{"id":1103,"date":"2026-04-24T15:16:32","date_gmt":"2026-04-24T08:16:32","guid":{"rendered":"https:\/\/vncybers.vn\/worm-tu-lay-lan-tren-npm-tan-cong-chuoi-cung-ung-danh-cap-token-cua-lap-trinh-vien\/"},"modified":"2026-04-24T15:16:32","modified_gmt":"2026-04-24T08:16:32","slug":"worm-tu-lay-lan-tren-npm-tan-cong-chuoi-cung-ung-danh-cap-token-cua-lap-trinh-vien","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/worm-tu-lay-lan-tren-npm-tan-cong-chuoi-cung-ung-danh-cap-token-cua-lap-trinh-vien\/","title":{"rendered":"Worm t\u1ef1 l\u00e2y lan tr\u00ean npm t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng, \u0111\u00e1nh c\u1eafp token c\u1ee7a l\u1eadp tr\u00ecnh vi\u00ean"},"content":{"rendered":"
\"Worm<\/figure>\n\n\n

C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u b\u1ea3o m\u1eadt v\u1eeba ph\u00e1t \u0111i c\u1ea3nh b\u00e1o v\u1ec1 m\u1ed9t \u0111\u1ee3t t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng m\u1edbi nh\u1eafm v\u00e0o h\u1ec7 sinh th\u00e1i npm. M\u1ed9t lo\u1ea1i m\u00e3 \u0111\u1ed9c d\u1ea1ng worm (s\u00e2u m\u00e1y t\u00ednh) c\u00f3 kh\u1ea3 n\u0103ng t\u1ef1 l\u00e2y lan \u0111ang \u0111\u01b0\u1ee3c ph\u00e1t t\u00e1n th\u00f4ng qua c\u00e1c g\u00f3i th\u01b0 vi\u1ec7n b\u1ecb chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n, v\u1edbi m\u1ee5c ti\u00eau ch\u00ednh l\u00e0 \u0111\u00e1nh c\u1eafp token v\u00e0 th\u00f4ng tin nh\u1ea1y c\u1ea3m c\u1ee7a c\u00e1c l\u1eadp tr\u00ecnh vi\u00ean.<\/p>\n\n

C\u01a1 ch\u1ebf l\u00e2y lan t\u1ef1 \u0111\u1ed9ng qua token b\u1ecb \u0111\u00e1nh c\u1eafp<\/h2>\n\n

Chi\u1ebfn d\u1ecbch n\u00e0y, \u0111\u01b0\u1ee3c c\u00e1c c\u00f4ng ty b\u1ea3o m\u1eadt nh\u01b0 Socket v\u00e0 StepSecurity theo d\u00f5i d\u01b0\u1edbi t\u00ean g\u1ecdi CanisterSprawl, s\u1eed d\u1ee5ng m\u1ed9t k\u1ef9 thu\u1eadt tinh vi \u0111\u1ec3 m\u1edf r\u1ed9ng ph\u1ea1m vi t\u1ea5n c\u00f4ng. M\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c nh\u00fang v\u00e0o c\u00e1c g\u00f3i npm th\u00f4ng qua postinstall<\/code> hook. Ngay khi m\u1ed9t l\u1eadp tr\u00ecnh vi\u00ean c\u00e0i \u0111\u1eb7t g\u00f3i th\u01b0 vi\u1ec7n nhi\u1ec5m \u0111\u1ed9c, m\u00e3 ngu\u1ed3n n\u00e0y s\u1ebd t\u1ef1 \u0111\u1ed9ng th\u1ef1c thi m\u00e0 kh\u00f4ng c\u1ea7n s\u1ef1 can thi\u1ec7p c\u1ee7a ng\u01b0\u1eddi d\u00f9ng.<\/p>\n\n

