{"id":47758,"date":"2026-04-26T22:38:10","date_gmt":"2026-04-26T15:38:10","guid":{"rendered":"https:\/\/antoanthongtinhaiphong.gov.vn\/?p=47758"},"modified":"2026-05-05T22:38:57","modified_gmt":"2026-05-05T15:38:57","slug":"goi-npm-doc-hai-bien-hugging-face-thanh-ha-tang-phat-tan-ma-doc-va-kho-chua-du-lieu","status":"publish","type":"post","link":"https:\/\/antoanthongtinhaiphong.gov.vn\/goi-npm-doc-hai-bien-hugging-face-thanh-ha-tang-phat-tan-ma-doc-va-kho-chua-du-lieu\/","title":{"rendered":"G\u00f3i npm \u0111\u1ed9c h\u1ea1i bi\u1ebfn Hugging Face th\u00e0nh h\u1ea1 t\u1ea7ng ph\u00e1t t\u00e1n m\u00e3 \u0111\u1ed9c v\u00e0 kho ch\u1ee9a d\u1eef li\u1ec7u"},"content":{"rendered":"
C\u00e1c chuy\u00ean gia b\u1ea3o m\u1eadt v\u1eeba ph\u00e1t hi\u1ec7n m\u1ed9t chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng tinh vi, trong \u0111\u00f3 k\u1ebb t\u1ea5n c\u00f4ng l\u1ee3i d\u1ee5ng uy t\u00edn c\u1ee7a n\u1ec1n t\u1ea3ng AI Hugging Face \u0111\u1ec3 bi\u1ebfn d\u1ecbch v\u1ee5 n\u00e0y th\u00e0nh h\u1ea1 t\u1ea7ng ph\u00e2n ph\u1ed1i m\u00e3 \u0111\u1ed9c (CDN) \u0111\u1ed3ng th\u1eddi l\u00e0m n\u01a1i l\u01b0u tr\u1eef d\u1eef li\u1ec7u b\u1ecb \u0111\u00e1nh c\u1eafp, nh\u1eb1m v\u01b0\u1ee3t qua c\u00e1c c\u01a1 ch\u1ebf ki\u1ec3m so\u00e1t an ninh truy\u1ec1n th\u1ed1ng.<\/b>
\n\u200b<\/div>\n
\n
\"npm.png\"<\/div>\n

\u200b<\/p><\/div>\n

\nTheo b\u00e1o c\u00e1o t\u1eeb JFrog c\u00f4ng b\u1ed1 ng\u00e0y 23\/04\/2026, chi\u1ebfn d\u1ecbch b\u1eaft \u0111\u1ea7u t\u1eeb m\u1ed9t g\u00f3i npm c\u00f3 t\u00ean js-logger-pack. B\u1ec1 ngo\u00e0i, g\u00f3i n\u00e0y \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf nh\u01b0 m\u1ed9t th\u01b0 vi\u1ec7n ghi log th\u00f4ng th\u01b0\u1eddng nh\u1eb1m \u0111\u00e1nh l\u1eeba l\u1eadp tr\u00ecnh vi\u00ean trong qu\u00e1 tr\u00ecnh c\u00e0i \u0111\u1eb7t. M\u00e3 \u0111\u1ed9c th\u1ef1c s\u1ef1 \u0111\u01b0\u1ee3c k\u00edch ho\u1ea1t th\u00f4ng qua script postinstall, t\u1ef1 \u0111\u1ed9ng ch\u1ea1y ngay sau khi c\u00e0i \u0111\u1eb7t g\u00f3i. C\u01a1 ch\u1ebf n\u00e0y cho ph\u00e9p m\u00e3 \u0111\u1ed9c kh\u1edfi ch\u1ea1y m\u1ed9t ti\u1ebfn tr\u00ecnh n\u1ec1n t\u00e1ch bi\u1ec7t, khi\u1ebfn qu\u00e1 tr\u00ecnh c\u00e0i \u0111\u1eb7t npm v\u1eabn di\u1ec5n ra b\u00ecnh th\u01b0\u1eddng, nh\u1eb1m che gi\u00e1u h\u00e0nh vi t\u1ea3i v\u00e0 th\u1ef1c thi payload \u0111ang di\u1ec5n ra \u1edf ch\u1ebf \u0111\u1ed9 n\u1ec1n..<\/p>\n

