Nō nā tata nei i kite a Xygeni i tētahi tauira āwangawanga i roto i te whenua o ngā whakaekenga mekameka tuku pūmanawa i te tau 2025., e puta ake ana i roto i ngā kaiwhakahaere mōkihi rongonui e rua: PyPI a npm. Hei wāhanga o ā mātou mahi tirotiro tūraru tonu,Whakatūpato Moata mō te Pūmanawa Kino a Xygeni (MEW) i kitea e te taputapu tētahi tauira motuhake engari he rite te tikanga o tētahi mōkihi kino i tukuna ki tētahi atu rēhita i mua. E whakaatu ana tēnei take i te whanaketanga me te whakamahinga anō a ngā kaiwhakatūkino i ngā tikanga whakaeke puta noa i ngā pūnaha rauropi, inā koa mā roto i ngā mōkihi Python kino a ngā mōkihi npm kino, e whakapiki ake ana i te mōrearea o ngā mōkihi kino ki te whakauru ki ngā mekameka tuku pūtake tuwhera.
MEW a Xygeni: Te Kite i ngā Āhuatanga Rite
Kua hangaia te taputapu MEW a Xygeni hei kimi me te tohu i ngā mōkihi kino, inā koa ko ērā e hono ana ki ngā Whakaekenga Mekameka Tuku Pūmanawa i te tau 2025, ina whakaputaina ki ngā rēhita pūtake tuwhera. Ka mahi mā te tātari i ngā mōkihi hou mō ngā whanonga whakapae.
I tēnei tauira, i tautuhia e ia ngā mea e rua ngā mōkihi Python kino (graphalgo i runga i te PyPI) me ngā mōkihi npm kino (express-cookie-parser i runga i te npm).
Ngā Mōkihi Python me te npm kino i roto i ngā Whakaekenga Mekameka Tuku Pūmanawa (2025)
Me tūhura tātou i ngā āhuatanga ōrite i whakaoho i ā tātou matohi:
Te pato-kōpiko
I ngana rāua ki te whakaari i ngā mōkihi rongonui o mua.
- graphalgo (PyPI): "He mōkihi Python mō te waihanga me te whakahaere i ngā kauwhata me ngā whatunga."I tukuna ake e tētahi kaiwhakamahi ko "larrytech" I te 13 o Hune, 2025, i puta mai tēnei mōkihi hei huarahi kē atu ki te kaupapa graphalgo taketake, ā, i muri mai ka whakaingoatia anō ko graphdict.
- te kaitātari pihikete-tere (npm): I whai tēnei mōkihi i te mōkihi cookie-parser rongonui, tae noa ki te whakaata i ana README.md. He rautaki matarohia tēnei momo whakatangata hei whakapiki i te whakawhirinakitanga o nāianei.
Te Whakapōrearea hei Raina Tuatahi o te Parenga
I huna e ngā mōkihi e rua ā rāua waehere kino i roto i ngā kōnae taketake. Mō graphalgo, i kitea te waehere huna i roto i /utils/load_libraries.py. I roto i te take o kaitātari pihikete-tere, cookie-loader.min.js i roto te kawenga huna.
Ko tēnei paparanga tuatahi o te whakapōrearea ka whakamahia hei aukati i te tirotiro tūpono me te tātari pūmau. He tino māmā te whakapōrearea: te kōpeketanga ZLib me te whakawaehere Base64. E whakaatu mārama ana tēnei momo whakapōrearea kei te ngana te pūmanawa ki te huna i tana whanonga. I tua atu i ētahi atu taunakitanga, nā tēnei i taea ai e Xygeni MEW te whakarōpū i ngā mōkihi hei pūmanawa kino pea. I te wā whakaū, i tere te whakarite a ā mātou kaiarotake i tētahi tuhinga tango whakapōrearea i whakaatu i te wāhanga maturuturu kino.
Tukunga Utu Maha-Wāhanga me te Pūtake Tiritiri
I mahi ngā mōkihi e rua hei "tūatahi"waipiro"," te whakatakoto i te tūāpapa mō te kawenga tūturu. I tohaina e rātou he "waho" noauri"URL kōnae:https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
He tohu kaha tēnei kōnae purapura o waho ōrite mō tētahi kaiwhakaari riri tiritahi. He mea whakamīharo, ko te ihirangi o tēnei kōnae purapura te āhua nei he taurangi taiao māmā noa iho (hei tauira, JWT_SECRET, PORT), ā, tera pea ka hē te tirotiro i tana mahi tuturu.
Taumira C2 Hihiri me te DGA
Ko tētahi rautaki matatau i kitea i roto i ēnei mōkihi kino ko te whakamahinga o tētahi Algorithm Whakaputa Rohe (DGA) hei whakatau i te tūmau Whakahau me te Mana (C2) i runga i te hihiri. Ko tēnei tikanga, e kitea pinepine ana i roto i ngā whakaeke mekameka tuku pūmanawa matatau i te tau 2025, e whakawhirinaki ana ki tētahi hash SHA256 i ahu mai i ngā ihirangi o te kōnae purapura, me ētahi atu uara kua whakapūmautia. Mā te mahi pera, ka huri pinepine te hanganga C2, ka iti ake te whai hua o te rārangi pango tuku iho. I tēnei take, i whakamahia e te momo npm he uara pumau o 496AAC7E hei wāhanga o tōna arorau DGA.
Te Whakatū i te Manawanui
I whai ngā kaiwhakaeke e rua ki te whakatū i tētahi aroaro pumau ki ngā pūnaha kua pāngia. Ko tā rātou rautaki he tuku i tētahi kōnae, startup.py (mō PyPi) rānei startup.js (mō te npm), ki roto i ngā whaiaronga raraunga kaiwhakamahi Google Chrome noa puta noa i ngā pūnaha whakahaere rerekē (Windows, Linux, macOS).
