TL, DR
Don kusan watanni biyu, wani npm infostealer guda ɗaya ya sake bayyana a ƙarƙashin jerin sunayen fakiti masu juyawa yayin da ake jigilar kayan aiki kusan ba a canza su ba. Ya fara a bayyane kamar yadda forge-jsxy, an haife shi forge-jsx3 / forge-jsx4 'yan'uwa, sannan suka daina amfani da alamar "forge" gaba ɗaya don nuna a matsayin kayayyakin more rayuwa na masu haɓakawa - da farko zredis-typed, kuma mafi kwanan nan pinokio-redis.
Kowane nau'in yana ɗauke da sarkar kayan aiki ta ciki ɗaya: fayilolin da aka sanya wa suna forge-jsx-explorer-*, a relayPackageServe module wanda ke aiki forge-jsxy-package.tgz, da kuma lokacin aiki mai ɗorewa da aka ɓoye a ƙarƙashin kundin adireshi mai dige-dige don haka yana tsira daga goge kunshin npm.
Nauyin da aka ɗauka yana karantawa walat ɗin cryptocurrency da kuma takardun shaidar masu haɓakawa daga mai masaukin baki kuma suna aika su zuwa gidan yanar gizo na Discordhooks, HuggingFace Hub yana lodawa, da kuma ƙarshen C2 mai lamba mai lamba. Yana shigar da farawa ta atomatik na matakin OS don haka yana aiki bayan sake kunnawa, kuma yana ɗaukar allo, allon rubutu, da ayyukan allo. Sabon nau'in, pinokio-redis, ya bayyana kansa a matsayin haɗin "Autodesk Forge" — bayanin da ba shi da alaƙa da abin da lambar ke yi.
| Kayan daji | npm |
| Ajin nauyin kaya | mai satar bayanai mai matakai da yawa + wakilin sarrafa nesa (RAT) |
| Manyan manufofin | Wallet ɗin crypto, fa'idodin walat ɗin mai bincike, bayanan masu haɓakawa/gajimare |
| dagewa | lokacin aiki mai ɗorewa + OS ta atomatik farawa (cire fakitin ya tsira) |
| Exfiltration | Yanar gizo ta Discordhooks + relay, HuggingFace Hub, mai lambar C2 mai lamba 9877 |
| Tsawon lokacin da aka lura | Mayu 2026 - Yuli 2026 (a ci gaba) |
| Sunan ƙarshe | pinokio-redis:1.0.127 |
Hari da Jiki
Kowace siga a cikin wannan iyali tana shigarwa ta hanyar siffa iri ɗaya: fakiti wanda yayi kama da marar aiki a shafin jerin sa amma yana bayyana ƙugiya bayan shigarwa, don haka Nauyin yana gudana da zarar an shigar da kunshin a matsayin abin dogaro. ƙugiya tana tuƙa sarkar matakai biyar.
- Mataki na 1 - a yi da'awa. Rubutun shigarwa yana fassara wani abu da aka haɗa, wanda aka rubuta A goge rubutun lokacin gudu sannan a rubuta su a cikin wani ɓoyayyen kundin adireshi a ƙarƙashin wurin saitin dandamali (sigogin forge-jsxy sun yi amfani da digo .forge-jsxy/runtime/v / hanya). Domin wannan kwafin yana zaune ne a wajen node_modules, cirewa ko cire kunshin npm ba ya cire wakilin da ke gudana.
- Mataki na 2 - ci gaba. Sarkar tana yin rijistar shigarwar farawa ta atomatik ta OS don haka wakilin zai sake farawa lokacin sake kunnawa. A kan Windows wannan yana gudana ta hanyar rubutun PowerShell da aka ɓoye; tsarin wakili an ƙirƙiri shi daban kuma tare da saitin windowsHide don haka babu taga na'urar wasan bidiyo da ta bayyana.
