{"id":150625,"date":"2025-12-04T23:12:08","date_gmt":"2025-12-04T21:12:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2"},"modified":"2025-12-04T23:12:08","modified_gmt":"2025-12-04T21:12:08","slug":"analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","title":{"rendered":"Analisi dei dati riservati, catturati dal worm Shai-Hulud 2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

L'azienda Wiz ha pubblicato i risultati dell'analisi delle tracce dell'attivit\u00e0 del worm Shai-Hulud 2, durante la quale sono state pubblicate versioni malevole di oltre 800 pacchetti nel repository NPM, con pi\u00f9 di 100 milioni di download complessivi. Dopo l'installazione del pacchetto compromesso, il worm attivato cerca dati riservati, pubblica nuove versioni malevole (in caso di rilevamento di un token di accesso al catalogo NPM) e rende pubblici i dati riservati trovati nel sistema creando nuovi repository su GitHub. <\/p>\n

\u0412 GitHub \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 30 \u0442\u044b\u0441\u044f\u0447 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u0441 \u0441\u043e\u0445\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u043c\u0438 \u0447\u0435\u0440\u0432\u0451\u043c \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438. \u0412 \u043e\u043a\u043e\u043b\u043e 70% \u0438\u0437 \u044d\u0442\u0438\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0444\u0430\u0439\u043b content.json, \u0432 50% — \u0444\u0430\u0439\u043b truffleSecrets.json, \u0430 \u0432 80% — environment.json, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0432\u0448\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 \u0441 \u0447\u0435\u0440\u0432\u0451\u043c. \u0422\u0430\u043a\u0436\u0435 \u0432 \u0434\u0430\u043d\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 400 \u0444\u0430\u0439\u043b\u043e\u0432 actionsSecrets.json \u0441 \u043a\u043b\u044e\u0447\u0430\u043c\u0438, \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f GitHub Actions. <\/p>\n

Nei file contents.json erano presenti oltre 500 credenziali uniche e token per l'accesso a GitHub. I file truffleSecrets.json contenevano dati riservati trovati a seguito dell'esecuzione sulla macchina compromessa dell'applicazione TruffleHog, che raccoglie oltre 800 tipi di dati, tra cui chiavi di accesso, chiavi di crittografia, password e token utilizzati in vari servizi, ambienti cloud, prodotti e database. In totale, in truffleSecrets.json sono stati identificati pi\u00f9 di 400.000 record unici, di cui circa il 2,5% (~10.000) sono stati verificati. <\/p>\n

Si ritiene che le informazioni riservate rese pubbliche possano diventare un punto di partenza per una nuova ondata di attacchi, poich\u00e9 molti di questi dati rimangono pertinenti. Ad esempio, la verifica ha mostrato che il 60% dei token di accesso a NPM catturati dai sistemi compromessi dal worm sono ancora attivi. <\/p>\n

\u0412 \u043e\u0442\u0447\u0451\u0442\u0435 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u043e\u0431\u0449\u0430\u044f \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0441 \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. 23% \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u0432 \u0447\u0435\u0440\u0432\u044f \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0430 77% — \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 (60% GitHub Actions, 5% — Jenkins, 5% — GitLab CI, 3% — AWS CodeBuild). \u041d\u0430 87% \u0441\u0438\u0441\u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f Linux, 12% — macOS \u0438 1% — Windows. 76% \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u0432 \u0431\u044b\u043b\u043e \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445, 13% — \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445. <\/p>\n

60% \u0432\u0441\u0435\u0445 \u0438\u043d\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u043e \u0438\u0437-\u0437\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0440\u0435\u043b\u0438\u0437\u043e\u0432 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 @postman\/tunnel-agent-0.6.7 \u0438 @asyncapi\/specs-6.8.3. \u0412 99% \u043f\u0440\u043e\u0446\u0435\u043d\u0442\u0435 \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0447\u0435\u0440\u0432\u044c \u0431\u044b\u043b \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b «node setup_bun.js», \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u0439 \u0432 package.json \u0432 \u0441\u0435\u043a\u0446\u0438\u0438 preinstall (\u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0435\u0441\u044f 1% \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e \u043f\u0440\u0438\u0445\u043e\u0434\u044f\u0442\u0441\u044f \u043d\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f).

\"Analisi<\/center>
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Wiz \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud 2, \u0432 \u0445\u043e\u0434\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0431\u043e\u043b\u0435\u0435 800 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430, \u0430\u043a\u0442\u0438\u0432\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0432\u0448\u0438\u0439\u0441\u044f \u0447\u0435\u0440\u0432\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043d\u043e\u0432\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0440\u0435\u043b\u0438\u0437\u044b (\u043f\u0440\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0442\u043e\u043a\u0435\u043d\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 NPM) \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":150626,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-150625","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Analisi dei dati riservati catturati dal worm Shai-Hulud 2 | ProHoster","description":"L'azienda Wiz ha pubblicato i risultati dell'analisi delle tracce dell'attivit\u00e0 del worm Shai-Hulud 2, durante la quale sono state pubblicate versioni malevole di oltre 800 pacchetti nel repository NPM, con pi\u00f9 di 100 milioni di download complessivi. Dopo l'installazione del pacchetto compromesso, il worm attivato cerca dati riservati, pubblica nuove versioni malevole (in caso di rilevamento di un token di accesso al catalogo NPM) e rende pubblici i","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d\u043d\u044b\u0445 \u0447\u0435\u0440\u0432\u0451\u043c Shai-Hulud 2 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Wiz \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud 2, \u0432 \u0445\u043e\u0434\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0431\u043e\u043b\u0435\u0435 800 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430, \u0430\u043a\u0442\u0438\u0432\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0432\u0448\u0438\u0439\u0441\u044f \u0447\u0435\u0440\u0432\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043d\u043e\u0432\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0440\u0435\u043b\u0438\u0437\u044b (\u043f\u0440\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0442\u043e\u043a\u0435\u043d\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 NPM) \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442 \u0432","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-12-04T21:12:08+00:00","article:modified_time":"2025-12-04T21:12:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"150625","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:25:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 16:25:22","updated":"2026-01-23 16:25:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/150625","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=150625"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/150625\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/150626"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=150625"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=150625"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=150625"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}