{"id":172766,"date":"2026-05-20T12:55:45","date_gmt":"2026-05-20T10:55:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/atakuyushhie-poluchili-dostup-k-vnutrennim-repozitoriyam-github-i-openai"},"modified":"2026-05-20T12:55:45","modified_gmt":"2026-05-20T10:55:45","slug":"atakuyushhie-poluchili-dostup-k-vnutrennim-repozitoriyam-github-i-openai","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/atakuyushhie-poluchili-dostup-k-vnutrennim-repozitoriyam-github-i-openai","title":{"rendered":"R\u00fcndajad said juurdep\u00e4\u00e4su GitHubi ja OpenAI siserepositooriatele","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub teatas, et on tuvastanud volitamata juurdep\u00e4\u00e4su oma sisemistele hoidlatele. P\u00f5hjuseks oli \u00fche t\u00f6\u00f6taja t\u00f6\u00f6jaama kompromiteerimine, kes installis uue versiooni \u00fcksest VS Code'i pluginate, millesse oli integreeritud pahavara. \u00dcksikasjad lubatakse avaldada p\u00e4rast uurimise l\u00f5petamist. Esialgsete andmete kohaselt ei saanud GitHubi hoidlates v\u00e4ljaspool ettev\u00f5tte sisemisi hoidlaid talletatud kasutajate teave kannatada. R\u00fcnnak piirdus teabe lekkimisega umbes 3800 GitHubile kuuluvast sisemisest hoidlast. <\/p>\n

Milline t\u00e4pselt VS Code'i lisa oli installitud, ei ole t\u00e4psustatud. Viimaste r\u00fcnnakute hulgas VS Code'i kasutajatele v\u00f5ib v\u00e4lja tuua eilse intsidendi NX Console'i lisa osas, millel on 2,2 miljonit paigaldust. Kurjategijatel \u00f5nnestus tabada \u00fche NX Console'i arendaja GitHubi konto\u00fchenduse teave ja avaldada uus versioon 18.95.0, mis sisaldab pahavara salajaste andmete, nagu paroolid ja juurdep\u00e4\u00e4su tokenid GitHubi, npm, AWS, HashiCorp Vault, Kubernetes ja 1Password, varastamiseks. Pahatahtlik versioon paigutati Visual Studio Marketplace'i katalooge 19. mail kell 15:30 ja eemaldati kell 15:48 (MSK). <\/p>\n

Lisaks tasub mainida 11. mail OpenAI t\u00f6\u00f6tajate kahe t\u00f6\u00f6jaama kompromiteerimist, kes paigaldasid pahatahtlikud NPM-pakettide TanStack uuendused, mis sisaldavad iseeneslikku levivat ussi. Pahatahtlikud versioonid avaldati r\u00fcnnaku tulemusena GitHub Actions'it kasutava versiooni loomise protsessi eesm\u00e4rgil projektis TanStack. Ussti aktiivsuse t\u00f5ttu server<\/a> kurjategijad said juurdep\u00e4\u00e4su t\u00f6\u00f6tajate OpenAI arvutites leiduvatele kontode ja ligip\u00e4\u00e4suv\u00f5tmete andmetele. Toodud s\u00fcsteemidel oli piiratud juurdep\u00e4\u00e4s m\u00f5nedele OpenAI sisemistele hoidlatele, kus muu hulgas s\u00e4ilitati sertifikaate digitaalsete allkirjade genereerimiseks Windowsi, macOS-i, iOS-i ja Androidi platvormide toodetele. Probleemi avastamisel algatati OpenAI-s protsess sertifikaatide asendamiseks, mida kasutati ChatGPT Desktopi, Codex App, Codex CLI ja Atlas digitaalsete allkirjade t\u00f5endamiseks. <\/p>\n

Huvitav on see, et see ei ole esimene sarnane intsident OpenAI-s \u2014 selle ettev\u00f5tte t\u00f6\u00f6tajate s\u00fcsteeme m\u00f5jutati samuti pahavara poolt aprillis, p\u00e4rast kahjuliku NPM-paketi Axios versiooni installimist, mille r\u00fcndajad suutsid avaldada peamise hooldaja mandaatide l\u00e4bip\u00e4\u00e4su t\u00f5ttu. P\u00e4rast seda intsidenti rakendati arendajate arvutites kaitset pahatahtlike s\u00f5ltuvuste installimise vastu, kuid t\u00f6\u00f6tajate s\u00fcsteemidele, mis hiljem TanStacki kaudu kompromiteeriti, ei rakendatud seda.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0435\u0440\u0432\u0438\u0441 GitHub \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0432\u043e\u0438\u043c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c. \u041f\u0440\u0438\u0447\u0438\u043d\u043e\u0439 \u0441\u0442\u0430\u043b\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0432\u0448\u0435\u0433\u043e \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0439 \u043a \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0443 \u043a\u043e\u0434\u0430 VS Code, \u0432 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0431\u044b\u043b \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0435\u0449\u0430\u044e\u0442 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430. \u041f\u043e \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0445\u0440\u0430\u043d\u0438\u043c\u0430\u044f \u0432\u043d\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 GitHub, \u043d\u0435 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u043b\u0430. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-172766","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u00fcndajad said juurdep\u00e4\u00e4su GitHubi ja OpenAI sisemistele hoidlatele | ProHoster","description":"GitHub teenus teatas, et on tuvastanud volitamata juurdep\u00e4\u00e4su oma sisemistele hoidlatele. Probleemiks oli \u00fche t\u00f6\u00f6taja t\u00f6\u00f6jaama kompromiteerimine, kes installis uue versiooni VS Code'i koodi redigeerimise laiendusest, millesse oli integreeritud pahavara. \u00dcksikasjad lubatakse avaldada p\u00e4rast uurimise l\u00f5petamist. Esialgsete andmete kohaselt ei saanud GitHubi ettev\u00f5tte sisehoidlas hoitavad kasutajainformatsiooni kahjustada.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/atakuyushhie-poluchili-dostup-k-vnutrennim-repozitoriyam-github-i-openai","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c GitHub \u0438 OpenAI | ProHoster","og:description":"\u0421\u0435\u0440\u0432\u0438\u0441 GitHub \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0432\u043e\u0438\u043c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c. \u041f\u0440\u0438\u0447\u0438\u043d\u043e\u0439 \u0441\u0442\u0430\u043b\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0432\u0448\u0435\u0433\u043e \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0439 \u043a \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0443 \u043a\u043e\u0434\u0430 VS Code, \u0432 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0431\u044b\u043b \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0435\u0449\u0430\u044e\u0442 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430. \u041f\u043e \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0445\u0440\u0430\u043d\u0438\u043c\u0430\u044f \u0432\u043d\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 GitHub, \u043d\u0435 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u043b\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/atakuyushhie-poluchili-dostup-k-vnutrennim-repozitoriyam-github-i-openai","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-20T10:55:45+00:00","article:modified_time":"2026-05-20T10:55:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/172766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=172766"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/172766\/revisions"}],"predecessor-version":[{"id":173169,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/172766\/revisions\/173169"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=172766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=172766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=172766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}