{"id":143668,"date":"2025-09-17T11:11:56","date_gmt":"2025-09-17T09:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/samorasprostranyayushhijsya-cherv-porazil-187-paketov-v-npm"},"modified":"2026-02-08T21:43:52","modified_gmt":"2026-02-08T19:43:52","slug":"samorasprostranyayushhijsya-cherv-porazil-187-paketov-v-npm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/samorasprostranyayushhijsya-cherv-porazil-187-paketov-v-npm","title":{"rendered":"Nj\u00eb virus vet\u00eb-shp\u00ebrndar\u00ebs ka prekur 187 paketa n\u00eb NPM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Sulmi ndaj paketeve n\u00eb repositorin NPM ka kaluar n\u00eb nj\u00eb nivel t\u00eb ri. P\u00ebrve\u00e7 p\u00ebrdorimit t\u00eb malware p\u00ebr t\u00eb kapur pagesat dhe informacionin e ndjesh\u00ebm, sulmuesit kan\u00eb kaluar n\u00eb inkorporimin e nj\u00eb virusi n\u00eb paketa t\u00eb kompromentuara p\u00ebr t\u00eb automatizuar vendosjen e malware n\u00eb var\u00ebsit\u00eb. P\u00ebrdorimi i virusit \u00ebsht\u00eb regjistruar pas kompromentimit t\u00eb paket\u00ebs NPM @ctrl\/tinycolor, e cila ka 2.2 milion shkarkime javore dhe \u00ebsht\u00eb p\u00ebrdorur si nj\u00eb var\u00ebsi direkte n\u00eb 964 paketa. Si rezultat i aktivitetit t\u00eb virusit, sulmi preku 187 paketa, p\u00ebr t\u00eb cilat u formuan l\u00ebshime t\u00eb d\u00ebmshme (477 l\u00ebshime t\u00eb d\u00ebmshme). <\/p>\n

Gjat\u00eb nj\u00eb sulmi t\u00eb ri pas marrjes s\u00eb parametrave t\u00eb llogaris\u00eb s\u00eb mb\u00ebshtet\u00ebsit p\u00ebrmes phishing-it, sulmuesit publikojn\u00eb nj\u00eb l\u00ebshim t\u00eb paket\u00ebs me virusin, i cili aktivizohet kur instaloni paket\u00ebn e kompromentuar n\u00eb var\u00ebsi. Pas aktivizimit, virusi k\u00ebrkon kredencialet n\u00eb mjedisin aktual, duke shkarkuar dhe ekzekutuar utilitarin TruffleHog. N\u00eb rast se gjen nj\u00eb token lidhjeje me katalogun NPM, virusi automatikisht publikojn\u00eb nj\u00eb l\u00ebshim t\u00eb ri t\u00eb d\u00ebmsh\u00ebm dhe d\u00ebmton zinxhirin e var\u00ebsive. P\u00ebrve\u00e7 tokenit t\u00eb aksesit n\u00eb NPM, virusi ruan \u00e7el\u00ebsat e aksesit p\u00ebr GitHub dhe sh\u00ebrbime t\u00eb ndryshme n\u00eb re si AWS, Azure dhe GCP (Google Cloud Platform), si dhe t\u00eb dh\u00ebna t\u00eb tjera t\u00eb ndjeshme q\u00eb skaneri TruffleHog mund t\u00eb zbuloj\u00eb. <\/p>\n

L\u00ebshimet e d\u00ebmshme formohen p\u00ebr 20 paketat m\u00eb t\u00eb popullarizuara, p\u00ebr t\u00eb cilat ka akses tokeni NPM i gjetur. Funksionaliteti i publikimit t\u00eb l\u00ebshimeve \u00ebsht\u00eb i realizuar n\u00eb form\u00ebn e funksionit NpmModule.updatePackage, i cili ngarkon arkiv\u00ebn burimore t\u00eb paket\u00ebs, ndryshon numrin e versionit dhe shton nj\u00eb postinstall-hook n\u00eb skedarin package.json, vendos nj\u00eb menaxher n\u00eb bundle.js, ripaketon paket\u00ebn dhe e publikon at\u00eb. P\u00ebrdoret n\u00eb Linux dhe macOS. <\/p>\n

