{"id":183679,"date":"2026-10-07T22:54:32","date_gmt":"2026-10-07T20:54:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/v-github-vyyavleno-543-tysyachi-ostavlennyh-v-repozitoriyah-dejstvuyushhih-tokenov-klyuchej-i-parolej"},"modified":"2026-10-07T22:54:38","modified_gmt":"2026-10-07T20:54:38","slug":"543000-active-tokens-keys-and-passwords-found-in-github-repositories","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/543000-active-tokens-keys-and-passwords-found-in-github-repositories","title":{"rendered":"N\u00eb GitHub jan\u00eb gjetur 543 mij\u00eb tokene, \u00e7el\u00ebsa dhe fjal\u00ebkalime t\u00eb l\u00ebna aktiv\u00eb n\u00eb depo","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompania Truffle Security publikoi rezultatet e analiz\u00ebs s\u00eb rrjedhjeve t\u00eb t\u00eb dh\u00ebnave t\u00eb akountit n\u00eb repozitor\u00ebt e hostuar n\u00eb GitHub. Si rezultat i skanimit t\u00eb 224 milion repozitor\u00ebve, q\u00eb num\u00ebrojn\u00eb 58 miliard\u00eb skedar\u00eb, u identifikuan 543 mij\u00eb akount t\u00eb dh\u00ebn\u00eb unik (tokena, \u00e7el\u00ebsa dhe fjal\u00ebkalime), t\u00eb cilat jan\u00eb ende funksionale. T\u00eb dh\u00ebnat funksionale kishin mbetur n\u00eb repozitor\u00eb p\u00ebr t\u00eb pakt\u00ebn nj\u00eb vit, pasi n\u00eb studim u p\u00ebrdor nj\u00eb most\u00ebr e gjendjes s\u00eb GitHub nga 7 gushti i vitit t\u00eb kaluar, dhe verifikimi i aktualitetit t\u00eb t\u00eb dh\u00ebnave u realizua p\u00ebrmes k\u00ebrkesave prova n\u00eb API, sh\u00ebrbime rrjeti dhe hoste, q\u00eb u krye n\u00eb fund t\u00eb korrikut t\u00eb k\u00ebtij viti. <\/p>\n

Koha mesatare e jet\u00ebgjat\u00ebsis\u00eb s\u00eb t\u00eb dh\u00ebnave t\u00eb akountit n\u00eb akses t\u00eb hapur u vler\u00ebsua n\u00eb 784 dit\u00eb, nd\u00ebrkoh\u00eb q\u00eb \u00e7el\u00ebsat e aksesit m\u00eb t\u00eb vjet\u00ebr ende funksional ishin datuar n\u00eb vitin 2009. Rreth 200 mij\u00eb t\u00eb dh\u00ebna akounti q\u00eb ishin funksionale u vendos\u00ebn n\u00eb repozitor\u00eb pas aktivizimit t\u00eb parazgjedhur n\u00eb GitHub t\u00eb mekanizmit p\u00ebr bllokimin e rrjedhjeve t\u00eb t\u00eb dh\u00ebnave t\u00eb ndjeshme dhe tokenave t\u00eb aksesit, q\u00eb kryen verifikimin n\u00eb faz\u00ebn e dor\u00ebzimit t\u00eb k\u00ebrkesave push. Rrjedhjet nuk u identifikuan p\u00ebr shkak se ishin vendosur n\u00eb formate q\u00eb nuk mb\u00ebshteten n\u00eb mbrojtjen e implementuar, edhe pse aktivizimi i filtrave p\u00ebrkat\u00ebs ul\u00ebn af\u00ebrsisht me gjysm\u00eb rrjedhjet e t\u00eb dh\u00ebnave t\u00eb akountit t\u00eb identifikueshme. <\/p>\n

Doli se GitHub identifikon me sukses rrjedhjet e tokenave p\u00ebr sh\u00ebrbimet m\u00eb t\u00eb zakonshme, si GitHub, AWS, Slack, SendGrid, Stripe dhe GCP, por anashkalon parametrat e lidhjes p\u00ebr Baza t\u00eb Dh\u00ebnash q\u00eb mbeten n\u00eb kod, \u00e7el\u00ebsat e aksesit p\u00ebr API Google dhe \u00e7el\u00ebsat e mbyllur. Parametrat e lidhjes p\u00ebr Baza t\u00eb Dh\u00ebnash dhe \u00e7el\u00ebsat e mbyllur nuk bllokohen automatikisht p\u00ebr t\u00eb shmangur alarmin e rrem\u00eb. \u00c7el\u00ebsat e aksesit p\u00ebr API Google nuk bllokohen, pasi kan\u00eb prefiksin AIzaSy, si\u00e7 ndodhin \u00e7el\u00ebsat e hapur p\u00ebr Google Maps, t\u00eb destinuara p\u00ebr integrim n\u00eb faqe web. <\/p>\n

