{"id":1540,"date":"2026-06-02T07:16:38","date_gmt":"2026-06-02T00:16:38","guid":{"rendered":"https:\/\/vncybers.vn\/miasma-ma-doc-tu-nhan-ban-tan-cong-chuoi-cung-ung-npm-cua-red-hat\/"},"modified":"2026-06-02T07:16:38","modified_gmt":"2026-06-02T00:16:38","slug":"miasma-ma-doc-tu-nhan-ban-tan-cong-chuoi-cung-ung-npm-cua-red-hat","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/miasma-ma-doc-tu-nhan-ban-tan-cong-chuoi-cung-ung-npm-cua-red-hat\/","title":{"rendered":"Miasma: M\u00e3 \u0111\u1ed9c t\u1ef1 nh\u00e2n b\u1ea3n t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng npm c\u1ee7a Red Hat"},"content":{"rendered":"

Chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng ph\u1ea7n m\u1ec1m mang t\u00ean Miasma<\/strong> v\u1eeba b\u1ecb ph\u00e1t hi\u1ec7n nh\u1eafm v\u00e0o c\u00e1c g\u00f3i th\u01b0 vi\u1ec7n (package) npm ch\u00ednh th\u1ee9c c\u1ee7a Red Hat Cloud Services. \u0110\u00e2y l\u00e0 m\u1ed9t bi\u1ebfn th\u1ec3 m\u1edbi c\u1ee7a d\u00f2ng m\u00e3 \u0111\u1ed9c Mini Shai-Hulud<\/strong>, \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 \u0111\u00e1nh c\u1eafp th\u00f4ng tin \u0111\u0103ng nh\u1eadp t\u1eeb m\u00e1y t\u00ednh c\u1ee7a c\u00e1c nh\u00e0 ph\u00e1t tri\u1ec3n v\u00e0 t\u1ef1 \u0111\u1ed9ng l\u00e2y lan qua h\u1ec7 th\u1ed1ng CI\/CD.<\/p>\n

Theo b\u00e1o c\u00e1o t\u1eeb c\u00e1c h\u00e3ng b\u1ea3o m\u1eadt nh\u01b0 Wiz, Socket v\u00e0 The Hacker News, \u00edt nh\u1ea5t 32 g\u00f3i th\u01b0 vi\u1ec7n d\u01b0\u1edbi namespace @redhat-cloud-services<\/code> \u0111\u00e3 b\u1ecb ch\u00e8n m\u00e3 \u0111\u1ed9c. V\u1ee5 vi\u1ec7c \u0111\u01b0\u1ee3c cho l\u00e0 b\u1eaft ngu\u1ed3n t\u1eeb vi\u1ec7c m\u1ed9t t\u00e0i kho\u1ea3n GitHub c\u1ee7a nh\u00e2n vi\u00ean Red Hat b\u1ecb chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n, cho ph\u00e9p tin t\u1eb7c th\u1ef1c hi\u1ec7n c\u00e1c “orphan commit” tr\u00e1i ph\u00e9p m\u00e0 kh\u00f4ng qua quy tr\u00ecnh ki\u1ec3m tra m\u00e3 ngu\u1ed3n.<\/p>\n

\"Miasma
Namespace @redhat-cloud-services tr\u00ean npm b\u1ecb t\u1ea5n c\u00f4ng b\u1edfi m\u00e3 \u0111\u1ed9c Miasma.<\/figcaption><\/figure>\n

C\u01a1 ch\u1ebf ho\u1ea1t \u0111\u1ed9ng c\u1ee7a Miasma<\/h2>\n

M\u00e3 \u0111\u1ed9c Miasma s\u1eed d\u1ee5ng m\u1ed9t “preinstall hook” b\u1ecb che gi\u1ea5u trong c\u00e1c t\u1ec7p tin c\u1ea5u h\u00ecnh c\u1ee7a g\u00f3i npm. Ngay khi nh\u00e0 ph\u00e1t tri\u1ec3n ch\u1ea1y l\u1ec7nh npm install<\/code>, m\u00e3 \u0111\u1ed9c s\u1ebd \u0111\u01b0\u1ee3c th\u1ef1c thi v\u00e0 b\u1eaft \u0111\u1ea7u qu\u00e1 tr\u00ecnh thu th\u1eadp d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m tr\u00ean m\u00e1y ch\u1ee7 build ho\u1eb7c m\u00e1y tr\u1ea1m.<\/p>\n

