{"id":170057,"date":"2026-04-29T00:24:33","date_gmt":"2026-04-28T22:24:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-python-paket-elementary-data-imeyushhij-1-1-mln-zagruzok-v-mesyacz-vnedryon-vredonosnyj-kod"},"modified":"2026-04-29T00:24:33","modified_gmt":"2026-04-28T22:24:33","slug":"v-python-paket-elementary-data-imeyushhij-1-1-mln-zagruzok-v-mesyacz-vnedryon-vredonosnyj-kod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-python-paket-elementary-data-imeyushhij-1-1-mln-zagruzok-v-mesyacz-vnedryon-vredonosnyj-kod","title":{"rendered":"N\u00eb paket\u00ebn Python elementary-data, e cila ka 1.1 milion shkarkime n\u00eb muaj, \u00ebsht\u00eb futur kod i keq","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompania Elementary Data njoftoi p\u00ebr komprometimin e proceseve t\u00eb GitHub Actions, t\u00eb cilat u mund\u00ebsuan nga sulmuesit p\u00ebr t\u00eb publikuar n\u00eb katalogun PyPI dhe n\u00eb depozit\u00ebn e GitHub nj\u00eb version t\u00eb paket\u00ebs elementary-data 0.23.3, n\u00eb t\u00eb cilin ishte integruar nj\u00eb kod malicioz p\u00ebr t\u00eb vjedhur informacionin konfidencial nga sistemet e p\u00ebrdoruesve. Ky version malicioz gjithashtu u p\u00ebrfshi n\u00eb imazhin zyrtar Docker t\u00eb projektit. Muajin e kaluar, paketa elementary-data u shp\u00ebrngul nga depozita PyPI m\u00eb shum\u00eb se 1.1 milion her\u00eb. <\/p>\n

Versioni malicioz u publikua m\u00eb 25 prill n\u00eb or\u00ebn 1:20 (MSK) dhe mbeti i disponuesh\u00ebm p\u00ebr shkarkim p\u00ebr m\u00eb shum\u00eb se 11 or\u00eb (deri n\u00eb 12:45). Sulmi u krye duke d\u00ebrguar nj\u00eb k\u00ebrkes\u00eb pull me nj\u00eb koment t\u00eb formatuar n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb, duke shfryt\u00ebzuar nj\u00eb vulnerabilitet n\u00eb menaxhuesin automatik t\u00eb GitHub Action. Sulmuesve iu arrit t\u00eb ekzekutonin komandat shell n\u00eb ambientin e integrimit t\u00eb vazhduesh\u00ebm dhe t\u00eb nxirrnin nga ai p\u00ebrmbajtjen e variablit t\u00eb ambientit GITHUB_TOKEN, me nj\u00eb token akses p\u00ebr depozit\u00ebn. Ky token u p\u00ebrdor p\u00ebr t\u00eb krijuar disa deg\u00eb n\u00eb git dhe p\u00ebr t\u00eb p\u00ebrgatitur versionin.<\/p>\n

N\u00eb p\u00ebrb\u00ebrje t\u00eb versionit t\u00eb publikuar nga sulmuesit ishte i p\u00ebrfshir\u00eb nj\u00eb kod malicioz, i koduar n\u00eb formatin base64 dhe aktivizohej gjat\u00eb instalimit t\u00eb paket\u00ebs. Kodi malicioz skanonte sistemin dhe d\u00ebrgonte t\u00eb dh\u00ebna konfidenciale, si\u00e7 jan\u00eb \u00e7el\u00ebsat SSH dhe SSL\/TLS, p\u00ebrmbajtjen e variablave t\u00eb ambientit, akreditetet p\u00ebr AWS, GCP, Azure dhe K8s, \u00e7el\u00ebsat e portofol\u00ebve kriptografik\u00eb, fjal\u00ebkalimet p\u00ebr DBMS, historiku i operacioneve n\u00eb interpreterin e komandave, skedar\u00ebt e konfigurimit nga Git, CI\/CD, menaxhuesit e paketave dhe Docker.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Elementary Data \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 GitHub Actions, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 PyPI \u0438 \u0432 GitHub-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u0430 elementary-data 0.23.3, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0432\u043d\u0435\u0434\u0440\u0451\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0441 \u0441\u0438\u0441\u0442\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0442\u0430\u043a\u0436\u0435 \u0431\u044b\u043b \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e Docker-\u043e\u0431\u0440\u0430\u0437\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u0430. \u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 \u043f\u0430\u043a\u0435\u0442 elementary-data \u0431\u044b\u043b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170057","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47N\u00eb paket\u00ebn Python elementary-data, e cila ka 1.1 milion shkarkime n\u00eb muaj, \u00ebsht\u00eb integruar nj\u00eb kod malicioz | ProHoster","description":"Kompania Elementary Data njoftoi p\u00ebr komprometimin e proceseve t\u00eb GitHub Actions, t\u00eb cilat u mund\u00ebsuan nga sulmuesit p\u00ebr t\u00eb publikuar n\u00eb katalogun PyPI dhe n\u00eb depozit\u00ebn e GitHub nj\u00eb version t\u00eb paket\u00ebs elementary-data 0.23.3, n\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-python-paket-elementary-data-imeyushhij-1-1-mln-zagruzok-v-mesyacz-vnedryon-vredonosnyj-kod","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Python-\u043f\u0430\u043a\u0435\u0442 elementary-data, \u0438\u043c\u0435\u044e\u0449\u0438\u0439 1.1 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043c\u0435\u0441\u044f\u0446, \u0432\u043d\u0435\u0434\u0440\u0451\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Elementary Data \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 GitHub Actions, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 PyPI \u0438 \u0432 GitHub-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u0430 elementary-data 0.23.3, \u0432.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-python-paket-elementary-data-imeyushhij-1-1-mln-zagruzok-v-mesyacz-vnedryon-vredonosnyj-kod","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-04-28T22:24:33+00:00","article:modified_time":"2026-04-28T22:24:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/170057","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=170057"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/170057\/revisions"}],"predecessor-version":[{"id":170727,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/170057\/revisions\/170727"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=170057"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=170057"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=170057"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}