Sau khi \u0111\u01b0\u1ee3c k\u00edch ho\u1ea1t, m\u00e3 \u0111\u1ed9c x\u00e1c \u0111\u1ecbnh h\u1ec7 \u0111i\u1ec1u h\u00e0nh c\u1ee7a n\u1ea1n nh\u00e2n v\u00e0 t\u1ea3i v\u1ec1 m\u1ed9t trong b\u1ed1n t\u1ec7p nh\u1ecb ph\u00e2n t\u1eeb kho Hugging Face c\u00f4ng khai do k\u1ebb t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t, mang t\u00ean Lordplay\/system-releases. Theo JFrog Security, ph\u00e2n t\u00edch cho th\u1ea5y c\u1ea3 b\u1ed1n t\u1ec7p \u0111\u1ec1u ch\u1ee9a c\u00f9ng m\u1ed9t payload JavaScript, \u0111\u01b0\u1ee3c \u0111\u00f3ng g\u00f3i trong c\u00e1c container Node.js kh\u00e1c nhau \u0111\u1ec3 t\u01b0\u01a1ng th\u00edch v\u1edbi Windows, macOS v\u00e0 Linux. C\u1ea3 b\u1ed1n t\u1ec7p th\u1ef1c ch\u1ea5t l\u00e0 c\u00f9ng m\u1ed9t implant, \u0111\u01b0\u1ee3c tri\u1ec3n khai tr\u00ean nhi\u1ec1u n\u1ec1n t\u1ea3ng kh\u00e1c nhau.<\/p>\n

Sau khi tri\u1ec3n khai, implant thi\u1ebft l\u1eadp c\u01a1 ch\u1ebf duy tr\u00ec tr\u00ean h\u1ec7 th\u1ed1ng. Tr\u00ean Windows, n\u00f3 t\u1ea1o Scheduled Task v\u00e0 Registry Run Key. Tr\u00ean macOS, n\u00f3 s\u1eed d\u1ee5ng LaunchAgent. Tr\u00ean Linux, n\u00f3 t\u1ea1o systemd user unit. Ti\u1ebfp \u0111\u00f3, m\u00e3 \u0111\u1ed9c k\u1ebft n\u1ed1i v\u1ec1 m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n t\u1ea1i \u0111\u1ecba ch\u1ec9 195[.]201[.]194[.]107 th\u00f4ng qua WebSocket. T\u1eeb \u0111\u00e2y, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 th\u1ef1c thi l\u1ec7nh t\u1eeb xa, bao g\u1ed3m \u0111\u1ecdc v\u00e0 ghi t\u1ec7p, thu th\u1eadp th\u00f4ng tin \u0111\u0103ng nh\u1eadp, ghi l\u1ea1i thao t\u00e1c b\u00e0n ph\u00edm, gi\u00e1m s\u00e1t clipboard v\u00e0 tri\u1ec3n khai th\u00eam payload.<\/p>\n

\u0110i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd c\u1ee7a chi\u1ebfn d\u1ecbch n\u1eb1m \u1edf c\u01a1 ch\u1ebf exfiltration. Thay v\u00ec g\u1eedi d\u1eef li\u1ec7u v\u1ec1 m\u00e1y ch\u1ee7 ri\u00eang, implant n\u00e9n d\u1eef li\u1ec7u v\u00e0 t\u1ea3i tr\u1ef1c ti\u1ebfp l\u00ean c\u00e1c dataset ri\u00eang t\u01b0 tr\u00ean Hugging Face d\u01b0\u1edbi t\u00e0i kho\u1ea3n do k\u1ebb t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t. C\u00e1ch ti\u1ebfp c\u1eadn n\u00e0y bi\u1ebfn Hugging Face th\u00e0nh k\u00eanh l\u01b0u tr\u1eef v\u00e0 trung chuy\u1ec3n d\u1eef li\u1ec7u \u0111\u00e1nh c\u1eafp, \u0111\u1ed3ng th\u1eddi gi\u00fap l\u01b0u l\u01b0\u1ee3ng h\u00f2a l\u1eabn v\u1edbi ho\u1ea1t \u0111\u1ed9ng h\u1ee3p ph\u00e1p c\u1ee7a n\u1ec1n t\u1ea3ng.
\n\u200b<\/p><\/div>\n

\n
\"1777021724952.png\"<\/div>\n

Lu\u1ed3ng r\u00f2 r\u1ec9 d\u1eef li\u1ec7u qua Hugging Face (Ngu\u1ed3n: JFrog)<\/i>\u200b<\/div>\n

