Хакеры запустили новый вирус для экосистемы JavaScript

cryptonews.ruPublished on 2025-09-21Last updated on 2025-09-21

В ключевые библиотеки JavaScript внедряется новый вид вируса-червя, уже заразившего более чем 500 NPM-пакетов, заявили эксперты по кибербезопасности компании Truesec.

Первую серьезную атаку на NPM — реестр пакетов для программного обеспечения на JavaScript — хакеры предприняли в начале сентября. Несколько дней назад они начали новую атаку. Скоординированная кампания по внедрению червя под названием Shai-Hulud началась с компрометации NPM-пакета @ctrl/tinycolor, который еженедельно скачивают более 2 млн раз, рассказали специалисты Truesec.

По их словам, атака продолжается, масштабируется и становится все более изощренной. Хотя злоумышленники используют множество старых приемов, они значительно усовершенствовали подход, превратив вирус в полностью автономную программу. Вредоносное ПО выполняет три действия:

  • собирает конфиденциальную информацию о разработчиках и раскрывает ее на GitHub;

  • компрометирует GitHub-репозитории;

  • ищет адреса кошельков, содержащих криптовалюты.

Вместо того, чтобы сосредоточиться на паре зараженных объектов, новая атака автоматически распространяется на все NPM-пакеты экосистемы JavaScript, сообщили эксперты Truesec.

Ранее представители специализирующейся на вопросах кибербезопасности компании Security Alliance заявили, что сумма ущерба от первой попытки взлома главных библиотек экосистемы JavaScript составила всего $50 в эфире и мемкоинах.

Related Reads

‘We’re trying to defend Bitcoin’: Why BIP-110 is losing community support

Blockstream CEO Adam Back argues that Bitcoin Improvement Proposal 110 (BIP-110), a contentious soft fork, is misguided. He contends discussions are fueled by misconceptions about Bitcoin's architecture, not malicious intent, and that the proposal's proponents are often well-intentioned newcomers. BIP-110, implemented in December 2025, aims to restrict arbitrary data like Ordinals inscriptions to prevent network spam and preserve Bitcoin's primary function as peer-to-peer cash. Back acknowledges spam is an issue but believes Bitcoin's existing market-driven mechanisms—transaction fees, miner incentives, and decentralized consensus—already address it. He argues BIP-110 clashes with Bitcoin's permissionless ethos and that a fork based on it would likely fail due to a lack of community support and because it contradicts Bitcoin's foundational principles. Market dynamics show limited support for the proposal, with only 10 out of 2,016 blocks backing a temporary upgrade on July 4th. Concurrently, Ordinals activity has dropped to all-time lows, with fewer than 10,000 inscriptions daily. Bitcoin's price has also fallen 45% over the past year. Michael Saylor echoes Back's critical stance on BIP-110.

ambcrypto1h ago

‘We’re trying to defend Bitcoin’: Why BIP-110 is losing community support

ambcrypto1h ago

Inside Bonzo Lend’s $9M exploit – Why secure smart contracts couldn’t stop it

Bonzo Lend, a lending protocol on the Hedera network, suffered a $9.05 million exploit due to a flaw in the external Supra oracle system. The attacker manipulated SAUCE token price feeds, enabling them to borrow assets far exceeding their collateral. Audits confirmed the protocol's own smart contracts and the Hedera core network were secure; the failure originated in the trusted oracle infrastructure. This incident highlights a recurring DeFi risk where correct protocol logic can still be weaponized via compromised external data. The attack impacted market sentiment, causing a drop in HBAR's price and Hedera's DeFi TVL, underscoring the need for stronger oracle safeguards and verification standards.

ambcrypto3h ago

Inside Bonzo Lend’s $9M exploit – Why secure smart contracts couldn’t stop it

ambcrypto3h ago

Ethereum vs. Bitcoin: Is ETH’s 5% Q3 rally the start of a structural rotation?