- Mataki na 3 - kubuta. Lokacin aiki yana duba alamun haɗin kai na ci gaba kuma yana fita a hankali lokacin da ya gano yanayin CI, don haka akwatunan sandboxes na ginawa ta atomatik ba su ga komai ba. A cikin nau'ikan forge-jsxy, wani sharhi na tushe ya bayyana cewa an cire filin forgeInstall da gangan daga package.json "saboda wannan filin zai bayyana a npm" - mai aiki ya ajiye bayanan mai kunna daga jerin jama'a da gangan.
- Mataki na 4 - tattarawa. Da zarar an fara aiki, wakilin zai yi girbi, a lokaci guda:
- Kayan walat ɗin Crypto. Jerin abubuwan da aka haɗa na secret_filename_patterns.json yana haifar da tsarin fayil don wallet.dat, *.mnemonic /.seed / *.phrase files, keypair.json, Ethereum UTC– shagunan keys, da kuma shagunan keys *.p12 / *.pfx / *.jks. Dakunan karatu na walat (bip39, secp256k1, base58check, da Solana helpers) suna nan a cikin kunshin.
- Fadada walat ɗin mai bincike. Tsarin chromiumExtensionDbHarvest yana karanta bayanan ajiya na gida na masu binciken Chromium, wurin da ƙarin walat ɗin da aka yi amfani da su a burauzar ke adana bayanan ajiyar su.
- Takardu da kuma sirri. Wakilin yana duba tarihin harsashi da fayilolin da ke ɗauke da sirri sannan yana karanta bayanan masu haɓakawa/gajimare, sannan yana rubuta bayanan HuggingFace don lodawa.
- Shigarwa kai tsaye. Ana ɗaukar abubuwan da ke cikin allon rubutu, shigar da madannai, da hotunan kariyar kwamfuta akai-akai.
Mataki na 5 - fitar da ruwaBayanan da aka tattara sun bar mai masaukin baki har zuwa uku Tashoshin da ke aiki a layi ɗaya: Yanar gizo ta Discordhooks (discordWebhookPost) da kuma mai lodawa na Discord wanda ke magana da `discord.com/api/v10 (discordRelayUpload), lodawa na HuggingFace Hub (hfUpload), da kuma Maƙallin ƙarshe na C2 mai lamba mai lamba ya kai ta tashar jiragen ruwa 9877. RelayPackageServe Bugu da ƙari, module ɗin yana amfani da forge-jsxy-package.tgz a baya - iri ɗaya sunan kayan tarihi a cikin kowane suna.
Muhimmin abu shine cewa matakan 1-3 suna aiki a lokacin shigarwa tare da babu hulɗar mai amfani, kuma mataki na 1 yana sanya nauyin da ake buƙata a wani wuri a cikin kunshin manaja baya bin diddigin. Mai haɓaka wanda ya lura da dogaro mai ban mamaki da kuma yana gudanar da cirewa na npm yana cire jerin amma ba wakili ba.
Kayan aikin kuma yana hana karantawa cikin sauri. Ba a aika rubutun lokacin aiki ba a bayyane yake: matakin aiwatar da tsari yana kiyaye dabarun aiki azaman toshe mai lamba wanda ke faɗaɗa zuwa rubutun da za a iya karantawa kawai bayan sarkar shigarwa yana fassara shi zuwa cikin ɓoyayyen kundin lokacin gudu. Fayilolin da ake iya gani a kan jerin - siririn shim bayan shigarwa da kuma dist-materialization mataimaki - ba a bayyana komai game da abin da ke gudana a ƙarshe ba. Wannan isarwa mai lamba ƙira ta yi tasiri mai ma'ana kan rarrabuwar kawuna: a tsawon rayuwar iyali, An tabbatar da cewa an tabbatar da bambance-bambancen da yawa ta hanyar rarrabawa ta atomatik, kuma nauyin da aka ɗauka ya kasance ba a bayyana ba don dakatar da bita ta atomatik kai tsaye. Halayen da ke ba wa iyali damar yin hakan za a iya gani ne kawai bayan an rubuta su a cikin takardar an faɗaɗa matakin, kuma ana karanta lokacin aiki kai tsaye.
tafiyar lokaci
Alƙawarin iyalin ya kasance mai ƙarfi sosai; waɗannan canje-canjen sune Suna a cikin akwatin. Bakin yana gudana daga alamar "forge" ta buɗe zuwa yana ɓoye a matsayin kayan aikin haɓaka da ba su da alaƙa.
