{"id":150625,"date":"2025-12-04T23:12:08","date_gmt":"2025-12-04T21:12:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2"},"modified":"2025-12-04T23:12:08","modified_gmt":"2025-12-04T21:12:08","slug":"analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","title":{"rendered":"Analyse des donn\u00e9es sensibles captur\u00e9es par le ver Shai-Hulud 2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

La soci\u00e9t\u00e9 Wiz a publi\u00e9 les r\u00e9sultats de son analyse des traces d'activit\u00e9 du ver Shai-Hulud 2, qui, lors de son activit\u00e9, a publi\u00e9 des releases malveillantes de plus de 800 packages dans le d\u00e9p\u00f4t NPM, totalisant plus de 100 millions de t\u00e9l\u00e9chargements. Apr\u00e8s l'installation d'un package infect\u00e9, le ver activ\u00e9 recherche des donn\u00e9es sensibles, publie de nouvelles releases malveillantes (lorsqu'il d\u00e9tecte un jeton de connexion au r\u00e9pertoire NPM) et met \u00e0 disposition du public les donn\u00e9es confidentielles trouv\u00e9es dans le syst\u00e8me en cr\u00e9ant de nouveaux d\u00e9p\u00f4ts sur GitHub. <\/p>\n

GitHub a r\u00e9v\u00e9l\u00e9 plus de 30 000 d\u00e9p\u00f4ts contenant des donn\u00e9es intercept\u00e9es par un ver. Environ 70 % de ces d\u00e9p\u00f4ts contiennent un fichier content.json, 50 % \u2014 un fichier truffleSecrets.json, et 80 % \u2014 un fichier environment.json, contenant des cl\u00e9s d'acc\u00e8s, des donn\u00e9es confidentielles et des variables d'environnement trouv\u00e9es sur le syst\u00e8me du d\u00e9veloppeur ayant install\u00e9 un paquet malveillant avec le ver. On a \u00e9galement d\u00e9couvert environ 400 fichiers actionsSecrets.json contenant des cl\u00e9s trouv\u00e9es dans les environnements d'ex\u00e9cution de GitHub Actions. <\/p>\n

Les fichiers contents.json contenaient plus de 500 identifiants uniques et jetons d'acc\u00e8s \u00e0 GitHub. Les fichiers truffleSecrets.json contenaient des donn\u00e9es sensibles d\u00e9couvertes lors de l'ex\u00e9cution sur le syst\u00e8me infect\u00e9 de l'outil TruffleHog, qui collecte plus de 800 types de donn\u00e9es, parmi lesquelles des cl\u00e9s d'acc\u00e8s, des cl\u00e9s de chiffrement, des mots de passe et des jetons utilis\u00e9s dans divers services, environnements cloud, produits et SGBD. Au total, plus de 400 000 enregistrements uniques ont \u00e9t\u00e9 identifi\u00e9s dans truffleSecrets.json, dont environ 2,5 % (~10 000) ont \u00e9t\u00e9 v\u00e9rifi\u00e9s. <\/p>\n

Il est suppos\u00e9 que les informations confidentielles rendues publiques pourraient servir de point de d\u00e9part \u00e0 une nouvelle vague d'attaques, car de nombreuses donn\u00e9es demeurent pertinentes. Par exemple, une v\u00e9rification a montr\u00e9 que 60 % des jetons d'acc\u00e8s \u00e0 NPM, captur\u00e9s sur des syst\u00e8mes infect\u00e9s par le ver, restent valides. <\/p>\n

Le rapport pr\u00e9sente \u00e9galement des statistiques globales, issues de l'analyse des variables d'environnement des syst\u00e8mes infect\u00e9s. 23 % des ex\u00e9cutions du ver se sont produites sur des ordinateurs de d\u00e9veloppeurs, et 77 % dans des environnements de syst\u00e8mes d'int\u00e9gration continue (60 % GitHub Actions, 5 % \u2014 Jenkins, 5 % \u2014 GitLab CI, 3 % \u2014 AWS CodeBuild). 87 % des syst\u00e8mes utilisaient Linux, 12 % \u2014 macOS et 1 % \u2014 Windows. 76 % des ex\u00e9cutions se sont faites dans des conteneurs, 13 % \u2014 dans des syst\u00e8mes principaux. <\/p>\n

60 % de toutes les infections sont survenues \u00e0 cause de l'installation des versions malveillantes des paquets @postman\/tunnel-agent-0.6.7 et @asyncapi\/specs-6.8.3. Dans 99 % des cas, le ver a \u00e9t\u00e9 activ\u00e9 lors de l'ex\u00e9cution de la commande \u00ab node setup_bun.js \u00bb, sp\u00e9cifi\u00e9e dans package.json dans la section preinstall (les 1 % restants concernent probablement des tentatives de test).

\"Analyse<\/center>
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Wiz \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud 2, \u0432 \u0445\u043e\u0434\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0431\u043e\u043b\u0435\u0435 800 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430, \u0430\u043a\u0442\u0438\u0432\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0432\u0448\u0438\u0439\u0441\u044f \u0447\u0435\u0440\u0432\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043d\u043e\u0432\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0440\u0435\u043b\u0438\u0437\u044b (\u043f\u0440\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0442\u043e\u043a\u0435\u043d\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 NPM) \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":150626,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-150625","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Analyse des donn\u00e9es confidentielles captur\u00e9es par le ver Shai-Hulud 2 | ProHoster","description":"La soci\u00e9t\u00e9 Wiz a publi\u00e9 les r\u00e9sultats de son analyse des traces d'activit\u00e9 du ver Shai-Hulud 2, au cours de laquelle plus de 800 versions malveillantes de paquets ont \u00e9t\u00e9 publi\u00e9es dans le d\u00e9p\u00f4t NPM, totalisant plus.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d\u043d\u044b\u0445 \u0447\u0435\u0440\u0432\u0451\u043c Shai-Hulud 2 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Wiz \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud 2, \u0432 \u0445\u043e\u0434\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0431\u043e\u043b\u0435\u0435 800 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-12-04T21:12:08+00:00","article:modified_time":"2025-12-04T21:12:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"150625","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:25:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 16:25:22","updated":"2026-01-23 16:25:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/150625","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=150625"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/150625\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media\/150626"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=150625"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=150625"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=150625"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}