TL; DR
nolimit-agent he mōkihi npm ko ōna putanga kua whakaputaina — 1.0.299 mā te 1.0.307, i tukuna mō ngā rā e whā mai i te 2026-06-26 ki te 2026-06-29 — kei ia ia he anga mahi hītinihanga me te mēra-maha katoa i roto i tētahi whaiaronga huna, kua tino hunaia. I roto i ia putanga ka whakatau te tāurunga matua ki .ad/x0.js, tētahi o ngā kōnae ~86 i roto i tētahi kōpaki i tapaina ki te kōnae-ira e pupuri ana i te 4,200 pea ngā pūrua aho-array javascript-obfuscator; he ōrite te tahora matau tāuta me te tāurunga puta noa i te rārangi.
Kei muri i te whakapouri kei reira he Te rere o te waehere pūrere Microsoft 365 OAuth (login[.]microsoftonline[.]com/common/oauth2/v2.0/devicecode) ina whakaaetia he waehere, ka pānuihia te pouakaroto Outlook a te patunga, ā, ka tukuna ngā tūemi mā te Microsoft Graph API; he mīhini tuku SMTP me te SMS nui e whakahaerehia ana e ngā rārangi kaiwhiwhi i tukuna mai e te kaiwhakahaere; ngā tauira karere whakahāngai waitohu; te hanganga hononga tuku-tuwhera; me te tirotiro i runga i te DNS-over-HTTPS, WHOIS, me te rapu waehere GitHub. Ngā tohu waka wā-oma ki te hanganga kaiwhakahaere i api[.]nolimitent[.]xyz:4100.
Pāngia: te tangata e tāuta ana i tētahi putanga o te mōkihi, me tētahi Pouaka mēra Microsoft 365 e whakaaetia ana e tōna rangatira tētahi waehere taputapu e whakaaturia ana mā roto. Ko te putanga hou rawa atu, 1.0.307, ko te tohu hou rawa atu tēnei, ā, kei a ia anō te āheinga pouaka mēra waehere-pūrere kotahi — kāore te waehere kino e herea ki te putanga-muri kotahi.
Taumaha: NuiTe pūnaha rauropi e pāngia ana: npmKo te tohu kotahi hei rapu tuatahi: te kaihautū api[.]nolimitent[.]xyz.
Te whakaeke: me pēhea te mahi
He anga pai i runga i te kawenga huna
He mata noa iho te āhua o te kete. mōkihi.json whakapuaki i tētahi i muri i te tāutanga matau –
text postinstall: node scripts/postinstall.js — ā, i te tirotirohanga ngā tuhinga/postinstall.js kāore he kino: ka tāutahia he whakahau Windows, ka puta atu. Ehara te matau i te wāhi e noho ai te whanonga. Ko te matua a ahau e tohu ana ngā āpure e rua ki roto .pānui/, he whaiaronga e pupuri ana tōna ira matua kia kore ai e uru ki te tūponotanga ls putanga, ā, ko ōna ihirangi he mea huna e te mīhini. I tatau te matawai tūmau i te ~4,293 ngā kawenga-whakawaehere e horapa ana puta noa i te .pānui/ huinga kōwae; javascript-obfuscator he whakawhirinakitanga whanaketanga kua whakapuakina, e ōrite ana ki te āhua hurihuri-aho-rōpū-aho o ngā kōnae kua pūpūhia.
Ko te wehenga te tohu tuatahi e tika ana kia tapaina: he ma te matau tāuta ka tirotirohia e te kaiarotake, ko te waehere whakahaere ia kei te taha kotahi o te whaiaronga, e huna ana, e pōuri ana, ka tae atu anake ina oma te pūwāhi whakauru kaweake o te mōkihi.
Urunga pouaka mēra waehere-pūrere Microsoft 365
Ko te kōwae .ad/x12.js kei a ia te āheinga tino nui o te anga. Koia te kaiārahi i te whakaaetanga pūrere Microsoft 365 OAuth 2.0:
text POST login[.]microsoftonline[.]com/common/oauth2/v2.0/devicecode Ko te tuku waehere-pūrere he rerenga tika a Microsoft i hangaia mō ngā pūrere e herea ana e te tāuru: ka tono te ratonga i tētahi waehere, ka patohia e te kaiwhakamahi taua waehere ki roto microsoft.com/pūrerelogin` i runga i tētahi atu pūrere, ā, ka whakaaetia, ā, ka whiwhi tohu te ratonga e tono ana. Ina nō tētahi atu tangata te ratonga e tono ana, ehara i te rangatira o te pouaka mēra, ka hoatu e te whakaaetanga he tohu ki taua rōpū tuatoru. Kia whiwhihia he tohu, Mā te .ad/x12.js` ka pānui tika i te pouaka mēra mā Microsoft Graph:
text GET graph[.]microsoft[.]com/v1.0/me/mailFolders/inbox/messages?$top=250&$select=from GET graph[.]microsoft[.]com/v1.0/me/mailFolders/sentitems/messages?$top=250&$select=toRecipients te $tīpako Ka tangohia e ngā matapae ngā wāhitau kaituku mai i te pouakauru me ngā wāhitau kaiwhiwhi mai i ngā tūemi kua tukuna — te rauemi mata mō te mahere i ngā kaituhi o te patunga. Ko te urunga a te hoariri-i-waenganui (AiTM) tēnei mā te whakaae kaua mā te hopu kupuhipa: kāore he tohu hei mahi tinihanga i te tikanga tawhito, he waehere anake hei whakaae.
