{"id":106945,"date":"2023-02-26T12:49:02","date_gmt":"2023-02-26T10:49:03","guid":{"rendered":"https:\/\/prohoster.info\/?p=106945"},"modified":"2023-02-27T12:02:06","modified_gmt":"2023-02-27T10:02:06","slug":"v-npm-vyyavleno-15-tysyach-paketov-dlya-fishinga-i-spama","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-npm-vyyavleno-15-tysyach-paketov-dlya-fishinga-i-spama","title":{"rendered":"N\u00eb NPM u zbuluan 15 mij\u00eb paketa p\u00ebr phishing dhe spam","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Nj\u00eb sulm \u00ebsht\u00eb regjistruar ndaj p\u00ebrdoruesve t\u00eb katalogut NPM, si pasoj\u00eb e t\u00eb cilit m\u00eb 20 shkurt n\u00eb depozitat NPM u vendos\u00ebn m\u00eb shum\u00eb se 15 mij\u00eb paketa, n\u00eb skedar\u00ebt README t\u00eb t\u00eb cilave ishin lidhje p\u00ebr n\u00eb faqe phishing ose lidhje referuese p\u00ebr kalime p\u00ebr t\u00eb cilat paguhen komisione. Gjat\u00eb analiz\u00ebs, n\u00eb paketa u zbuluan 190 lidhje unike phishing ose reklamuese, q\u00eb mbulonin 31 domene. <\/p>\n
Emrat e paketave jan\u00eb zgjedhur p\u00ebr t\u00eb t\u00ebrhequr interesin e p\u00ebrdoruesve, si p.sh. «free-tiktok-followers» «free-xbox-codes», «instagram-followers-free» etj. Llogaritja \u00ebsht\u00eb b\u00ebr\u00eb p\u00ebr t\u00eb mbushur me paketa spamuese list\u00ebn e azhurnimeve t\u00eb fundit n\u00eb faqen kryesore t\u00eb NPM. N\u00eb p\u00ebrshkrimin e paketave ishin p\u00ebrmendur lidhje q\u00eb premtonin shp\u00ebrblime falas, dhurata, trukime loj\u00ebrash, si dhe sh\u00ebrbime falas p\u00ebr rritjen e ndjek\u00ebsve dhe p\u00eblqimeve n\u00eb rrjetet sociale, si TikTok dhe Instagram. Kjo nuk \u00ebsht\u00eb nj\u00eb sulm i par\u00eb i till\u00eb, n\u00eb dhjetor n\u00eb katalog\u00ebt NuGet, NPM dhe PyPi u regjistrua publikimi i 144 mij\u00eb paketeve spamuese.
<\/center> <\/p>\n
P\u00ebrmbajtja e paketeve u gjenerua automatikisht duke p\u00ebrdorur nj\u00eb skrypt python, i cili duket se p\u00ebr shkak t\u00eb moskujdesit ishte l\u00ebn\u00eb n\u00eb paketa dhe p\u00ebrfshinte kredenciale funksionale q\u00eb ishin p\u00ebrdorur gjat\u00eb sulmit. Paketa u publikuan n\u00ebn shum\u00eb llogari t\u00eb ndryshme duke p\u00ebrdorur metoda q\u00eb e komplikonin ndjekjen e gjurm\u00ebve dhe identifikimin e shpejt\u00eb t\u00eb paketimeve problematike. <\/p>\n
P\u00ebrve\u00e7 veprimeve mashtruese n\u00eb depozitat NPM dhe PyPi gjithashtu jan\u00eb identifikuar disa p\u00ebrpjekje p\u00ebr publikimin e paketeve t\u00eb d\u00ebmshme: <\/p>\n
\n
N\u00eb depozitat e PyPI jan\u00eb gjetur 451 paketa t\u00eb d\u00ebmsh\u00ebm, t\u00eb cilat maskoheshin si disa biblioteka t\u00eb njohura p\u00ebrmes type-squatting (emra t\u00eb ngjash\u00ebm, q\u00eb ndryshojn\u00eb me simbole t\u00eb ve\u00e7anta, p\u00ebr shembull, vper n\u00eb vend t\u00eb vyper, bitcoinnlib n\u00eb vend t\u00eb bitcoinlib, ccryptofeed n\u00eb vend t\u00eb cryptofeed, ccxtt n\u00eb vend t\u00eb ccxt, cryptocommpare n\u00eb vend t\u00eb cryptocompare, seleium n\u00eb vend t\u00eb selenium, pinstaller n\u00eb vend t\u00eb pyinstaller etj.). Paketat p\u00ebrmbanin kod t\u00eb obfuskatuar p\u00ebr t\u00eb vjedhur kriptovaluta, i cili p\u00ebrcaktonte pranin\u00eb e identifikuesve t\u00eb portofol\u00ebve t\u00eb kriptove n\u00eb skedarin e kopjimit dhe i ndryshonte ato me portofolin e sulmuesit (b\u00ebhet fjal\u00eb se gjat\u00eb pages\u00ebs, viktima nuk do ta v\u00ebr\u00eb re se numri i transferuar p\u00ebrmes skedarit t\u00eb kopjimit ishte ndryshe). Z\u00ebvend\u00ebsimi b\u00ebhej nga nj\u00eb shtes\u00eb e instaluar n\u00eb shfletues, e cila ekzekutohej n\u00eb kontekstin e \u00e7do faqe web q\u00eb shikohej.\n
N\u00eb depozitat e PyPI \u00ebsht\u00eb zbuluar nj\u00eb seri bibliotekash t\u00eb d\u00ebmshme HTTP. Aktiviteti i d\u00ebmsh\u00ebm u gjet n\u00eb 41 paketa, emrat e t\u00eb cil\u00ebve ishin zgjedhur duke p\u00ebrdorur metoda type-squatting dhe i ngjanin bibliothekave t\u00eb njohura (aio5, requestst, ulrlib, urllb, libhttps, piphttps, httpxv2 etj.). P\u00ebrmbajtja ishte stilizuar si bibliotekat funksionale t\u00eb HTTP ose kishte kopjuar kodin e bibliotekave ekzistuese, dhe n\u00eb p\u00ebrshkrim jepeshin pretendime p\u00ebr p\u00ebrfitimet dhe krahasime me bibliotekat legjitime t\u00eb HTTP. Aktiviteti i d\u00ebmsh\u00ebm p\u00ebrfshinte ose shkarkimin e softuerit t\u00eb d\u00ebmsh\u00ebm n\u00eb sistem, ose grumbullimin dhe d\u00ebrgimin e t\u00eb dh\u00ebnave t\u00eb ndjeshme.\n
N\u00eb NPM jan\u00eb zbuluar 16 paketa JavaScript (speedte*, trova*, lagra), t\u00eb cilat, p\u00ebrve\u00e7 funksionalitetit t\u00eb deklaruar (testimi i kapacitetit), gjithashtu p\u00ebrmbanin kod p\u00ebr minimin e kriptovalutave pa dijenin\u00eb e p\u00ebrdoruesit.\n
![\"N\u00eb](\"\/wp-content\/uploads\/2023\/02\/434214f596ba6d4174a3f0a8eae982e4.jpg\")
<\/center> <\/p>\n