{"id":52,"date":"2026-04-14T08:06:33","date_gmt":"2026-04-14T08:06:33","guid":{"rendered":"http:\/\/www.cert.hr\/?p=52"},"modified":"2026-11-04T17:13:00","modified_gmt":"2026-11-04T17:13:00","slug":"upozorenje-kompromitacija-lanca-opskrbe-javascript-axios-biblioteke","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/ranjivosti\/upozorenje-kompromitacija-lanca-opskrbe-javascript-axios-biblioteke\/","title":{"rendered":"UPOZORENJE: kompromitacija lanca opskrbe JavaScript Axios biblioteke"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Do\u0161lo je do kompromitacije lanca opskrbe JavaScript biblioteke \u2013 Axios. &nbsp;<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">S vi\u0161e od&nbsp;<strong>83 milijuna tjednih preuzimanja<\/strong>, Axios je jedan od naj\u010de\u0161\u0107e kori\u0161tenih HTTP klijenata u JavaScript ekosustavu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Prema izvje\u0161taju portala&nbsp;<a href=\"https:\/\/thehackernews.com\/2026\/03\/axios-supply-chain-attack-pushes-cross.html\">The Hacker News<\/a>, napada\u010di su kompromitirali korisni\u010dki ra\u010dun jedne od glavnih osoba za odr\u017eavanje Axios-a te objavili&nbsp;<strong>zlonamjerne verzije biblioteke \u2013 axios@1.14.1 i axios@0.30.4.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Napada\u010di su u k\u00f4d ubacili la\u017enu ovisnost (eng.&nbsp;<em>fake dependency<\/em>) plain-crypto-js@4.2.1, \u010dija je svrha pokretanje skripte nakon instalacije koja djeluje kao remote access trojan (RAT) dropper, a cilja macOS, Windows i Linux (cross-platoform RAT).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dropper kontaktira aktivni C&amp;C poslu\u017eitelj te isporu\u010duje drugu fazu napada ovisno o platformi. Nakon izvr\u0161enja, zlonamjerni softver se bri\u0161e i zamjenjuje vlastiti package.json \u010distom verzijom kako bi izbjegao forenzi\u010dko otkrivanje.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Korisnicima se savjetuje da izvr\u0161e sljede\u0107e radnje:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Provjerite imate li instalirane zlonamjerne verzije (<strong>axios@1.14.1 i axios@0.30.4<\/strong>)<\/li>\n\n\n\n<li>Provjerite postojanje malicioznih artefakata poput: \u201c\/Library\/Caches\/com.apple.act.mond\u201d (macOS), \u201c%PROGRAMDATA%\\wt.exe\u201d (Windows) i \u201c\/tmp\/ld.py\u201d (Linux).<\/li>\n\n\n\n<li><strong>Vratite se na verzije Axiosa 1.14.0 ili 0.30.3.<\/strong><\/li>\n\n\n\n<li><strong>Uklonite \u201cplain-crypto-js\u201d<\/strong>\u00a0iz direktorija \u201cnode_modules\u201d.<\/li>\n\n\n\n<li>Ako se otkriju maliciozni artefakti, pretpostavite da je sustav kompromitiran i\u00a0<strong>rotirajte sve vjerodajnice na sustavu.<\/strong><\/li>\n\n\n\n<li>Revidirajte CI\/CD pipelinove koji su se mogli izvr\u0161iti i instalirati zahva\u0107ene verzije.<\/li>\n\n\n\n<li><strong>Blokirajte izlazni promet prema C&amp;C domeni (\u201csfrclak[.]com\u201d)<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Zlonamjerne verzije Axiosa, kao i \u201cplain-crypto-js\u201d paket, nisu vi\u0161e dostupni za preuzimanje s npm repozitorija.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Kako napad funkcionira:<\/strong><\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af1a06dab387&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af1a06dab387\" class=\"wp-block-image wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2026\/04\/image.jpeg\" alt=\"\" class=\"wp-image-113493\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Vi\u0161e i kompromitaciji pro\u010ditajte na:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/thehackernews.com\/2026\/03\/axios-supply-chain-attack-pushes-cross.html\n<\/div><\/figure>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/www.huntress.com\/blog\/supply-chain-compromise-axios-npm-package\n<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Do\u0161lo je do kompromitacije lanca opskrbe JavaScript biblioteke \u2013 Axios. &nbsp; S vi\u0161e od&nbsp;83 milijuna tjednih preuzimanja, Axios je jedan od naj\u010de\u0161\u0107e kori\u0161tenih HTTP klijenata u JavaScript ekosustavu. Prema izvje\u0161taju portala&nbsp;The Hacker News, napada\u010di su kompromitirali korisni\u010dki ra\u010dun jedne od glavnih osoba za odr\u017eavanje Axios-a te objavili&nbsp;zlonamjerne verzije biblioteke \u2013 axios@1.14.1 i axios@0.30.4. Napada\u010di su [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":54,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[27],"tags":[],"tema":[],"class_list":["post-52","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ranjivosti"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/52","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=52"}],"version-history":[{"count":2,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/52\/revisions"}],"predecessor-version":[{"id":1724,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/52\/revisions\/1724"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/54"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=52"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=52"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=52"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=52"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=52"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}