TL, DR
Tsakanin 1 ga Afrilu da 3 ga Mayu, 2026, wani mai buga npm guda ɗaya, user0001, an yi rijista da adireshin Gmail da ba a tabbatar ba tanvisoul9@gmail.com, a hankali aka tura fakiti shida da sunayen da ba su da kyau, masu kama da kayayyakin more rayuwa: centralogger, dom-utils-lite, node-fetch-lite, connector-agent, node-gyp-runtime, Da kuma node-env-resolve.
Sabbin nau'ikan guda biyu na node-env-resolve, 1.0.7 da 1.0.8, an yi musu alama da tsarin Xygeni's Malware Early Warning (MEW) a ranar 2 ga Mayu kuma an tabbatar da cewa suna da cutarwa a ranar 3 ga Mayu.
Dashen ba sabon abu bane ga abin da ba shi ba ne: babu bots na Telegram, babu kiran OAST, a'a obfuscation, kuma babu wani yunƙuri na ɗaukar takardun shaidar AWS a lokacin shigarwa. Madadin haka, postinstall.js yana ƙara shigarwar boot-persistent ta Windows, ta amfani da maɓallin HKCU Run wanda ke buɗewa wscript.exe a kan wani stub na VBS. Sannan ya haifar da wani wakili na Node.js wanda ke haɗa kayayyaki don kama makirufo, satar tarihin burauza, ɗaukar hotunan allo, da kwaikwayon linzamin kwamfuta/keyboard.
Muna kiran wannan rukuni DevTap, bayan kayan aikin yana barin yana aiki akan injin mai haɓakawa.
Duk fakitin guda shida an yi su ne kai tsaye a npm a lokacin rubuta wannan labarin. Mun gabatar da su ga tashar cin zarafi ta rajista. Masu kare ya kamata su cire duk wani shigarwa daga mai wallafa kafin a cire shi.
Ƙungiyar: Fakiti Shida, Mai Bugawa Ɗaya
Asusun mai wallafawa user0001 ba a tabbatar da shi ba. Ba shi da SCM tabbatarwa, babu imel da aka haɗa da yankin yanar gizo, kuma babu tarihin da ya gabata. tanvisoul9 bai bayyana a cikin wani rikodin mawallafin npm da muka iya samu ba.
Duk fakiti shida sun lissafa mai kula da iri ɗaya, an buga su ne daga asusu ɗaya, kuma suna raba iri ɗaya package.json farantin tukunya. Babu repository, a'a homepage, kuma a'a description ya fi tsayi fiye da layi ɗaya.
Dabarun sanya suna shine ɓangaren da ke da ban sha'awa. Ba kamar kamfen ɗin dogaro da kai na gargajiya ko kuma kamfen ɗin rubutu ba, babu ɗayan waɗannan sunayen da ke da niyya ga wani takamaiman ɗakin karatu na sama. Madadin haka, an daidaita su don su ɓace zuwa ainihin package.json or npm ls fitarwa.
| Package | Na farko An buga | Latest Version | versions | Matsayi a cikin Ƙungiyar |
|---|---|---|---|---|
| mai bincike na tsakiya | 2026-04-01 12:46 UTC | 1.0.9 | 5, daga 1.0.5 zuwa 1.0.9 | Murfin "ayyukan yin rajista" na Cluster; bugawa ta farko |
| dom-utils-lite | 2026-04-14 07:36 UTC | 1.0.3 | 3 | Murfin taimakon DOM na gama gari |
| node-fetch-lite | 2026-04-19 10:22 UTC | 1.0.2 | 3 | Iyalin ɗaukar node na Mimics |
| wakili mai haɗawa | 2026-04-25 05:12 UTC | 1.0.0 | 1 | Sunan gama gari "wakili" |
| lokacin gudu-gyp | 2026-04-25 05:17 UTC | 1.0.0 | 1 | Kayan aikin gina na'urar kwamfuta ta asali ta Mimics |
| warware node-env | 2026-04-25 05:21 UTC | 1.0.9 | 10, daga 1.0.0 zuwa 1.0.9 | ɗigon ruwa mai aiki; cikakken dashen |
Sunaye kamar centralogger, node-fetch-lite, Da kuma node-gyp-runtime an tsara su ne don su yi kama da marasa jayayya a cikin sake duba lambar. Suna kama da abubuwan da za su kasance a cikin bishiyar dogaro da aiki.
Idan aka haɗa su da sabon mai bugawa wanda ba a tabbatar da shi ba da kuma hanyoyin haɗin ma'ajiyar bayanai da suka ɓace, suna samar da tsari mai ganewa: ɗan wasan kwaikwayo yana shuka sunayen da ba su da bambanci sosai a cikin rajistar, sannan ya sake maimaitawa da sauri akan wanda yake da mahimmanci. A wannan yanayin, node-env-resolve an karɓi sigar goma cikin kwana takwas.
