{"id":106945,"date":"2023-02-26T12:49:02","date_gmt":"2023-02-26T10:49:03","guid":{"rendered":"https:\/\/prohoster.info\/?p=106945"},"modified":"2023-02-27T12:02:06","modified_gmt":"2023-02-27T10:02:06","slug":"v-npm-vyyavleno-15-tysyach-paketov-dlya-fishinga-i-spama","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/v-npm-vyyavleno-15-tysyach-paketov-dlya-fishinga-i-spama","title":{"rendered":"A NPM-ben 15 ezer \u00e1lca \u00e9s spam csomagot azonos\u00edtottak","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
T\u00e1mad\u00e1st regisztr\u00e1ltak az NPM katal\u00f3gus felhaszn\u00e1l\u00f3i ellen, amelynek k\u00f6vetkezt\u00e9ben febru\u00e1r 20-\u00e1n t\u00f6bb mint 15 ezer csomagot helyeztek el az NPM t\u00e1rol\u00f3j\u00e1ban, amelyek README f\u00e1jljaiban hivatkoz\u00e1sok szerepeltek phishing weboldalakra vagy refer\u00e1l\u00f3 linkekre, amelyek ut\u00e1n jutal\u00e9kot fizetnek a kattint\u00e1sok\u00e9rt. Az elemz\u00e9s sor\u00e1n a csomagokban 190 egyedi phishing vagy rekl\u00e1m linket azonos\u00edtottak, \u00f6sszesen 31 domainek k\u00f6r\u00e9ben. <\/p>\n
A csomagnevek a h\u00e9tk\u00f6znapi emberek \u00e9rdekl\u0151d\u00e9s\u00e9nek felkelt\u00e9s\u00e9re lettek kiv\u00e1lasztva, p\u00e9ld\u00e1ul: «free-tiktok-followers», «free-xbox-codes», «instagram-followers-free» stb. A sz\u00e1m\u00edt\u00e1s a spamcsomagokkal val\u00f3 friss\u00edt\u00e9sek lista felt\u00f6lt\u00e9s\u00e9re ir\u00e1nyult az NPM f\u0151oldal\u00e1n. A csomagok le\u00edr\u00e1s\u00e1ban linkek szerepeltek, amelyek ingyenes aj\u00e1nd\u00e9kokat, nyerem\u00e9nyeket, j\u00e1t\u00e9kbeli csal\u00e1sokat, valamint ingyenes szolg\u00e1ltat\u00e1sokat \u00edg\u00e9rtek k\u00f6vet\u0151k \u00e9s l\u00e1jkok n\u00f6vel\u00e9s\u00e9re a k\u00f6z\u00f6ss\u00e9gi m\u00e9di\u00e1ban, p\u00e9ld\u00e1ul a TikTok-on \u00e9s az Instagram-on. Ez nem az els\u0151 hasonl\u00f3 t\u00e1mad\u00e1s, decemberben a NuGet, NPM \u00e9s PyPi katal\u00f3gusokban \u00f6sszesen 144 ezer spamcsomag publik\u00e1l\u00e1s\u00e1ra ker\u00fclt sor.
<\/center> <\/p>\n
A csomagok tartalm\u00e1t automatikusan gener\u00e1lt\u00e1k egy python szkripttel, amely nyilv\u00e1nval\u00f3an figyelmetlens\u00e9g folyt\u00e1n maradt a csomagokban, \u00e9s tartalmazta a t\u00e1mad\u00e1s sor\u00e1n haszn\u00e1lt m\u0171k\u00f6d\u0151 bejelentkez\u00e9si adatokat. A csomagokat sok k\u00fcl\u00f6nb\u00f6z\u0151 fi\u00f3k alatt publik\u00e1lt\u00e1k \u00fagy, hogy megnehez\u00edtett\u00e9k a nyomoz\u00e1si folyamatot \u00e9s a probl\u00e9m\u00e1s csomagok gyors azonos\u00edt\u00e1s\u00e1t. <\/p>\n
A NPM \u00e9s a PyPi t\u00e1rol\u00f3kban a csal\u00e1rd tev\u00e9kenys\u00e9gek mellett t\u00f6bb k\u00eds\u00e9rletet is felfedeztek k\u00e1rtev\u0151 csomagok publik\u00e1l\u00e1s\u00e1ra: <\/p>\n
\n
A PyPI repository has found 451 malicious packages that disguised themselves as popular libraries through typoscoping (using similar names differing by individual characters, e.g., vper instead of vyper, bitcoinnlib instead of bitcoinlib, ccryptofeed instead of cryptofeed, ccxtt instead of ccxt, cryptocommpare instead of cryptocompare, seleium instead of selenium, pinstaller instead of pyinstaller, etc.). The packages contained obfuscated code to steal cryptocurrency, which identified the presence of cryptocurrency wallet identifiers in the clipboard and replaced them with the attacker's wallet (it is assumed that when the victim makes a payment, they will not notice that the wallet number copied to the clipboard is different). The substitution was carried out by a browser extension embedded in each visited web page's context.\n
A series of malicious HTTP libraries has been identified in the PyPI repository. Malicious activity was found in 41 packages, whose names were selected using typosquatting methods and resembled popular libraries (aio5, requestst, ulrlib, urllb, libhttps, piphttps, httpxv2, etc.). The contents were styled to resemble working HTTP libraries or copied the code from existing libraries, while their descriptions made claims about advantages and comparisons with legitimate HTTP libraries. The malicious activity involved either downloading malware onto the system or collecting and sending confidential data.\n
16 JavaScript packages (speedte*, trova*, lagra) have been identified in NPM that, in addition to their stated functionality (throughput testing), also contained code for mining cryptocurrency without the user's knowledge.\n
![\"A](\"\/wp-content\/uploads\/2023\/02\/434214f596ba6d4174a3f0a8eae982e4.jpg\")
<\/center> <\/p>\n