TL; DR
Otu onye ọrụ npm jiri izu isii bipụta ngwugwu "utility" adịgboroja dịka nke TypeScript. ts-form-utils, ts-project-lint, na ts-enum-helper.
Ọ bụ ezie na ngwugwu ndị a na-ekpughe obere ndị enyemaka nkwado ziri ezi, ibu ọrụ ahụ na-arụ ọrụ ozugbo arụnyere ma ọ bụ na mbụ chọrọ ma na-eme ka akara mkpịsị aka nnabata, nchọpụta ụlọ ọrụ GitHub, nchịkọta ebe nchekwa, na iwepụ koodu isi mmalite.
Malware a na-elekwasị anya kpọmkwem na òtù GitHub dị oke ọnụ ahịa, gụnyere ọtụtụ Shopify ebe a na-edebe ihe, wee debe ma wepụ osisi ndị a pụrụ iru eru ruo ebe nchịkọta etiti.
Dịka akụkụ nke usoro nkwekọrịta, ibu ọrụ ahụ commitweghachite faịlụ ahụ n'ime ebe nchekwa ndị a na-emegbu ka ị na-eme ka ọ bụrụ njirimara koodu nke Google google-labs-jules[bot].
Anyị sochiri mkpọsa ahụ — nke aha ya bụ JulesJacker — n'ọtụtụ ebe obibi akwụkwọ na ọ dịkarịa ala ọgbọ ise na-ebu ibu ọrụ, gụnyere ụdị dị iche iche e zoro ezo na nke a maara na sandbox.
Ụdị kachasị ọhụrụ a na-elekwasị anya kpọmkwem na akụrụngwa nyocha malware: ọ na-arụ ọrụ naanị n'ime gburugburu nyocha, na-ezuru akara ngosi ọrụ metadata ígwé ojii, ma na-enyocha ụgbọ elu njikwa Kubernetes na bọket nchekwa ígwé ojii.
Isi IOC a na-ekerịta n'ọgbọ niile na-ebu ibu bụ njedebe nchịkọta aaronstack[.]com/jules-collect.
Oke ike: dị oke mkpa.
Mwakpo ahụ: Otu O Si Arụ Ọrụ
Ngwugwu JulesJacker ọ bụla na-agbaso otu ndebiri ahụ. ngwugwu.json na-akpọsa onye enyemaka TypeScript dị mma nke nwere ikike MIT na enweghị ebe nchekwa njikọ. index.js na-ebupụ obere ọrụ dị adị — regexes email, enum maps, lint rule tables — ka onye mmepụta nke na-ebubata ngwugwu ahụ wee hụ omume dị mma. Ajọ omume ahụ dị n'ebe ọzọ: na nrụnye mgbe etinyere nko, ma ọ bụ n'ime blọk dị n'okpuru nke index.js nke na-eme oge achọrọ modulu ahụ.
Ibu ndị a agbanweela site na ọkwa dị n'ime nke nwere nọmba doro anya (onye ọrụ ahụ na-akpọ ihe omume telemetry nke ya sc1-, sc3-, sc4-, na ihe ndị ọzọ), na ikiri mgbanwe ahụ bụ ụzọ kachasị doo anya isi ghọta mkpọsa ahụ.
Ọgbọ nke 1–2: nyocha na izu ohi git-config
Ngwugwu ndị mbụ bụ ndị na-ere infostealers ozugbo. Mgbe etinyere ha, ha na-anakọta mgbanwe gburugburu ebe obibi, GitHub CLI na-akwado faịlụ, yana nhazi git zuru ụwa ọnụ (git config –global –list, git remote -v), wee zipụ ngwugwu ahụ na njedebe nchịkọta ahụ. Nke a guzobere mbinye aka onye ọrụ: akụkọ mkpuchi "Ọrụ nkwado ụdịdịScript", ihe ngosi mpụga na otu ngalaba, na mmasị maka asambodo onye nrụpụta kama data ndị ahịa.