Abin da Ya Sauka a Akwatin Tsarin Windows
Sarkar mugunta a kan node-env-resolve:1.0.8 gajere ne, kai tsaye, kuma mai cike da fasali na musamman don npm RAT.
Bayan shigarwa: Natsuwa da Wakili Mai Ragewa
package.json ya ayyana ƙugiya ɗaya ta shigarwa:
{ "scripts": { "postinstall": "node postinstall.js" } }postinstall.js yana yin abubuwa uku a tsari.
Da farko, yana ɗaukar matakin kundin shigarwa a wajen bishiyar npm. Ana ƙididdige hanyar a lokacin gudu a cikin rubutun kamar yadda INSTALL_DIRSannan yana aiki da na ciki execSync('npm install --production --silent ...') a ciki don jawo dogaro da lokacin aiki na dashen. Wannan yana sanya wakili a kan faifai a wani wuri da aka rubuta littafin jagora. node_modules binciken ba zai samu ba.
Na biyu, yana rubuta mai ƙaddamar da VBS kuma yana yin rijistar sa don juriyar boot:
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run \ /v ${AGENT_NAME} \ /t REG_SZ \ /d "wscript.exe \"${vbsPath}\"" /fwscript.exe shine Windows Script Host, wani Microsoft binary mai sa hannu wanda ke aiki .vbs fayiloli ba tare da taga na'ura wasan bidiyo ba. Wannan shine precisdalilin da ya sa aka fi so shi don autorun stubs.
Akwai kuma daidaitawa reg delete hanyar ciki src/index.js, yana nuna cewa an tsara dashen don a iya cire shi daga jiki bisa umarnin mai aiki.
Na uku, yana haifar da tsarin rabuwar yara:
spawn(node, [path.join(INSTALL_DIR, 'src/index.js')], { detached: true, env: { ...process.env, SERVER_URL } })Cikakkun bayanai guda biyu suna da muhimmanci a nan.
SERVER_URL Ana karanta shi daga muhalli. Sakamakon haka, ana iya daidaita ƙarshen C2 a kowane tsari kuma ba a haɗa shi cikin kunshin ba. Wannan ƙaramin zaɓi amma da gangan ya kayar da yawancin zaɓukan da aka yi a tsaye-IOC.
Haka kuma, yaron da aka haifa yana gadon cikakken yanayin iyaye. Saboda haka, duk wani NPM_TOKEN, AWS_*, GITHUB_TOKEN, ko soket ɗin wakili na SSH da ke cikin harsashin mai haɓakawa a lokacin shigarwa yana tafiya zuwa ƙwaƙwalwar wakilin da ya daɗe.
Abin da Wakilin Yake Shigowa da shi
An haɗa src/ Itacen ya ƙunshi kayayyaki guda uku waɗanda sunayensu kaɗai ke ba da labarin: audioCapture.js, browserHistory.js, Da kuma systemInfo.js.
Jerin dogaro da lokacin aiki, an warware shi yayin shirye-shiryen da aka tsara npm install, ya tabbatar da su.
Wannan hanyar ta mayar da wani lamari mai cike da rudani zuwa martani mai tsari.
Maimakon mayar da martani ba tare da an yi masa kallon makaho ba, ƙungiyoyi suna aiki da bayyana fifiko da kuma gyara cikin sauri.
| dogara | Abin da Yake Don A Wannan Halin |
|---|---|
| allo mai nuna allo-desktop | Ɗauki allo lokaci-lokaci |
| @ goro-tree-fork/goro-js | Aiki da linzamin kwamfuta da madannai / kwaikwayon shigarwa ta atomatik |
| mafi kyau-sqlite3 | Karanta bayanai kai tsaye na Tarihin Chrome, Edge, da Firefox SQLite |
| adm-zip | Haɗa kayan tarihi kafin a tace su |
| kaifi | Sake girman/matse hotunan kariyar kwamfuta da kayan tarihi na hoto |
| socket.io-abokin ciniki | Tashar C2 mai ɗorewa mai jurewa biyu |
| lambar na'urar-kulle | Tafin yatsa mai ƙarfi ga kowane mai masaukin baki don bin diddigin wanda aka zalunta |
systemInfo.js da kira os.networkInterfaces() don ƙarin ɗaukar yatsan hannu kafin alamar farko.