Te Horoi i Muri i te Whakatinanatanga
Hei whakaiti i ngā tohu, i whakahaerehia e ngā tuhinga kino e rua ngā mahi horoi. I uru atu ki tēnei te muku i ā rāua kōnae maturuturu tuatahi (load_libraries.py, cookie-loader.min.js) me te whakarerekē i ngā kōnae mōkihi tika (__init__.py, index.js) hei tango i ngā tohutoro ki ngā wāhanga kua mukua inaianei.
Ngā Tohu o te Whakakorenga i roto i ngā Mōkihi Python Kino me te npm
- Mōkihi PyPI: graphalgo (i whakaputaina e larrytech, 13 o Hune, 2025)
- Mōkihi npm: express-cookie-parser (te putanga 1.4.12 rānei)
- Te urunga ki te URL Purapura Tiritahi:
https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
- Ngā Ingoa Kōnae Pūmau:
startup.py(Python)startup.js(JavaScript) - Ngā Ara Pūmau Noa (e whakawhirinaki ana ki te OS): I roto i ngā whaiaronga raraunga kaiwhakamahi a Google Chrome (hei tauira,
AppData\Local\Google\Chrome\UserData\Scripts\i runga Matapihi,~/.config/google-chrome/Scripts/i runga i te Linux, me ētahi atu).
Me pēhea te tiaki i ngā mōkihi kino i roto i ngā whakaekenga mekameka tuku pūmanawa 2025
He Huarahi e Manakohia ana mō ngā Kaiwhakawhanake
He tauira ako nui tēnei i roto i te āhua o te riri e whanake haere ana o ngā whakaekenga mekameka tuku pūmanawa i te tau 2025. E whakaatu ana i te kaha o ngā mōkihi Python kino me ngā mōkihi npm kino ki roto i ngā pūnaha pono, ā, he maha ngā wā ka karohia te kitenga tae noa ki te mutunga rawa. Koia te take he wāhanga nui o tētahi rerengamahi DevOps haumaru te kitenga wawe, ngā taputapu atamai, me te akuaku pūnaha matatau. E akiakihia ana ngā kaiwhakawhanake kia whai whakaaro ki ēnei e whai ake nei:
Arotake i te Whakawhirinakitanga
Mena kua whakaurua e ō kaupapa graphalgo or kaitātari pihikete-tere, he mea whakaaro nui kia tangohia tonutia rātou.
- Mō PyPI:
pip uninstall graphalgo - Mō te npm:
npm uninstall express-cookie-parser
Te Akuaku o te Pūnaha
Whakaarohia te whakahaere i tētahi matawai pūnaha whānui. He mea tika hoki kia tirohia ā-ringa ngā ara whaiaronga raraunga kaiwhakamahi Chrome noa mō tētahi mea ohorere. startup.py or startup.js kōnae.
Nga Whakaritenga Haumarutanga
- Aromatawai i ngā Whakawhirinakitanga HouWhakatūria he tikanga hei arotake i ngā mōkihi hou i mua i te whakaurunga, me te arotahi ki ngā mea mai i ngā kaiwhakaputa tauhou.
- Whakauruhia ngā Utauta HaumarutangaNgā taputapu pēnei i te MEW a Xygeni, me ētahi atu Tātaritanga Hanga Pūmanawa (SCA) ngā otinga, ka taea te whakarato i tētahi paparanga tiaki nui mā te tautuhi i ngā whanonga me ngā ngoikoretanga whakapae.
- Tikanga iti rawaMā te whakahaere i ngā taiao whanaketanga me te mātāpono o te mana iti rawa ka āwhina i te whakawhāiti i te pānga pea o tētahi whakararuraru.
- Te Mōhiotanga WhatungaMā te aroturuki i ngā waka whatunga e haere atu ana mō ngā hononga rerekē ka kitea pea ngā whakawhitiwhiti kōrero C2 i hangaia e te DGA.
Waenga matua o load_libraries.py (mai i te graphalgo)
download_remote_content(): Ka whakahaere i te tiki kōnae mai i ngā URL kua tohua.run_process(): Ka whakahaere i ngā tuhinga Python o waho i roto i te āhua motuhake, ka pehi i te putanga kia noho puku.get_output_file_path(): Ka whakatau i te tauwāhi pūnaha tino pai mō te kōnae startup.py pumau.remove_self(): Whakahaere i te horoinga whai muri i te whakatinanatanga o ngā kōnae kino tuatahi me ngā whakarerekētanga mōkihi.simple_shift_encrypt()/simple_shift_decrypt()Ngā mahi whakamuna ritenga mō te huna i ngā hongere whakawhitiwhiti kōrero, he mea nui mō te whakatinanatanga o te DGA.load_libraries()Ko te mahi matua e whakarite ana i te tukanga maha-wāhanga katoa, mai i te tango tuatahi ki te whakahaerenga me te horoinga o te kawenga whakamutunga.
Tuhinga o mua
Pērā i ētahi atu mōkihi kino pea i tautuhia e MEW, i tiakina tonutia e te pareārai whakawhirinakitanga ngā kaiwhakamahi e whakauru ana i ēnei mōkihi kino ki roto i ā rātou whakawhirinakitanga. Whai muri i te whakaū, i whai mātou i ngā tikanga whakamōhiotanga mō ngā rēhita e rua, ā, i muri i te arotakenga i tangohia ai ngā mōkihi e rua.
