{"id":166951,"date":"2026-03-31T23:11:57","date_gmt":"2026-03-31T21:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/skomprometirovan-npm-paket-axios-imeyushhij-100-mln-zagruzok-v-nedelyu"},"modified":"2026-03-31T23:11:57","modified_gmt":"2026-03-31T21:11:57","slug":"skomprometirovan-npm-paket-axios-imeyushhij-100-mln-zagruzok-v-nedelyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/skomprometirovan-npm-paket-axios-imeyushhij-100-mln-zagruzok-v-nedelyu","title":{"rendered":"Paket\u00eb NPM axios \u00ebsht\u00eb e kompromentuar, e cila ka 100 milion shkarkime n\u00eb jav\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Haker\u00ebt arrit\u00ebn t\u00eb kapin llogarin\u00eb e mb\u00ebshtetjes dhe t\u00eb l\u00ebshonin dy versione t\u00eb d\u00ebmshme t\u00eb paket\u00ebs NPM axios, e cila ofron nj\u00eb implementim t\u00eb klientit HTTP p\u00ebr shfletuesit dhe Node.js. Paketa axios ka m\u00eb shum\u00eb se 100 milion shkarkime n\u00eb jav\u00eb dhe p\u00ebrdoret si nj\u00eb var\u00ebsi nga 174 mij\u00eb paketa t\u00eb tjera. Ndryshimet e d\u00ebmshme u integruan n\u00eb versionet Axios 1.14.1 dhe 0.30.4 p\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb var\u00ebsis\u00eb fiktive plain-crypto-js 4.2.1, e cila p\u00ebrmbante kod p\u00ebr shkarkimin e komponenteve q\u00eb marrin komanda nga serveri drejtues i haker\u00ebve. Versionet e d\u00ebmshme u propozuan p\u00ebr shkarkim m\u00eb 31 mars p\u00ebr gati 3 or\u00eb \u2014 nga 03:21 deri n\u00eb 6:15 (MSK). <\/p>\n

Versionet e d\u00ebmshme u publikuan n\u00eb NPM direkt duke p\u00ebrdorur t\u00eb dh\u00ebnat e llogaris\u00eb kryesore t\u00eb mb\u00ebshtetjes s\u00eb projektit axios (\"jasonsaayman\") duke shmangur mekanizmin standard t\u00eb publikimit t\u00eb versioneve t\u00eb reja q\u00eb bazohet n\u00eb GitHub Actions. Supozohet se sulmuesit arrit\u00ebn t\u00eb kapin tokenin e aksesit n\u00eb NPM t\u00eb mb\u00ebshtetjes, pas s\u00eb cil\u00ebs hyn\u00eb n\u00eb llogari dhe ndryshuan lidhjen me email. Si u kap tokeni i aksesit nuk specifikohet. <\/p>\n

Kodi i keq i l\u00ebshuar ndodhej n\u00eb paket\u00ebn plain-crypto-js n\u00eb skedarin setup.js, aktivizohej pas p\u00ebrfundimit t\u00eb instalimit t\u00eb paket\u00ebs NPM p\u00ebrmes menaxhuesit postinstall ('postinstall: \"node setup.js\"') dhe p\u00ebrdorej p\u00ebr shkarkimin dhe instalimin e nj\u00eb trojani q\u00eb godiste sistemet me Windows, macOS dhe Linux. P\u00ebr t\u00eb fshehur pranin\u00eb e tij pas aktivizimit, komponenti i d\u00ebmsh\u00ebm fshinte skedarin setup.js dhe z\u00ebvend\u00ebsonte package.json me nj\u00eb variant pa hukun postinstall. \"Paket\u00eb <\/p>\n

N\u00eb macOS, skedari ekzekutues i d\u00ebmsh\u00ebm shkarkohej si \"\/Library\/Caches\/com.apple.act.mond\", n\u00eb Windows \u2014 \"%PROGRAMDATA%\\wt.exe\", n\u00eb Linux \u2014 \"\/tmp\/ld.py\". Pas aktivizimit, n\u00eb Linux dhe macOS, \u00e7do 60 sekonda d\u00ebrgon n\u00eb jasht\u00eb server<\/a> p\u00ebr t\u00eb ekzekutuar n\u00eb sistemin e infektuar, t\u00eb cilat mund t\u00eb p\u00ebrdoren p\u00ebr ngarkimin e komponent\u00ebve t\u00eb tjer\u00eb t\u00eb d\u00ebmsh\u00ebm, p\u00ebr t\u00eb ekzekutuar komanda t\u00eb rastit shell dhe p\u00ebr t\u00eb k\u00ebrkuar\/d\u00ebrguar skedar\u00eb t\u00eb caktuar. <\/p>\n

Aktiviteti i d\u00ebmsh\u00ebm n\u00eb Linux dhe macOS nuk parashikonte ruajtjen e pranis\u00eb pas rinisjes dhe ishte i dizajnuar p\u00ebr mbledhjen e shpejt\u00eb t\u00eb t\u00eb dh\u00ebnave t\u00eb ndjeshme, fjal\u00ebkalimeve, tokeneve dhe \u00e7el\u00ebsave t\u00eb aksesit. N\u00eb Windows, krijohej skedari \"%PROGRAMDATA%\\system.bat\", i cili nxirrte komponentin e d\u00ebmsh\u00ebm me server\u00eb<\/a> sulmuesit n\u00eb \u00e7do hyrje n\u00eb sistem.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0434\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 NPM-\u043f\u0430\u043a\u0435\u0442\u0430 axios, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e HTTP-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u0438 Node.js. \u041f\u0430\u043a\u0435\u0442 axios \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 174 \u0442\u044b\u0441\u044f\u0447 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0438 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 Axios 1.14.1 \u0438 0.30.4 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 plain-crypto-js 4.2.1, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":166952,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-166951","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Paketa NPM axios n\u00eb kompromis, me 100 milion shkarkime n\u00eb jav\u00eb | ProHoster","description":"Haker\u00ebt arrit\u00ebn t\u00eb kapin llogarin\u00eb e shoq\u00ebruesit dhe l\u00ebshuan dy publikime t\u00eb d\u00ebmshme t\u00eb paket\u00ebs NPM axios, q\u00eb ofron nj\u00eb zbatim t\u00eb klientit HTTP p\u00ebr shfletuesit dhe Node.js.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/skomprometirovan-npm-paket-axios-imeyushhij-100-mln-zagruzok-v-nedelyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d NPM-\u043f\u0430\u043a\u0435\u0442 axios, \u0438\u043c\u0435\u044e\u0449\u0438\u0439 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e | ProHoster","og:description":"\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0434\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 NPM-\u043f\u0430\u043a\u0435\u0442\u0430 axios, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e HTTP-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u0438 Node.js.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/skomprometirovan-npm-paket-axios-imeyushhij-100-mln-zagruzok-v-nedelyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-31T21:11:57+00:00","article:modified_time":"2026-03-31T21:11:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/166951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=166951"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/166951\/revisions"}],"predecessor-version":[{"id":173154,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/166951\/revisions\/173154"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/166952"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=166951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=166951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=166951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}