{"id":143668,"date":"2025-09-17T11:11:56","date_gmt":"2025-09-17T09:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/samorasprostranyayushhijsya-cherv-porazil-187-paketov-v-npm"},"modified":"2026-02-08T21:43:52","modified_gmt":"2026-02-08T19:43:52","slug":"samorasprostranyayushhijsya-cherv-porazil-187-paketov-v-npm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/samorasprostranyayushhijsya-cherv-porazil-187-paketov-v-npm","title":{"rendered":"Ett sj\u00e4lvf\u00f6r\u00f6jande mjukvaruorm har infekterat 187 paket i NPM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Attacken p\u00e5 paket som transporteras via NPM-repo har n\u00e5tt en ny niv\u00e5. Ut\u00f6ver att anv\u00e4nda skadlig programvara f\u00f6r att f\u00e5nga betalningar och konfidentiell information har angriparna g\u00e5tt \u00f6ver till att infoga en orm i komprometterade paket f\u00f6r att automatiskt infoga skadlig programvara i beroenden. Anv\u00e4ndningen av ormen har dokumenterats efter komprometteringen av NPM-paketet @ctrl\/tinycolor, som har 2,2 miljoner veckoladda nedladdningar och anv\u00e4nds som ett direkt beroende i 964 paket. Som ett resultat av ormaktiviteten omfattade attacken 187 paket f\u00f6r vilka skadliga versioner skapades (477 skadliga utg\u00e5vor). <\/p>\n

I en ny attack, efter att ha f\u00e5tt accessuppgifterna f\u00f6r en v\u00e4rd genom phishing, publicerar angriparna en version av paketet med ormen, som aktiveras n\u00e4r det komprometterade paketet installeras som ett av beroendena. N\u00e4r ormen aktiveras s\u00f6ker den efter autentiseringsuppgifter i den aktuella milj\u00f6n, laddar ner och k\u00f6r verktyget TruffleHog. Om en NPM-kontotoken uppt\u00e4ckts publicerar ormen automatiskt en ny skadlig version och infekterar d\u00e4rigenom beroendetr\u00e4det. F\u00f6rutom NPM-token, sparar ormen ocks\u00e5 \u00e5tkomstnycklar till GitHub och molntj\u00e4nster som AWS, Azure och GCP (Google Cloud Platform), samt andra konfidentiella uppgifter som TruffleHog-skannern kan uppt\u00e4cka. <\/p>\n

Skadliga versioner skapas f\u00f6r de 20 mest popul\u00e4ra paketen som den trov\u00e4rdiga NPM-token har tillg\u00e5ng till. Funktionaliteten f\u00f6r att publicera versioner \u00e4r implementerad i form av funktionen NpmModule.updatePackage, som laddar ner paketets ursprungsarkiv, \u00e4ndrar versionsnumret och l\u00e4gger till en postinstall-hook i filen package.json, infogar en hanterare i bundle.js, packar om paketet och publicerar det. St\u00f6dja drift i Linux och macOS. <\/p>\n

Masken har f\u00e5tt kodnamnet Shai-Hulud (en gigantisk mask som n\u00e4mns i romanen Dune). De uppt\u00e4ckta autentiseringsuppgifterna lagras p\u00e5 GitHub genom att skapa repositories med namnet Shai-Hulud (till exempel «B611\/Shai-Hulud»), och dessa visas \u00e4ven i kodad form i loggarna f\u00f6r GitHub Actions. I det skapade repositoryt finns en fil som heter data.json, d\u00e4r det finns en str\u00e4ng med kodad information om systemet, milj\u00f6variabler och avlyssnade \u00e5tkomstnycklar med hj\u00e4lp av base64-metoden. I CI som \u00e4r baserat p\u00e5 GitHub skapar masken en GitHub Actions-handler (.github\/workflows\/shai-hulud-workflow.yml) f\u00f6r att \u00f6verf\u00f6ra information till en extern v\u00e4rd. Tydligen \u00e4r attacken inte begr\u00e4nsad till de n\u00e4mnda 187 paketen, eftersom nya repositories med namnet Shai-Hulud och filen data.json forts\u00e4tter att dyka upp p\u00e5 GitHub.

\"Ett<\/center> <\/p>\n

Bland annat drabbades 25 paket fr\u00e5n f\u00f6retaget CrowdStrike, som utvecklar verktyg f\u00f6r att skydda mot attacker<\/a> genom beroenden (Supply Chain). Enligt uttalande fr\u00e5n CrowdStrike har de komprometterade paketen inte anv\u00e4nts p\u00e5 plattformen Falcon och attacken har inte spridit sig till kunder. Det har ocks\u00e5 framkommit att den tidigare v\u00e5gen av publicering av skadliga versioner p\u00e5 NPM, som genomf\u00f6rdes utan masken, p\u00e5verkade projektet gemini-cli som utvecklas av Google.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u043f\u0435\u0440\u0435\u0448\u043b\u0430 \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c. \u0412 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \u0438 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u0435\u0440\u0435\u0448\u043b\u0438 \u043a \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044e \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0447\u0435\u0440\u0432\u044f \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438. \u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0447\u0435\u0440\u0432\u044f \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043f\u043e\u0441\u043b\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 NPM-\u043f\u0430\u043a\u0435\u0442\u0430 @ctrl\/tinycolor, \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e 2.2 \u043c\u043b\u043d \u0435\u0436\u0435\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0438 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u044f\u043c\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":143669,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-143668","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Masken som sj\u00e4lv sprider sig har drabbat 187 paket i NPM | ProHoster","description":"Attacken mot de f\u00f6ljande paketen i NPM-repository har n\u00e5tt en ny niv\u00e5.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/samorasprostranyayushhijsya-cherv-porazil-187-paketov-v-npm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0430\u043c\u043e\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0447\u0435\u0440\u0432\u044c \u043f\u043e\u0440\u0430\u0437\u0438\u043b 187 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 NPM | ProHoster","og:description":"\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u043f\u0435\u0440\u0435\u0448\u043b\u0430 \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/samorasprostranyayushhijsya-cherv-porazil-187-paketov-v-npm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-09-17T09:11:57+00:00","article:modified_time":"2026-02-08T19:43:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"143668","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 19:43:52","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:50:19","updated":"2026-02-08 19:43:52","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/143668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=143668"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/143668\/revisions"}],"predecessor-version":[{"id":157614,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/143668\/revisions\/157614"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/143669"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=143668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=143668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=143668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}