A empresa GitHub publicou os resultados da an\u00e1lise de um ataque ocorrido em 12 de abril, quando criminosos conseguiram acesso a ambientes de nuvem do servi\u00e7o Amazon AWS, utilizados na infraestrutura do projeto NPM. A an\u00e1lise do incidente revelou que os atacantes acessaram c\u00f3pias de seguran\u00e7a do host skimdb.npmjs.com, incluindo uma c\u00f3pia de backup do banco de dados com dados de aproximadamente 100 mil usu\u00e1rios do NPM de 2015, contendo hashes de senhas, nomes e e-mails. <\/p>\n
Os hashes de senha foram criados utilizando algoritmos PBKDF2 ou SHA1 com sal, que em 2017 foram substitu\u00eddos por uma op\u00e7\u00e3o mais resistente a ataques, o bcrypt. Ap\u00f3s a identifica\u00e7\u00e3o do incidente, as senhas afetadas pela viola\u00e7\u00e3o foram redefinidas, e os usu\u00e1rios receberam notifica\u00e7\u00f5es sobre a necessidade de definir uma nova senha. Como a NPM implementou a verifica\u00e7\u00e3o de dois fatores obrigat\u00f3ria com confirma\u00e7\u00e3o por e-mail desde 1\u00ba de mar\u00e7o, o risco de comprometimento dos usu\u00e1rios foi avaliado como baixo. <\/p>\n
Al\u00e9m disso, os atacantes obtiveram todos os arquivos de manifesto e metadados de pacotes privados at\u00e9 abril de 2021, arquivos CSV com a lista atual de todos os nomes e vers\u00f5es de pacotes privados, al\u00e9m do conte\u00fado de todos os pacotes privados de dois clientes do GitHub (nossos nomes n\u00e3o ser\u00e3o revelados). No que diz respeito ao reposit\u00f3rio em si, a an\u00e1lise de rastros e a verifica\u00e7\u00e3o de hashes de pacotes n\u00e3o revelaram que os atacantes fizessem altera\u00e7\u00f5es nos pacotes do NPM ou publicassem novas vers\u00f5es falsas. <\/p>\n
O ataque ocorreu em 12 de abril, utilizando tokens OAuth roubados, gerados para dois integradores externos do GitHub \u2014 Heroku e Travis-CI. Aproveitando esses tokens, os atacantes conseguiram extrair de reposit\u00f3rios privados do GitHub uma chave de acesso \u00e0 API da Amazon Web Services, usada na infraestrutura do projeto NPM. A chave obtida permitiu o acesso a dados armazenados no servi\u00e7o AWS S3. <\/p>\n
Al\u00e9m disso, foram reveladas informa\u00e7\u00f5es sobre problemas cr\u00edticos de privacidade identificados anteriormente no tratamento de dados dos usu\u00e1rios. servidores<\/a> NPM \u2014 nos logs internos, as senhas de alguns usu\u00e1rios do NPM e tokens de acesso ao NPM foram salvos em texto claro. Durante a integra\u00e7\u00e3o do NPM com o sistema de gerenciamento de logs do GitHub, os desenvolvedores n\u00e3o garantiram a remo\u00e7\u00e3o de informa\u00e7\u00f5es confidenciais das solicita\u00e7\u00f5es de logs feitas aos servi\u00e7os do NPM. Alega-se que essa falha foi corrigida e os logs limpos antes do ataque ao NPM. Apenas alguns funcion\u00e1rios do GitHub tinham acesso aos logs que continham senhas em aberto. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0442\u0430\u043a\u0438, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 12 \u0430\u043f\u0440\u0435\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u043c \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Amazon AWS, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u043c \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 NPM. \u0410\u043d\u0430\u043b\u0438\u0437 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u044b\u043c \u043a\u043e\u043f\u0438\u044f\u043c \u0445\u043e\u0441\u0442\u0430 skimdb.npmjs.com \u0438 \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043a \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0439 \u043a\u043e\u043f\u0438\u0438 \u0411\u0414 \u0441 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 100 \u0442\u044b\u0441\u044f\u0447 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 NPM \u043f\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104172","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub revelou dados sobre a viola\u00e7\u00e3o da infraestrutura do NPM e a exposi\u00e7\u00e3o de senhas em logs | ProHoster","description":"A GitHub publicou os resultados da investiga\u00e7\u00e3o sobre o ataque, onde em 12 de abril, os criminosos obtiveram acesso aos ambientes em nuvem do servi\u00e7o Amazon AWS, utilizados na infraestrutura do projeto NPM.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/github-raskryl-dannye-o-vzlome-infrastruktury-npm-i-vyyavlenii-otkrytyh-parolej-v-logah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b NPM \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0432 \u043b\u043e\u0433\u0430\u0445 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0442\u0430\u043a\u0438, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 12 \u0430\u043f\u0440\u0435\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u043c \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Amazon AWS, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u043c \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 NPM.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/github-raskryl-dannye-o-vzlome-infrastruktury-npm-i-vyyavlenii-otkrytyh-parolej-v-logah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-05-27T19:36:38+00:00","article:modified_time":"2022-05-27T19:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104172","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-25 11:20:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-05-27 19:36:53","updated":"2026-01-25 11:20:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/104172","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=104172"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/104172\/revisions"}],"predecessor-version":[{"id":164417,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/104172\/revisions\/164417"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=104172"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=104172"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=104172"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"