Feed Entities Podcasts Deep Dives Developers About

[KongchangAI]

Real-time AI knowledge base. Every claim is traceable to its source, with data freshness under 24 hours.

Powered by 240+ first-hand AI sources

Knowledge

Feed
Hot Entities
Podcasts

Developers

CLI
MCP Server
REST API
About

© 2026 KongchangAI. The freshest, most accurate AI knowledge

Unverified50% confidenceFactExact time

攻击载荷会扫描 .npmrc 中的 npm 认证令牌、AWS/GCP/Azure 云凭证、环境变量中的密钥以及 CI/CD 部署密钥

1

Sources

50%

Confidence

Long-term

Relevance

8/7/2026

First Seen

Sources

Shai-Hulud供应链攻击：Keyv等npm包遭入侵详解与防御指南

Related Claims

Unverified抓包工具的核心原理是中间人攻击（MITM），通过安装自签名CA证书来解密HTTPS流量69% similar UnverifiedVICE 的安全扫描覆盖打包文件中泄露的密钥、Supabase RLS 配置错误、暴露的 API 接口、弱 HTTP 头部与基础设施配置等高危问题68% similar Unverified~/.aws/credentials 以 INI 格式存储 AWS 访问密钥；~/.npmrc 可能包含 npm registry 认证令牌；~/.docker/config.json 存储 base64 编码的 Docker 认证信息；~/.kube/config 包含 Kubernetes 集群访问凭证67% similar UnverifiedPantsdown（CVE-2019-6260）漏洞允许通过网络未经认证直接读写BMC物理内存67% similar UnverifiedAWS SDK 凭证链按优先级依次检查环境变量、~/.aws/credentials 文件、AWS Config 文件、Container credentials、EC2 IMDSv2，最后是 IAM Identity Center67% similar

Cite This Claim

Stable URI

https://kongchang.com/claim/704136

API

curl https://kongchang.com/api/v1/knowledge/claims/704136

MCP

get_claim(id=704136)