Ọgbọ nke 3: nyocha mgbapụ hypervisor na kernel
Otu ụdị mgbasa ozi etiti gbadoro ụkwụ nke ukwuu n'ime mwakpo akụrụngwa. Kama izu ohi nhazi, o mere nyocha ihe mgbochi. AF_VSOCK sockets, virtio MMIO mpaghara, / dev / mem, na ọkọlọtọ ike kernel, na ọbụna nwara mkpọka kernel nke sysrq kpalitere — omume metụtara mgbalị ịgbapụ na igwe ma ọ bụ akpa mebere emebere.s0-vmm-recon, s1-vmm-vsock-fuzz, s2-vmm-mmio, s3-kernel-probe) mere ka ebumnuche a doo anya. E mere nke a nke ọma maka ígwé ojii-sandbox na gburugburu ebe ndị na-agba ọsọ na-enweghị sava — ụdị VM ephemeral nke na-ewulite ma na-anwale koodu a na-atụkwasịghị obi.
Ọgbọ nke 3 (SC3): ikpuru ide ihe n'obe
Ebe ike ndọda nke mkpọsa ahụ ghọrọ onye ohi repo nke na-agbasa onwe ya. Mgbe etinyere ya, ibu ọrụ ahụ na-agba usoro oge ise:
- ogbo 0 (~100 ms): akara mkpịsị aka onye ọbịa — aha onye ọbịa, ozi onye ọrụ, njirimara git.
- ogbo 1 (~3 s): chọpụta otu nzukọ onye ahụ metụtara so na ya site na inyocha git remote -v, wee chọọ koodu siri ike ORG_CONFIG ohere ịnweta tebụl na ebe nchekwa ule na git ls-remote — e zigara ya site na proxy SSRF nke onye na-awakpo na-achịkwa na http://git@192.168.0.1:8080.
- ogbo 2 (~ sekọnd 10): gee clone ebe nchekwa ọ bụla enwere ike iru na ndepụta ebumnuche, tarball na gzip osisi ahụ, base64-encode ya, ma wepụ ya na chunk-filtrate.
- ogbo 3 (~ s 45): "ihe akaebe nke ịnweta" — mepụta ihe nchekwa ederede, tinye faịlụ aha ya bụ SECURITY-POC.md, na commit ya na onye dere ya ka ọ bụrụ google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com> na ọrụ ozi: melite nchekwa ndabere, wee pịa gaa na ngalaba isi nke onye ahụ metụtara.
Ndepụta ihe mgbaru ọsọ nke koodu siri ike abụghị nke a na-ahụkarị. Ọ na-agụta ihe karịrị iri atọ Shopify ebe nchekwa aha - Shopify/shopify, Shopify/njikọ, Ụlọ ahịa/ịkwụ ụgwọ, Shopify/vault, Shopify/ihe nzuzo, Shopify/akụrụngwa, Shopify/.github, na ọtụtụ ndị ọzọ — tinyere nzukọ nnwale, AaronStackBarnes, na o yiri ka onye ọrụ ahụ na-achịkwa ma na-eji dị ka ihe mgbaru ọsọ ide ihe.
Ọgbọ nke 4 (SC4): ezoro ezo ma nwee oghere
Ụdị kachasị ọhụrụ nke na-eche ihu na onye nrụpụta na-agbakwụnye akwa abụọ nke ịgba ọsọ n'elu ikpuru SC3.
Nke mbụ, ibu ọrụ anaghịzi abata dị ka ederede doro anya. Ezi echiche dị na blọb AES-256-CBC nke e zoro ezo, lib/.perf.dat, ya na IV na byte iri na isii mbụ ya. index.js na-emegharị igodo decryption site na iberibe eriri ndị ejikọtara ọnụ, na-ewepụ blob ahụ, ma na-agba ya na Ọrụ ọhụrụ()A na-ekewa ọbụna aha modulu iji zere nyocha ndị na-anaghị agbanwe agbanwe — chọrọ('crypt' + 'o'), chọrọ('f' + 's').
Nke abụọ, ọ bụ host-gate. Otu ụdị na-ewepụ naanị ma na-agba ọsọ mgbe aha os.hostname() nhata igbe devbox or ubuntu-fc-uvm (ndabara ndabara nke Firecracker microVM) ma ọ bụ nwere ihe mgbakwunye ahụ igbe devboxỌnụ ụzọ ọzọ dị n'ihu nke .jules/ ndekọ ọrụ:
N'ikwu ya n'ụzọ ọzọ, a na-eme atụmatụ ibu SC4 ka ọ nọrọ na-ehi ụra na laptọọpụ onye mmepụta nkịtị ma teta naanị n'ime onye nnọchi anya AI akpaka na gburugburu sandbox onye ọrụ ahụ chọrọ n'ezie imebi iwu.
