Si pasoj\u00eb e komprometimit t\u00eb procesit t\u00eb formimit t\u00eb versioneve n\u00eb baz\u00eb t\u00eb GitHub Actions n\u00eb projektin TanStack, sulmuesit arrit\u00ebn t\u00eb publikojn\u00eb n\u00eb depo NPM 84 versione malware, q\u00eb p\u00ebrfshin\u00eb 42 paketat NPM nga staku TanStack. Disa nga paketat e komprometuara pat\u00ebn m\u00eb shum\u00eb se 10 milion shkarkime n\u00eb jav\u00eb. <\/p>\n
Pronaq\u00eb p\u00ebr publikimin e l\u00ebshimeve u arrit p\u00ebr shkak t\u00eb konfigurimit t\u00eb gabuar pull_request_target \u00abPwn Request\u00bb n\u00eb GitHub Actions (caktimi i mask\u00ebs n\u00eb cil\u00ebsimet \u00e7oi n\u00eb aktivizimin e pull_request_target p\u00ebr k\u00ebrkesa t\u00eb t\u00ebrheqjes n\u00eb forka t\u00eb jashtme), ndotjes s\u00eb caches s\u00eb GitHub Actions p\u00ebrmes fork dhe mund\u00ebsis\u00eb p\u00ebr t\u00eb nxjerr\u00eb OIDC-token nga memorie e procesit runner t\u00eb ekzekutuar (Runner.Worker) p\u00ebrmes leximit t\u00eb p\u00ebrmbajtjes \/proc\/\/mem. <\/p>\n
Paketat NPM me ndryshime malware u publikuan m\u00eb 11 maj nga ora 22:20 deri n\u00eb 22:26 (MSK), u v\u00ebrejt\u00ebn pas 20 minutash dhe u bllokuan pas nj\u00eb ore e gjysm\u00eb. P\u00ebr secil\u00ebn nga paketat NPM t\u00eb prekuara, u l\u00ebshuan dy versione malware, n\u00eb t\u00eb cilat ishte integruar kodi p\u00ebr aktivizimin e virusit mini-shai-hulud, i cili k\u00ebrkonte token-at dhe kredencialet n\u00eb ambientin aktual. N\u00eb rastin e gjetjes s\u00eb nj\u00eb tokeni t\u00eb lidhjes me depo NPM, virusi automatikisht publikonte versione t\u00eb reja malware p\u00ebr paketat e zhvilluara n\u00eb ambientin aktual, duke prekur pem\u00ebn e var\u00ebsive. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb u preken m\u00eb shum\u00eb se 400 paketat NPM, q\u00eb p\u00ebrdornin paketat TanStack si var\u00ebsi. <\/p>\n
Krimbi ishte vendosur n\u00eb skedarin router_init.js dhe aktivizohej kur paketa e prekur instalhej manualisht nga zhvilluesi ose n\u00eb m\u00ebnyr\u00eb automatike n\u00eb nj\u00eb mjedis integrimi t\u00eb vazhduesh\u00ebm me komandat \u00abnpm install\u00bb, \u00abpnpm install\u00bb ose \u00abyarn install\u00bb. Pas aktivizimit, krimbi k\u00ebrkonte n\u00eb sistem p\u00ebr tokenet e NPM (~\/.npmrc), AWS, GCP, Azure, HashiCorp dhe KubernetesK8s, si dhe \u00e7el\u00ebsat e mbyllura SSH. T\u00eb dh\u00ebnat e gjetura d\u00ebrgoheshin te sulmuesit p\u00ebrmes mesazherit t\u00eb decentralizuar P2P getsession.org. <\/p>\n
Krimbi kishte parapar\u00eb kryerjen e veprimeve shkat\u00ebrruese n\u00eb rastin e revokimit t\u00eb tokenit t\u00eb kapur NPM \u2014 n\u00eb sistem konfiguronte nj\u00eb ekzekutim periodic t\u00eb skriptit ~\/.local\/bin\/gh-token-monitor.sh, i cili \u00e7do 60 sekonda kontrollonte aktivitetin e tokenit p\u00ebrmes thirrjes n\u00eb api.github.com\/user dhe n\u00eb rast t\u00eb revokimit t\u00eb tokenit ekzekutonte komand\u00ebn \u00abrm -rf ~\/\u00bb. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"