriti Axiosi versioonidesse 1.14.1 ja 0.30.4 vale s\u00f5ltuvuse plain-crypto-js 4.2.1 kaudu, mis sisaldas koodi komponentide allalaadimiseks, mis saavad k\u00e4ske r\u00fcndajate juhtimisserverilt. Pahatahtlikud versioonid olid allalaadimiseks saadaval 31. m\u00e4rtsil peaaegu 3 tunni jooksul \u2014 alates 03:21 kuni 6:15 (MSK). <\/p>\n

Pahatahtlikud versioonid avaldati NPM-is otse, kasutades peamise Axiosi hooldaja konto andmeid («jasonsaayman»), m\u00f6\u00f6da GitHub Actions p\u00f5hist uut versioonide avaldamise mehhanismi. Eeldatakse, et r\u00fcndajad suutsid hooldajalt haarata NPM-i juurdep\u00e4\u00e4sutokeni, p\u00e4rast mida sisenesid nad kontole ja muutsid e-posti aadressi sideme. T\u00e4pset meetodit, kuidas juurdep\u00e4\u00e4sutoken looti, ei t\u00e4psustata. <\/p>\n

K\u00e4itatav pahatahtlik kood oli paigutatud paketti plain-crypto-js faili setup.js, aktiveeriti p\u00e4rast NPM-paketi installatsiooni l\u00f5ppu postinstall (‘postinstall: «node setup.js»‘) k\u00e4sitleja kaudu ja kasutati trooja laadimiseks ja installimiseks, mis r\u00fcndas Windowsi, macOS-i ja Linuxi s\u00fcsteeme. Oma kohaloleku varjamiseks eemaldas pahatahtlik komponent k\u00e4ivitumise j\u00e4rel faili setup.js ja asendas package.json versiooniga, mis ei sisaldanud postinstalli hooki. \"Kompromiteeritud <\/p>\n

macOS-is laaditi pahatahtlik k\u00e4ivitatav fail kui «\/Library\/Caches\/com.apple.act.mond», Windowsis \u2014 «%PROGRAMDATA%\wt.exe», Linuxis \u2014 «\/tmp\/ld.py,». P\u00e4rast aktiveerimist Linuxis ja macOS-is saadeti iga 60 sekundi j\u00e4rel r\u00fcndajate serverisse k\u00e4sud r\u00fcndatud s\u00fcsteemi t\u00e4itmiseks, mida v\u00f5idi kasutada t\u00e4iendavate pahatahtlik komponentide allalaadimiseks, juhuslike shell-k\u00e4skude t\u00e4itmiseks ja teatud failide otsimiseks\/saatmiseks. server<\/a> Pahatahtlik aktiivsus Linuxis ja macOS-is ei sisaldanud taasalustamisj\u00e4rgset kohaloleku s\u00e4ilitamist ning oli suunatud konfidentsiaalsete andmete, paroolide, tokenite ja juurdep\u00e4\u00e4suklahvide kiirele kogumisele. Windowsis loodi fail «%PROGRAMDATA%\system.bat», mis t\u00f5i pahatahtliku komponendi r\u00fcndajatelt iga sisselogimise ajal. <\/p>\n

Linuxi ja macOSi pahatahtlik tegevus ei olnud ette n\u00e4htud oma kohaloleku s\u00e4ilitamiseks p\u00e4rast taask\u00e4ivitamist ning oli suunatud kiirete konfidentsiaalsete andmete, paroolide, tokenite ja juurdep\u00e4\u00e4su v\u00f5ti kogumisele. Windowsis loodud fail «%PROGRAMDATA%\system.bat» t\u00f5mbas pahavara komponendi serverile<\/a> r\u00fcnnakute korral iga sisselogimisega.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0434\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 NPM-\u043f\u0430\u043a\u0435\u0442\u0430 axios, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e HTTP-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u0438 Node.js. \u041f\u0430\u043a\u0435\u0442 axios \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 174 \u0442\u044b\u0441\u044f\u0447 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0438 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 Axios 1.14.1 \u0438 0.30.4 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 plain-crypto-js 4.2.1, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":166952,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-166951","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kompromiteeritud NPM-pakett axios, millel on 100 miljonit allalaadimist n\u00e4dalas | ProHoster","description":"Kurjategijad suutsid haarata kaasasoleva konto ja vabastada kaks r\u00fcndavat NPM-paketi versiooni axios, mis pakub HTTP-kliendi teostust brauseritele ja Node.js-ile. Pakett axios on \u00fcle 100 miljoni allalaadimise n\u00e4dalas ja seda kasutatakse 174 tuhande teise paketi s\u00f5ltuvusena. Kahjulikud muudatused integreeriti Axios versioonidesse 1.14.1 ja 0.30.4 l\u00e4bi vale s\u00f5ltuvuse plain-crypto-js 4.2.1 asendamise.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/skomprometirovan-npm-paket-axios-imeyushhij-100-mln-zagruzok-v-nedelyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d NPM-\u043f\u0430\u043a\u0435\u0442 axios, \u0438\u043c\u0435\u044e\u0449\u0438\u0439 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e | ProHoster","og:description":"\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0434\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 NPM-\u043f\u0430\u043a\u0435\u0442\u0430 axios, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e HTTP-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u0438 Node.js. \u041f\u0430\u043a\u0435\u0442 axios \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 174 \u0442\u044b\u0441\u044f\u0447 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0438 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 Axios 1.14.1 \u0438 0.30.4 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 plain-crypto-js 4.2.1,","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/skomprometirovan-npm-paket-axios-imeyushhij-100-mln-zagruzok-v-nedelyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-31T21:11:57+00:00","article:modified_time":"2026-03-31T21:11:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/166951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=166951"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/166951\/revisions"}],"predecessor-version":[{"id":173154,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/166951\/revisions\/173154"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/166952"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=166951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=166951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=166951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}