Ịgbanye Ụlọ Nyocha: Ụdị Nyocha na Akụrụngwa
Ngwugwu kachasị ọhụrụ na mkpọsa ahụ, onye inyeaka ts-enum, anaghị alụso ndị mmepe ma ọ bụ Shopify ọgụ ma ọlị. postinstall.sh meghere na ọnụ ụzọ ámá nke na-enye egwuregwu ahụ ohere:
Edemede a anaghị eme ihe ọ bụla ma ọ bụrụ na edobere mgbanwe gburugburu ebe obibi nke metụtara ikpo okwu nyocha malware. Mgbe ọ dị, ibu ọrụ ahụ maara na ọ na-agba n'ime igbe ájá nke dị iji gbawaa ma mụọ ngwugwu dịka nke a — ọ na-alụsokwa ọgụ.
Ọ na-ebu ụzọ dọpụta akara ngosi ọrụ GCP OAuth site na sava metadata instance wee wepụ ya. Mgbe ahụ, site na iji akara ngosi ahụ, ọ na-ehichapụ akara ngosi ahụ. Ụgbọ elu njikwa Kubernetes enwere ike iru na kubernetes.default.svc:
- depụtara Njikọta Ọrụ Cluster, Njikọta Ọrụ, na Nodes;
- na-enyocha pods, nzuzo, na nhazi n'ofe sistemụ kube, ndabara, kube-ọha, mgbazinye kube-node, na aha oghere nyocha;
- nsogbu SelfSubjectAccessReview na-akpọ iji maapụ kpọmkwem ihe njirimara ezuru ikike ime.
N'ikpeazụ, ọ na-amanye Google Cloud Storage aha bọket e ji koodu GCP arụ ọrụ rụọ (onye na-akanye akara-437603-p9) na nọmba ọrụ, ịkọ nkọ njikọta dịka *-na-ewuli, *-ihe ochie, na ọtụtụ ọrịa kansa- prefixes (ihe na-akpata ọrịa malysis, ngwungwu ọrịa malysis, nyocha ọrịa malysis) A na-edekọ ma zipụ koodu nzaghachi na ahụ ọ bụla n'otu ebe ahụ jules-collect njedebe.
Nke a bụ ihe a na-adịghị ahụkebe nke ibu ọrụ ọkọnọ e wuru kpọmkwem iji wakpo akụrụngwa nke ndị na-agbachitere. Akụkọ mkpuchi n'ofe mkpọsa ahụ dum - nke iberibe ya pụtara n'ime ibu ọrụ ndị a na-akwụ ụgwọ ka okwu ndị na-akọwa omume ahụ dị ka "Nchekwa Nnyocha PoC ... ide ihe n'usoro site na ihe nrịbama proxy git overscoped" - bụ otu ihe ahụ na-egosi onwe ya, ma ihe mgbaru ọsọ oge ọ bụ Shopify monorepo ma ọ bụ ihe nkesa metadata nke otu nyocha.
Usoro iheomume na Mbugharị Oke
JulesJacker abụghị otu ugboro. Ọ bụ ọrụ na-adịgide adịgide nke lanarịrị mwepụ ndekọ site na ịgbanwe aha ya.
