Xygeni nyuam qhuav pom ib qho qauv txhawj xeeb hauv thaj chaw ntawm kev tawm tsam software hauv xyoo 2025, tshwm sim thoob plaws ob tus thawj tswj hwm pob khoom nrov: PyPI thiab npmUa ib feem ntawm peb txoj kev siv zog ntawm kev txawj ntse txog kev hem thawj,Xygeni's Malware Early Warning (MEW) cov cuab yeej tau txheeb xyuas ib qho piv txwv sib txawv tab sis zoo sib xws ntawm cov pob khoom phem uas tau xa mus rau lwm lub npe sau npe ua ntej. Cov ntaub ntawv no qhia txog yuav ua li cas cov neeg ua phem hem thawj tau hloov pauv thiab siv cov txheej txheem tawm tsam rov qab thoob plaws hauv ecosystem, tshwj xeeb tshaj yog los ntawm Cov pob khoom Python phem thiab cov pob khoom npm phem, uas ua rau muaj kev pheej hmoo ntawm cov pob khoom phem nkag mus rau hauv cov saw hlau qhib.
Xygeni's MEW: Pom Qhov Zoo Sib Xws
Xygeni lub cuab yeej MEW yog tsim los nrhiav thiab cim cov pob khoom phem, tshwj xeeb tshaj yog cov uas txuas nrog Software Supply Chain Attacks hauv xyoo 2025, sai li sai tau thaum lawv tau tshaj tawm rau cov ntawv sau npe qhib. Nws ua haujlwm los ntawm kev tshuaj xyuas cov pob khoom tshiab rau tus cwj pwm txawv txawv.
Hauv qhov xwm txheej no, nws tau pom ob qho tib si Cov pob khoom Python phem (graphalgo ntawm PyPI) thiab cov pob khoom npm phem (express-cookie-parser rau npm).
Cov Pob Khoom Python thiab npm phem hauv Software Supply Chain Attacks (2025)
Cia peb tshawb nrhiav cov yam ntxwv sib koom ua ke uas ua rau peb cov ceeb toom ua rau muaj:
Kev kuaj mob Typosquatting
Lawv ob leeg tau sim ua txuj ua li cov pob khoom uas twb muaj lawm.
- graphalgo (PyPI): "Python pob rau kev tsim thiab tswj cov duab thiab cov tes hauj lwm."Tau muab tso los ntawm ib tus neeg siv lub npe hu ua "larrytech" Thaum Lub Rau Hli 13, 2025, lub pob no tau nthuav tawm nws tus kheej ua lwm txoj hauv kev PyPi rau qhov project graphalgo tsis yog qhov phem, uas tom qab ntawd tau hloov npe ua graphdict.
- express-cookie-parser (npm): Lub pob no ua raws li lub pob khoom qab zib-parser uas paub zoo, txawm tias ua raws li nws README.md. Kev ua txuj ua li no yog ib qho tswv yim qub los siv kev ntseeg siab uas twb muaj lawm.
Kev Ua Phem Ua Kab Tiv Thaiv Thawj Zaug
Ob lub pob khoom tau zais lawv cov lej phem hauv cov ntaub ntawv qub. Rau graphalgo, cov lej zais cia tau pom nyob rau hauv /utils/load_libraries.py. Nyob rau hauv cov ntaub ntawv ntawm express-cookie-parser, cookie-loader.min.js muaj cov payload uas tsis meej.
Cov txheej txheem pib ntawm kev tsis meej pem no feem ntau yog siv los cuam tshuam kev tshuaj xyuas tsis tu ncua thiab kev tshuaj xyuas zoo li qub. Kev tsis meej pem yooj yim heev: rov ua dua ZLib compression ntxiv rau Base64 encoding. Hom kev tsis meej pem no qhia meej tias software tab tom sim zais nws tus cwj pwm. Nrog rau lwm cov pov thawj, qhov no tso cai rau Xygeni MEW los faib cov pob khoom ua cov malware. Thaum lub sijhawm lees paub, peb cov neeg tshuaj xyuas tau npaj cov ntawv sau deobfuscation uas qhia txog theem dropper phem.
