{"id":182783,"date":"2026-08-10T19:40:40","date_gmt":"2026-08-10T17:40:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov"},"modified":"2026-08-10T19:40:40","modified_gmt":"2026-08-10T17:40:40","slug":"novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov","title":{"rendered":"K\u00ebrmilli i ri ChainDrop ka goditur m\u00eb shum\u00eb se 400 paketa NPM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/i><\/a>
1 <\/p>\n

E regjistruar<\/a> nj\u00eb sulm masiv n\u00eb paketat n\u00eb depozitorin NPM, i realizuar me p\u00ebrdorimin e nj\u00eb derri t\u00eb ri vet\u00eb-shp\u00ebrndar\u00ebs ChainDrop, q\u00eb fut nj\u00eb softuer t\u00eb d\u00ebmsh\u00ebm n\u00eb var\u00ebsi. Si rezultat i sulmit, jan\u00eb publikuar 2212 versione t\u00eb d\u00ebmshme p\u00ebr 444 paketa. Paketat m\u00eb t\u00eb njohura t\u00eb komprometuara keyv, flat-cache dhe file-entry-cache kan\u00eb gjithsej 154, 149.9 dhe 147.6 milion shkarkime n\u00eb jav\u00eb.<\/p>\n

<\/noindex> <\/p>\n

Shkarkuesi i krimbave ishte i vendosur n\u00eb skedar\u00ebt setup.mjs dhe Math_Symbol.js, t\u00eb cil\u00ebt aktivizoheshin me an\u00eb t\u00eb nj\u00eb procesi parainstallimi (\"preinstall\": \"node setup.mjs\"), q\u00eb thirrej gjat\u00eb instalimit t\u00eb paket\u00ebs s\u00eb prekur. Skriptet e p\u00ebrmendura shkarkonin nj\u00eb runtime legjitim t\u00eb Bun dhe nj\u00eb kod t\u00eb obfuskuar t\u00eb krimbave me nj\u00eb madh\u00ebsi prej 710 KB. Pas aktivizimit, krimbi kryente nj\u00eb k\u00ebrkim n\u00eb sistem dhe n\u00eb variablat e mjedisit p\u00ebr tokenet e NPM, PyPI, CircleCI, AWS, GCP, Docker, Azure, HashiCorp, KubernetesK8s dhe sh\u00ebrbime t\u00eb tjera (n\u00eb total u analizuan m\u00eb shum\u00eb se 140 rrug\u00eb skedash, si ~\/.npmrc), si dhe analizonte memorien (p\u00ebrmes \/proc\/\/mem) t\u00eb mjedisit GitHub Actions p\u00ebr tokenet dhe akreditimet.<\/p>\n

<\/p>\n

N\u00eb rast se gjendej nj\u00eb token p\u00ebr lidhjen me katalogun NPM, derri automatikisht publikonte ril\u00ebshime t\u00eb reja t\u00eb d\u00ebmshme p\u00ebr paketat q\u00eb zhvilloheshin n\u00eb ambientin aktual, duke prekur pem\u00ebn e var\u00ebsive. Ndryshe nga derri i zbuluar m\u00eb par\u00eb Shai-Hulud 2.0<\/a> n\u00eb ChainDrop ishte realizuar teknika EtherHiding p\u00ebr t\u00eb marr\u00eb komandat e menaxhimit p\u00ebrmes blockchain-it publik Ethereum, duke p\u00ebrdorur enkriptimin p\u00ebr t\u00eb fshehur t\u00eb dh\u00ebnat konfidenciale t\u00eb d\u00ebrguara n\u00eb serverin e sulmuesit dhe duke siguruar nd\u00ebrlidhjen n\u00eb skedar\u00ebt e konfigurimit Claude Code, VS Code dhe GitHub Copilot p\u00ebr t\u00eb konsoliduar pranin\u00eb n\u00eb sistem.<\/p>\n

<\/noindex> <\/p>\n

Sulmi filloi me komprometimin e procesit t\u00eb formimit t\u00eb ril\u00ebshimeve mbi baz\u00ebn e GitHub Actions p\u00ebr paket\u00ebn keyv<\/a>, i cili num\u00ebronte 154 milion shkarkime n\u00eb jav\u00eb dhe p\u00ebrdorej si var\u00ebsi n\u00eb 1703 paketa. Sulmuesit formuan nj\u00eb version t\u00eb ri 6.0.0, duke futur n\u00eb t\u00eb kodin e d\u00ebmsh\u00ebm, dhe e publikuan at\u00eb duke p\u00ebrdorur mekanizmin \"Botuesit e Besuar<\/a>\" dhe t\u00eb sakt\u00eb. SLSA-aktakim<\/a>. Pas publikimit, derri preku shum\u00eb paketa t\u00eb varura nga keyv dhe me zinxhir filloi t\u00eb prekte var\u00ebsit\u00eb indirekte.<\/p>\n

<\/noindex> <\/p>\n

Mes paketave m\u00eb t\u00eb njohura q\u00eb u preken nga derri, i cili publikoi p\u00ebr to ril\u00ebshime t\u00eb d\u00ebmshme, jan\u00eb:<\/p>\n