Krimbi \u00ebsht\u00eb caktuar emri kod Shai-Hulud (krimb gjigand, i p\u00ebrmendur n\u00eb romanin Dune). Akreditimet e gjetura n\u00eb sistem publikohen n\u00eb GitHub p\u00ebrmes krijimit t\u00eb repozitoreve me emrin Shai-Hulud (p.sh. \u00abB611\/Shai-Hulud\u00bb), si dhe pasqyrohen n\u00eb form\u00eb t\u00eb koduar n\u00eb regjistrat e GitHub Actions. N\u00eb repozitorin e krijuar vendoset nj\u00eb skedar data.json, n\u00eb t\u00eb cilin ndodhet nj\u00eb varg me informacion t\u00eb koduar me metod\u00ebn base64 mbi sistemin, variablat e mjedisit dhe \u00e7el\u00ebsat e aksesit t\u00eb kapur. N\u00eb CI t\u00eb bazuar n\u00eb GitHub p\u00ebr t\u00eb transmetuar informacionin n\u00eb nj\u00eb host t\u00eb jasht\u00ebm, krimbi krijon nj\u00eb p\u00ebrpunues GitHub Actions (.github\/workflows\/shai-hulud-workflow.yml). Sipas duket, sulmi nuk \u00ebsht\u00eb i kufizuar n\u00eb 187 paketat e p\u00ebrmendura, pasi n\u00eb GitHub vazhdojn\u00eb t\u00eb shfaqen repozitore t\u00eb reja me emrin Shai-Hulud dhe skedarin data.json.

\"Nj\u00eb<\/center> <\/p>\n

Nd\u00ebr t\u00eb tjera, si rezultat i aktivitetit t\u00eb wormit, jan\u00eb prekur 25 paketa t\u00eb kompanis\u00eb CrowdStrike, e cila zhvillon mjete p\u00ebr mbrojtjen nga sulmet<\/a> n\u00ebp\u00ebrmjet var\u00ebsive (Supply Chain). Sipas deklarat\u00ebs s\u00eb CrowdStrike, paketat e kompromentuara nuk jan\u00eb p\u00ebrdorur n\u00eb platform\u00ebn Falcon dhe sulmi nuk ka shp\u00ebrthyer te klient\u00ebt. Gjithashtu, \u00ebsht\u00eb b\u00ebr\u00eb e ditur se vala e kaluar e publikimit t\u00eb l\u00ebshimeve t\u00eb d\u00ebmshme n\u00eb NPM, e kryer pa wormin, ka prekur projektin gemini-cli, i zhvilluar nga kompania Google.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u043f\u0435\u0440\u0435\u0448\u043b\u0430 \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c. \u0412 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \u0438 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u0435\u0440\u0435\u0448\u043b\u0438 \u043a \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044e \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0447\u0435\u0440\u0432\u044f \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438. \u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0447\u0435\u0440\u0432\u044f \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043f\u043e\u0441\u043b\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 NPM-\u043f\u0430\u043a\u0435\u0442\u0430 @ctrl\/tinycolor, \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e 2.2 \u043c\u043b\u043d \u0435\u0436\u0435\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0438 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u044f\u043c\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":143669,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-143668","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wormi q\u00eb vet\u00ebshp\u00ebrndahet ka goditur 187 paketa n\u00eb NPM | ProHoster","description":"Sulmi ndaj paketave shoq\u00ebruese n\u00eb repozitorin NPM ka kaluar n\u00eb nj\u00eb nivel t\u00eb ri.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/samorasprostranyayushhijsya-cherv-porazil-187-paketov-v-npm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0430\u043c\u043e\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0447\u0435\u0440\u0432\u044c \u043f\u043e\u0440\u0430\u0437\u0438\u043b 187 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 NPM | ProHoster","og:description":"\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u043f\u0435\u0440\u0435\u0448\u043b\u0430 \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/samorasprostranyayushhijsya-cherv-porazil-187-paketov-v-npm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-09-17T09:11:57+00:00","article:modified_time":"2026-02-08T19:43:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"143668","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 19:43:52","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:50:19","updated":"2026-02-08 19:43:52","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/143668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=143668"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/143668\/revisions"}],"predecessor-version":[{"id":157614,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/143668\/revisions\/157614"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/143669"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=143668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=143668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=143668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}