Dalilin Da Yasa Kama Sauti Shine Siginar Fitaccen
Yawancin npm RATs da muke tantancewa a MEW suna tsayawa ne a lokacin shigarwa na sirri. Suna karantawa ~/.npmrc, karanta ~/.aws/credentials, gogewa process.env, Aika a kan hanyar yanar gizo, sannan a fita. Wannan ya dace da tsarin tattalin arziki mai cike da sarkakiya. Takardun shaida suna da ɗan gajeren rabin rayuwa, kuma maharin yana buƙatar samun kuɗi cikin sauri.
node-env-resolve ya bambanta a siffarsa.
An saita juriyar don tsira daga sake farawa. Wakilin yana aiki a ware kuma yana rayuwa tsawon lokaci a ƙarƙashin wscript.exeKayan aikin da yake ɗauke da shi don kasancewa a wurin a kan na'urar mai haɓakawa ne, ba don kamawa da barin ba: na'urar rikodin makirufo, direban keyboard/linzami, cikakken shiga tarihin burauza, ɗaukar allo, da kuma tashar Socket.IO mai hulɗa zuwa C2 mai daidaitawa.
Kama makirufo musamman shine layin da wannan kamfen ɗin ya wuce wanda yawancin malware na npm ba sa yi.
Wurin aiki na masu haɓaka manhajoji, a mafi yawan lokuta, shine wurin aiki inda masu haɓaka manhajoji ke ɗaukar matakan tsayawa, kiran abokan ciniki, tattaunawa kan ƙira, da kuma gadoji a lokacin kira. Tsarin dashen makirufo ba ya bin alamar npm ta mai haɓaka manhajoji. Yana bin abin da mai haɓaka manhajoji ke faɗi a gaban kwamfutar tafi-da-gidanka.
Wannan ƙarfin da aka saita, tare da rashin ɓoyewa da kuma rashin wani sharewa mai ban mamaki lokacin shigarwa, yana kama da sanya wuri a matsayin wuri don samun dama da aka yi niyya maimakon satar takardun shaida na dama-dama.
Ba wai kawai muna tabbatar da alaƙar ba ne daga wannan kawai. Muna lura da bayanin aikin.
Zagayen kwanaki takwas na sake zagayowar ranar node-env-resolve shine mafi kyawun bayani game da aiki a cikin tsarin lokaci.
Wannan ba faifan da aka yi amfani da shi wajen yin dropper ba ne. Mai bugawa yana kula da dropper ɗin sosai, wanda yawanci yana nufin ɗaya daga cikin abubuwa biyu. Ko dai suna daidaita shi da yanayin gwaji kafin a fara amfani da shi, ko kuma sun riga sun sami na'urar shigarwa kuma suna mayar da martani gare shi.
Sauran fakitin guda biyar ba su ga wani sauyi ba bayan buga su na farko. Wannan ya dace da tsarin "mataki ɗaya, bar mai suna" ga ƙungiyar tallafi yayin da ƙoƙarin injiniyanci ya mayar da hankali kan kunshin da ke yin aikin.
Bayani: Ƙananan Alamu, Babu Hukunci Mai Karfi
Jama'a OSINT Sigina suna da siriri, kuma ba za mu shimfiɗa su ba. Abin da za a iya gani:
Ma'ajiyar Gmail tanvisoul9 wani ɓangare yana kama da sunan Kudancin Asiya, "Tanvi." Wannan alama ce mai rauni. Maɓallan Gmail ba asali ba ne, kuma abubuwan da ke bayansu soul9 na gama gari ne. Ba shi da haɗari a faɗi labarin ƙasa daga wani imel na gida kawai.
Salon lambar ba shi da ban mamaki Node.js: standard kiran laburare kamar os, child_process, spawn, Da kuma reg addBabu wani ɓoyewa, babu juyawar igiya, kuma babu wata dabara ta hana cire kurakurai. Marubucin yana jin daɗin tsarin rajista na Windows da kuma tsarin tsara tsarin yara, amma da alama bai kai ga neman fasahar kasuwanci mai ɓoye da za su iya amfani da ita ba.
Abubuwan da ake buƙata ba su da tabbas kuma an san su sosai: screenshot-desktop, nut-js, better-sqlite3, Da kuma socket.io-clientBabu wata yarjejeniya ta musamman, babu tarin C2 da aka mirgina daga karce, kuma babu wata sabuwar dabara ta juriya fiye da littafin karatu Maɓallin Gudun HKCUWannan ƙwararren mai haɗa kayan aiki ne, ba marubucin kayan aiki ba.
Ba mu sami igiyoyi marasa Turanci ba, sharhi da aka saka, bayanan gida, ko kuma yatsan hannu na yankin lokaci a cikin kayan tarihi da aka buga.
