{"id":182035,"date":"2026-06-12T14:48:20","date_gmt":"2026-06-12T12:48:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur"},"modified":"2026-06-12T14:48:20","modified_gmt":"2026-06-12T12:48:21","slug":"atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur","title":{"rendered":"R\u00fcndajad on kompromiteerinud 469 paketti AUR hoidlas","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

AUR (Arch User Repository) pakettide ulatuslik kompromiteerimine on fikseeritud, mida kasutatakse Arch Linuxis kolmandate osapoolte rakenduste levitamiseks. R\u00fcndajad said kontrolli 469 paketi \u00fcle ja suutsid nendesse sisestada pahavara, mis varastas kasutajate s\u00fcsteemidest paroole ja p\u00e4\u00e4sukoode. \u00dche hulgas oli pahavara integreeritud AUR-i kaudu tarnitud ALVR paketti, mis on populaarne arvutim\u00e4ngude armastajate seas.<\/p>\n

R\u00fcndajad v\u00f5tsid endale pakettide, mille staatus oli «orphaned», saatmise, mis j\u00e4id saatjateta. Nimeks pandi viimase saatja nimi, kuid teine e-post, mille j\u00e4rel lisati \u00fcks kommiteerimine ja avaldati uuendus. Kommiteerimine lisas «npm» s\u00f5ltuvuste loendisse PKGBUILD ja sisestas post_install-bloki skripti install.sh rida, et installida mitmeid NPM-pakette. Installitavate NPM-pakettide seas olid \u00fcks v\u00f5i mitu populaarset legitiimset paketti ja pakett atomic-lockfile, mis sisaldas varjatud pahavara. NPM-pakketide installimine toimus k\u00f5ikides kompromiteeritud projektides, isegi kui neis ei kasutata JavaScripti ja NPM-i. <\/p>\n

P\u00e4rast aktiveerimist kinnitati pahavara s\u00fcsteemis systemd teenusena juhusliku nimega ja maskiti tuumavoogude alla. Root'i \u00f5iguste korral loodi teenus s\u00fcsteemitasemel (\uff0fetc\uff0fsystemd\uff0fsystem) ja aktiveeris lisaks tuumatasemel t\u00f6\u00f6tava rootkiti, ning kasutaja \u00f5igustega k\u00e4ivitamisel k\u00e4ivitati see kasutaja nimel (~\uff0f.config\uff0fsystemd\uff0fuser). Pahavara viis l\u00e4bi skaneerimise ja andmete edastamise v\u00e4liseks server<\/a> VPN, Docker, Podman ja SSH v\u00f5tmete ja kasutajatunnuste, samuti brauserist v\u00e4lja t\u00f5mmatud konfidentsiaalsete andmete, shelli k\u00e4surea ajaloost, kr\u00fcptovaluuta rahakottide v\u00f5tmete, Slacki, Microsoft Teamsi, Discordi, GitHubi, NPM-i ja Vault'i juurdep\u00e4\u00e4sutokenite skaneerimise ja saatmise.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Arch Linux \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 469 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0438 \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432 \u043d\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u0441\u0438\u0441\u0442\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0421\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u044b\u043b \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0439 \u0447\u0435\u0440\u0435\u0437 AUR \u043f\u0430\u043a\u0435\u0442 ALVR, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182035","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u00fcndajad on kompromiteerinud 469 paketti AUR-i hoones | ProHoster","description":"AUR (Arch User Repository) pakettide ulatuslik kompromiteerimine on fikseeritud, mida kasutatakse Arch Linuxis kolmandate osapoolte rakenduste levitamiseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 469 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Arch Linux \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-12T12:48:21+00:00","article:modified_time":"2026-06-12T12:48:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/182035","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=182035"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/182035\/revisions"}],"predecessor-version":[{"id":182071,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/182035\/revisions\/182071"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=182035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=182035"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=182035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}