{"id":182783,"date":"2026-08-10T19:40:40","date_gmt":"2026-08-10T17:40:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov"},"modified":"2026-08-12T20:28:40","modified_gmt":"2026-08-12T18:28:40","slug":"novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov","title":{"rendered":"Wormi i ri ChainDrop ka prekur m\u00eb shum\u00eb se 400 paketa NPM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

E konfirmuar<\/a> nj\u00eb sulm masiv ndaj paketave n\u00eb depozitorin\u00eb NPM, i realizuar me ndihm\u00ebn e nj\u00eb wurmi t\u00eb ri vet\u00eb-shp\u00ebrndar\u00ebs, ChainDrop, i cili inxhinjon malware n\u00eb var\u00ebsi. Si rezultat i sulmit jan\u00eb publikuar 2212 l\u00ebshime t\u00eb d\u00ebmshme p\u00ebr 444 paketa. Paketat m\u00eb t\u00eb njohura t\u00eb komprometuara, keyv, flat-cache dhe file-entry-cache, kan\u00eb p\u00ebr kat\u00ebr 154, 149.9 dhe 147.6 milion shkarkime n\u00eb jav\u00eb.<\/p>\n

 <\/p>\n

Ngarkuesi i krimbave ndodhej n\u00eb skedar\u00ebt setup.mjs dhe Math_Symbol.js, t\u00eb cilat u ekzekutuan me ndihm\u00ebn e procesorit preinstall (\"preinstall\": \"node setup.mjs\"), q\u00eb thirrej gjat\u00eb instalimit t\u00eb paket\u00ebs s\u00eb prekur. Skriptet e p\u00ebrmendura ngarkonin runtime t\u00eb legjitim t\u00eb Bun dhe kodin e obfuskuesh\u00ebm t\u00eb krimbave, me nj\u00eb madh\u00ebsi prej 710 KB. Pas aktivizimit, krimbi fillonte nj\u00eb k\u00ebrkim n\u00eb sistem dhe n\u00eb variablat e ambientit p\u00ebr tokens t\u00eb NPM, PyPI, CircleCI, AWS, GCP, Docker, Azure, HashiCorp, KubernetesK8s dhe sh\u00ebrbime t\u00eb tjera (n\u00eb total ishin analizuar m\u00eb shum\u00eb se 140 rrug\u00eb skedari, si ~\/.npmrc), si dhe analizonte memorjen (p\u00ebrmes \/proc\/\/mem) t\u00eb ambientit t\u00eb GitHub Actions p\u00ebr tokens dhe kredenciale.<\/p>\n

 <\/p>\n

N\u00eb rast se gjeje nj\u00eb token p\u00ebr t'u lidhur me katalogun NPM, wurmi automatikisht publikonte l\u00ebshime t\u00eb reja t\u00eb d\u00ebmshme p\u00ebr paketat q\u00eb zhvilloheshin n\u00eb mjedisin aktual, duke prekur pem\u00ebn e var\u00ebsive. Ndryshe nga wurmi i zbuluar m\u00eb par\u00eb Shai-Hulud 2.0<\/a> n\u00eb ChainDrop u implementua teknika EtherHiding p\u00ebr t\u00eb marr\u00eb komanda menaxhuese p\u00ebrmes blockchain-it publik Ethereum, duke u angazhuar me enkriptim p\u00ebr t\u00eb fshehur t\u00eb dh\u00ebna konfidenciale t\u00eb d\u00ebrguara n\u00eb serverin e sulmuesve dhe duke siguruar inserimin n\u00eb skedar\u00ebt e konfigurimit t\u00eb Claude Code, VS Code dhe GitHub Copilot p\u00ebr t\u00eb mbajtur prani n\u00eb sistem.<\/p>\n

 <\/p>\n

Sulmi filloi me komprometimin e procesit t\u00eb krijimit t\u00eb l\u00ebshimeve n\u00eb baz\u00eb t\u00eb GitHub Actions p\u00ebr paket\u00ebn keyv<\/a>, e cila ka 154 milion shkarkime n\u00eb jav\u00eb dhe p\u00ebrdoret si var\u00ebsi n\u00eb 1703 paketa. Sulmuesit formuan nj\u00eb version t\u00eb ri 6.0.0, duke vendosur n\u00eb t\u00eb kodin e d\u00ebmsh\u00ebm, dhe e publikuan at\u00eb duke p\u00ebrdorur mekanizmin \u2018Publikues t\u00eb Besuar<\/a>\u2019 dhe nj\u00eb certifikim t\u00eb sakt\u00eb SLSA<\/a>. Pas publikimit, wurmi goditi shum\u00eb paketa q\u00eb varen nga keyv dhe p\u00ebrmes zinxhirit filloi t\u00eb ndikoj\u00eb n\u00eb var\u00ebsit\u00eb e drejtp\u00ebrdrejta.<\/p>\n

 <\/p>\n

Nd\u00ebr paketat m\u00eb t\u00eb njohura q\u00eb u preken nga wurmi, t\u00eb cil\u00ebt publikuan l\u00ebshime t\u00eb d\u00ebmshme p\u00ebr to:<\/p>\n