The article examines whether Ethereum's (ETH) recent 5% Q3 rally against Bitcoin (BTC) signals a lasting capital rotation or is merely another short-term move. Historically, ETH has struggled to sustain outperformance; a strong 2025 Q3 rally was largely reversed, suggesting temporary rotations as capital flowed back to Bitcoin. Currently, Bitcoin dominance is testing a key resistance level, hinting at a possible shift back toward BTC. However, on-chain and institutional data present a counter-narrative. Ethereum ETFs have attracted significant net inflows this month, outperforming Bitcoin ETFs. A key catalyst is Robinhood's new Layer 2 network, which uses ETH for gas and settlement. Data shows a nearly 10x weekly surge in ETH bridged to this chain, indicating growing ecosystem activity and ETH demand. While it's premature to confirm a structural shift, the rally appears increasingly supported by fundamentals—including institutional inflows, rising Layer 2 adoption, and stronger on-chain metrics—rather than just market rotation. If these trends persist, the current ETH/BTC breakout could signal the beginning of a broader capital move into Ethereum during Q3.

ambcrypto5h ago

Ethereum vs. Bitcoin: Is ETH’s 5% Q3 rally the start of a structural rotation?

ambcrypto5h ago

Apple Sues OpenAI Sparking Feud, Musk Slams Altman for Fraud, Altman Retorts with 'Space Data Center' Boast

Apple Sues OpenAI as Musk-Altman Feud Escalates The public feud between Elon Musk and OpenAI CEO Sam Altman intensified, coinciding with their respective AI companies launching flagship models in the same week, highlighting fierce competition. On July 11, Musk posted on X, accusing Altman of taking "fraud to the next level" regarding OpenAI's commercial practices. Altman fired back, sarcastically suggesting Musk was the one selling "short-term space datacenter" concepts to public market investors. Musk countered with allegations that Altman "stole an open-source AI charity" and, amid Apple's recent lawsuit, "stole all of Apple's phone tech." He mockingly referenced Altman needing a "parole officer's" approval to travel. This exchange occurred against the backdrop of a significant legal development: Apple filed a lawsuit against OpenAI in a California federal court, alleging the AI company deliberately solicited Apple employees to leak confidential information on unreleased products to aid its own hardware plans. Apple demands OpenAI cease this activity, destroy proprietary materials, and redesign upcoming products. OpenAI responded, stating it has no interest in other companies' trade secrets and remains focused on innovation. This lawsuit could profoundly impact their two-year partnership where OpenAI provides key tech for Apple Intelligence and Siri. The rivalry extended to product releases. OpenAI launched GPT-5.6, while Musk's SpaceXAI unveiled Grok 4.5. Both are positioned as AI agents capable of multi-step tasks. GPT-5.6 is noted for strengths in broad reasoning, business workflows, and cybersecurity. Grok 4.5 is highlighted for higher efficiency in autonomous programming and developer workflows, with lower usage costs than GPT-5.6, though OpenAI's model reportedly still leads in areas like abstract reasoning. The differing strengths offer distinct choices for enterprises and developers based on their specific needs.

marsbit5h ago

Apple Sues OpenAI Sparking Feud, Musk Slams Altman for Fraud, Altman Retorts with 'Space Data Center' Boast

marsbit5h ago

Robinhood Chain's Success Proves Ethereum Is Not Dead

Robinhood Chain's success demonstrates that the L1+L2 model is the preferred infrastructure for real-world, cash-flow-focused businesses entering the crypto space. Historically, many crypto projects were built around token monetization. In contrast, companies like Robinhood and Coinbase (with Base) choose to build their businesses using Ethereum's established foundation. They leverage the decentralized security, liquidity, and neutrality of Ethereum L1 while creating custom, high-performance, and controlled environments on Ethereum L2s (like Arbitrum). This separation allows for business-specific customization without the massive overhead of launching and securing an independent L1. Their decision to use ETH for gas and to integrate deeply with Ethereum's ecosystem is a rational business choice aimed at minimizing risk and maximizing product viability, not ideological support. As more traditional entities build cash-generating services on-chain, this model will solidify Ethereum's position as the core settlement and security layer for the growing on-chain economy, benefiting ETH's network effects and monetary premium.

marsbit5h ago

Robinhood Chain's Success Proves Ethereum Is Not Dead

marsbit5h ago

Trading

Spot
活动图片