{"id":149530,"date":"2025-11-25T17:11:58","date_gmt":"2025-11-25T15:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov"},"modified":"2025-11-25T17:11:58","modified_gmt":"2025-11-25T15:11:59","slug":"pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","title":{"rendered":"Me ndihm\u00ebn e virusit Shai-Hulud jan\u00eb kompromise 600 paketa NPM.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00cbsht\u00eb regjistruar nj\u00eb sulm i dyt\u00eb mbi paketat n\u00eb depo NPM, q\u00eb po zhvillohet duke p\u00ebrdorur nj\u00eb modifikim t\u00eb nj\u00eb verme vet\u00ebshp\u00ebrndar\u00ebse Shai-Hulud, e cila vendos softuer t\u00eb d\u00ebmsh\u00ebm n\u00eb var\u00ebsi. Si rezultat i sulmit, jan\u00eb publikuar versione t\u00eb d\u00ebmshme t\u00eb 605 paketimeve, q\u00eb num\u00ebrojn\u00eb gjithsej m\u00eb shum\u00eb se 100 milion shkarkime. <\/p>\n
P\u00ebr t\u00eb realizuar sulmin, haker\u00ebt kap\u00ebn parametrat e llogaris\u00eb s\u00eb mbik\u00ebqyr\u00ebsit t\u00eb nj\u00eb prej paketimeve m\u00eb t\u00eb njohura, t\u00eb cilat p\u00ebrdoren si var\u00ebsi nga nj\u00eb num\u00ebr i madh paketash, p\u00ebrmes phishing-ut. Duke shfryt\u00ebzuar llogarin\u00eb e kapur, sulmuesit publikuan nj\u00eb version t\u00eb paket\u00ebs, n\u00eb t\u00eb cil\u00ebn u shtua kodi p\u00ebr aktivizimin e veres gjat\u00eb instalimit t\u00eb paket\u00ebs s\u00eb prekur n\u00eb mesin e var\u00ebsive. Verma e nisur k\u00ebrkon t\u00eb dh\u00ebnat e aksesit n\u00eb mjedisin aktual, duke shkarkuar dhe ekzekutuar utilitarin TruffleHog. <\/p>\n
N\u00eb rast se zbulohet nj\u00eb token lidhjeje me katalogun NPM, verma automatikisht publikoni versione t\u00eb reja t\u00eb d\u00ebmshme p\u00ebr paketat q\u00eb zhvillohen n\u00eb mjedisin aktual. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, t\u00eb gjitha var\u00ebsit\u00eb preken nd\u00ebrsjelltas. P\u00ebrve\u00e7 NPM token-it, verma mban \u00e7el\u00ebsa p\u00ebr t\u00eb hyr\u00eb n\u00eb GitHub dhe sh\u00ebrbimet cloud t\u00eb AWS, Azure dhe GCP (Google Cloud Platform), si dhe variablat e mjedisit dhe t\u00eb dh\u00ebna t\u00eb tjera konfidenciale q\u00eb mund t\u00eb zbulohen nga skaneri TruffleHog. <\/p>\n
T\u00eb dh\u00ebnat e konfidencialitetit t\u00eb gjetura n\u00eb sistem publikohen n\u00eb GitHub p\u00ebrmes krijimit t\u00eb repozitoreve me emra kaotik\u00eb (p.sh. «qzx15djl71alh6p80h») dhe nj\u00eb fraze «Sha1-Hulud: The Second Coming» n\u00eb p\u00ebrshkrim, si dhe shfaqen n\u00eb form\u00eb t\u00eb koduar n\u00eb log-et e GitHub Actions. N\u00eb repozitorin e krijuar do t\u00eb vendoset nj\u00eb sked\u00eb n\u00eb formatin JSON (p.sh. jsonactionsSecrets.json ose contents.json), e cila ka nj\u00eb varg me informacione t\u00eb koduara me metod\u00ebn base64 rreth sistemit, variablave t\u00eb mjedisit dhe t\u00eb dh\u00ebnave t\u00eb kapura. P\u00ebr t\u00eb transferuar informacionin jasht\u00eb sistemeve t\u00eb integrimit t\u00eb vazhduesh\u00ebm t\u00eb bazuara n\u00eb GitHub, krimb krijon nj\u00eb trajtues GitHub Actions me emrin «.github\/workflows\/formatter_123456789.yml» dhe konfiguron nj\u00eb runner me emrin SHA1HULUD. <\/p>\n
Dallimet nga sulmi i ngjash\u00ebm t\u00eb shtatorit reduktohen n\u00eb nj\u00eb metod\u00eb tjet\u00ebr p\u00ebr z\u00ebvend\u00ebsimin e kodit t\u00eb d\u00ebmsh\u00ebm n\u00eb paket\u00eb. N\u00eb l\u00ebshimet e d\u00ebmshme t\u00eb formuara nga krimbi, shpallet realizimi i mb\u00ebshtetjes p\u00ebr platform\u00ebn JavaScript Bun. N\u00eb sked\u00ebn package.json, n\u00eb seksionin «preinstall», q\u00eb p\u00ebrcakton skenaret q\u00eb ekzekutohen para fillimit t\u00eb instalimit, shtohet komanda «node setup_bun.js».
<\/center> <\/p>\n
N\u00eb sked\u00ebn «setup_bun.js» ka kod p\u00ebr ekzekutimin e skenarit t\u00eb obfuskuar «bun_environment.js», q\u00eb p\u00ebrmban kodin e krimbit. P\u00ebr shp\u00ebrndarjen e tij t\u00eb m\u00ebtejshme, krimbi gjen kodin e pakove, b\u00ebn ndryshime n\u00eb sked\u00ebn package.json (rrit numrin e versionit dhe p\u00ebrfshin thirrjen e setup_bun.js), shton skedat setup_bun.js dhe bun_environment.js, ripaketon paket\u00ebn dhe ekzekuton komand\u00ebn «npm publish» p\u00ebr publikimin e l\u00ebshimit t\u00eb ri. <\/p>\n
![\"Me](\"\/wp-content\/uploads\/2025\/11\/9b6fe1ba9d28fa5432b53d051ad21724.png\")
<\/center> <\/p>\n