Kompania GitHub publikoi rezultatet e hetimit t\u00eb nj\u00eb sulmi, n\u00eb t\u00eb cilin m\u00eb 12 prill, sulmuesit arrit\u00ebn t\u00eb fitonin qasje n\u00eb mjediset cloud n\u00eb sh\u00ebrbimin Amazon AWS, q\u00eb p\u00ebrdoren n\u00eb infrastruktur\u00ebn e projektit NPM. Analiza e incidentit tregoi se sulmuesit arrit\u00ebn t\u00eb aksesojn\u00eb kopjet rezerv\u00eb t\u00eb hostit skimdb.npmjs.com, p\u00ebrfshir\u00eb nj\u00eb kopje rezerv\u00eb t\u00eb baz\u00ebs s\u00eb t\u00eb dh\u00ebnave me informacionin e rreth 100,000 p\u00ebrdoruesve t\u00eb NPM nga viti 2015, e cila p\u00ebrfshin hash t\u00eb fjal\u00ebkalimeve, emra dhe email. <\/p>\n
Hash-t e fjal\u00ebkalimeve u krijuan duke p\u00ebrdorur algoritmet PBKDF2 ose SHA1 me krip\u00eb, t\u00eb cilat n\u00eb vitin 2017 u z\u00ebvend\u00ebsuan me nj\u00eb metod\u00eb m\u00eb t\u00eb q\u00ebndrueshme ndaj thyerjes, bcrypt. Pasi u identifikua incidenti, fjal\u00ebkalimet e prekuara nga rrjedhja u rivendos\u00ebn, dhe p\u00ebrdoruesit mor\u00ebn nj\u00eb njoftim p\u00ebr nevoj\u00ebn e vendosjes s\u00eb nj\u00eb fjal\u00ebkalimi t\u00eb ri. Duke qen\u00eb se nga 1 marsi NPM ka futur verifikimin e detyruesh\u00ebm me dy faktor\u00eb me konfirmim p\u00ebrmes emailit, rreziku i kompromitimit t\u00eb p\u00ebrdoruesve vler\u00ebsohet si i vog\u00ebl. <\/p>\n
P\u00ebr m\u00eb tep\u00ebr, n\u00eb duar t\u00eb sulmuesve kaluan t\u00eb gjitha skedar\u00ebt manifes dhe metadata e pakove private deri n\u00eb prillin e vitit 2021, skedar\u00eb CSV me list\u00ebn aktuale t\u00eb t\u00eb gjith\u00eb emrave dhe versioneve t\u00eb pakove private, si dhe p\u00ebrmbajtjen e t\u00eb gjitha pakove private nga dy klient\u00eb t\u00eb GitHub (emrat nuk zbulohen). Sa i p\u00ebrket vet\u00eb depozit\u00ebs, analiza e gjurm\u00ebve dhe verifikimi i hash-eve t\u00eb paketave nuk tregoi asnj\u00eb ndryshim t\u00eb b\u00ebr\u00eb nga sulmuesit n\u00eb paketat NPM dhe publikimin e versioneve t\u00eb reja fiktive t\u00eb pakove. <\/p>\n
Sulmi u krye m\u00eb 12 prill duke p\u00ebrdorur tokena OAuth t\u00eb vjedhur, t\u00eb gjeneruar p\u00ebr dy integrator\u00eb t\u00eb jasht\u00ebm t\u00eb GitHub - Heroku dhe Travis-CI. Duke shfryt\u00ebzuar k\u00ebta tokena, sulmuesit arrit\u00ebn t\u00eb nxjerrin nga repozitat private t\u00eb GitHub nj\u00eb \u00e7el\u00ebs p\u00ebr qasje n\u00eb API-n\u00eb e Amazon Web Services, e cila p\u00ebrdorej n\u00eb infrastruktur\u00ebn e projektit NPM. \u00c7el\u00ebsi i marr\u00eb mund\u00ebsoi aksesin n\u00eb t\u00eb dh\u00ebnat q\u00eb ruheshin n\u00eb sh\u00ebrbimin AWS S3. <\/p>\n
P\u00ebr m\u00eb tep\u00ebr, jan\u00eb zbuluar informacione mbi probleme serioze t\u00eb m\u00ebparshme me privat\u00ebsin\u00eb gjat\u00eb p\u00ebrpunimit t\u00eb t\u00eb dh\u00ebnave t\u00eb p\u00ebrdoruesve mbi sistemet<\/a> NPM - n\u00eb log\u00ebt e brendshme ruheshin hapur fjal\u00ebkalimet e disa p\u00ebrdoruesve t\u00eb NPM, si dhe tokenat e aksesit n\u00eb NPM. Gjat\u00eb integrimit t\u00eb NPM me sistemin e menaxhimit t\u00eb log\u00ebve GitHub, zhvilluesit nuk e siguruan heqjen e informacionit t\u00eb ndjesh\u00ebm nga k\u00ebrkesat log t\u00eb sh\u00ebrbimeve NPM. Pretendohet se kjo mang\u00ebsi \u00ebsht\u00eb riparuar dhe log\u00ebt jan\u00eb pastruar p\u00ebrpara sulmit ndaj NPM. Aksesi n\u00eb log\u00ebt q\u00eb p\u00ebrfshinin fjal\u00ebkalime t\u00eb hapura e kishin vet\u00ebm disa punonj\u00ebs t\u00eb ve\u00e7ant\u00eb t\u00eb GitHub. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0442\u0430\u043a\u0438, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 12 \u0430\u043f\u0440\u0435\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u043c \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Amazon AWS, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u043c \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 NPM. \u0410\u043d\u0430\u043b\u0438\u0437 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u044b\u043c \u043a\u043e\u043f\u0438\u044f\u043c \u0445\u043e\u0441\u0442\u0430 skimdb.npmjs.com \u0438 \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043a \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0439 \u043a\u043e\u043f\u0438\u0438 \u0411\u0414 \u0441 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 100 \u0442\u044b\u0441\u044f\u0447 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 NPM \u043f\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104172","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub zbuloi t\u00eb dh\u00ebnat mbi thyerjen e infrastruktur\u00ebs NPM dhe zbules\u00ebn e fjal\u00ebkalimeve t\u00eb hapura n\u00eb log\u00eb | ProHoster","description":"Kompania GitHub publikoi rezultatet e hetimit t\u00eb sulmit, n\u00eb t\u00eb cilin m\u00eb 12 prill, sulmuesit mor\u00ebn qasje n\u00eb ambientet cloud n\u00eb sh\u00ebrbimin Amazon AWS, t\u00eb p\u00ebrdorura n\u00eb infrastruktur\u00ebn e projektit NPM.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/github-raskryl-dannye-o-vzlome-infrastruktury-npm-i-vyyavlenii-otkrytyh-parolej-v-logah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b NPM \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0432 \u043b\u043e\u0433\u0430\u0445 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0442\u0430\u043a\u0438, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 12 \u0430\u043f\u0440\u0435\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u043c \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Amazon AWS, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u043c \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 NPM.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/github-raskryl-dannye-o-vzlome-infrastruktury-npm-i-vyyavlenii-otkrytyh-parolej-v-logah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-05-27T19:36:38+00:00","article:modified_time":"2022-05-27T19:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104172","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-25 11:20:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-05-27 19:36:53","updated":"2026-01-25 11:20:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/104172","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=104172"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/104172\/revisions"}],"predecessor-version":[{"id":164417,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/104172\/revisions\/164417"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=104172"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=104172"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=104172"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"