Kev Xa Khoom Them Nqi Ntau Qib thiab Ib Qho Chaw Pib Sib Koom
Ob lub pob khoom ua haujlwm ua thawj "poob cev, ” teeb tsa theem rau qhov payload tiag tiag. Lawv tau sib koom ua ke sab nraud “noob"URL ntawm cov ntaub ntawv:"https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
Cov ntaub ntawv noob sab nraud zoo sib xws no yog ib qho cim qhia txog kev hem thawj sib koom ua ke. Qhov nthuav yog, cov ntsiab lus ntawm cov ntaub ntawv noob no zoo li yog cov hloov pauv ib puag ncig yooj yim (piv txwv li, JWT_SECRET, PORT), uas ua rau kev tshuaj xyuas tsis meej rau nws txoj haujlwm tiag tiag.
Kev daws teeb meem dynamic C2 nrog DGA
Ib qho tswv yim zoo uas pom muaj nyob rau hauv cov pob khoom phem no yog kev siv Domain Generation Algorithm (DGA) los daws qhov Command and Control (C2) server dynamically. Cov txheej txheem no, feem ntau pom hauv kev tawm tsam software supply chain xyoo 2025, vam khom SHA256 hash uas tau los ntawm cov ntsiab lus ntawm cov ntaub ntawv noob, ua ke nrog lwm cov nqi hardcoded. Los ntawm kev ua li ntawd, C2 infrastructure hloov pauv ntau zaus, ua rau cov blacklist ib txwm tsis muaj txiaj ntsig zoo. Hauv qhov no, npm variant siv tus nqi ruaj khov ntawm 496AAC7E ua ib feem ntawm nws cov kev xav DGA.
Tsim Kom Muaj Kev Ruaj Khov
Ob tug neeg tawm tsam xav kom muaj kev nyob ruaj khov rau ntawm cov kab ke uas raug cuam tshuam. Lawv txoj kev npaj yog tso ib daim ntawv, startup.py (rau PyPi) los yog startup.js (rau npm), mus rau hauv cov npe ntawm cov neeg siv Google Chrome thoob plaws ntau lub operating systems (Windows, Linux, macOS).
Kev Ntxuav Tom Qab Ua Haujlwm
Yuav kom txo tau qhov tsis pom kev, ob daim ntawv sau phem tau ua cov haujlwm ntxuav. Qhov no suav nrog kev rho tawm lawv cov ntaub ntawv dropper thawj zaug (load_libraries.py, cookie-loader.min.js) thiab hloov kho cov ntaub ntawv pob khoom raug cai (__init__.py, index.js) kom tshem tawm cov kev xa mus rau cov khoom uas tam sim no raug tshem tawm.
Cov Cim Qhia Txog Kev Ua Phem Hauv Malicious Python thiab npm Pob Khoom
- PyPI Pob Khoom: graphalgo (luam tawm los ntawm larrytech, Lub Rau Hli 13, 2025)
- npm pob khoom: express-cookie-parser (tshwj xeeb yog version 1.4.12)
- Nkag mus rau URL ntawm Shared Seed:
https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
- Cov Npe Ntaub Ntawv Uas Nyob Mus Ib Txhis:
startup.py(Python)startup.js(JavaScript) - Cov Kev Mus Los Uas Nyob Mus Ib Txhis (OS-dependent)Hauv cov npe ntawm cov ntaub ntawv neeg siv Google Chrome (piv txwv li,
AppData\Local\Google\Chrome\UserData\Scripts\ntawm Windows,~/.config/google-chrome/Scripts/ntawm Linux, thiab lwm yam).