\u0427\u0442\u043e \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0440\u0430\u0431\u043e\u0447\u0438\u043c\u0438, \u0442\u043e \u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0438\u0437 \u043d\u0438\u0445 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u0442\u043e\u043a\u0435\u043d\u0430\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043a\u043b\u044e\u0447\u0430\u043c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c \u0441 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u043c\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043e\u0442\u0437\u044b\u0432\u0430. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0438\u0437 101886 NPM-\u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0431\u044b\u043b \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u043e\u0434\u0438\u043d \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 (0.001%), \u0438\u0437 73048 GitHub-\u0442\u043e\u043a\u0435\u043d\u043e\u0432 — 260 (0.35%), \u0430 \u0438\u0437 30437 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 Hugging Face — 15 (0.05%). \u0414\u043b\u044f \u043a\u043b\u044e\u0447\u0435\u0439 Stripe \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c \u0432\u044b\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0441\u0442\u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b 4%, AWS — 8%, GCP — 8%, Slack — 2%, GitLab — 0.64%. \u0414\u043b\u044f \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044f \u0438\u0437 12985 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0421\u0423\u0411\u0414 PostgreSQL \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u043b\u0438\u0441\u044c 11465 (88%), \u0438\u0437 2421 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a MySQL — 1806 (74%), \u0438\u0437 126963 \u0441\u0435\u0440\u0432\u0438\u0441\u043d\u044b\u0445 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u043e\u0432 Google Cloud — 69041 (54%), \u0438\u0437 3790 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u043a Docker Hub — 1244 (33%), \u0430 \u0438\u0437 22800 \u043a\u043b\u044e\u0447\u0435\u0439 \u043a SendGrid — 9189 (40%). <\/p>\n

M\u00eb par\u00eb, studiuesit analizuan rreth 7.5 PB t\u00eb dh\u00ebnash p\u00ebr trajnimin e modeleve AI, t\u00eb shp\u00ebrndara p\u00ebrmes Hugging Face, dhe identifikuan n\u00eb to 221 mij\u00eb kredenciale funksionale.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Truffle Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u0442\u0435\u0447\u0435\u043a \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u043d\u0430 GitHub. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f 224 \u043c\u043b\u043d \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 58 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u043e\u0432 \u0444\u0430\u0439\u043b\u043e\u0432, \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 543 \u0442\u044b\u0441\u044f\u0447\u0438 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (\u0442\u043e\u043a\u0435\u043d\u043e\u0432, \u043a\u043b\u044e\u0447\u0435\u0439 \u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c. \u0414\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0433\u043e\u0434, \u0442\u0430\u043a \u043a\u0430\u043a \u0432 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0441\u0440\u0435\u0437 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f GitHub \u043e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183679","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47N\u00eb GitHub jan\u00eb identifikuar 543 mij\u00eb tokene, \u00e7el\u00ebsa dhe fjal\u00ebkalime t\u00eb l\u00ebna n\u00eb depot funksionale | ProHoster","description":"Kompania Truffle Security publikoi rezultatet e analiz\u00ebs s\u00eb rrjedhjeve t\u00eb kredencialeve n\u00eb depo q\u00eb jan\u00eb hostuar n\u00eb GitHub.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/543000-active-tokens-keys-and-passwords-found-in-github-repositories","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 GitHub \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 543 \u0442\u044b\u0441\u044f\u0447\u0438 \u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0442\u043e\u043a\u0435\u043d\u043e\u0432, \u043a\u043b\u044e\u0447\u0435\u0439 \u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Truffle Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u0442\u0435\u0447\u0435\u043a \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u043d\u0430 GitHub.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/543000-active-tokens-keys-and-passwords-found-in-github-repositories","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-07T20:54:33+00:00","article:modified_time":"2026-10-07T20:54:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/183679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=183679"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/183679\/revisions"}],"predecessor-version":[{"id":183680,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/183679\/revisions\/183680"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=183679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=183679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=183679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}