TL, DR
nolimit-agent fakitin npm ne wanda sigar da aka buga - 1.0.299 ta hanyar 1.0.307, an sake shi tsawon kwanaki huɗu daga 2026-06-26 zuwa 2026-06-29 — kowannensu yana ɗauke da cikakken tsarin phishing da bulk-mail a cikin wani ɓoyayyen kundin adireshi mai ɓoyewa gaba ɗaya. A cikin kowace sigar babban shigarwar ya ta'allaka ne ga .ad/x0.js, ɗaya daga cikin fayiloli ~86 a cikin babban fayil mai suna dotfile wanda ke ɗauke da kusan 4,200 javascript-obfuscator string-array blobs; ƙugiyar shigarwa da tsarin shigarwa iri ɗaya ne a faɗin layin.
Bayan ɓoyewar, akwai wani abu da ke ɓoye a bayan Tsarin lambar na'urar Microsoft 365 OAuth (login[.]microsoftonline[.]com/common/oauth2/v2.0/devicecode) cewa, da zarar an amince da lambar, yana karanta akwatin saƙon Outlook na wanda aka azabtar kuma yana aika abubuwa ta hanyar Microsoft Graph API; injin aika saƙon SMTP da SMS mai yawa wanda jerin masu karɓa da mai aiki ya samar ke jagoranta; samfuran saƙon kwaikwayon alama; gina hanyar haɗin buɗewa; da kuma bincike kan DNS-over-HTTPS, WHOIS, da binciken lambar GitHub. Tashoshin zirga-zirga na lokacin gudu zuwa ga kayayyakin more rayuwa na mai aiki a api[.]nolimitent[.]xyz:4100.
Abin da ya shafa: duk wanda ya girka kowace sigar kunshin, da duk wani Akwatin gidan waya na Microsoft 365 wanda mai shi ya amince da lambar na'urar da aka gabatar ta hanyarta. Sigar da ta gabata, 1.0.307, shine sabon alama na yanzu kuma yana ɗauke da irin wannan ikon akwatin saƙon lambar na'ura - lambar mugunta ba ta takaita ga sigar baya ɗaya ba.
Tsanani: mTsarin halittu da abin ya shafa: npmAlamar farko da za a bincika ita ce: mai masaukin baki api[.]nolimitent[.]xyz.
Harin: yadda yake aiki
Harsashi mai sauƙi a kan wani ɓoyayyen kayan aiki
Kunshin yana nuna saman yau da kullun. fakamari.json ya ayyana a postinstall ƙugiya –
text postinstall: node scripts/postinstall.js - kuma a kan bincike rubutun/postinstall.js ba shi da lahani: yana shigar da umarnin Windows kuma yana fita. Ƙofar ba ita ce inda ɗabi'ar take rayuwa ba. main da kuma ni filayen biyu suna nuni zuwa .ad/, wani kundin adireshi wanda babban digo nasa ke hana shi shiga cikin abubuwan yau da kullun ls fitarwa, da kuma abubuwan da ke cikinsa a cikin na'ura iri ɗaya. Na'urar daukar hoton da ba ta canzawa ta ƙidaya ~4,293 da aka tsara ta hanyar lambobi a fadin .ad/ saitin module; javascript-obfuscator dogara ne da ci gaba da aka ayyana, wanda ya dace da siffar juyawar zaren-array-juyawa na fayilolin da aka haɗa.
Rabawar ita ce siginar farko da ta cancanci a sanya mata suna: ƙugiyar shigarwa da mai bita zai bincika tana da tsabta, yayin da lambar aiki take nesa da babban fayil, ɓoye kuma an ɓoye ta, tana isa ne kawai lokacin da wurin shigarwar da aka fitar da fakitin ya fara aiki.
Samun damar akwatin akwatin gidan waya na Microsoft 365 ta lambar na'urar
Module .ad/x12.js yana da mafi girman ƙarfin tsarin. Yana jagorantar bayar da izinin na'urar Microsoft 365 OAuth 2.0:
text POST login[.]microsoftonline[.]com/common/oauth2/v2.0/devicecode Tallafin lambar na'ura halal ne na Microsoft wanda aka tsara don na'urorin da aka takaita shigarwa: sabis yana buƙatar lambar, mai amfani yana rubuta lambar da ke cikinta microsoft.com/devicelogin`a na'ura ta biyu kuma ta amince, kuma sabis ɗin da ke buƙatar ya karɓi alamun. Idan sabis ɗin da ke buƙatar ya zama na wani ba mai akwatin gidan waya ba, amincewa ta miƙa wa wannan ɓangare na uku alamar. Da zarar an sami alamar, .ad/x12.js` yana karanta akwatin gidan waya kai tsaye ta hanyar Microsoft Graph:
text GET graph[.]microsoft[.]com/v1.0/me/mailFolders/inbox/messages?$top=250&$select=from GET graph[.]microsoft[.]com/v1.0/me/mailFolders/sentitems/messages?$top=250&$select=toRecipients The $select Hasashen yana jawo adiresoshin mai aikawa daga akwatin saƙo da adiresoshin mai karɓa daga abubuwan da aka aika - kayan aiki don zana taswirar wakilin wanda aka zalunta. Wannan shine damar shiga ta hanyar abokin gaba (AiTM) ta hanyar izini maimakon ta hanyar kama kalmar sirri: babu takardar shaidar yin phish a ma'anar gargajiya, kawai lambar da za a amince da ita.
