{"id":166951,"date":"2026-03-31T23:11:57","date_gmt":"2026-03-31T21:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/skomprometirovan-npm-paket-axios-imeyushhij-100-mln-zagruzok-v-nedelyu"},"modified":"2026-03-31T23:11:57","modified_gmt":"2026-03-31T21:11:57","slug":"skomprometirovan-npm-paket-axios-imeyushhij-100-mln-zagruzok-v-nedelyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/skomprometirovan-npm-paket-axios-imeyushhij-100-mln-zagruzok-v-nedelyu","title":{"rendered":"Kompromitovan\u00fd NPM bal\u00edk axios, ktor\u00fd m\u00e1 100 mili\u00f3nov stiahnut\u00ed za t\u00fd\u017ede\u0148.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00dato\u010dn\u00edci sa zmocnili \u00fa\u010dtu spr\u00e1vcu a vydali dve \u0161kodliv\u00e9 verzie NPM bal\u00edka axios, ktor\u00fd pon\u00faka implement\u00e1ciu HTTP klienta pre prehliada\u010de a Node.js. Bal\u00edk axios m\u00e1 viac ako 100 mili\u00f3nov stiahnut\u00ed t\u00fd\u017edenne a pou\u017e\u00edvaj\u00fa ho ako z\u00e1vislos\u0165 \u010fal\u0161ie 174 tis\u00edc bal\u00edkov. \u0160kodliv\u00e9 zmeny boli integrovan\u00e9 do verzi\u00ed Axios 1.14.1 a 0.30.4 prostredn\u00edctvom substit\u00facie fikt\u00edvnej z\u00e1vislosti plain-crypto-js 4.2.1, ktor\u00e1 obsahovala k\u00f3d na na\u010d\u00edtanie komponentov pr\u00edjmaj\u00facich pr\u00edkazy z riadiaceho servera \u00fato\u010dn\u00edkov. \u0160kodliv\u00e9 verzie boli pon\u00fakan\u00e9 na stiahnutie 31. marca po\u010das takmer 3 hod\u00edn \u2013 od 03:21 do 6:15 (MSK). <\/p>\n

\u0160kodliv\u00e9 verzie boli priamo umiestnen\u00e9 na NPM pomocou pr\u00edstupov\u00fdch \u00fadajov hlavn\u00e9ho spr\u00e1vcu projektu axios («jasonsaayman») obch\u00e1dzaj\u00fac be\u017en\u00fd mechanizmus publikovania nov\u00fdch vydan\u00ed zalo\u017een\u00fd na GitHub Actions. Predpoklad\u00e1 sa, \u017ee \u00fato\u010dn\u00edci sa zmocnili pr\u00edstupov\u00e9ho tokenu k NPM, po \u010dom sa prihl\u00e1sili do \u00fa\u010dtu a zmenili prepojenie na email. Ako presne bol pr\u00edstupov\u00fd token zneu\u017eit\u00fd nie je spresnen\u00e9. <\/p>\n

Prev\u00e1dzkovan\u00fd \u0161kodliv\u00fd k\u00f3d bol umiestnen\u00fd v bal\u00edku plain-crypto-js v s\u00fabore setup.js, aktivoval sa po dokon\u010den\u00ed in\u0161tal\u00e1cie NPM bal\u00edka cez spracovate\u013ea postinstall (‘postinstall: «node setup.js»‘) a pou\u017e\u00edval sa na na\u010d\u00edtanie a in\u0161tal\u00e1ciu tr\u00f3jskeho ko\u0148a, ktor\u00fd nap\u00e1dal syst\u00e9my s Windows, macOS a Linux. Na skrytie svojej pr\u00edtomnosti po spusten\u00ed \u0161kodliv\u00e1 s\u00fa\u010das\u0165 odstr\u00e1nila s\u00fabor setup.js a nahradila package.json verziou bez postinstall-h\u00faku. \"Kompromitovan\u00fd <\/p>\n

V macOS bol \u0161kodliv\u00fd spustite\u013en\u00fd s\u00fabor na\u010d\u00edtan\u00fd ako «\\\/Library\\\/Caches\\\/com.apple.act.mond», vo Windows — «%PROGRAMDATA%\wt.exe», v Linuxe — «\\\/tmp\\\/ld.py,». Po aktiv\u00e1cii v Linuxe a macOS ka\u017ed\u00fdch 60 sek\u00fand na extern\u00fd server<\/a> \u00fato\u010dn\u00edkom po\u017eiadavku pr\u00edkazov na vykon\u00e1vanie na napadnutej s\u00fastave, ktor\u00e9 mohli by\u0165 pou\u017eit\u00e9 na s\u0165ahovanie \u010fal\u0161\u00edch \u0161kodliv\u00fdch komponentov, vykon\u00e1vanie \u013eubovo\u013en\u00fdch shell pr\u00edkazov a vyh\u013ead\u00e1vanie\/odosielanie ur\u010dit\u00fdch s\u00faborov. <\/p>\n

\u0160kodliv\u00e1 aktivita v Linuxe a macOS nepredpokladala zachovanie pr\u00edtomnosti po re\u0161tarte a bola zameran\u00e1 na r\u00fdchle zhroma\u017e\u010fovanie d\u00f4vern\u00fdch \u00fadajov, hesiel, tokenov a pr\u00edstupov\u00fdch k\u013e\u00fa\u010dov. Vo Windows bol vytvoren\u00fd s\u00fabor «%PROGRAMDATA%\system.bat», ktor\u00fd extrahoval \u0161kodliv\u00fa s\u00fa\u010das\u0165. servera<\/a> \u00fato\u010dn\u00edkov pri ka\u017edom prihl\u00e1sen\u00ed do syst\u00e9mu.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0434\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 NPM-\u043f\u0430\u043a\u0435\u0442\u0430 axios, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e HTTP-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u0438 Node.js. \u041f\u0430\u043a\u0435\u0442 axios \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 174 \u0442\u044b\u0441\u044f\u0447 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0438 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 Axios 1.14.1 \u0438 0.30.4 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 plain-crypto-js 4.2.1, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":166952,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-166951","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kompromitovan\u00fd NPM bal\u00ed\u010dek axios, ktor\u00fd m\u00e1 100 mili\u00f3nov stiahnut\u00ed t\u00fd\u017edenne | ProHoster","description":"\u00dato\u010dn\u00edci dok\u00e1zali z\u00edska\u0165 pr\u00edstup k \u00fa\u010dtu sprievodcu a vydali dva \u0161kodliv\u00e9 vydania bal\u00ed\u010dka NPM axios, ktor\u00e9 pon\u00fakaj\u00fa implement\u00e1ciu HTTP klienta pre prehliada\u010de a Node.js.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/skomprometirovan-npm-paket-axios-imeyushhij-100-mln-zagruzok-v-nedelyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d NPM-\u043f\u0430\u043a\u0435\u0442 axios, \u0438\u043c\u0435\u044e\u0449\u0438\u0439 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e | ProHoster","og:description":"\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0434\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 NPM-\u043f\u0430\u043a\u0435\u0442\u0430 axios, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e HTTP-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u0438 Node.js.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/skomprometirovan-npm-paket-axios-imeyushhij-100-mln-zagruzok-v-nedelyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-31T21:11:57+00:00","article:modified_time":"2026-03-31T21:11:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/166951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=166951"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/166951\/revisions"}],"predecessor-version":[{"id":173154,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/166951\/revisions\/173154"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/166952"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=166951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=166951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=166951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}