Abubuwa biyu sun yi fice a cikin jadawalin lokaci. Na farko, ana sake amfani da lambar sigar 1.0.127 ta hanyar zredis-typed da pinokio-redis - suna canzawa amma layin ginin bai sake farawa ba. Na biyu, sauyawa daga sunayen "forge-*" ya zo daidai da sauyawa zuwa sunayen da ake karantawa a matsayin kayan more rayuwa na yau da kullun (redis, pinokio), yana rage damar mai haɓakawa ya kauce wa sunan kuma ya yi jinkiri.
Alamomin Yarjejeniya
An cire IOCs ɗin da ke ƙasa. Mai masaukin C2 ya juya tsakanin layin forge-jsxy da kuma sabon nau'in yayin da ake ci gaba da riƙe tashar jiragen ruwa iri ɗaya.
Siginar ganowa mafi ɗorewa ba kowace mai masaukin baki ɗaya ko kuma mahaɗin yanar gizo ba ce - waɗanda juya — amma sunayen fayil ɗin kayan aiki da kuma forge-jsxy-package.tgz kayan tarihi, waɗanda suka ci gaba da kasancewa a bayyane a duk lokacin da aka sake suna.
Halayya da Ɗabi'un da Aka Lura
An buga fakitin a ƙarƙashin fiye da asusun npm ɗaya. layin ya yi amfani da mai wallafa jacksonkaandorp2 (jacksonkaandorp2@outlook[.]com); sabon nau'in pinokio-redis an buga shi ta donimique (donimiqueakers@gmail[.]com). Babu ɗayan asusun da ke ɗauke da imel ko imel da aka tabbatar ma'ajiyar tushen da aka haɗa. Layin da ke tsakanin asusu shine toolchain, ba asalin mai wallafa ba - sunayen module iri ɗaya, iri ɗaya An yi amfani da .tgz, kuma wannan ƙirar exfil ta sake dawowa ba tare da la'akari da wanda ya buga ba.
Halaye da dama da ake iya gani suna nuna ɓoyewa da gangan maimakon tarin abubuwa da yawa ba bisa ka'ida ba:
Ana sanya lokacin aiki a wajen node_modules a cikin wani ɓoyayyen kundin adireshi, don haka ya fi fakitin da ya kawo shi.
Wakilin yana yin beli idan ya gano yanayin CI, yana iyakance fallasa a cikin akwatunan sandboxes na bincike ta atomatik.
An ƙaddamar da tsarin wakili a ware kuma taga-ɓoye.Cikin A cikin sigar forge-jsxy, wani sharhi ya haɗa rashin filin shigarwa da ake gani da wannan filin da ake "bayyana a npm."
Bayanin kunshin jama'a ba shi da alaƙa da lambar - pinokio-redis yana gabatar da shi azaman haɗin "Autodesk Forge".
Wani gibin gano abubuwa da ake yawan gani ya kamata a lura da shi ga masu kare da ke dogaro da shi rarrabuwa ta atomatik: an tabbatar da bambance-bambancen da yawa a cikin wannan iyali An yi wa mai rarraba ML alama a matsayin amintacce kafin a gyara sake duba lambar hukunci. Abubuwan da suka dace da mai bita zai iya dogara da su - lokacin shigarwa sarkar, lokacin gudu da aka ɓoye, sunayen fayil ɗin kayan aiki - su ne ainihin waɗanda waɗanda suka tsira daga sake suna.
