{"id":149530,"date":"2025-11-25T17:11:58","date_gmt":"2025-11-25T15:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov"},"modified":"2025-11-25T17:11:58","modified_gmt":"2025-11-25T15:11:59","slug":"pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","title":{"rendered":"Pomocou \u010derva Shai-Hulud bolo skompromitovan\u00fdch 600 bal\u00edkov NPM.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bola zaznamenan\u00e1 druh\u00e1 \u00fatok na bal\u00ed\u010dky v \u00falo\u017eisku NPM, vykonan\u00e9 pomocou modifik\u00e1cie samoreplikuj\u00faceho \u010derva Shai-Hulud, ktor\u00fd vklad\u00e1 \u0161kodliv\u00fd softv\u00e9r do z\u00e1vislost\u00ed. V d\u00f4sledku \u00fatoku boli zverejnen\u00e9 \u0161kodliv\u00e9 vydania 605 bal\u00edkov, ktor\u00e9 celkovo prekro\u010dili 100 mili\u00f3nov stiahnut\u00ed. <\/p>\n

Na uskuto\u010dnenie \u00fatoku \u00fato\u010dn\u00edci prostredn\u00edctvom phishingu zachytili parametre \u00fa\u010dtu spr\u00e1vcov jedn\u00e9ho z popul\u00e1rnych bal\u00edkov, pou\u017e\u00edvan\u00e9ho ako z\u00e1vislos\u0165 ve\u013ek\u00fdm po\u010dtom bal\u00edkov. Vyu\u017eit\u00edm zachyten\u00e9ho \u00fa\u010dtu \u00fato\u010dn\u00edci zverejnili vydanie bal\u00edka, do ktor\u00e9ho bol pridan\u00fd k\u00f3d na aktiv\u00e1ciu \u010derva pri in\u0161tal\u00e1cii postihnut\u00e9ho bal\u00edka medzi z\u00e1vislos\u0165ami. Spusten\u00fd \u010derv vykon\u00e1va vyh\u013ead\u00e1vanie prihlasovac\u00edch \u00fadajov v aktu\u00e1lnom prostred\u00ed, s\u0165ahuje a sp\u00fa\u0161\u0165a n\u00e1stroj TruffleHog. <\/p>\n

V pr\u00edpade zistenia tokenu pripojenia k adres\u00e1ru NPM \u010derv automaticky zverej\u0148uje nov\u00e9 \u0161kodliv\u00e9 vydania pre bal\u00edky vyv\u00edjan\u00e9 v aktu\u00e1lnom prostred\u00ed. T\u00fdmto sp\u00f4sobom sa re\u0165azovo nap\u00e1da cel\u00e9 strom z\u00e1vislost\u00ed. Okrem NPM tokenu \u010derv uklad\u00e1 pr\u00edstupov\u00e9 k\u013e\u00fa\u010de k GitHubu a cloudov\u00fdm slu\u017eb\u00e1m AWS, Azure a GCP (Google Cloud Platform), ako aj premenn\u00e9 prostredia a in\u00e9 d\u00f4vern\u00e9 \u00fadaje, ktor\u00e9 dok\u00e1\u017ee objavi\u0165 skener TruffleHog. <\/p>\n

N\u00e1jden\u00e9 v syst\u00e9me d\u00f4vern\u00e9 \u00fadaje sa zverej\u0148uj\u00fa na GitHub prostredn\u00edctvom vytv\u00e1rania repozit\u00e1rov s chaotick\u00fdmi n\u00e1zvami (napr\u00edklad, «qzx15djl71alh6p80h») a fr\u00e1zou «Sha1-Hulud: Druh\u00e9 pr\u00edchod» v opise, a taktie\u017e s\u00fa zak\u00f3dovan\u00e9 vo v\u00fdstupoch GitHub Actions. V vytvorenom repozit\u00e1ri sa umiestni s\u00fabor vo form\u00e1te JSON (napr\u00edklad jsonactionsSecrets.json alebo contents.json), v ktorom sa nach\u00e1dza riadok s inform\u00e1ciami o syst\u00e9me zak\u00f3dovan\u00fdmi met\u00f3dou base64, premenn\u00fdmi prostredia a zachyten\u00fdmi \u00fadajmi. Na prenose inform\u00e1ci\u00ed von z CI syst\u00e9mov zalo\u017een\u00fdch na GitHub \u010derv vytv\u00e1ra spracovate\u013ea GitHub Actions s n\u00e1zvom «.github\/workflows\/formatter_123456789.yml» a konfiguruje runner s n\u00e1zvom SHA1HULUD. <\/p>\n