Sau khi x\u00e2m nh\u1eadp v\u00e0o m\u00f4i tr\u01b0\u1eddng ph\u00e1t tri\u1ec3n, worm s\u1ebd ti\u1ebfn h\u00e0nh l\u1ee5c so\u00e1t c\u00e1c file c\u1ea5u h\u00ecnh nh\u1ea1y c\u1ea3m nh\u01b0 .npmrc<\/code>, SSH keys<\/code>, v\u00e0 c\u00e1c th\u00f4ng tin x\u00e1c th\u1ef1c \u0111\u00e1m m\u00e2y (AWS, Azure, Google Cloud). \u0110i\u1ec1u nguy hi\u1ec3m nh\u1ea5t l\u00e0 n\u1ebfu t\u00ecm th\u1ea5y token npm c\u00f3 quy\u1ec1n ghi, m\u00e3 \u0111\u1ed9c s\u1ebd s\u1eed d\u1ee5ng ch\u00ednh token \u0111\u00f3 \u0111\u1ec3 t\u1ef1 \u0111\u1ed9ng \u0111\u1ea9y c\u00e1c phi\u00ean b\u1ea3n nhi\u1ec5m \u0111\u1ed9c m\u1edbi c\u1ee7a c\u00e1c g\u00f3i th\u01b0 vi\u1ec7n m\u00e0 l\u1eadp tr\u00ecnh vi\u00ean \u0111\u00f3 qu\u1ea3n l\u00fd l\u00ean registry. Qu\u00e1 tr\u00ecnh n\u00e0y t\u1ea1o ra m\u1ed9t v\u00f2ng l\u1eb7p l\u00e2y lan t\u1ef1 \u0111\u1ed9ng, bi\u1ebfn m\u1ed7i n\u1ea1n nh\u00e2n th\u00e0nh m\u1ed9t ngu\u1ed3n ph\u00e1t t\u00e1n m\u00e3 \u0111\u1ed9c m\u1edbi.<\/p>\n\n

C\u00e1c g\u00f3i th\u01b0 vi\u1ec7n b\u1ecb \u1ea3nh h\u01b0\u1edfng<\/h2>\n\n

Danh s\u00e1ch c\u00e1c g\u00f3i npm \u0111\u01b0\u1ee3c x\u00e1c \u0111\u1ecbnh \u0111\u00e3 b\u1ecb ch\u00e8n m\u00e3 \u0111\u1ed9c trong chi\u1ebfn d\u1ecbch n\u00e0y bao g\u1ed3m:<\/p>\n

    \n
  • @automagik\/genie<\/code> (phi\u00ean b\u1ea3n 4.260421.33 \u0111\u1ebfn 4.260421.40)<\/li>\n
  • @fairwords\/loopback-connector-es<\/code> (phi\u00ean b\u1ea3n 1.4.3 \u0111\u1ebfn 1.4.4)<\/li>\n
  • @fairwords\/websocket<\/code> (phi\u00ean b\u1ea3n 1.0.38 \u0111\u1ebfn 1.0.39)<\/li>\n
  • @openwebconcept\/design-tokens<\/code> (phi\u00ean b\u1ea3n 1.0.1 \u0111\u1ebfn 1.0.3)<\/li>\n
  • @openwebconcept\/theme-owc<\/code> (phi\u00ean b\u1ea3n 1.0.1 \u0111\u1ebfn 1.0.3)<\/li>\n
  • pgserve<\/code> (phi\u00ean b\u1ea3n 1.1.11 \u0111\u1ebfn 1.1.14)<\/li>\n<\/ul>\n\n

    M\u1ee5c ti\u00eau \u0111\u00e1nh c\u1eafp th\u00f4ng tin \u0111a d\u1ea1ng<\/h2>\n\n

    Kh\u00f4ng ch\u1ec9 d\u1eebng l\u1ea1i \u1edf token npm, s\u00e2u m\u00e1y t\u00ednh n\u00e0y c\u00f2n \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 thu th\u1eadp m\u1ed9t l\u01b0\u1ee3ng l\u1edbn d\u1eef li\u1ec7u quan tr\u1ecdng t\u1eeb m\u00e1y t\u00ednh c\u1ee7a l\u1eadp tr\u00ecnh vi\u00ean, bao g\u1ed3m:<\/p>\n

      \n
    • C\u1ea5u h\u00ecnh Git v\u00e0 c\u00e1c th\u00f4ng tin \u0111\u0103ng nh\u1eadp \u0111\u01b0\u1ee3c l\u01b0u tr\u1eef.<\/li>\n
    • C\u1ea5u h\u00ecnh Kubernetes, Docker v\u00e0 c\u00e1c file Terraform, Vault.<\/li>\n
    • D\u1eef li\u1ec7u t\u1eeb c\u00e1c tr\u00ecnh duy\u1ec7t web d\u1ef1a tr\u00ean Chromium v\u00e0 c\u00e1c ti\u1ec7n \u00edch v\u00ed ti\u1ec1n \u0111i\u1ec7n t\u1eed.<\/li>\n
    • L\u1ecbch s\u1eed d\u00f2ng l\u1ec7nh (shell history) v\u00e0 c\u00e1c file .env<\/code> ch\u1ee9a bi\u1ebfn m\u00f4i tr\u01b0\u1eddng.<\/li>\n<\/ul>\n\n

