{"id":143668,"date":"2025-09-17T11:11:56","date_gmt":"2025-09-17T09:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/samorasprostranyayushhijsya-cherv-porazil-187-paketov-v-npm"},"modified":"2026-02-08T21:43:52","modified_gmt":"2026-02-08T19:43:52","slug":"samorasprostranyayushhijsya-cherv-porazil-187-paketov-v-npm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/samorasprostranyayushhijsya-cherv-porazil-187-paketov-v-npm","title":{"rendered":"Samoroz\u0161iruj\u00faci \u010derv infikoval 187 bal\u00edkov v NPM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00datok na obslu\u017en\u00e9 bal\u00edky v repozit\u00e1ri NPM dosiahol nov\u00fa \u00farove\u0148. Okrem pou\u017e\u00edvania \u0161kodliv\u00e9ho softv\u00e9ru na zachyt\u00e1vanie platieb a citliv\u00fdch inform\u00e1ci\u00ed pre\u0161li \u00fato\u010dn\u00edci k vkladaniu \u010derva do skompromitovan\u00fdch bal\u00edkov na automatiz\u00e1ciu vkladania \u0161kodliv\u00e9ho softv\u00e9ru do z\u00e1vislost\u00ed. Pou\u017eitie \u010derva bolo zaznamenan\u00e9 po skompromitovan\u00ed NPM bal\u00edka @ctrl\/tinycolor, ktor\u00fd m\u00e1 2,2 mili\u00f3na t\u00fd\u017edenn\u00fdch stiahnut\u00ed a je pou\u017e\u00edvan\u00fd ako priama z\u00e1vislos\u0165 v 964 bal\u00edkoch. V d\u00f4sledku aktivity \u010derva \u00fatok zasiahol 187 bal\u00edkov, pre ktor\u00e9 boli vytvoren\u00e9 \u0161kodliv\u00e9 vydania (477 \u0161kodliv\u00fdch vydan\u00ed). <\/p>\n

Po\u010das nov\u00e9ho \u00fatoku, ke\u010f \u00fato\u010dn\u00edci z\u00edskali parametre \u00fa\u010dtu sprievodcu v\u00fdsledkom phishingu, zverej\u0148uje \u00fato\u010dn\u00edk vydanie bal\u00edka s \u010dervom, ktor\u00fd sa aktivuje pri in\u0161tal\u00e1cii skompromitovan\u00e9ho bal\u00edka v z\u00e1vislostiach. Po aktiv\u00e1cii \u010derv vyh\u013ead\u00e1va prihlasovacie \u00fadaje v aktu\u00e1lnom prostred\u00ed, na\u010d\u00edtava a sp\u00fa\u0161\u0165a utilitu TruffleHog. V pr\u00edpade, \u017ee objav\u00ed pripojovac\u00ed token k adres\u00e1ru NPM, \u010derv automaticky zverejn\u00ed nov\u00e9 \u0161kodliv\u00e9 vydanie a re\u0165azovo zasahuje do stromu z\u00e1vislost\u00ed. Okrem pr\u00edstupov\u00e9ho tokenu k NPM si \u010derv uchov\u00e1va pr\u00edstupov\u00e9 k\u013e\u00fa\u010de k GitHubu a cloudov\u00fdm slu\u017eb\u00e1m AWS, Azure a GCP (Google Cloud Platform), ako aj \u010fal\u0161ie citliv\u00e9 \u00fadaje, ktor\u00e9 dok\u00e1\u017ee objavi\u0165 skener TruffleHog. <\/p>\n

\u0160kodliv\u00e9 vydania s\u00fa vytv\u00e1ran\u00e9 pre 20 najpopul\u00e1rnej\u0161\u00edch bal\u00edkov, ku ktor\u00fdm m\u00e1 pr\u00edstup n\u00e1jden\u00fd NPM token. Funkcionalita publikovania vydania je implementovan\u00e1 vo forme funkcie NpmModule.updatePackage, ktor\u00e1 na\u010d\u00edta zdrojov\u00fd arch\u00edv bal\u00edka, zmen\u00ed \u010d\u00edslo verzie a prid\u00e1 postinstall hook do s\u00faboru package.json, vlo\u017e\u00ed spracovate\u013ea bundle.js, zabal\u00ed bal\u00edk do nov\u00e9ho form\u00e1tu a zverejn\u00ed ho. Podporuje sa prev\u00e1dzka na Linuxe a macOS. <\/p>\n