Injin aika saƙonni da SMS mai yawa tare da samfuran kwaikwayon mutum
A kusa da akwatin gidan waya akwai mai aika saƙo. Kunshin yana jigilar fayilolin bayanai masu gyarawa na mai aiki - jerin masu aikawa (senders.txt, smtps.txt) da fayil ɗin samfuri (ayyuka.txt) — wanda adireshin mai riƙe wurinsa ya karanta a matsayin takardar jefa ƙwallo don yin kwaikwayon mutum: security@apple.com, login-tabbatarwa, sabis na OAuth, lissafin kuɗi, da kuma masu aika sanarwar asusu akan yourdomain.com Mai aiki a cikin akwatin yana maye gurbinsa. Bangaren SMS yana ɗauke da wayaebook da kuma tsarin ƙofar shiga. Mai aikawa yana maimaita jerin masu karɓa da mai aiki ya bayar kuma yana aikawa ta hanyar SMTP relays da aka tsara.
Don sanya hanyoyin haɗi su sauka, .ad/xu.js da kuma .ad/xq.js gina URLs waɗanda ke amfani da rashin tabbas na nazarin URL da bin diddigin dannawa. Tsarin yaudara suna ɗauke da wani amintaccen iko kafin @ don haka prefix ɗin da ake iya gani ya bambanta da ainihin mai masaukin baki:
text https://trusted[.]com@ https://trusted[.]com%40 https://trusted[.]com:80@ https://redirect[.]example[.]com/ https://track[.]example[.]com/click? Tsarin kuma yana ɗaukar favicons daga manyan masu amfani da enterprise masu samar da wasiku - wata hanya ce ta yau da kullun don samar da ingantaccen umarni ko shafin saukarwa mai alamar mai bayarwa.
Binciken ababen more rayuwa da kuma sa ido kan ababen more rayuwa
Da yawa daga cikin kayayyaki suna tattara bayanai kafin a aika su. .ad/x0.js yana warware sunaye akan DNS-over-HTTPS (dns[.]google/resolve), .ad/xa.js tambayoyi WHOIS (api[.]whois[.]vu), Da kuma .ad/x9.js yana gudanar da binciken lambar GitHub (api[.]github[.]com/search/code?q=) — tsari mai dacewa da gano tsarin sabar wasiku da aka fallasa da kuma takardun shaidar SMTP don ciyar da jerin jigilar kaya. .ad/xs.js yana tambaya game da ma'aunin CDX na Wayback Machine.
Umurni da sarrafawa
A fadin saitin da aka ɓoye, .ad/x4.js nassoshi ƙarshen mai aiki:
text http://api[.]nolimitent[.]xyz:4100 Mai masaukin baki yana raba nasa wanda ba shi da iyaka alamar da ke ɗauke da sunan mawallafin, da kuma : 4100 tashar jiragen ruwa ita ce hanyar kiran gida ta tsarin. Wannan ita ce alama mafi ɗorewa ga masu kare: fakiti, wurin aiki na masu haɓakawa, ko wakilin gini da ke isa gare shi. api[.]nolimitent[.]xyz ya aiwatar da wannan lambar.
Alamomin sulhu
Alamun da ke ƙasa su ne waɗanda mai tsaro zai iya aiki a kansu - grep a lockfile, block a host, ko search proxy da DNS logs. Maƙallan ƙarshe na Microsoft suna bayyana saboda tsarin yana cin zarafin su; ba kansu bane masu cutarwa kuma bai kamata a toshe su ba.
An kama hash ɗin fayil a lokacin gwaji:
- kunshin/.ad/x0.js — sha256 e4153bb614ee03ec456e6b5b41926385db6aae0e4f3e771d18e581571ad7ca2a
- fakiti/fakiti.json — sha256 8618064f1f6146b4a8f0459aff9154dca1847e3936aa44f4d4cd37e127075644
Alamar haya ta Microsoft 365 ta cancanci neman kuɗi ba tare da wannan kunshin ba: shiga lambar na'ura mai nasara tare da karanta Graph nan take Fayilolin imel/akwatin saƙo da kuma Fayilolin mail/masu jin daɗi, musamman daga zaman da mai amfani bai gane ba.
Ba da izini & ɗabi'ar da aka lura
Abin da ake iya gani yana bambanta da wanda ke bayansa.
