{"id":170684,"date":"2026-05-15T00:24:32","date_gmt":"2026-05-14T22:24:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-42-npm-paketa-tanstack-integrirovan-samorasprostranyayushhijsya-cherv"},"modified":"2026-05-15T00:24:32","modified_gmt":"2026-05-14T22:24:32","slug":"v-42-npm-paketa-tanstack-integrirovan-samorasprostranyayushhijsya-cherv","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/v-42-npm-paketa-tanstack-integrirovan-samorasprostranyayushhijsya-cherv","title":{"rendered":"42 NPM-csomagba integr\u00e1lt\u00e1k a TanStack \u00f6nmag\u00e1t terjeszt\u0151 f\u00e9reg\u00e9t.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A GitHub Actions release process compromise in the TanStack project allowed attackers to publish 84 malicious versions across 42 NPM packages in the TanStack stack to the NPM repository. Some of the compromised packages had over 10 million downloads per week. <\/p>\n
A kiad\u00e1si \u00e9rtes\u00edt\u00e9sekhez val\u00f3 hozz\u00e1f\u00e9r\u00e9s a GitHub Actions pull_request_target «Pwn Request» hib\u00e1s be\u00e1ll\u00edt\u00e1s\u00e1b\u00f3l fakad\u00f3an t\u00f6rt\u00e9nt, amely a maszk be\u00e1ll\u00edt\u00e1s\u00e1nak megad\u00e1sa miatt elind\u00edtotta a pull_request_target-et harmadik f\u00e9lt\u0151l sz\u00e1rmaz\u00f3 forkok eset\u00e9ben, a GitHub Actions cache-nek a fork \u00e1ltal val\u00f3 manipul\u00e1l\u00e1s\u00e1val \u00e9s az OIDC-token ind\u00edtott runner-folyamat (Runner.Worker) mem\u00f3ri\u00e1j\u00e1b\u00f3l val\u00f3 kiolvas\u00e1s\u00e1ra vonatkoz\u00f3 lehet\u0151s\u00e9gek r\u00e9v\u00e9n a \/proc\/\/mem f\u00e1jl el\u00e9r\u00e9s\u00e9vel. <\/p>\n
NPM packages with malicious changes were published on May 11 from 22:20 to 22:26 (MSK), noticed after 20 minutes and blocked after an hour and a half. Two malicious versions were released for each affected NPM package, integrating code to activate the mini-shai-hulud worm, which searched for tokens and credentials in the current environment. When a connection token to the NPM directory was detected, the worm automatically published new malicious releases for the packages being developed in the current environment, compromising the dependency tree. More than 400 NPM packages using TanStack packages among dependencies were affected in this way. <\/p>\n
A f\u00e9reg a router_init.js f\u00e1jlban volt elhelyezve, \u00e9s aktiv\u00e1l\u00f3dott, amikor a s\u00e9r\u00fclt csomagot a fejleszt\u0151 k\u00e9zzel telep\u00edtette, vagy automatiz\u00e1lt k\u00f6rnyezetben folyamatos integr\u00e1ci\u00f3val a «npm install», «pnpm install» vagy «yarn install» parancsok seg\u00edts\u00e9g\u00e9vel. Az aktiv\u00e1l\u00f3d\u00e1s ut\u00e1n a f\u00e9reg a rendszerben az NPM (~\/.npmrc), AWS, GCP, Azure, HashiCorp \u00e9s KubernetesK8s tokenek, valamint SSH priv\u00e1t kulcsok keres\u00e9s\u00e9re indult. A tal\u00e1lhat\u00f3 adatokat a t\u00e1mad\u00f3k a decentraliz\u00e1lt P2P-messengeren, a getsession.org-on kereszt\u00fcl tov\u00e1bb\u00edtott\u00e1k. <\/p>\n
A f\u00e9reg arra is volt programozva, hogy destrukt\u00edv m\u0171veleteket hajtson v\u00e9gre, ha a megszerzett NPM-token visszavon\u00e1sra ker\u00fclt \u2014 a rendszerben egy id\u0151szakos szkript, a ~\/.local\/bin\/gh-token-monitor.sh, lett be\u00e1ll\u00edtva, amely 60 m\u00e1sodpercenk\u00e9nt ellen\u0151rizte a token aktivit\u00e1s\u00e1t az api.github.com\/user lek\u00e9rdez\u00e9s\u00e9vel, \u00e9s ha a token visszavon\u00e1sra ker\u00fclt, a «rm -rf ~\/» parancsot hajtotta v\u00e9gre. \n Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"