      D\u1eef li\u1ec7u \u0111\u00e1nh c\u1eafp \u0111\u01b0\u1ee3c chuy\u1ec3n v\u1ec1 m\u1ed9t c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 ch\u1ed1ng g\u1ee1 b\u1ecf, bao g\u1ed3m c\u00e1c ICP canister tr\u00ean m\u1ea1ng Internet Computer (Internet Computer Protocol). Ngo\u00e0i ra, c\u00e1c chuy\u00ean gia c\u00f2n ph\u00e1t hi\u1ec7n m\u00e3 ngu\u1ed3n n\u00e0y c\u00f3 ch\u1ee9a logic \u0111\u1ec3 l\u00e2y lan sang c\u1ea3 h\u1ec7 sinh th\u00e1i Python (PyPI), cho th\u1ea5y tham v\u1ecdng t\u1ea5n c\u00f4ng \u0111a n\u1ec1n t\u1ea3ng c\u1ee7a k\u1ebb \u0111\u1ee9ng sau.<\/p>\n\n

      Khuy\u1ebfn ngh\u1ecb cho l\u1eadp tr\u00ecnh vi\u00ean<\/h2>\n\n

      V\u1ee5 vi\u1ec7c n\u00e0y m\u1ed9t l\u1ea7n n\u1eefa cho th\u1ea5y r\u1ee7i ro t\u1eeb chu\u1ed7i cung \u1ee9ng ph\u1ea7n m\u1ec1m \u0111ang ng\u00e0y c\u00e0ng tr\u1edf n\u00ean nghi\u00eam tr\u1ecdng v\u00e0 tinh vi h\u01a1n. \u0110\u1ec3 b\u1ea3o v\u1ec7 m\u00f4i tr\u01b0\u1eddng l\u00e0m vi\u1ec7c, c\u00e1c l\u1eadp tr\u00ecnh vi\u00ean v\u00e0 t\u1ed5 ch\u1ee9c c\u1ea7n:<\/p>\n

        \n
      • Ki\u1ec3m tra l\u1ea1i l\u1ecbch s\u1eed c\u00e0i \u0111\u1eb7t v\u00e0 c\u00e1c phi\u00ean b\u1ea3n g\u00f3i th\u01b0 vi\u1ec7n \u0111ang s\u1eed d\u1ee5ng, \u0111\u1eb7c bi\u1ec7t l\u00e0 c\u00e1c g\u00f3i trong danh s\u00e1ch n\u00eau tr\u00ean.<\/li>\n
      • S\u1eed d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 qu\u00e9t ph\u1ee5 thu\u1ed9c (dependency scanning) \u0111\u1ec3 ph\u00e1t hi\u1ec7n s\u1edbm c\u00e1c d\u1ea5u hi\u1ec7u b\u1ea5t th\u01b0\u1eddng.<\/li>\n
      • H\u1ea1n ch\u1ebf quy\u1ec1n h\u1ea1n c\u1ee7a c\u00e1c token npm, ch\u1ec9 c\u1ea5p quy\u1ec1n publish khi th\u1ef1c s\u1ef1 c\u1ea7n thi\u1ebft v\u00e0 s\u1eed d\u1ee5ng x\u00e1c th\u1ef1c hai l\u1edbp (2FA).<\/li>\n
      • Th\u01b0\u1eddng xuy\u00ean l\u00e0m s\u1ea1ch c\u00e1c th\u00f4ng tin \u0111\u0103ng nh\u1eadp v\u00e0 token c\u0169 kh\u00f4ng c\u00f2n s\u1eed d\u1ee5ng trong m\u00f4i tr\u01b0\u1eddng local.<\/li>\n<\/ul>\n\n

         <\/p>\n

        VNCyberS t\u1ed5ng h\u1ee3p t\u1eeb: The Hacker News, Socket Dev, StepSecurity<\/em><\/p>","protected":false},"excerpt":{"rendered":"

        C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u b\u1ea3o m\u1eadt v\u1eeba ph\u00e1t \u0111i c\u1ea3nh b\u00e1o v\u1ec1 m\u1ed9t \u0111\u1ee3t t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng m\u1edbi nh\u1eafm v\u00e0o h\u1ec7 sinh th\u00e1i npm. M\u1ed9t lo\u1ea1i m\u00e3 \u0111\u1ed9c d\u1ea1ng worm (s\u00e2u m\u00e1y t\u00ednh) c\u00f3 kh\u1ea3 n\u0103ng t\u1ef1 l\u00e2y lan \u0111ang \u0111\u01b0\u1ee3c ph\u00e1t t\u00e1n th\u00f4ng qua c\u00e1c g\u00f3i th\u01b0 vi\u1ec7n b\u1ecb chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u […]<\/p>\n","protected":false},"author":2,"featured_media":1102,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[110,108,109,15,107],"class_list":["post-1103","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-bao-mat-web","tag-chuoi-cung-ung","tag-lap-trinh-vien","tag-ma-doc","tag-npm"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1103","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1103"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1103\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1102"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1103"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1103"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}