{"id":149530,"date":"2025-11-25T17:11:58","date_gmt":"2025-11-25T15:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov"},"modified":"2025-11-25T17:11:58","modified_gmt":"2025-11-25T15:11:59","slug":"pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","title":{"rendered":"Utiliz\u00e2nd viermele Shai-Hulud, au fost compromise 600 de pachete NPM.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A fost \u00eenregistrat al doilea atac asupra pachetelor din repository-ul NPM, realizat prin modificarea viermelui auto-replicant Shai-Hulud, care introduce software mali\u021bios \u00een dependen\u021be. Ca rezultat al atacului, au fost publicate versiuni mali\u021bioase ale 605 pachete, av\u00e2nd \u00een total peste 100 milioane de desc\u0103rc\u0103ri. <\/p>\n

Pentru a desf\u0103\u0219ura atacul, infractorii au interceptat prin phishing parametrii contului men\u021bin\u0103torului unuia dintre pachetele populare, utilizat ca dependen\u021b\u0103 de un num\u0103r mare de pachete. Profit\u00e2nd de contul capturat, atacatorii au publicat o versiune a pachetului, \u00een care a fost ad\u0103ugat un cod pentru activarea viermelui la instalarea pachetului afectat printre dependen\u021be. Viermele activat caut\u0103 datele de autentificare din mediul curent, desc\u0103rc\u00e2nd \u0219i execut\u00e2nd utilitarul TruffleHog. <\/p>\n

\u00cen cazul \u00een care este detectat un token de conectare la directorul NPM, viermele public\u0103 automat noi versiuni mali\u021bioase pentru pachetele dezvoltat \u00een mediul curent. \u00cen acest mod, \u00eentregul arbore de dependen\u021be este afectat \u00een lan\u021b. Pe l\u00e2ng\u0103 token-ul NPM, viermele salveaz\u0103 cheile de acces pentru GitHub \u0219i serviciile cloud AWS, Azure \u0219i GCP (Google Cloud Platform), precum \u0219i variabile de mediu \u0219i alte date confiden\u021biale pe care le poate identifica scannerul TruffleHog. <\/p>\n

Datele confiden\u021biale g\u0103site \u00een sistem sunt postate pe GitHub prin crearea de repository-uri cu nume haotice (de exemplu, «qzx15djl71alh6p80h») \u0219i cu fraza «Sha1-Hulud: A Doua Venire» \u00een descriere, fiind de asemenea afi\u0219ate \u00eentr-o form\u0103 codificat\u0103 \u00een logurile GitHub Actions. \u00cen repository-ul creat se va g\u0103si un fi\u0219ier \u00een format JSON (de exemplu, jsonactionsSecrets.json sau contents.json), care con\u021bine o linie cu informa\u021bii despre sistem, variabile de mediu \u0219i date capture codificate prin metoda base64. Pentru a transfera informa\u021bia \u00een afara sistemelor de integrare continu\u0103 bazate pe GitHub, viermele creeaz\u0103 un handler GitHub Actions numit «.github\/workflows\/formatter_123456789.yml» \u0219i configureaz\u0103 un runner numit SHA1HULUD. <\/p>\n

Diferitele metode utilizate \u00een atacul similar din septembrie se reduc la o alt\u0103 abordare pentru injectarea codului mali\u021bios \u00een pachet. \u00cen versiunile mali\u021bioase generate de vierme se declar\u0103 implementarea suportului pentru platforma JavaScript Bun. \u00cen fi\u0219ierul package.json, \u00een sec\u021biunea «preinstall», care define\u0219te scripturile ce se ruleaz\u0103 \u00eenainte de instalare, se adaug\u0103 comanda «node setup_bun.js».

\"Utiliz\u00e2nd<\/center> <\/p>\n

\u00cen fi\u0219ierul «setup_bun.js» se g\u0103se\u0219te codul pentru executarea scriptului obfuscat «bun_environment.js», care con\u021bine codul viermelui. Pentru a-\u0219i extinde r\u0103sp\u00e2ndirea, viermele caut\u0103 codul pachetelor, face modific\u0103ri \u00een fi\u0219ierul package.json (cre\u0219te num\u0103rul versiunii \u0219i include apelul c\u0103tre setup_bun.js), adaug\u0103 fi\u0219ierele setup_bun.js \u0219i bun_environment.js, recompune pachetul \u0219i execut\u0103 comanda «npm publish» pentru a publica noua versiune. <\/p>\n

Printre pachetele populare compromise se num\u0103r\u0103: @zapier\/zapier-sdk (2.8 milioane desc\u0103rc\u0103ri pe s\u0103pt\u0103m\u00e2n\u0103), @posthog\/core (2.8 milioane), posthog-node (1.5 milioane), @asyncapi\/specs (1.4 milioane), @postman\/tunnel-agent (1.2 milioane). Se presupune c\u0103 atacul a \u00eenceput cu compromiterea pachetului @asyncapi\/specs.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u0442\u043e\u0440\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM, \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0430\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0430\u043c\u043e\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0447\u0435\u0440\u0432\u044f Shai-Hulud, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 605 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0443\u0442\u0451\u043c \u0444\u0438\u0448\u0438\u043d\u0433\u0430 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u043b\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":149531,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-149530","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cu ajutorul viermului Shai-Hulud, 600 de pachete NPM compromise | ProHoster","description":"A fost \u00eenregistrat un al doilea atac asupra pachetelor din repositoarele NPM, desf\u0103\u0219urat cu ajutorul unei modific\u0103ri a viermului auto-replicant Shai-Hulud, care insereaz\u0103 software mali\u021bios \u00een dependen\u021be.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e 600 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u0442\u043e\u0440\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM, \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0430\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0430\u043c\u043e\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0447\u0435\u0440\u0432\u044f Shai-Hulud, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-11-25T15:11:59+00:00","article:modified_time":"2025-11-25T15:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"149530","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:12:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 16:12:19","updated":"2026-01-23 16:12:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/149530","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=149530"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/149530\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/149531"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=149530"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=149530"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=149530"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}