Axios 库遭供应链攻击,黑客窃取 npm 令牌植入木马,波及约 80% 云环境

GateNews

Gate News 消息,4 月 2 日,JavaScript 最流行 HTTP 客户端库 Axios 遭供应链攻击。攻击者窃取了 Axios 首席维护者的 npm 访问令牌,利用该令牌发布了两个包含跨平台远程访问木马(RAT)的恶意版本(axios@1.14.1 和 axios@0.30.4),目标覆盖 macOS、Windows 及 Linux 系统。恶意包在 npm 注册表上存活约 3 小时后被移除。据安全公司 Wiz 数据,Axios 每周下载量超 1 亿次,存在于约 80% 的云和代码环境中。安全公司 Huntress 在恶意包上线 89 秒后即检测到首批感染,并在暴露窗口期内确认至少 135 个系统遭到入侵。值得注意的是,Axios 项目此前已部署了 OIDC 可信发布机制和 SLSA 溯源证明等现代安全措施,但攻击者完全绕过了这些防线。调查发现,项目在配置 OIDC 的同时仍保留了传统长期有效的 NPM_TOKEN,而 npm 在两者共存时默认优先使用传统令牌,使得攻击者无需突破 OIDC 即可完成发布。

Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to Disclaimer.
Opmerking
0/400
Geen opmerkingen