{"id":182035,"date":"2026-06-12T14:48:20","date_gmt":"2026-06-12T12:48:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur"},"modified":"2026-06-12T14:48:20","modified_gmt":"2026-06-12T12:48:21","slug":"atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur","title":{"rendered":"Sulmuesit kan\u00eb komprometuar 469 paketa n\u00eb depozitorin AUR","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

U zbulua nj\u00eb kompromitim masiv t\u00eb paketave n\u00eb depot AUR (Arch User Repository), t\u00eb p\u00ebrdorura n\u00eb Arch Linux p\u00ebr shp\u00ebrndarjen e aplikacioneve nga zhvilluesit e tret\u00eb. Sulmuesit mor\u00ebn kontroll mbi 469 paketa dhe arrit\u00ebn t\u00eb integroujn\u00eb kode t\u00eb d\u00ebmshme p\u00ebr t\u00eb vjedhur fjal\u00ebkalimet dhe \u00e7el\u00ebsat e aksesit nga sistemet e p\u00ebrdoruesve. P\u00ebrve\u00e7 t\u00eb tjerash, kodi i d\u00ebmsh\u00ebm u integroua n\u00eb paket\u00ebn ALVR, e njohur nd\u00ebr p\u00ebrdoruesit e loj\u00ebrave kompjuterike.<\/p>\n

Sulmuesit mor\u00ebn p\u00ebrsip\u00ebr p\u00ebrcjelljen e paketave me statusin \"orphaned\" dhe q\u00eb kishin mbetur pa mb\u00ebshtetje. Si em\u00ebr u p\u00ebrdor emri i mb\u00ebshtet\u00ebsit t\u00eb fundit, por me nj\u00eb email tjet\u00ebr, pas s\u00eb cil\u00ebs u shtua nj\u00eb komit dhe u publikua nj\u00eb p\u00ebrdit\u00ebsim. Komiti shtoi \"npm\" n\u00eb list\u00ebn e var\u00ebsive PKGBUILD dhe futi n\u00eb bllokun post_install t\u00eb skriptit install.sh nj\u00eb rresht p\u00ebr instalimin e disa paketave NPM. N\u00eb mesin e paketave NPM q\u00eb u instaluan ishin nj\u00eb ose disa paketa popullore legjitime dhe paketa atomic-lockfile, e cila p\u00ebrmbante softuer t\u00eb fsheht\u00eb t\u00eb d\u00ebmsh\u00ebm. Shtimi i instalimeve t\u00eb paketave NPM u b\u00eb n\u00eb t\u00eb gjitha projektet e kompromentuara, edhe n\u00ebse ato nuk p\u00ebrdornin JavaScript dhe NPM. <\/p>\n

Pas activizimi, malware-i ngjitej n\u00eb sistem si nj\u00eb sh\u00ebrbim systemd me nj\u00eb em\u00ebr t\u00eb rast\u00ebsish\u00ebm dhe n\u00eb kryerjen e tij kamuflohej si nj\u00eb rrjedh\u00eb e b\u00ebrtham\u00ebs. Kur aktivizohej me t\u00eb drejtat root, sh\u00ebrbimi krijohej n\u00eb nivelin sistemik (\/etc\/systemd\/system) dhe aktivizonte gjithashtu nj\u00eb rootkit q\u00eb punonte n\u00eb nivelin e b\u00ebrtham\u00ebs, nd\u00ebrsa kur ekzekutohej me t\u00eb drejtat e p\u00ebrdoruesit \u2014 aktivizohej me emrin e p\u00ebrdoruesit (~\/.config\/systemd\/user). Malware-i b\u00ebnte skanimin dhe d\u00ebrgonte n\u00eb jasht\u00eb server<\/a> \u00e7el\u00ebsat dhe t\u00eb dh\u00ebnat e llogarive t\u00eb VPN, Docker, Podman dhe SSH, si dhe t\u00eb dh\u00ebnat e ndjeshme t\u00eb nxjerra nga shfletuesi, historikun e komandave n\u00eb shell, \u00e7el\u00ebsat e portofol\u00ebve t\u00eb kriptomonedhave, tokenet e qasjes n\u00eb Slack, Microsoft Teams, Discord, GitHub, NPM dhe Vault.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Arch Linux \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 469 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0438 \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432 \u043d\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u0441\u0438\u0441\u0442\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0421\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u044b\u043b \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0439 \u0447\u0435\u0440\u0435\u0437 AUR \u043f\u0430\u043a\u0435\u0442 ALVR, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182035","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sulmuesit kan\u00eb komprometuar 469 paketa n\u00eb depozitat AUR | ProHoster","description":"\u00cbsht\u00eb regjistruar nj\u00eb kompromitim masiv i paketave n\u00eb depozitat AUR (Arch User Repository), t\u00eb p\u00ebrdorura n\u00eb Arch Linux p\u00ebr t\u00eb shp\u00ebrndar\u00eb aplikacione nga zhvillues t\u00eb tret\u00eb. Sulmuesit fituan kontroll mbi 469 paketa dhe arrit\u00ebn t\u00eb integrojn\u00eb n\u00eb to kod t\u00eb d\u00ebmsh\u00ebm p\u00ebr t\u00eb vjedhur fjal\u00ebkalimet dhe \u00e7el\u00ebsat e qasjes nga sistemet e p\u00ebrdoruesve. Mes t\u00eb tjerash, kodi i d\u00ebmsh\u00ebm u integrua n\u00eb paket\u00ebn ALVR q\u00eb shp\u00ebrndahet p\u00ebrmes AUR, e cila \u00ebsht\u00eb popullore.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 469 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Arch Linux \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 469 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0438 \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432 \u043d\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u0441\u0438\u0441\u0442\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0421\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u044b\u043b \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0439 \u0447\u0435\u0440\u0435\u0437 AUR \u043f\u0430\u043a\u0435\u0442 ALVR, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0439","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-12T12:48:21+00:00","article:modified_time":"2026-06-12T12:48:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/182035","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=182035"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/182035\/revisions"}],"predecessor-version":[{"id":182071,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/182035\/revisions\/182071"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=182035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=182035"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=182035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}