Mun duba ko akwai karo tsakanin lambobi da kamfen ɗin da muka riga muka bi diddiginsu, ciki har da Shai Hulud, Mujiya, Buildkite, da kuma heibai na baya-bayan nan / claude-code-best Iyalin Anthropic-CLI clone. Ba mu sami ko ɗaya ba: babu tsarin C2 da aka raba, babu tsarin fayil da aka raba, kuma babu karin magana da aka raba.
Abin da ba za mu ce ba: cewa wannan wani ɗan siyasa ne na jiha, wata ƙungiya da aka sani, ko kuma ta fuskar yanki da ke da alaƙa da kowace ƙasa.
Bayanin aiki ya yi daidai da ƙaramin ƙungiya mai ƙwarewa mai matsakaicin aiki da ke sa ido kan wuraren aiki na masu haɓakawa. Wataƙila yana da alaƙa da kuɗi ta hanyar amfani da hanyar shiga ta ƙasa, amma kuma yana iya zama kamar sabis ga wani mai siye daban.
Maki biyu a kaikaice suna goyon bayan waɗanda ke karantawa: guje wa hanyoyin fitar da abubuwa masu jan hankali waɗanda za su ƙone rukunin da sauri, kamar bots na Telegram, oastify.com, ko canarytokens, da kuma sunayen fakiti marasa kyau da gangan, waɗanda ke fifita shigarwar dogon wutsiya mai natsuwa a kan ɗan gajeren girma mai girma.
Alamomin Sasantawa da Ganowa
| Fakiti da Mai Bugawa | |
|---|---|
| Field | darajar |
| mai bugawa npm | user0001 |
| Imel ɗin mai wallafawa | tanvisole9@gmail.com, ba a tabbatar ba |
| Pakete | centralogger, dom-utils-lite, node-fetch-lite, connector-wakili, node-gyp-runtime, node-env-resolve |
| An tabbatar da aikata mugunta | node-env-resolve@1.0.7, node-env-resolve@1.0.8 |
| Kayayyakin Tarihi Masu Shiryawa | |
|---|---|
| type | darajar |
| Maɓallin juriya | HKCU\SoftwareMicrosoftWindowsCurrentVersionRun |
| Darajar juriya | Sunan mai canzawa; bayanai na fom ɗin wscript.exe " \\ .vbs" |
| Shigar da ƙugiya | postinstall: node postinstall.js a cikin bayanin kunshin |
| Modules na dasawa | src/audioCapture.js, src/browserHistory.js, src/systemInfo.js |
| Jagorar gabatarwa | An warware INSTALL_DIR a wajen node_modules na aikin; an saita wurin ta postinstall.js a lokacin shigarwa |
| Network | |
|---|---|
| type | darajar |
| Sufurin C2 | socket.io-client, tashar mai ɗorewa mai jagora biyu |
| ƙarshen C2 | An bayar da shi ga wakilin ta hanyar canjin yanayi na SERVER_URL; ba a sanya masa lamba mai ƙarfi a cikin kayan tarihi da aka buga ba |
Bayanan Ganowa
Dokoki biyu sun shafi wannan iyali ba tare da buƙatar ƙarshen C2 ba.
Da farko, yi alama da rubutun bayan shigarwa wanda ke aiki a cikin npm install zuwa wata hanya a wajen kundin adireshin fakitin. Duk wani ingantaccen mai saukarwa kafin a gina, kamar node-gyp sake ginawa ko kuma masu saukar da binary da aka riga aka gina, suna rubutu a cikin fakitin ko kuma a cikin dandamali-standard hanyoyin cache tare da ingantattun hashes. Ba ya rubutawa cikin sabon ƙirƙira INSTALL_DIR a wani wuri a kan faifai.
Na biyu, yi alama da rubutun bayan shigarwa wanda ke fitowa reg add HKCU\…\Run tare da wscript.exe a matsayin mai ƙaddamar da shirin. Wannan ba ya taɓa zama halaltacce daga kunshin npm ba. Yi masa alama kuma ka killace shi.
Tsarin lissafi na uku yana da amfani don gano fakitin 'yan'uwa na gaba kafin a tabbatar da shi: sabon mai buga npm wanda ba shi da wani SCM tabbatarwa, imel na Gmail, a'a repository filin, da kuma sunayen gajarta da yawa, na gama gari, masu kama da kayayyakin more rayuwa da aka buga cikin 'yan kwanaki kaɗan, shi kaɗai, ya isa ya cancanci yin bita da hannu.
An bayar da rahoto ga rajistar npm. Za mu sabunta wannan sakon idan aka cire asusun mai wallafawa.