\nC\u01a1 ch\u1ebf \u0111i\u1ec1u khi\u1ec3n \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o \u0111\u1ed9 b\u1ec1n. D\u1eef li\u1ec7u \u0111\u01b0\u1ee3c chia nh\u1ecf, theo d\u00f5i tr\u1ea1ng th\u00e1i upload v\u00e0 t\u1ef1 \u0111\u1ed9ng ti\u1ebfp t\u1ee5c khi k\u1ebft n\u1ed1i b\u1ecb gi\u00e1n \u0111o\u1ea1n. Ngo\u00e0i ra, implant c\u00f3 kh\u1ea3 n\u0103ng bu\u1ed9c \u0111\u0103ng xu\u1ea5t phi\u00ean tr\u00ecnh duy\u1ec7t, trong khi keylogger v\u1eabn ho\u1ea1t \u0111\u1ed9ng, cho ph\u00e9p thu th\u1eadp th\u00f4ng tin x\u00e1c th\u1ef1c khi ng\u01b0\u1eddi d\u00f9ng \u0111\u0103ng nh\u1eadp l\u1ea1i.<\/p>\n

C\u00e1c chuy\u00ean gia khuy\u1ebfn c\u00e1o t\u1ed5 ch\u1ee9c r\u00e0 so\u00e1t h\u1ec7 th\u1ed1ng n\u1ebfu t\u1eebng c\u00e0i \u0111\u1eb7t g\u00f3i li\u00ean quan v\u00e0 xoay v\u00f2ng to\u00e0n b\u1ed9 th\u00f4ng tin nh\u1ea1y c\u1ea3m, bao g\u1ed3m API key, SSH key, token npm v\u00e0 m\u1eadt kh\u1ea9u c\u01a1 s\u1edf d\u1eef li\u1ec7u. \u0110\u1ed3ng th\u1eddi, c\u1ea7n g\u1ee1 b\u1ecf g\u00f3i js-logger-pack, v\u00f4 hi\u1ec7u h\u00f3a script t\u1ef1 \u0111\u1ed9ng b\u1eb1ng l\u1ec7nh npm config set ignore-scripts true v\u00e0 lo\u1ea1i b\u1ecf c\u00e1c c\u01a1 ch\u1ebf duy tr\u00ec tr\u00ean h\u1ec7 th\u1ed1ng nh\u01b0 Scheduled Task, Registry Run Key, LaunchAgent v\u00e0 systemd unit t\u00f9y n\u1ec1n t\u1ea3ng. C\u00e1c h\u1ec7 th\u1ed1ng ch\u1ea1y phi\u00ean b\u1ea3n 1.1.27 \u0111\u01b0\u1ee3c coi l\u00e0 \u0111\u00e3 b\u1ecb x\u00e2m nh\u1eadp, c\u1ea7n ki\u1ec3m tra v\u00e0 thay th\u1ebf to\u00e0n b\u1ed9 th\u00f4ng tin x\u00e1c th\u1ef1c.\u200b<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

C\u00e1c chuy\u00ean gia b\u1ea3o m\u1eadt v\u1eeba ph\u00e1t hi\u1ec7n m\u1ed9t chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng tinh vi, trong \u0111\u00f3 k\u1ebb t\u1ea5n c\u00f4ng l\u1ee3i d\u1ee5ng uy t\u00edn c\u1ee7a n\u1ec1n t\u1ea3ng AI Hugging Face \u0111\u1ec3 bi\u1ebfn d\u1ecbch v\u1ee5 n\u00e0y th\u00e0nh h\u1ea1 t\u1ea7ng ph\u00e2n ph\u1ed1i m\u00e3 \u0111\u1ed9c (CDN) \u0111\u1ed3ng th\u1eddi l\u00e0m n\u01a1i l\u01b0u tr\u1eef d\u1eef li\u1ec7u b\u1ecb […]<\/p>\n","protected":false},"author":20,"featured_media":47759,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[3,24,35],"tags":[],"class_list":["post-47758","post","type-post","status-publish","format-standard","has-post-thumbnail","category-canh-bao-khuyen-nghi","category-tin-noi-bat","category-tin-tuc-su-kien"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/47758","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/comments?post=47758"}],"version-history":[{"count":1,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/47758\/revisions"}],"predecessor-version":[{"id":47760,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/47758\/revisions\/47760"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media\/47759"}],"wp:attachment":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media?parent=47758"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/categories?post=47758"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/tags?post=47758"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}