Si rezultat i kompromisimit t\u00eb procesit t\u00eb formimit t\u00eb rrelease-it n\u00eb baz\u00eb t\u00eb GitHub Actions, sulmuesit arrit\u00ebn t\u00eb publikojn\u00eb n\u00eb depozitat NPM 84 versione t\u00eb d\u00ebmshme q\u00eb p\u00ebrfshinin 42 paketa NPM nga stoku TanStack. Disa nga paketat e komprometuara kishin m\u00eb shum\u00eb se 10 milion shkarkime n\u00eb jav\u00eb. <\/p>\n
Aksesi p\u00ebr publikimin e lirimeve u mor p\u00ebr shkak t\u00eb nj\u00eb konfigurimi t\u00eb gabuar t\u00eb pull_request_target «Pwn Request» n\u00eb GitHub Actions (caktimi i mask\u00ebs n\u00eb cil\u00ebsimet \u00e7oi n\u00eb nisjen e pull_request_target p\u00ebr pull-requestet n\u00eb fork-et e jashtme), ndotjes s\u00eb cache-it t\u00eb GitHub Actions p\u00ebrmes fork dhe mund\u00ebsin\u00eb e nxjerrjes s\u00eb tokenit OIDC nga memoria e procesit t\u00eb ekzekutuesit (Runner.Worker) p\u00ebrmes leximit t\u00eb p\u00ebrmbajtjes \/proc\/\/mem. <\/p>\n
Paketa NPM me ndryshime t\u00eb d\u00ebmshme u publikuan m\u00eb 11 maj nga ora 22:20 deri n\u00eb 22:26 (MSK), u v\u00ebreh\u00ebn pas 20 minutash dhe u bllokuan pas nj\u00eb ore e gjysm\u00eb. P\u00ebr secil\u00ebn nga paketat e ndikuara NPM u l\u00ebshuan dy versione t\u00eb d\u00ebmshme, n\u00eb t\u00eb cilat u integrua kodi p\u00ebr aktivizimin e krimbit mini-shai-hulud, q\u00eb kryen k\u00ebrkimin e token\u00ebve dhe t\u00eb dh\u00ebnave t\u00eb p\u00ebrdoruesve n\u00eb ambientin aktual. N\u00eb rast se zbuloheshin nj\u00eb token lidhjeje me katalogun NPM, krimbi publikonte automatikisht versione t\u00eb reja t\u00eb d\u00ebmshme p\u00ebr paketat q\u00eb zhvilloheshin n\u00eb ambientin aktual, duke prekur deg\u00ebn e varshm\u00ebris\u00eb. K\u00ebshtu u preken m\u00eb shum\u00eb se 400 paketa NPM q\u00eb p\u00ebrdorin paketat TanStack si varshm\u00ebri. <\/p>\n
Wormi ishte i vendosur n\u00eb skedarin router_init.js dhe aktivizohej kur paketa e prekur instalohej manualisht nga zhvilluesi ose automatikisht n\u00eb nj\u00eb mjedis integrimi t\u00eb vazhduesh\u00ebm p\u00ebrmes komandave «npm install», «pnpm install» ose «yarn install». Pas aktivizimit, wormi skanon sistemin p\u00ebr tokenet e NPM (~\/.npmrc), AWS, GCP, Azure, HashiCorp dhe KubernetesK8s, si dhe \u00e7el\u00ebsat privat\u00eb SSH. T\u00eb dh\u00ebnat e gjetura d\u00ebrgoheshin te sulmuesit p\u00ebrmes mesazherit decentralizues P2P getsession.org. <\/p>\n
N\u00eb worm ishte parashikuar t\u00eb kryheshin veprime destruktive n\u00eb rast t\u00eb t\u00ebrheqjes s\u00eb tokenit t\u00eb kapur NPM \u2014 n\u00eb sistem konfiguritej nisja periodike e skriptit ~\/local\/bin\/gh-token-monitor.sh, i cili \u00e7do 60 sekonda kontrollonte aktiviteten e tokenit p\u00ebrmes nj\u00eb thirrjeje n\u00eb api.github.com\/user dhe n\u00eb rast t\u00eb t\u00ebrheqjes s\u00eb tokenit ekzekutohej komanda \u00abrm -rf ~\u00bb. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"