D\u1eef li\u1ec7u m\u1ee5c ti\u00eau bao g\u1ed3m:<\/p>\n

    \n
  • Secret c\u1ee7a GitHub Actions v\u00e0 m\u00e3 th\u00f4ng b\u00e1o (token) npm.<\/li>\n
  • Th\u00f4ng tin \u0111\u0103ng nh\u1eadp d\u1ecbch v\u1ee5 \u0111\u00e1m m\u00e2y (AWS, GCP, Azure).<\/li>\n
  • Ch\u1ee9ng ch\u1ec9 Kubernetes, t\u00e0i li\u1ec7u Vault v\u00e0 kh\u00f3a SSH.<\/li>\n
  • Th\u00f4ng tin \u0111\u0103ng nh\u1eadp Git v\u00e0 c\u00e1c t\u1ec7p c\u1ea5u h\u00ecnh nh\u1ea1y c\u1ea3m kh\u00e1c.<\/li>\n<\/ul>\n

    \u0110i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd trong bi\u1ebfn th\u1ec3 n\u00e0y l\u00e0 kh\u1ea3 n\u0103ng t\u1eadp trung m\u1ea1nh m\u1ebd v\u00e0o danh t\u00ednh \u0111\u00e1m m\u00e2y. Miasma kh\u00f4ng ch\u1ec9 l\u1ea5y c\u1eafp secret m\u00e0 c\u00f2n thu th\u1eadp to\u00e0n b\u1ed9 danh t\u00ednh m\u00e0 m\u00e1y b\u1ecb nhi\u1ec5m c\u00f3 quy\u1ec1n truy c\u1eadp, cho th\u1ea5y m\u1ee5c ti\u00eau xa h\u01a1n c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng l\u00e0 chi\u1ebfm quy\u1ec1n ki\u1ec3m so\u00e1t tr\u1ef1c ti\u1ebfp h\u1ea1 t\u1ea7ng cloud c\u1ee7a doanh nghi\u1ec7p.<\/p>\n

    T\u1ef1 l\u00e2y lan v\u00e0 \u1ea9n m\u00ecnh tinh vi<\/h2>\n

    Miasma \u0111\u01b0\u1ee3c m\u00f4 t\u1ea3 nh\u01b0 m\u1ed9t lo\u1ea1i “s\u00e2u” (worm) tr\u00ean h\u1ec7 th\u1ed1ng CI\/CD. Khi x\u00e2m nh\u1eadp v\u00e0o m\u1ed9t repository GitHub, n\u00f3 s\u1ebd li\u1ec7t k\u00ea c\u00e1c kho m\u00e3 ngu\u1ed3n m\u00e0 token \u0111\u00e1nh c\u1eafp \u0111\u01b0\u1ee3c c\u00f3 quy\u1ec1n ghi, sau \u0111\u00f3 t\u1ef1 \u0111\u1ed9ng ch\u00e8n c\u00e1c workflow \u0111\u1ed9c h\u1ea1i th\u00f4ng qua API c\u1ee7a GitHub. C\u00e1c commit n\u00e0y \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n b\u1eb1ng mutation createCommitOnBranch<\/code>, khi\u1ebfn ch\u00fang xu\u1ea5t hi\u1ec7n d\u01b0\u1edbi d\u1ea1ng c\u00e1c thay \u0111\u1ed5i \u0111\u00e3 \u0111\u01b0\u1ee3c x\u00e1c th\u1ef1c v\u00e0 k\u00fd s\u1ed1, r\u1ea5t kh\u00f3 \u0111\u1ec3 ph\u00e1t hi\u1ec7n b\u1eb1ng m\u1eaft th\u01b0\u1eddng.<\/p>\n

    \"Miasma
    Danh s\u00e1ch m\u1ed9t s\u1ed1 g\u00f3i npm c\u1ee7a Red Hat b\u1ecb \u1ea3nh h\u01b0\u1edfng b\u1edfi chi\u1ebfn d\u1ecbch Miasma.<\/figcaption><\/figure>\n

    M\u00e3 \u0111\u1ed9c c\u00f2n thi\u1ebft l\u1eadp s\u1ef1 ki\u00ean tr\u00ec (persistence) b\u1eb1ng c\u00e1ch:<\/p>\n

      \n
    • Ti\u00eam hook v\u00e0o c\u00e0i \u0111\u1eb7t c\u1ee7a c\u00e1c c\u00f4ng c\u1ee5 h\u1ed7 tr\u1ee3 l\u1eadp tr\u00ecnh nh\u01b0 Anthropic Claude Code.<\/li>\n
    • Ch\u00e8n c\u00e1c t\u00e1c v\u1ee5 t\u1ef1 \u0111\u1ed9ng ch\u1ea1y khi m\u1edf th\u01b0 m\u1ee5c d\u1ef1 \u00e1n trong Microsoft Visual Studio Code (tasks.json<\/code>).<\/li>\n
    • Tr\u00e1nh th\u1ef1c thi tr\u00ean c\u00e1c h\u1ec7 th\u1ed1ng s\u1eed d\u1ee5ng ng\u00f4n ng\u1eef ti\u1ebfng Nga \u0111\u1ec3 h\u1ea1n ch\u1ebf b\u1ecb c\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u t\u1ea1i khu v\u1ef1c n\u00e0y ph\u00e2n t\u00edch.<\/li>\n<\/ul>\n

