{"id":150625,"date":"2025-12-04T23:12:08","date_gmt":"2025-12-04T21:12:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2"},"modified":"2025-12-04T23:12:08","modified_gmt":"2025-12-04T21:12:08","slug":"analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","title":{"rendered":"Anal\u00fdza d\u00f4vern\u00fdch \u00fadajov zachyten\u00fdch \u010dervom Shai-Hulud 2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spolo\u010dnos\u0165 Wiz zverejnila v\u00fdsledky anal\u00fdzy st\u00f4p \u010dinnosti \u010derva Shai-Hulud 2, po\u010das ktor\u00e9ho boli v repozit\u00e1ri NPM zverejnen\u00e9 \u0161kodliv\u00e9 verzie viac ako 800 bal\u00edkov, ktor\u00e9 celkovo zaznamenali viac ako 100 mili\u00f3nov stiahnut\u00ed. Po nain\u0161talovan\u00ed zasiahnut\u00e9ho bal\u00edka sa aktivovan\u00fd \u010derv pok\u00fa\u0161a vyh\u013ead\u00e1va\u0165 d\u00f4vern\u00e9 \u00fadaje, zverej\u0148uje nov\u00e9 \u0161kodliv\u00e9 vydania (pri zisten\u00ed pr\u00edstupov\u00e9ho tokenu do repozit\u00e1ra NPM) a spr\u00edstup\u0148uje n\u00e1jden\u00e9 d\u00f4vern\u00e9 \u00fadaje prostredn\u00edctvom vytv\u00e1rania nov\u00fdch repozit\u00e1rov na GitHub-e. <\/p>\n

Na GitHub-e bolo zisten\u00fdch viac ako 30 000 repozit\u00e1rov so zachyten\u00fdmi \u00fadajmi od \u010derva. V pribli\u017ene 70 % z t\u00fdchto repozit\u00e1rov je umiestnen\u00fd s\u00fabor content.json, v 50 % \u2014 s\u00fabor truffleSecrets.json a v 80 % \u2014 environment.json, ktor\u00e9 obsahuj\u00fa pr\u00edstupov\u00e9 k\u013e\u00fa\u010de, citliv\u00e9 \u00fadaje a premenne prostredia n\u00e1jden\u00e9 v syst\u00e9me v\u00fdvoj\u00e1ra, ktor\u00fd nain\u0161taloval \u0161kodliv\u00fd bal\u00edk s \u010dervom. Taktie\u017e sa v t\u00fdchto repozit\u00e1roch na\u0161lo pribli\u017ene 400 s\u00faborov actionsSecrets.json s k\u013e\u00fa\u010dmi, ktor\u00e9 boli n\u00e1jden\u00e9 v prostrediach pre vykon\u00e1vanie GitHub Actions. <\/p>\n

V s\u00faboroch contents.json bolo viac ako 500 unik\u00e1tnych prihlasovac\u00edch \u00fadajov a tokenov na pripojenie k GitHub-u. V s\u00faboroch truffleSecrets.json sa nach\u00e1dzali d\u00f4vern\u00e9 \u00fadaje, ktor\u00e9 boli n\u00e1jden\u00e9 v d\u00f4sledku vykon\u00e1vania na zasiahnutom syst\u00e9me n\u00e1stroja TruffleHog, ktor\u00fd zhroma\u017e\u010fuje viac ako 800 typov \u00fadajov, medzi ktor\u00e9 patr\u00ed pr\u00edstupov\u00e9 k\u013e\u00fa\u010de, \u0161ifrovacie k\u013e\u00fa\u010de, hesl\u00e1 a tokeny pou\u017e\u00edvan\u00e9 v r\u00f4znych slu\u017eb\u00e1ch, cloudov\u00fdch prostrediach, produktoch a DBMS. Celkovo bolo v truffleSecrets.json identifikovan\u00fdch viac ako 400 tis\u00edc unik\u00e1tnych z\u00e1znamov, z ktor\u00fdch pribli\u017ene 2,5% (~10 000) bolo overen\u00fdch. <\/p>\n

