{"id":150625,"date":"2025-12-04T23:12:08","date_gmt":"2025-12-04T21:12:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2"},"modified":"2025-12-04T23:12:08","modified_gmt":"2025-12-04T21:12:08","slug":"analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","title":{"rendered":"Analiza danych wra\u017cliwych przechwyconych przez robaka Shai-Hulud 2.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Firma Wiz opublikowa\u0142a wyniki analizy \u015blad\u00f3w dzia\u0142alno\u015bci robaka Shai-Hulud 2, w trakcie kt\u00f3rego w repozytorium NPM opublikowano z\u0142o\u015bliwe wersje ponad 800 pakiet\u00f3w, kt\u00f3re \u0142\u0105cznie mia\u0142y ponad 100 milion\u00f3w pobra\u0144. Po zainstalowaniu zainfekowanego pakietu, aktywowany robak poszukuje danych poufnych, publikuj\u0105c nowe z\u0142o\u015bliwe wersje (po wykryciu tokena dost\u0119pu do katalogu NPM) i udost\u0119pniaj\u0105c znalezione w systemie dane poufne poprzez tworzenie nowych repozytori\u00f3w na GitHubie. <\/p>\n

Na GitHubie zidentyfikowano ponad 30 tysi\u0119cy repozytori\u00f3w z danymi przechwyconymi przez robaka. W oko\u0142o 70% z tych repozytori\u00f3w znajduje si\u0119 plik content.json, w 50% \u2014 plik truffleSecrets.json, a w 80% \u2014 environment.json, kt\u00f3re zawieraj\u0105 klucze dost\u0119powe, poufne dane i zmienne \u015brodowiskowe, znalezione w systemach deweloper\u00f3w, kt\u00f3rzy zainstalowali z\u0142o\u015bliwy pakiet z robakiem. W tych repozytoriach zidentyfikowano r\u00f3wnie\u017c oko\u0142o 400 plik\u00f3w actionsSecrets.json z kluczami znalezionymi w \u015brodowiskach uruchamiania GitHub Actions. <\/p>\n

W plikach contents.json wyst\u0119powa\u0142o ponad 500 unikalnych danych logowania i token\u00f3w do po\u0142\u0105czenia z GitHubem. W plikach truffleSecrets.json znajdowa\u0142y si\u0119 dane poufne, kt\u00f3re zosta\u0142y znalezione w wyniku dzia\u0142ania na zainfekowanej maszynie narz\u0119dzia TruffleHog, zbieraj\u0105cego ponad 800 typ\u00f3w danych, w tym klucze dost\u0119pu, klucze szyfrowania, has\u0142a i tokeny u\u017cywane w r\u00f3\u017cnych serwisach, chmurach, produktach i bazach danych. W sumie w truffleSecrets.json zidentyfikowano ponad 400 tysi\u0119cy unikalnych rekord\u00f3w, z kt\u00f3rych oko\u0142o 2,5% (~10000) zosta\u0142o zweryfikowanych. <\/p>\n

Zak\u0142ada si\u0119, \u017ce ujawnione dane poufne mog\u0105 sta\u0107 si\u0119 punktem wyj\u015bcia do nowej fali atak\u00f3w, poniewa\u017c wiele informacji pozostaje aktualnych. Na przyk\u0142ad, kontrola wykaza\u0142a, \u017ce 60% token\u00f3w dost\u0119pu do NPM, przechwyconych z zainfekowanych system\u00f3w, pozostaje wa\u017cnych. <\/p>\n

W raporcie przedstawiono r\u00f3wnie\u017c og\u00f3ln\u0105 statystyk\u0119 opart\u0105 na analizie zmiennych \u015brodowiskowych z zainfekowanych system\u00f3w. 23% uruchomie\u0144 robaka mia\u0142o miejsce na komputerach deweloper\u00f3w, a 77% \u2014 w \u015brodowiskach system\u00f3w ci\u0105g\u0142ej integracji (60% GitHub Actions, 5% \u2014 Jenkins, 5% \u2014 GitLab CI, 3% \u2014 AWS CodeBuild). Na 87% system\u00f3w u\u017cywano Linuxa, 12% \u2014 macOS, a 1% \u2014 Windows. 76% uruchomie\u0144 mia\u0142o miejsce w kontenerach, a 13% \u2014 w systemach g\u0142\u00f3wnych. <\/p>\n

60% wszystkich infekcji mia\u0142o miejsce z powodu zainstalowania z\u0142o\u015bliwych wersji pakiet\u00f3w @postman\/tunnel-agent-0.6.7 oraz @asyncapi\/specs-6.8.3. W 99% przypadk\u00f3w robak zosta\u0142 aktywowany przy uruchamianiu polecenia \u201enode setup_bun.js\u201d, wskazanego w package.json w sekcji preinstall (pozosta\u0142y 1% prawdopodobnie dotyczy pr\u00f3b testowania).

\"Analiza<\/center>
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Wiz \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud 2, \u0432 \u0445\u043e\u0434\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0431\u043e\u043b\u0435\u0435 800 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430, \u0430\u043a\u0442\u0438\u0432\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0432\u0448\u0438\u0439\u0441\u044f \u0447\u0435\u0440\u0432\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043d\u043e\u0432\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0440\u0435\u043b\u0438\u0437\u044b (\u043f\u0440\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0442\u043e\u043a\u0435\u043d\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 NPM) \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":150626,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-150625","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Analiza poufnych danych przechwyconych przez robaka Shai-Hulud 2 | ProHoster","description":"Firma Wiz opublikowa\u0142a wyniki analizy \u015blad\u00f3w dzia\u0142alno\u015bci robaka Shai-Hulud 2, w trakcie kt\u00f3rej w repozytorium NPM opublikowano z\u0142o\u015bliwe wydania ponad 800 pakiet\u00f3w, kt\u00f3re w sumie licz\u0105 wi\u0119cej.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d\u043d\u044b\u0445 \u0447\u0435\u0440\u0432\u0451\u043c Shai-Hulud 2 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Wiz \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud 2, \u0432 \u0445\u043e\u0434\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0431\u043e\u043b\u0435\u0435 800 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-12-04T21:12:08+00:00","article:modified_time":"2025-12-04T21:12:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"150625","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:25:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 16:25:22","updated":"2026-01-23 16:25:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/150625","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=150625"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/150625\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media\/150626"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=150625"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=150625"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=150625"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}