\u010cervu bolo pridelen\u00e9 k\u00f3dov\u00e9 meno Shai-Hulud (obrovsk\u00fd \u010derv spom\u00ednan\u00fd v rom\u00e1ne Duna). N\u00e1jden\u00e9 v syst\u00e9me pr\u00edstupov\u00e9 \u00fadaje s\u00fa publikovan\u00e9 na GitHub prostredn\u00edctvom vytvorenia repozit\u00e1rov s n\u00e1zvom Shai-Hulud (napr\u00edklad \u201eB611\/Shai-Hulud\u201c), ako aj sa k\u00f3dovan\u00e9 objavuj\u00fa v logoch GitHub Actions. V vytvorenom repozit\u00e1ri sa nach\u00e1dza s\u00fabor data.json, ktor\u00fd obsahuje riadok s inform\u00e1ciami o syst\u00e9me, premenn\u00fdch prostredia a zachyten\u00fdch pr\u00edstupov\u00fdch k\u013e\u00fa\u010doch zak\u00f3dovan\u00fd met\u00f3dou base64. V CI zalo\u017eenom na GitHube na prenos inform\u00e1ci\u00ed na extern\u00fd hostite\u013e \u010derv vytv\u00e1ra spracovate\u013ea GitHub Actions (.github\/workflows\/shai-hulud-workflow.yml). Pod\u013ea v\u0161etk\u00e9ho \u00fatok nie je obmedzen\u00fd na spom\u00ednan\u00fdch 187 bal\u00edkov, preto\u017ee na GitHubu na\u010falej vznikaj\u00fa nov\u00e9 repozit\u00e1re s n\u00e1zvom Shai-Hulud a s\u00faborom data.json.

\"Samoroz\u0161iruj\u00faci<\/center> <\/p>\n

Medzi in\u00fdm, v d\u00f4sledku aktivity \u010derva bolo postihnut\u00fdch 25 bal\u00edkov spolo\u010dnosti CrowdStrike, ktor\u00e1 vyv\u00edja n\u00e1stroje na ochranu pred \u00fatokmi<\/a> cez z\u00e1vislosti (Supply Chain). Pod\u013ea vyhl\u00e1senia CrowdStrike boli skompromitovan\u00e9 bal\u00edky nepou\u017e\u00edvan\u00e9 na platforme Falcon a \u00fatok sa ne\u0161\u00edril medzi z\u00e1kazn\u00edkmi. Okrem toho sa dozvedelo, \u017ee predch\u00e1dzaj\u00faca vlna publikovania \u0161kodliv\u00fdch verzi\u00ed v NPM, ktor\u00e1 prebiehala bez \u010derva, zasiahla projekt gemini-cli vyv\u00edjan\u00fd spolo\u010dnos\u0165ou Google.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u043f\u0435\u0440\u0435\u0448\u043b\u0430 \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c. \u0412 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \u0438 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u0435\u0440\u0435\u0448\u043b\u0438 \u043a \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044e \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0447\u0435\u0440\u0432\u044f \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438. \u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0447\u0435\u0440\u0432\u044f \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043f\u043e\u0441\u043b\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 NPM-\u043f\u0430\u043a\u0435\u0442\u0430 @ctrl\/tinycolor, \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e 2.2 \u043c\u043b\u043d \u0435\u0436\u0435\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0438 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u044f\u043c\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":143669,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-143668","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Samoroz\u0161iruj\u00faci sa \u010derv napadol 187 bal\u00edkov v NPM | ProHoster","description":"\u00datok na sprievodn\u00e9 bal\u00edky v repozit\u00e1ri NPM pre\u0161iel na nov\u00fa \u00farove\u0148.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/samorasprostranyayushhijsya-cherv-porazil-187-paketov-v-npm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0430\u043c\u043e\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0447\u0435\u0440\u0432\u044c \u043f\u043e\u0440\u0430\u0437\u0438\u043b 187 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 NPM | ProHoster","og:description":"\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u043f\u0435\u0440\u0435\u0448\u043b\u0430 \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/samorasprostranyayushhijsya-cherv-porazil-187-paketov-v-npm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-09-17T09:11:57+00:00","article:modified_time":"2026-02-08T19:43:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"143668","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 19:43:52","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:50:19","updated":"2026-02-08 19:43:52","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/143668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=143668"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/143668\/revisions"}],"predecessor-version":[{"id":157614,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/143668\/revisions\/157614"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/143669"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=143668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=143668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=143668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}