Rozdiely od podobn\u00e9ho septembrov\u00e9ho \u00fatoku spo\u010d\u00edvaj\u00fa v inom sp\u00f4sobe vkladania \u0161kodliv\u00e9ho k\u00f3du do bal\u00ed\u010dka. V \u010dervom generovan\u00fdch \u0161kodliv\u00fdch vydaniach sa uv\u00e1dza implement\u00e1cia podpory JavaScriptovej platformy Bun. Do s\u00faboru package.json v sekcii «preinstall», ktor\u00e1 ur\u010duje skripty, ktor\u00e9 sa sp\u00fa\u0161\u0165aj\u00fa pred za\u010dat\u00edm in\u0161tal\u00e1cie, sa prid\u00e1va pr\u00edkaz «node setup_bun.js».

\"Pomocou<\/center> <\/p>\n

V s\u00fabore «setup_bun.js» je pr\u00edtomn\u00fd k\u00f3d na vykonanie obfuskovan\u00e9ho skriptu «bun_environment.js», obsahuj\u00faceho k\u00f3d \u010derva. Pre svoje \u010fal\u0161ie \u0161\u00edrenie \u010derv h\u013ead\u00e1 k\u00f3d bal\u00edkov, men\u00ed s\u00fabor package.json (zvy\u0161uje \u010d\u00edslo verzie a zahr\u0148uje volanie setup_bun.js), prid\u00e1va s\u00fabory setup_bun.js a bun_environment.js, prebal\u00ed bal\u00edk a vykon\u00e1va pr\u00edkaz «npm publish» na zverejnenie novej verzie. <\/p>\n

Medzi kompromitovan\u00e9 popul\u00e1rne bal\u00edky patr\u00ed: @zapier\/zapier-sdk (2,8 mili\u00f3na stiahnut\u00ed t\u00fd\u017edenne), @posthog\/core (2,8 mili\u00f3na), posthog-node (1,5 mili\u00f3na), @asyncapi\/specs (1,4 mili\u00f3na), @postman\/tunnel-agent (1,2 mili\u00f3na). Predpoklad\u00e1 sa, \u017ee \u00fatok za\u010dal kompromit\u00e1ciou sprievodn\u00e9ho bal\u00edka @asyncapi\/specs.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u0442\u043e\u0440\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM, \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0430\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0430\u043c\u043e\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0447\u0435\u0440\u0432\u044f Shai-Hulud, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 605 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0443\u0442\u0451\u043c \u0444\u0438\u0448\u0438\u043d\u0433\u0430 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u043b\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":149531,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-149530","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pomocou \u010derva Shai-Hulud bolo kompromitovan\u00fdch 600 NPM-pakiet | ProHoster","description":"Bola zaznamenan\u00e1 druh\u00e1 \u00fatok na bal\u00edky v repozit\u00e1ri NPM, uskuto\u010dnen\u00e1 s pou\u017eit\u00edm modifik\u00e1cie samodistribu\u010dn\u00e9ho \u010derva Shai-Hulud, ktor\u00fd vn\u00e1\u0161a \u0161kodliv\u00fd k\u00f3d do z\u00e1vislost\u00ed.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e 600 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u0442\u043e\u0440\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM, \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0430\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0430\u043c\u043e\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0447\u0435\u0440\u0432\u044f Shai-Hulud, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-11-25T15:11:59+00:00","article:modified_time":"2025-11-25T15:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"149530","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:12:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 16:12:19","updated":"2026-01-23 16:12:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/149530","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=149530"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/149530\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/149531"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=149530"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=149530"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=149530"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}