GitHub har publicerat resultaten fr\u00e5n en analys av en attack d\u00e4r angripare den 12 april fick tillg\u00e5ng till molnmilj\u00f6er inom Amazon AWS som anv\u00e4nds i infrastrukturen f\u00f6r NPM-projektet. Analysen av h\u00e4ndelsen visade att angriparna fick tillg\u00e5ng till s\u00e4kerhetskopior av v\u00e4rden skimdb.npmjs.com, inklusive en s\u00e4kerhetskopia av databasen med anv\u00e4ndardata f\u00f6r cirka 100 000 NPM-anv\u00e4ndare fr\u00e5n 2015, vilket inkluderar hashade l\u00f6senord, namn och e-postadresser. <\/p>\n
De hashade l\u00f6senorden genererades med hj\u00e4lp av algoritmerna PBKDF2 eller SHA1 med salt, som 2017 ersattes med det mer motst\u00e5ndskraftiga bcrypt. Efter att h\u00e4ndelsen uppt\u00e4cktes har de p\u00e5verkade l\u00f6senorden \u00e5terst\u00e4llts, och anv\u00e4ndarna har f\u00e5tt meddelande om att de m\u00e5ste s\u00e4tta ett nytt l\u00f6senord. Eftersom obligatorisk tv\u00e5faktorsautentisering med e-postbekr\u00e4ftelse har inf\u00f6rts i NPM fr\u00e5n och med den 1 mars bed\u00f6ms risken f\u00f6r anv\u00e4ndarkompromiss som obetydlig. <\/p>\n
Dessutom kom angriparna \u00f6ver alla manifestfiler och metadata f\u00f6r privata paket senast i april 2021, CSV-filer med en aktuell lista \u00f6ver alla namn och versioner av privata paket, samt inneh\u00e5llet i alla privata paket fr\u00e5n tv\u00e5 GitHub-kunder (namnen avsl\u00f6jas inte). N\u00e4r det g\u00e4ller sj\u00e4lva arkivet visade analys av sp\u00e5r och verifiering av hashade paket att inga \u00e4ndringar gjorts av angriparna i NPM-paket och inga falska nya versioner publicerades. <\/p>\n
Attacken utf\u00f6rdes den 12 april med stulna OAuth-token som genererades f\u00f6r tv\u00e5 tredjeparts GitHub-integratorer \u2014 Heroku och Travis-CI. Genom att utnyttja dessa token kunde angriparna extrahera nyckeln f\u00f6r att f\u00e5 tillg\u00e5ng till Amazon Web Services API fr\u00e5n privata GitHub-repositorier, vilket anv\u00e4ndes i infrastrukturen f\u00f6r projektet NPM. Den erh\u00e5llna nyckeln gjorde det m\u00f6jligt att komma \u00e5t data som lagrades p\u00e5 AWS S3-tj\u00e4nsten. <\/p>\n
Ytterligare uppgifter har avsl\u00f6jats om tidigare identifierade allvarliga integritetsproblem vid hanteringen av anv\u00e4ndardata. servrar<\/a> NPM \u2014 i de interna loggarna sparades vissa anv\u00e4ndares l\u00f6senord och NPM-\u00e5tkomsttoken i klartext. Under integrationen av NPM med logghanteringssystemet GitHub missade utvecklarna att ta bort konfidentiell information fr\u00e5n loggade f\u00f6rfr\u00e5gningar till NPM-tj\u00e4nsterna. Det p\u00e5st\u00e5s att denna brist \u00e5tg\u00e4rdades och att loggarna rensades innan attacken mot NPM. Endast vissa anst\u00e4llda p\u00e5 GitHub hade tillg\u00e5ng till loggarna som inneh\u00f6ll \u00f6ppna l\u00f6senord. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0442\u0430\u043a\u0438, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 12 \u0430\u043f\u0440\u0435\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u043c \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Amazon AWS, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u043c \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 NPM. \u0410\u043d\u0430\u043b\u0438\u0437 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u044b\u043c \u043a\u043e\u043f\u0438\u044f\u043c \u0445\u043e\u0441\u0442\u0430 skimdb.npmjs.com \u0438 \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043a \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0439 \u043a\u043e\u043f\u0438\u0438 \u0411\u0414 \u0441 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 100 \u0442\u044b\u0441\u044f\u0447 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 NPM \u043f\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104172","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub avsl\u00f6jade uppgifter om intr\u00e5nget i NPM:s infrastruktur och att \u00f6ppna l\u00f6senord uppt\u00e4cktes i loggar | ProHoster","description":"GitHub har offentliggjort resultaten av sin utredning av en attack d\u00e4r angripare den 12 april fick tillg\u00e5ng till de molnbaserade milj\u00f6erna i Amazon AWS, som anv\u00e4nds i NPM-projektets infrastruktur.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/github-raskryl-dannye-o-vzlome-infrastruktury-npm-i-vyyavlenii-otkrytyh-parolej-v-logah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b NPM \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0432 \u043b\u043e\u0433\u0430\u0445 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0442\u0430\u043a\u0438, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 12 \u0430\u043f\u0440\u0435\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u043c \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Amazon AWS, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u043c \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 NPM.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/github-raskryl-dannye-o-vzlome-infrastruktury-npm-i-vyyavlenii-otkrytyh-parolej-v-logah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-05-27T19:36:38+00:00","article:modified_time":"2022-05-27T19:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104172","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-25 11:20:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-05-27 19:36:53","updated":"2026-01-25 11:20:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/104172","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=104172"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/104172\/revisions"}],"predecessor-version":[{"id":164417,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/104172\/revisions\/164417"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=104172"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=104172"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=104172"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"