{"id":181856,"date":"2026-06-02T08:48:05","date_gmt":"2026-06-02T06:48:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/atakuyushhie-vstroili-vredonosnoe-po-v-32-npm-paketa-red-hat"},"modified":"2026-06-02T08:48:05","modified_gmt":"2026-06-02T06:48:05","slug":"atakuyushhie-vstroili-vredonosnoe-po-v-32-npm-paketa-red-hat","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/atakuyushhie-vstroili-vredonosnoe-po-v-32-npm-paketa-red-hat","title":{"rendered":"Sulmuese kan\u00eb integruar malware n\u00eb 32 paketa NPM t\u00eb Red Hat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Si pasoj\u00eb e komprometimit t\u00eb procesit t\u00eb formimit t\u00eb publikimeve n\u00eb baz\u00eb t\u00eb GitHub Actions n\u00eb depo t\u00eb RedHatInsights q\u00eb i p\u00ebrkasin kompanis\u00eb Red Hat, sulmuesit arrit\u00ebn t\u00eb publikojn\u00eb n\u00eb katalogun NPM 64 versione t\u00eb d\u00ebmshme, q\u00eb p\u00ebrfshinin 32 paketa NPM p\u00ebr platform\u00ebn Red Hat Cloud Services. P\u00ebr secilin nga paketat NPM t\u00eb prekura u l\u00ebshuan nga dy versione t\u00eb d\u00ebmshme, n\u00eb t\u00eb cilat u integrua kodi p\u00ebr aktivizimin e nj\u00eb varianti t\u00eb ri t\u00eb krimbit mini-shai-hulud, i cili k\u00ebrkonte tokene dhe kredenciale n\u00eb mjedisin aktual. <\/p>\n

Krimbi u vendos n\u00eb skedarin index.js dhe u aktivizua p\u00ebrmes nj\u00eb procesi preinstall, i cili thirrej gjat\u00eb instalimit t\u00eb paket\u00ebs s\u00eb prekur. Pas aktivizimit, krimbi kryente k\u00ebrkime n\u00eb sistem p\u00ebr tokene t\u00eb NPM (~\/.npmrc), PyPI, CircleCI, AWS, GCP, Docker, Azure, HashiCorp dhe KubernetesK8s, si dhe p\u00ebr \u00e7el\u00ebsa t\u00eb mbyllur SSH. T\u00eb dh\u00ebnat e gjetura i d\u00ebrgoheshin sulmuesve. N\u00eb rast se zbulohej nj\u00eb token p\u00ebr lidhjen me katalogun NPM, krimbi automatikisht publikonte versione t\u00eb reja t\u00eb d\u00ebmshme p\u00ebr paketat e zhvilluara n\u00eb mjedisin aktual, duke goditur pem\u00ebn e var\u00ebsive. <\/p>\n

Q \uc811\uadfc GitHub Actions u mor p\u00ebrmes komprometimit t\u00eb llogaris\u00eb s\u00eb nj\u00eb prej punonj\u00ebsve t\u00eb Red Hat, gj\u00eb q\u00eb i lejoi sulmuesve t\u00eb d\u00ebrgojn\u00eb drejtp\u00ebrdrejt commit-e n\u00eb depo t\u00eb javascript-clients, frontend-components dhe platform-frontend-ai-toolkit, pa kaluar n\u00ebp\u00ebr faz\u00ebn e rishikimit. P\u00ebrmes commit-eve n\u00eb sistemin e integrimit t\u00eb vazhduesh\u00ebm, u fut skedari ci.yaml, i cili, gjat\u00eb ekzekutimit t\u00eb pun\u00ebs s\u00eb nd\u00ebrtimit, aktivizonte p\u00ebrmes platform\u00ebs bun skriptin _index.js. Skripti p\u00ebrdorte autorizimin \"id-token: write\" p\u00ebr t\u00eb k\u00ebrkuar nga GitHub nj\u00eb token OIDC (OpenID Connect), i cili m\u00eb pas p\u00ebrdorej p\u00ebr autentifikim n\u00eb NPM p\u00ebrmes mekanizmit \"publikim i besuar\".<\/p>\n

Paketa NPM q\u00eb p\u00ebrmbajn\u00eb kod t\u00eb d\u00ebmsh\u00ebm:<\/p>\n