答案已發布2 週前Last edited 5 天前21 來源

Red Hat遭Miasma蠕蟲攻擊：一個被盜GitHub帳戶如何污染32個npm套件

2026年6月1日，一款名為「Miasma」嘅憑證竊取蠕蟲被發現存在於32個Red Hat官方npm套件中，每週下載量約117,000次；攻擊源於一個被盜嘅員工GitHub帳戶 [5][7][12]。呢個能夠自動傳播嘅惡意軟件係Mini Shai Hulud蠕蟲嘅變種，會喺安裝時自動執行，竊取雲端憑證、GitHub Actions secrets、SSH密鑰同其他敏感資料 [2][5][10][12]。

使用 Studio Global AI 搜尋並查核事實瀏覽更多熱門頁面

915K0

Abstract representation of a supply chain attack on Red Hat npm packages showing a digital worm spreading through code repositories. — What was the Miasma supply chain attack against Red Hat npm packages on June 1, 2026 — including how the compromise occurred via a Red Hat eThe Miasma worm used a compromised Red Hat employee account to inject malicious code into the official npm supply chain.
AI 提示
Create a landscape editorial hero image for this Studio Global article: What was the Miasma supply chain attack against Red Hat npm packages on June 1, 2026 — including how the compromise occurred via a Red Hat e. Article summary: Here is a complete breakdown of the Miasma supply chain attack, confirmed by multiple security vendors and Red Hat's own advisory.. Topic tags: general, general web. Reference image context from search candidates: Reference image 1: visual subject "# Red Hat npm packages compromised in new Mini Shai-Hulud malware wave. Unknown attackers have compromised 30+ Red Hat Cloud Services npm packages with malware that goes after cred" source context "Red Hat npm packages compromised in new Mini Shai-Hulud malware wave - Help Net Security" Reference image 2: visual subject "# Miasma: Supply Chain Attack Targeting RedHat npm Packages. Detect and mitigate malicious npm pa
openai.com

2026年6月1日朝早，一班安全研究員響起咗警號，揭露咗一場精心策劃、靜悄悄滲透咗JavaScript生態系統嘅軟件供應鏈攻擊。呢場被命名為**「Miasma: The Spreading Blight」（擴散嘅枯萎病）**嘅行動，喺Red Hat旗下@redhat-cloud-services命名空間內嘅32個官方npm套件中，植入咗一隻會竊取憑證、兼且能夠自我複製嘅蠕蟲病毒。總共有96個惡意套件版本被確認，每週合共下載量約為117,000次。呢次攻擊係一個沉重嘅警示，提醒我哋只要一個開發者帳戶被盜，就可以引發災難性嘅信任崩塌。

黑客係點樣攞到權限嘅？

成條攻擊鏈嘅起點，並唔係乜嘢前所未見嘅零日漏洞，而係一次經典嘅身份盜用。黑客成功控制咗一個合法嘅Red Hat員工GitHub帳戶。就係呢個單一嘅弱點，為佢哋打開咗通往成條受信任發佈管道嘅大門，因為呢個帳戶對Red Hat GitHub組織入面三個關鍵嘅程式碼庫（Repository）擁有寫入權限。

Studio Global AI

Search, cite, and publish your own answer

Use this topic as a starting point for a fresh source-backed answer, then compare citations before you share it.

使用 Studio Global AI 搜尋並查核事實

人們還問