| Mgbe ole | omume |
|---|---|
| Etiti Eprel 2026 | Ngwugwu mbụ na-apụta n'okpuru oke mbipụta mbụ: TS-utility façade, environment na git-config exfiltration. |
| mbido Mee 2026 | E bipụtara ụdị nchọpụta Hypervisor na kernel-escape. |
| Ọkara ruo ngwụcha Mee 2026 | SC3 cross-repo write worm pụtara n'akụkụ Shopify-ezubere iche maka ibu ọrụ na google-labs-jules[bot] n'igosi onwe onye. SC4 na-ewebata ihe ndị e tinyere n'ime AES na ndị e tinyere n'ime oghere. |
| Mbubreyo Mee 2026 | npm na-ewepụ oke mbipụta mbụ; aha ngwugwu na-aghọ ihe na-ejide nchekwa efu. |
| Izu ahụ otu | Onye ọrụ ahụ na-akwaga na ihe dị ka otu ụdị ihe ahụ ma bipụtaghachi ikpuru ahụ, gụnyere ụdị ihe owuwu nyocha. |
Mbugharị ahụ bụ akụkụ ndị na-agbachitere kwesịrị ịnọnyere. Iwepụ nke scope mbụ emeghị ka mkpọsa ahụ kwụsị ma ọ bụ belata ya. Onye ọrụ ahụ etinyelarị scope yiri nke aha ya dị iche na nke mbụ site na otu mkpụrụedemede, ma nọgide na-ebipụta ya n'ime otu izu ahụ. Dịka e si dee ya, scope ọhụrụ ahụ ts-form-utils (nsụgharị 1.0.0 ruo 1.1.0), ya ọrụ ts-lint (1.0.0 na 1.1.0), na nke nọọrọ onwe ya onye inyeaka ts-enum (1.0.0) ka dị mfe ịwụnye.
Ihe Ndị Na-egosi Nkwekọrịta
E kwadoro ihe ngosi niile dị n'okpuru ebe a megide isi iyi ngwugwu ahụ.
| ụdị | egosi | Notes |
|---|---|---|
| Netwọk (C2) | aaronstack[.]com/jules-collect | Otu njedebe nchịkọta n'ọgbọ ọ bụla; na-enweta telemetry JSON na iberibe tarball base64-gzip. |
| Netwọk (nnọchianya SSRF) | http://git@192.168.0.1:8080 | Ihu maka ihe nrịbama git proxy nke e ji ekpuchi ihe nke ukwuu nke e ji erute ebe nchekwa ndị otu ezubere iche. |
| Netwọk (igwe ojii) | metadata.google.internal/computeMetadata/v1kubernetes.default.svcstorage.googleapis.com/storage/v1/b | Ejiri naanị ụdị nyocha na akụrụngwa eme ihe maka izu ohi ihe nrịbama na nyocha ụgbọelu Kubernetes. |
| Identity | google-labs-jules[bot]161369871+google-labs-jules[bot]@users.noreply.github.com | Ekere commit njirimara onye edemede ahụ tinyere aka na ngalaba ndị a na-emegbu. |
| File | lib/.perf.dat | AES-256-CBC-encrypted payload blob; IV echekwara na byte 16 mbụ ma rụgharịa igodo ahụ nke ọma na index.js. |
| File | SECURITY-POC.md | E tinyere na commitozi ahụ laghachiri n'ebe a na-edebe ndị ihe metụtara chore: update dependency cache. |
| File | scripts/postinstall.sh | E tinyere n'ọnụ ụzọ ámá $MALYSIS_ANALYSIS_ID; na-achọpụta ụdị ihe dị iche iche e ji eme nnyocha-ihe owuwu. |
| Omume | os.hostname() na-enyocha maka devbox / ubuntu-fc-uvm | Ọ na-eme ka ebe a na-eji igbe Sandbox na AI arụ ọrụ dị mma tupu e depụta ma mezie ya. |
| Omume | .jules/ na /app/.jules na-agụ akwụkwọ ndekọ | Nzube doro anya nke gburugburu ebe ọrụ onye nnọchi anya AI. |
| Omume | sc1-, sc3-, sc4-, s0-vmm-recon | Akara ngosi telemetry nke onye ọrụ depụtara bara uru maka nchọpụta na ịchụ nta. |
| Ebumnuche ígwé ojii | rare-signer-437603-p9malysis-* atụmatụ ịwụ | Ihe nchọpụta ọrụ GCP siri ike na ụkpụrụ nchịkọta ihe nchekwa-bọket nke etinyere na ụdị nyocha-akụrụngwa. |
| Ụdị ngwugwu | Facade ngwugwu TS-utility na-enweghị ubi ebe nchekwa | Nlereanya mkpọsa na-agbanwe agbanwe: ngwugwu ngwa TypeScript adịgboroja nwere ibu ọrụ ọjọọ agbakwunyere postinstall hooks ma ọ bụ agbakwunyere na index.js. |