Muna bayyana abin da ke sama a matsayin ɗabi'ar da aka lura. Ba ma danganta shi da ɗabi'ar da aka gani. kamfen ga duk wani ɗan wasan kwaikwayo da aka ambata, kuma ba mu yi iƙirarin cewa mai gudanar da aikin ba ne asali ko manufofi fiye da abin da lambar da kayayyakin more rayuwa suka nuna.
Tasiri, Sauye-sauye & Jagorar Mai Kare
Wanda aka fallasa. An yi nufin tarin kayan aikin ne ga masu haɓakawa. injuna: walat ɗin cryptocurrency da shagunan maɓalli, faɗaɗa walat ɗin mai bincike, tarihin harsashi, da kuma takardun shaidar girgije/sabis. Duk wanda ya girka kunshin da abin ya shafa - kai tsaye ko a matsayin dogaro mai canzawa - a lokacin taga da yake kai tsaye yana cikin ikon yin aiki, kuma ƙirar juriya tana nufin fallasa ba ya ƙarewa lokacin da aka cire kunshin.
Me yasa juriya take da muhimmanci? Domin mataki na 1 yana kwafi kayan da aka biya zuwa wani ɓoyayyen kundin lokacin gudu da rajista na mataki na 2 suna farawa ta atomatik, wanda aka saba ilhami na gyara (cire mummunan dogaro, share node_modules, sake shigar da shi) baya korar wakilin. Amsar lamarin dole ne ta nemi lokacin aiki daga itace da kuma shigar da fara aiki ta atomatik, ba kawai kunshin ba.
Yanayin. Wannan iyali ya nuna wani tsari da ya kamata a kalla: kayan aiki mai ƙarfi da girma, an naɗe shi cikin ruwan da za a iya zubarwasunayen fakitin da ke ƙaura daga kowane suna da aka riga aka cire wanda za a iya gane shi, zuwa ga sunaye waɗanda ake ɗauka a matsayin kayan aikin yau da kullun. jerin masu toshewa da kuma suna da suna ga masu wallafawa sun tsufa da sauri saboda wannan; kuma siginar da aka yi da kayan tarihi ba ta yi ba.
Ga masu haɓakawa da masu amfani
Yi amfani da rubutun lokacin shigarwa a matsayin babban abin haɗari. Shigarwa tare da an kashe rubutun inda zai yiwu kuma sake duba duk wani dogaro da ya bayyana bayan shigarwa. Dogayen dogara na wucin gadi da na wucin gadi; wannan nau'in malware yana zuwa cikin sauƙi ta hanyar dogaro na ɗan lokaci kamar na kai tsaye.
A kan wanda ake zargi da zama mai masaukin baki, nemi fiye da fakitin: nemi ɓoyayyen kundin adireshi na lokacin gudu a cikin wurin saitin dandamali, shigarwar farawa ta atomatik da ba a zata ba, da kuma haɗin waje zuwa Discord webhook ko : 9877 endpoints.
A ɗauka cewa duk wani kalma ta walat, makullin keystore, ko takardar shaidar da ke kan mai masaukin da abin ya shafa a lokacin da aka fallasa ta lalace, sannan a juya ta.
Ga masu rajista da masu kare su
Faɗakarwa kan kayan tarihi masu ɗorewa (forge-jsxy-package.tgz, the forge-jsx-explorer-* / chromiumExtensionDbHarvest / discordRelayUpload sunayen fayiloli) maimakon sunan kunshin, wanda ke canzawa.
Yi alama ga haɗin tsarin da iyali ke dogara da shi - shigarwa bayan shigarwa wanda ya bayyana rubutun zuwa hanyar ɓoyayyen tsari-dir tare da OS rajistar farawa ta atomatik - ba tare da la'akari da takamaiman abubuwan da ke ciki ba.
Sunan da ke kan fakitin ya canza aƙalla sau huɗu; akwatin da ke ciki ba. Ganowa da aka gina bisa abin da lambar ke yi ya wuce kowace shekara sake yiwa lakabi zuwa yanzu.
