{"id":139659,"date":"2025-07-21T11:12:05","date_gmt":"2025-07-21T09:12:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami"},"modified":"2025-07-21T11:12:05","modified_gmt":"2025-07-21T09:12:05","slug":"fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami","title":{"rendered":"Phishing umo\u017cliwi\u0142 przej\u0119cie kontroli nad kilkoma popularnymi pakietami NPM.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Zidentyfikowano atak phishingowy skierowany na biblioteki JavaScript, w ramach kt\u00f3rego w imieniu us\u0142ugi NPM wys\u0142ano wiadomo\u015b\u0107 informuj\u0105c\u0105 o konieczno\u015bci potwierdzenia swojego adresu email. Przeprowadzony atak umo\u017cliwi\u0142 cyberprzest\u0119pcom uzyskanie token\u00f3w NPM jednego z wi\u0119kszych projekt\u00f3w JavaScript i wypuszczenie aktualizacji z z\u0142o\u015bliwym kodem dla pi\u0119ciu pakiet\u00f3w NPM, kt\u00f3re w sumie mia\u0142y oko\u0142o 100 milion\u00f3w pobra\u0144 tygodniowo.       <\/p>\n<p>Wys\u0142ana wiadomo\u015b\u0107 towarzysz\u0105ca by\u0142a stylizowana na typowe powiadomienia NPM, wysy\u0142ane z adresu \"support@npmjs.org\", jednak jako link do przej\u015bcia podano domen\u0119 \"npnjs.com\" zamiast \"npmjs.com\" (trzecia litera \"n\" zamiast \"m\"). Atakuj\u0105cy skorzystali z efektu psychologicznego, przez kt\u00f3ry m\u00f3zg, oczekuj\u0105c rezultatu, nie dostrzega drobnych zniekszta\u0142ce\u0144, takich jak zamiana liter na podobne lub zmiana kolejno\u015bci liter w s\u0142owie. Po klikni\u0119ciu w link otwiera\u0142a si\u0119 pe\u0142na kopia strony npmjs.com (prawdopodobnie skonfigurowano proxy przechwytuj\u0105ce token dost\u0119pu).    <center><img decoding=\"async\" alt=\"Phishing umo\u017cliwi\u0142 przej\u0119cie kontroli nad kilkoma popularnymi pakietami NPM.\" src=\"\/wp-content\/uploads\/2025\/07\/0d5e2613f7265b3fcca6ee367c0ecac9.png\" style=\"display:block;margin: 0 auto;\" \/><\/center>    <\/p>\n<p>W trakcie ataku utworzono nowe wersje pakiet\u00f3w:  <\/p>\n<ul>\n<li class=\"l\"> eslint-config-prettier: 8.10.1, 9.1.1, 10.1.6, 10.1.7.\n<li class=\"l\"> eslint-plugin-prettier: 4.2.2, 4.2.3.\n<li class=\"l\"> synckit: 0.11.9.\n<li class=\"l\"> @pkgr\/core: 0.2.8.\n<li class=\"l\"> napi-postinstall: 0.3.1.  <\/ul>\n<p>Do utworzonych wyda\u0144 dodano z\u0142o\u015bliwy kod atakuj\u0105cy u\u017cytkownik\u00f3w korzystaj\u0105cych z platformy Windows. Wprowadzone zmiany pobiera\u0142y bibliotek\u0119 node-gyp.dll, zawieraj\u0105c\u0105 funkcjonalno\u015b\u0107 do zdalnego wykonywania komend w systemie.     <\/p>\n<p>Osoba odpowiedzialna za pakiety zauwa\u017cy\u0142a, \u017ce sta\u0142a si\u0119 ofiar\u0105 phishingu mniej wi\u0119cej godzin\u0119 po otrzymaniu pierwszej skargi na publikacj\u0119 podejrzanych wyda\u0144. Natychmiast odwo\u0142a\u0142a token dost\u0119pu, zmieni\u0142a has\u0142a, oznaczy\u0142a problematyczne wersje jako przestarza\u0142e, aby zapobiec ich pobieraniu przez zautomatyzowane systemy buduj\u0105ce, i wys\u0142a\u0142a pro\u015bb\u0119 o usuni\u0119cie problematycznych wersji z repozytori\u00f3w do wsparcia NPM.     <\/p>\n<p>Nie wiadomo, ilu u\u017cytkownik\u00f3w uda\u0142o si\u0119 pobra\u0107 z\u0142o\u015bliwe wersje (na przyk\u0142ad z\u0142o\u015bliwa wersja pakietu eslint-plugin-prettier pozostawa\u0142a w repozytorium przez oko\u0142o dwa dni). W ubieg\u0142ym tygodniu pakiet eslint-config-prettier mia\u0142 30 mln pobra\u0144 i by\u0142 u\u017cywany jako zale\u017cno\u015b\u0107 w 11762 pakietach, pakiet eslint-plugin-prettier \u2014 21 mln pobra\u0144 (8468 zale\u017cnych pakiet\u00f3w), synckit \u2014 18 mln, @pkgr\/core \u2014 16 mln i napi-postinstall \u2014 10 mln.<br \/>\n<br \/>\u0179r\u00f3d\u0142o: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=63610\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0444\u0438\u0448\u0438\u043d\u0433-\u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 NPM \u0431\u044b\u043b\u043e \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u044f\u044e\u0449\u0435\u0435 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u044c \u0441\u0432\u043e\u0439 email. \u041f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c NPM-\u0442\u043e\u043a\u0435\u043d\u044b \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 JavaScript-\u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u043f\u044f\u0442\u0438 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432 \u0441\u0443\u043c\u043c\u0435 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u043e\u043a\u043e\u043b\u043e 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e. \u041e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0435 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u043c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u0441\u0442\u0438\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":139660,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-139659","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0444\u0438\u0448\u0438\u043d\u0433-\u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 NPM \u0431\u044b\u043b\u043e \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u044f\u044e\u0449\u0435\u0435 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u044c \u0441\u0432\u043e\u0439 email.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pl\/blog\/news\/fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"pl_PL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0424\u0438\u0448\u0438\u043d\u0433 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 NPM-\u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0444\u0438\u0448\u0438\u043d\u0433-\u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 NPM \u0431\u044b\u043b\u043e \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u044f\u044e\u0449\u0435\u0435 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u044c \u0441\u0432\u043e\u0439 email.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pl\/blog\/news\/fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-07-21T09:12:05+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-07-21T09:12:05+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Phishing umo\u017cliwi\u0142 przej\u0119cie kontroli nad kilkoma popularnymi pakietami NPM | ProHoster","description":"Zarejestrowano atak phishingowy na towarzysz\u0105ce biblioteki JavaScript, w trakcie kt\u00f3rego w imieniu serwisu NPM wys\u0142ano wiadomo\u015b\u0107 informuj\u0105c\u0105 o konieczno\u015bci potwierdzenia swojego adresu email.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0424\u0438\u0448\u0438\u043d\u0433 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 NPM-\u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0444\u0438\u0448\u0438\u043d\u0433-\u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 NPM \u0431\u044b\u043b\u043e \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u044f\u044e\u0449\u0435\u0435 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u044c \u0441\u0432\u043e\u0439 email.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-07-21T09:12:05+00:00","article:modified_time":"2025-07-21T09:12:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"139659","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:55:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:55:19","updated":"2026-01-23 13:55:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/139659","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=139659"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/139659\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media\/139660"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=139659"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=139659"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=139659"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}