GitHub 和 Grafana 安全事件很可能与大规模“迷你沙虫”供应链攻击相关
ChainCatcher 消息，据慢雾发布的威胁情报，近期多个高频 npm 包包括 AntV 和 Echarts-for-react 以及 Python SDK durabletask 遭到 Mini Shai-Hulud “迷你沙虫”供应链攻击。npm 账号 atool 被入侵，攻击者在 22 分钟内自动发布了 637 个恶意版本，涉及 317 个包。攻击者在 35 分钟内连续上传 durabletask 1.4.1、1.4.2 和 1.4.3 版本，绕过正常发布控制并冒充微软官方发布。
GitHub token 大规模泄露事件和 Grafana Labs 遭勒索攻击很可能与此供应链攻击相关。受影响组件包括 npm 生态系统中的 AntV、Echarts-for-react 等高频组件，以及 Python 包 durabletask 1.4.1、1.4.2 和 1.4.3。攻击者可窃取云和本地凭证、未经授权访问内部仓库和敏感云基础设施、横向移动至开发者机器和 CI/CD 管道、销售和利用泄露的 GitHub token、实施勒索和数据泄露威胁。
慢雾建议立即轮换所有暴露的凭证，替换受影响的包，隔离可能受感染的系统，并实施严格依赖审查政策。此前消息，“迷你沙虫”蠕虫近期在开源代码库里完成大面积感染，开发者需注意排查。
Disclaimer: OKX Orbit content is provided for informational purposes only. Learn more
Replies
Related Flash News
A New York court has accepted a case involving "claiming dormant Bitcoin addresses such as Satoshi Nakamoto," valued at $274 billion
BIT: Bitcoin may reach a critical turning point in June
Data: XRP spot ETFs saw a net inflow of $15.2 million last week
Data: SOL spot ETFs saw a net inflow of $2.36 million last week
Wintermute: Expanding institutional trading into prediction markets
Bithumb Listing: [마켓 추가
MiniMax launches MiniMax M3 model (Jinshi Data APP)
Solana has launched the SIMD 547 upgrade draft, aiming to increase the long-term burn allowance of SOL
South Korean retail investors borrowed money to chase the gains, with personal loans seeing the largest increase in five years
Powell issued a warning about the Federal Reserve's independence