Predpoklad\u00e1 sa, \u017ee d\u00f4vern\u00e9 inform\u00e1cie, ktor\u00e9 sa dostali na verejnos\u0165, m\u00f4\u017eu by\u0165 v\u00fdchodiskov\u00fdm bodom pre nov\u00fa vlnu \u00fatokov, preto\u017ee mnoh\u00e9 \u00fadaje zost\u00e1vaj\u00fa aktu\u00e1lne. Napr\u00edklad preverenie uk\u00e1zalo, \u017ee 60% pr\u00edstupov\u00fdch tokenov k NPM, zachyten\u00fdch zo zasiahnut\u00fdch syst\u00e9mov \u010dervom, zost\u00e1va platn\u00fdch. <\/p>\n

V spr\u00e1ve sa tie\u017e uv\u00e1dza celkov\u00e1 \u0161tatistika z\u00edskan\u00e1 na z\u00e1klade anal\u00fdzy premenn\u00fdch prostredia z postihnut\u00fdch syst\u00e9mov. 23 % spusten\u00ed \u010derva sa uskuto\u010dnilo na po\u010d\u00edta\u010doch v\u00fdvoj\u00e1rov, zatia\u013e \u010do 77 % \u2014 v prostrediach syst\u00e9mov nepretr\u017eitej integr\u00e1cie (60 % GitHub Actions, 5 % \u2014 Jenkins, 5 % \u2014 GitLab CI, 3 % \u2014 AWS CodeBuild). Na 87 % syst\u00e9moch bol pou\u017eit\u00fd Linux, 12 % \u2014 macOS a 1 % \u2014 Windows. 76 % spusten\u00ed prebehlo v kontajneroch, 13 % \u2014 v z\u00e1kladn\u00fdch syst\u00e9moch. <\/p>\n

60 % v\u0161etk\u00fdch infekci\u00ed sa stalo v d\u00f4sledku in\u0161tal\u00e1cie \u0161kodliv\u00fdch verzi\u00ed bal\u00edkov @postman\/tunnel-agent-0.6.7 a @asyncapi\/specs-6.8.3. V 99 % pr\u00edpadov bol \u010derv aktivovan\u00fd spusten\u00edm pr\u00edkazu \u201enode setup_bun.js\u201c, ktor\u00fd bol uveden\u00fd v package.json v sekcii preinstall (zvy\u0161n\u00fdch 1 % pravdepodobne patr\u00ed pokusom o testovanie).

\"Anal\u00fdza<\/center>
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Wiz \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud 2, \u0432 \u0445\u043e\u0434\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0431\u043e\u043b\u0435\u0435 800 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430, \u0430\u043a\u0442\u0438\u0432\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0432\u0448\u0438\u0439\u0441\u044f \u0447\u0435\u0440\u0432\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043d\u043e\u0432\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0440\u0435\u043b\u0438\u0437\u044b (\u043f\u0440\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0442\u043e\u043a\u0435\u043d\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 NPM) \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":150626,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-150625","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Anal\u00fdza d\u00f4vern\u00fdch \u00fadajov zachyten\u00fdch \u010dervom Shai-Hulud 2 | ProHoster","description":"Spolo\u010dnos\u0165 Wiz zverejnila v\u00fdsledky anal\u00fdzy st\u00f4p \u010dinnosti \u010derva Shai-Hulud 2, po\u010das ktorej boli v repozit\u00e1ri NPM zverejnen\u00e9 \u0161kodliv\u00e9 vydania viac ako 800 bal\u00edkov, ktor\u00e9 celkovo obsahuj\u00fa viac ne\u017e.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d\u043d\u044b\u0445 \u0447\u0435\u0440\u0432\u0451\u043c Shai-Hulud 2 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Wiz \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud 2, \u0432 \u0445\u043e\u0434\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0431\u043e\u043b\u0435\u0435 800 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-12-04T21:12:08+00:00","article:modified_time":"2025-12-04T21:12:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"150625","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:25:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 16:25:22","updated":"2026-01-23 16:25:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/150625","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=150625"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/150625\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/150626"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=150625"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=150625"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=150625"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}