Yuav Ua Li Cas Tiv Thaiv Cov Pob Khoom Phem Hauv Kev Tawm Tsam Software Supply Chain Xyoo 2025
Ib Txoj Kev Pom Zoo rau Cov Neeg Tsim Khoom
Qhov xwm txheej no ua haujlwm ua ib qho kev kawm tseem ceeb hauv thaj chaw muaj kev hem thawj ntawm kev tawm tsam software hauv xyoo 2025. Nws qhia txog yuav ua li cas cov pob Python phem thiab cov pob npm phem tuaj yeem nkag mus rau hauv cov ecosystem ntseeg siab, feem ntau zam kev kuaj pom kom txog thaum nws lig dhau lawm. Yog vim li cas kev kuaj pom thaum ntxov, cov cuab yeej ntse, thiab kev tu cev huv si tam sim no yog qhov tseem ceeb ntawm txhua qhov kev ua haujlwm DevOps ruaj ntseg. Cov neeg tsim khoom raug txhawb kom xav txog cov hauv qab no:
Kev Tshuaj Xyuas Txog Kev Nyob Ntawm Qhov Txuas
Yog tias koj cov haujlwm tau suav nrog graphalgo or express-cookie-parser, nws yuav yog qhov zoo kom txuas ntxiv mus nrog lawv tshem tawm.
- Rau PyPI:
pip uninstall graphalgo - Rau npm:
npm uninstall express-cookie-parser
Kev Huv Si ntawm Lub Cev
Xav txog kev ua qhov kev tshuaj xyuas lub cev kom ntxaws. Nws tseem ceeb heev uas yuav tsum tau kuaj xyuas cov ntaub ntawv ntawm cov neeg siv Chrome kom paub seb puas muaj dab tsi tshwm sim. startup.py or startup.js cov ntaub ntawv.
Kev Ntsuas Kev Ruaj Ntseg Ua Ntej
- Soj Ntsuam Cov Kev Cia Siab TshiabTsim kom muaj ib txoj kev cai los soj ntsuam cov pob khoom tshiab ua ntej kev koom ua ke, tsom mus rau cov uas tsis paub zoo.
- Kev Sib Koom Tes Cov Cuab Yeej Kev Ruaj NtsegCov cuab yeej zoo li Xygeni's MEW, nrog rau lwm yam Software Composition Analysis (SCA) cov kev daws teeb meem, tuaj yeem muab ib txheej tiv thaiv tseem ceeb los ntawm kev txheeb xyuas cov cwj pwm txawv txawv thiab qhov tsis muaj zog.
- Txoj Cai Tsawg Tshaj PlawsKev khiav lag luam ib puag ncig kev txhim kho nrog lub hauv paus ntsiab lus ntawm qhov tsawg tshaj plaws txoj cai tuaj yeem pab txwv qhov cuam tshuam ntawm kev sib haum xeeb.
- Kev Paub Txog NetworkKev soj ntsuam cov tsheb khiav tawm hauv network rau cov kev sib txuas tsis zoo qee zaum tuaj yeem qhia txog kev sib txuas lus C2 uas DGA tsim.
Cov ntsiab lus tseem ceeb ntawm load_libraries.py (los ntawm graphalgo)
download_remote_content(): Tswj kev rub cov ntaub ntawv los ntawm cov URLs tshwj xeeb.run_process(): Ua cov ntawv sau Python sab nraud hauv txoj kev sib cais, tswj cov zis kom tsis txhob pom.get_output_file_path(): Txheeb xyuas qhov chaw zoo tshaj plaws rau cov ntaub ntawv startup.py uas ruaj khov.remove_self(): Tswj kev ntxuav tom qab ua tiav cov ntaub ntawv phem thawj zaug thiab kev hloov kho pob khoom.simple_shift_encrypt()/simple_shift_decrypt()Cov haujlwm cryptographic tshwj xeeb rau kev zais cov channel sib txuas lus, tseem ceeb rau kev siv DGA.load_libraries(): Lub luag haujlwm tseem ceeb uas sib koom tes tag nrho cov txheej txheem ntau theem, txij li thawj zaug rub tawm mus rau qhov kawg ntawm kev ua tiav thiab kev ntxuav.
ntaug
Ib yam li lwm cov pob khoom phem uas MEW tau txheeb xyuas, lub firewall dependency tau tiv thaiv cov neeg siv uas yuav suav nrog cov pob khoom phem no hauv lawv cov dependencies tam sim ntawd. Tom qab kev lees paub, peb tau ua raws li cov txheej txheem ceeb toom rau ob lub npe sau npe, uas tom qab kev tshuaj xyuas tau tshem tawm ob lub pob khoom.