Abubuwan da za a iya gani: an buga kunshin a ƙarƙashin hannun wakili mai suna nolimit-wakili tare da adireshin Gmail da ba a tabbatar da shi ba kuma babu ma'ajiyar tushe da aka haɗa; fakamari.json ya bayyana shi a matsayin "mai aika imel na gaba" kuma yana yi masa alama da ƙungiyar ja kalmar sirri; lambar lokacin gudu ta mayar da hankali ne a cikin wani ɓoye, ɓoye .ad/ kundin adireshi wanda sarkar kayan aikin sa (javascript-obfuscator) dogaro ne da aka ayyana; kuma mai masaukin baki na kiran gida api[.]nolimitent[.]xyz yana sake amfani da shi wanda ba shi da iyaka Alamar kasuwanci. Wannan fakiti ɗaya ne mai alamar kayayyakin more rayuwa guda ɗaya da mai aiki ke sarrafawa — ba tarin fakiti da yawa ba, kuma ba a gano wani karo da wani kamfen da aka ambata a baya ba.
The ƙungiyar ja Kalmar sirri ba ta canza rarrabuwa ba. Kayan aiki na tsaro na laifi da aka amince da su waɗanda ke jigilar ikon amfani da su biyu suna yin hakan a bayyane: tushen da za a iya karantawa, abubuwan da mai aiki ya kawo, kuma babu ɓoyayyen kira-gida. Wannan fakitin yana juyar da kowanne daga cikin waɗannan kaddarorin - lambar aikinsa ta ɓoye kuma an ɓoye ta, kuma tana nuna kayan aikin mai aiki da aka gyara maimakon abin da mai amfani ya bayar. Halin, ba lakabin ba, ne ke jagorantar hukuncin, wanda yake da mugunta.
Ba a tabbatar da niyya a nan ba. Sakon ya bayyana abin da lambar ke yi - neman lambar na'ura, karanta akwatin gidan waya akan Jadawali, aika wasiku masu yawa ta hanyar jigilar bayanai da aka tsara, alamar haske zuwa ga mai masaukin da aka ƙayyade - kuma ba a bayyana dalili ba.
Tasiri, yanayi & jagorar mai kare
Tasirin lokacin shigarwa guda biyu suna da mahimmanci. Na farko, duk wani mai haɓakawa ko wakilin CI da ya girka wakili mai suna nolimit-wakili yana kawo tsarin a kan wannan mai masaukin baki kuma yana kafa gidan kiran zuwa api[.]nolimitent[.]xyzNa biyu, ikon lambar na'urar ya wuce mai masaukin shigarwa: akwatin gidan waya na Microsoft 365 wanda mai shi ya amince da lambar da aka gabatar ana karanta shi kai tsaye ta cikin Graph, ba tare da kalmar sirri ba da ta taɓa ketare waya.
Babban abin da ake amfani da shi a yanzu shi ne wanda za a iya amfani da shi a cikin gida. phishing na lambar na'ura (AiTM) ya canza daga tsarin phishing mai zaman kansa zuwa wani fakiti a cikin rajistar jama'a - rarrabawa ta hanyar npm shigarwa maimakon ta hanyar hanyar haɗin imel. Ta wannan hanyar tana sauya matsalar masauki da isar da hanyar haɗin yanar gizo na mai sarrafa phishing don isa ga rajista, kuma tana ɓoye lambar aiki a bayan ƙugiya mai tsabta da kuma babban fayil mai suna ɓoyayyen fayil wanda ya kayar da saurin bincike da hannu.
Ga masu kare kai:
- Bitar rajista da dogaro. Yi wa wani fakitin da ya dace main/ni ya warware zuwa cikin wani ɓoyayyen kundin adireshi (wanda aka riga aka yi masa alama) na lambar ɓangare na farko da aka ɓoye a matsayin babban haɗari akan tsari kawai, ba tare da la'akari da ko ƙugiyar shigarwa ta yi kama da tsabta ba. Ƙaddamarwa ba ɓoyewa ba ne - ƙofar da ke kan sa hannun na'urar fassara ta zaren, ba a kan tsawon layi ba.
- Microsoft 365 taurarewa. Taƙaita kwararar izinin lambar na'ura tare da Samun dama ta Sharaɗi inda ba a buƙatar sa a aiki; tallafin lambar na'ura sanannu ne na AiTM vector kuma ba kasafai ake buƙatar sa daga masu amfani da hulɗa ba. Duba don shiga lambar na'ura sannan a rubuta lissafin akwatin gidan waya nan take.
- Gano hanyar sadarwa. Toshewa da kuma sanar da kai api[.]nolimitent[.]xyzNemo DNS da rajistan ayyukan wakili da ke fita daga ciki a cikin masu haɓakawa da kuma gina ababen more rayuwa.
- Gano hanyar wasiƙa. The mai amfani@host fom ɗin batsa na URL (amintacce[.]com@…) ana iya gano su a ƙofar gidan waya da wakili; hanyoyin haɗin tuta waɗanda sashin ikonsu ya riga @.
Kunshin ya kasance kai tsaye a npm a lokacin nazarin. Domin tsarin ɓoye ya mamaye dukkan layin sigar da aka buga da kuma na yanzu latest alamar (1.0.307) tana ɗauke da ikon lambar na'urar, cire rajista ya kamata ya rufe kowace sigar, ba kawai sigar baya ba.
