{"id":182783,"date":"2026-08-10T19:40:40","date_gmt":"2026-08-10T17:40:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov"},"modified":"2026-08-10T19:40:40","modified_gmt":"2026-08-10T17:40:40","slug":"novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov","title":{"rendered":"Uus ChainDrop uss on \u0161okeerinud rohkem kui 400 NPM-paketti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex>          <a rel=\"nofollow\" id=\"memories_button\" href=\"#\" title=\"J\u00e4lgida\"><i class=\"icon-bell\"><\/i><\/a><br \/>1                            <noindex><\/p>\n<p><a rel=\"nofollow\" href=\"https:\/\/www.stepsecurity.io\/blog\/chaindrop-npm-worm\">Ahnestatud<\/a> massiivne r\u00fcnnak NPM-i reposta\u017eis olevatele pakettidele, mida viiakse l\u00e4bi uusi iseseisvalt levivaid usse ChainDrop kasutades, mis paigaldab kahjulikke rakendusi s\u00f5ltuvustesse. R\u00fcnnaku tulemusena on avaldatud 2212 kahjulikku versiooni 444 paketile. K\u00f5ige populaarsemad kompromiteeritud paketid keyv, flat-cache ja file-entry-cache, kuhu n\u00e4dalas toimub vastavalt 154, 149.9 ja 147.6 miljonit allalaadimist.<\/p>\n<p><\/noindex>  <\/p>\n<p>Kahjuri laadija oli paiknenud failides setup.mjs ja Math_Symbol.js, mis k\u00e4ivitati preinstall-t\u00f6\u00f6tleja abil (\"preinstall\": \"node setup.mjs\"), mida kasutatakse nakatunud paketi installimisel. Need skriptid laadisid seadusliku Bun runtime'i ja obfuskeeritud kahjurikoodi, mille suurus oli 710 KB. P\u00e4rast aktiveerimist otsis kahjur s\u00fcsteemist ja keskkonnamuutujatest NPM, PyPI, CircleCI, AWS, GCP, Docker, Azure, HashiCorp, Kubernetes K8s ja teiste teenuste tokenite j\u00e4rele (anal\u00fc\u00fcsiti kokku \u00fcle 140 failitee, n\u00e4iteks ~\\ .npmrc), samuti anal\u00fc\u00fcsis see m\u00e4lu (l\u00e4bi \/proc\/\/mem) GitHub Actions keskkonna tokenite ja autentimisandmete osas.<\/p>\n<p> <noindex><\/p>\n<p>Kui leiti token NPM katalooge \u00fchendamiseks, avaldas uss automaatselt uusi kahjulikke versioone aktiivses keskkonnas arendatavale paketile, m\u00f5jutades s\u00f5ltuvuste puu. Erinevalt varem tuvastatud ussist <a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=64377\">Shai-Hulud 2.0<\/a> ChainDrop'is oli rakendatud EtherHiding tehnika juhtimisk\u00e4skude saamiseks avalikust Ethereum plokiahelast, kasutades kr\u00fcpteerimist, et varjata r\u00fcnnakutele suunatud konfidentsiaalset teavet, ning tagades Claude Code'i, VS Code'i ja GitHub Copilot'i konfiguratsioonifailidesse sisestamiseks, et kindlustada s\u00fcsteemi kohalolek.<\/p>\n<p><\/noindex> <noindex><\/p>\n<p>R\u00fcnnak algas GitHub Actions'i vabastamisprotsessi kompromiteerimisega paketi <a rel=\"nofollow\" href=\"https:\/\/www.npmjs.com\/package\/keyv\">keyv<\/a>, mille n\u00e4dalane allalaadimise maht ulatub 154 miljonini ja mida kasutatakse s\u00f5ltuvusena 1703 paketis. R\u00fcndajad koostasid uue versiooni 6.0.0, asendades selle kuri koodiga, ja avaldasid selle, kasutades mehhanismi &laquo;<a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=59019\">Usaldusv\u00e4\u00e4rsed Avaldajad<\/a>&raquo; ja korrektset <a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55345\">SLSA-sertifikaati<\/a>. P\u00e4rast avaldamist kahjustas uss paljusid s\u00f5ltuvaid keyv pakette ja r\u00fcndas seej\u00e4rel kaudseid s\u00f5ltuvusi.<\/p>\n<p><\/noindex> <\/p>\n<p>K\u00f5ige populaarsemate paketid, mida m\u00f5jutab uss, mis avaldas nende jaoks pahatahtlikke versioone:<\/p>\n<ul>\n<li>flat-cache 6.1.24 (149.8 miljonit allalaadimist n\u00e4dalas);<\/li>\n<li>file-entry-cache 11.1.6 (147.5 miljonit);<\/li>\n<li>cacheable-request 13.0.20 (33.9 miljonit);<\/li>\n<li>@cacheable\/utils 2.5.1 (8.7 miljonit);<\/li>\n<li>cacheable 2.5.1 (7.8 miljonit);<\/li>\n<li>@cacheable\/memory 2.2.1 (7.1 miljonit);<\/li>\n<li>cache-manager 7.2.10 (4.2 miljonit);<\/li>\n<li>@cacheable\/node-cache 3.1.2 (1.5 miljonit).<\/li>\n<\/ul>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18352803\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>1 \u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM, \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0430\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u043e\u0432\u043e\u0433\u043e \u0441\u0430\u043c\u043e\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0447\u0435\u0440\u0432\u044f ChainDrop, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043e 2212 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u0432 \u0434\u043b\u044f 444 \u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u0438\u0437 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 keyv, flat-cache \u0438 file-entry-cache \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0442 154, 149.9 \u0438 147.6 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e. \u0417\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0447\u0435\u0440\u0432\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u043b\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0430\u0445 setup.mjs [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182783","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"1 \u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Emin Berklin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041d\u043e\u0432\u044b\u0439 \u0447\u0435\u0440\u0432\u044c ChainDrop \u043f\u043e\u0440\u0430\u0437\u0438\u043b \u0431\u043e\u043b\u0435\u0435 400 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"1 \u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-08-10T17:40:40+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-08-10T17:40:40+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uus uss ChainDrop on tabanud \u00fcle 400 NPM-paketi | ProHoster","description":"1 On fikseeritud.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0439 \u0447\u0435\u0440\u0432\u044c ChainDrop \u043f\u043e\u0440\u0430\u0437\u0438\u043b \u0431\u043e\u043b\u0435\u0435 400 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"1 \u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-08-10T17:40:40+00:00","article:modified_time":"2026-08-10T17:40:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/182783","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=182783"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/182783\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=182783"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=182783"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=182783"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}