{"id":181856,"date":"2026-06-02T08:48:05","date_gmt":"2026-06-02T06:48:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/atakuyushhie-vstroili-vredonosnoe-po-v-32-npm-paketa-red-hat"},"modified":"2026-06-02T08:48:05","modified_gmt":"2026-06-02T06:48:05","slug":"atakuyushhie-vstroili-vredonosnoe-po-v-32-npm-paketa-red-hat","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/atakuyushhie-vstroili-vredonosnoe-po-v-32-npm-paketa-red-hat","title":{"rendered":"Sulmuesit kan\u00eb integruar malware n\u00eb 32 paketat NPM t\u00eb Red Hat.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Si pasoj\u00eb e komprometimit t\u00eb procesit t\u00eb formimit t\u00eb l\u00ebshimeve bazuar n\u00eb GitHub Actions n\u00eb repository-t RedHatInsights q\u00eb i p\u00ebrkasin kompanis\u00eb Red Hat, sulmuesit mund\u00ebn t\u00eb publikojn\u00eb n\u00eb katalogun NPM 64 versione t\u00eb d\u00ebmshme, q\u00eb p\u00ebrfshinin 32 NPM-paketa p\u00ebr platform\u00ebn Red Hat Cloud Services. P\u00ebr secilin nga NPM-pakat e prekur u l\u00ebshuan dy versione t\u00eb d\u00ebmshme, n\u00eb t\u00eb cilat ishte integruar kodi p\u00ebr aktivizimin e nj\u00eb varianti t\u00eb ri t\u00eb njoll\u00ebs mini-shai-hulud, q\u00eb kryente k\u00ebrkimin e tokeneve dhe kredencialeve n\u00eb mjedisin aktual. <\/p>\n

Njolla ishte vendosur n\u00eb skedarin index.js dhe aktivizohej p\u00ebrmes nj\u00eb preinstall handler-i, i cili thirrej gjat\u00eb instalimit t\u00eb paket\u00ebs t\u00eb prekur. Pas aktivizimit, njolla kryente k\u00ebrkimin n\u00eb sistem p\u00ebr tokenet e NPM (~\/.npmrc), PyPI, CircleCI, AWS, GCP, Docker, Azure, HashiCorp dhe KubernetesK8s, si dhe \u00e7el\u00ebsat e mbyllur SSH. T\u00eb dh\u00ebnat e gjetura iu d\u00ebrgoheshin sulmuesve. N\u00eb rast se gjendej nj\u00eb token p\u00ebr lidhjen me katalogun NPM, njolla automatikisht publikonte l\u00ebshime t\u00eb reja t\u00eb d\u00ebmshme p\u00ebr paketat q\u00eb ishin duke u zhvilluar n\u00eb ambientin aktual, duke prekur pem\u00ebn e var\u00ebsive. <\/p>\n

Qasja n\u00eb GitHub Actions u p\u00ebrfituar si rezultat i kompromitimit t\u00eb llogaris\u00eb s\u00eb nj\u00eb nga punonj\u00ebsve t\u00eb Red Hat, duke lejuar sulmuesit t\u00eb d\u00ebrgojn\u00eb drejtp\u00ebrdrejt komit\u00eb n\u00eb repositor\u00ebt javascript-clients, frontend-components dhe platform-frontend-ai-toolkit, pa kaluar faz\u00ebn e shqyrtimit. P\u00ebrmes komit\u00ebve n\u00eb sistemin e integrimit t\u00eb vazhduesh\u00ebm, u fut nj\u00eb skedar ci.yaml, i cili, kur aktivizohej puna e nd\u00ebrtimit, ekzekutonte me ndihm\u00ebn e platform\u00ebs bun skenarin _index.js. Skenari p\u00ebrdorte autorizimin \u00abid-token: write\u00bb p\u00ebr t\u00eb k\u00ebrkuar nga GitHub nj\u00eb token OIDC (OpenID Connect), i cili m\u00eb pas aplikoheshin p\u00ebr identifikim n\u00eb NPM p\u00ebrmes mekanizmit \u00abtrusted publishing\u00bb.<\/p>\n

NPM-pakete q\u00eb p\u00ebrmbajn\u00eb kod t\u00eb d\u00ebmsh\u00ebm:<\/p>\n