      Khuy\u1ebfn ngh\u1ecb cho nh\u00e0 ph\u00e1t tri\u1ec3n v\u00e0 doanh nghi\u1ec7p<\/h2>\n

      V\u00ec Miasma c\u00f3 kh\u1ea3 n\u0103ng ch\u1ea1y ng\u1ea7m v\u00e0 thi\u1ebft l\u1eadp c\u00e1c c\u01a1 ch\u1ebf duy tr\u00ec l\u00e2u d\u00e0i, vi\u1ec7c ch\u1ec9 \u0111\u01a1n thu\u1ea7n x\u00f3a th\u01b0 m\u1ee5c node_modules<\/code> ho\u1eb7c g\u1ee1 c\u00e0i \u0111\u1eb7t g\u00f3i npm l\u00e0 kh\u00f4ng \u0111\u1ee7. C\u00e1c chuy\u00ean gia an ninh m\u1ea1ng khuy\u1ebfn ngh\u1ecb:<\/p>\n

      1. C\u00f4 l\u1eadp v\u00e0 ki\u1ec3m tra:<\/strong> Ngay l\u1eadp t\u1ee9c c\u00f4 l\u1eadp c\u00e1c m\u00e1y tr\u1ea1m ho\u1eb7c h\u1ec7 th\u1ed1ng CI\/CD \u0111\u00e3 c\u00e0i \u0111\u1eb7t c\u00e1c g\u00f3i b\u1ecb \u1ea3nh h\u01b0\u1edfng. Ki\u1ec3m tra c\u00e1c thay \u0111\u1ed5i b\u1ea5t th\u01b0\u1eddng trong th\u01b0 m\u1ee5c .github\/workflows\/<\/code> v\u00e0 c\u00e1c t\u1ec7p c\u1ea5u h\u00ecnh IDE.<\/p>\n

      2. Thu h\u1ed3i v\u00e0 thay m\u1edbi credential:<\/strong> V\u00f4 hi\u1ec7u h\u00f3a to\u00e0n b\u1ed9 token GitHub, kh\u00f3a cloud, kh\u00f3a SSH v\u00e0 th\u00f4ng tin \u0111\u0103ng nh\u1eadp \u0111\u00e3 c\u00f3 kh\u1ea3 n\u0103ng b\u1ecb l\u1ed9 trong c\u1eeda s\u1ed5 th\u1eddi gian di\u1ec5n ra cu\u1ed9c t\u1ea5n c\u00f4ng.<\/p>\n

      3. Gi\u00e1m s\u00e1t h\u1ec7 th\u1ed1ng build:<\/strong> Ki\u1ec3m tra c\u00e1c artifact, container image ho\u1eb7c g\u00f3i ph\u1ea7n m\u1ec1m \u0111\u01b0\u1ee3c t\u1ea1o ra trong th\u1eddi gian qua \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o ch\u00fang kh\u00f4ng b\u1ecb ch\u00e8n m\u00e3 \u0111\u1ed9c tr\u01b0\u1edbc khi tri\u1ec3n khai l\u00ean m\u00f4i tr\u01b0\u1eddng s\u1ea3n xu\u1ea5t.<\/p>\n

      4. \u00c1p d\u1ee5ng nguy\u00ean t\u1eafc \u0111\u1eb7c quy\u1ec1n t\u1ed1i thi\u1ec3u:<\/strong> H\u1ea1n ch\u1ebf quy\u1ec1n h\u1ea1n c\u1ee7a c\u00e1c token CI\/CD, s\u1eed d\u1ee5ng x\u00e1c th\u1ef1c OIDC thay cho secret t\u0129nh v\u00e0 b\u1eaft bu\u1ed9c quy tr\u00ecnh review k\u1ef9 l\u01b0\u1ee1ng cho m\u1ecdi thay \u0111\u1ed5i \u0111\u1ed1i v\u1edbi workflow t\u1ef1 \u0111\u1ed9ng h\u00f3a.<\/p>\n

      VNCyberS t\u1ed5ng h\u1ee3p t\u1eeb The Hacker News, Wiz Research v\u00e0 Socket.<\/em><\/p>","protected":false},"excerpt":{"rendered":"

      Chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng ph\u1ea7n m\u1ec1m mang t\u00ean Miasma v\u1eeba b\u1ecb ph\u00e1t hi\u1ec7n nh\u1eafm v\u00e0o c\u00e1c g\u00f3i th\u01b0 vi\u1ec7n npm ch\u00ednh th\u1ee9c c\u1ee7a Red Hat Cloud Services.<\/p>","protected":false},"author":2,"featured_media":1538,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[46,124],"class_list":["post-1540","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-an-ninh-mang","tag-an-toan-thong-tin"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1540","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1540"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1540\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1538"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1540"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1540"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1540"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}