He mīhini mēra me te karere kuputuhi nui me ngā tauira whakakatakata
Kei te taha o te pouaka mēra he mēra. Ka tukuna e te kete ngā kōnae raraunga ka taea te whakatika e te kaiwhakahaere — ngā rārangi kaituku (ngā kaituku.txt, smtps.txt) me te kōnae tauira (functions.txt) — ko ōna wāhitau whakakapinga ka pānuitia hei pepa maka mō te whakatangata: haumarutanga@apple.com, loginmanatoko, ratonga OAuth, nama, me ngā kaituku whakamōhiotanga pūkete ki tētahi yourdomain.com whakakapia e te kaiwhakahaere tū-ā-ringa. Kei te taha SMS he waeaebook me te whirihoranga o te kuwaha. Ka tāruatia e te mēra ngā rārangi kaiwhiwhi i tukuna mai e te kaiwhakahaere, ā, ka tukuna mā roto i ngā whakawhiti SMTP kua whirihorahia.
Hei whakatū hononga, .ad/xu.js a .ad/xq.js hanga URL e whakamahi ana i te koretake o te tātari URL me te aroturuki pāwhiri. Ka whakauruhia e ngā tauira tinihanga he mana pono i mua i te @ nō reira he rerekē te kupumatua e kitea ana i te kaihautū tūturu:
text https://trusted[.]com@ https://trusted[.]com%40 https://trusted[.]com:80@ https://redirect[.]example[.]com/ https://track[.]example[.]com/click? Ka hopukina hoki e te anga ngā tohu rongonui mai i ngā kaihoko nui me enterprise ngā kaiwhakarato mēra — he tikanga noa mō te whakaatu i tētahi tohu whakamōhio, whārangi taunga rānei e whai ingoa ana te kaiwhakarato.
Te tirotiro i te whāinga me te hanganga
He maha ngā kōwae e kohikohi ana i ngā horopaki i mua i te tukunga. .ad/x0.js ka whakatau i ngā ingoa mā te DNS-over-HTTPS (dns[.]google/whakatau), .ad/xa.js ngā uiui mō WHOIS (api[.]whois[.]vu), A .ad/x9.js ka whakahaere i te rapu waehere GitHub (api[.]github[.]com/rapu/waehere?q=) — he tauira e rite ana ki te kitenga i te whirihoranga tūmau-mēra kua kitea me ngā tohu SMTP hei whāngai i te rārangi tuku. .ad/xs.js ka uiui i te taupū CDX a Wayback Machine.
Te whakahau me te whakahaere
I te taha o te huinga pōuriuri, .ad/x4.js e tohutoro ana i te pito mutunga o te kaiwhakahaere:
text http://api[.]nolimitent[.]xyz:4100 Ka tohaina e te kaihautū tana kāore he mutunga waitohu me te ingoa ake a te kaiwhakaputa, me te : 4100 Ko te tauranga te hongere karanga-kāinga o te anga. Koinei te tohu kotahi tino pumau mō ngā kaiwawao: he mōkihi, he teihana mahi kaiwhakawhanake, he kaihoko hanga rānei e toro atu ana api[.]kore-mutunga[.]xyz kua whakahaere i tēnei waehere.
Ngā tohu o te whakaae tahi
Ko ngā tohu i raro nei ko ngā mea ka taea e te kaiwawao te mahi — te hopu i tētahi kōnae maukati, te aukati i tētahi kaihautū, te rapu rānei i ngā rangitaki takawaenga me ngā rangitaki DNS. Ka puta ngā pito mutunga Microsoft nā te mea ka tukinotia e te anga; ehara i te mea kino, ā, kaua e āraia.
Ngā hapa kōnae i hopukina i te whakarōpūtanga:
- mōkihi/.ad/x0.js — sha256 e4153bb614ee03ec456e6b5b41926385db6aae0e4f3e771d18e581571ad7ca2a
- mōkihi/mōkihi.json — sha256 8618064f1f6146b4a8f0459aff9154dca1847e3936aa44f4d4cd37e127075644
He tohu mō te kairēti Microsoft 365 e tika ana kia rapua motuhake mai i tēnei mōkihi: he angitu ngā takiuru waehere-pūrere, ā, ka whai muri tonu mai ko ngā pānui Kauwhata o Ngā Kōpaki/Pouakauru mēra a Ngā Kōpaki/Ngā Tūemi Mēra, inā koa mai i tētahi wātū kāore e mōhiotia e te kaiwhakamahi.
Te tohu me te whanonga i kitea
Ka noho motuhake te mea e kitea ana i te tangata kei muri.
Ngā mea e kitea ana: kua whakaputaina te kete i raro i te ingoa o te kaiwhakahaere kaihoko-kore-mutunga me te wāhitau Gmail kāore anō kia manatokohia, ā, kāore he putunga pūtake hono; tōna mōkihi.json e whakaahua ana i a ia hei "kaituku īmēra matatau" me te tohu ki te tīma whero kupumatua; kei roto i te wāhi huna, huna hoki te waehere wā-oma .pānui/ whaiaronga ko tana mekameka taputapu (javascript-obfuscator) he whakawhirinakitanga kua whakapuakina; ā, ko te kaihautū kāinga-waea api[.]kore-mutunga[.]xyz ka whakamahi anō i te kāore he mutunga waitohu. He mōkihi kotahi tēnei me tētahi tohu hanganga e whakahaerehia ana e te kaiwhakahaere — ehara i te rōpū mōkihi maha, ā, kāore i kitea he taupatupatu ki tētahi kaupapa kua whakaingoatia i mua.
te tīma whero Kāore te kupumatua e whakarerekē i te whakarōpūtanga. Ko te taputapu haumarutanga-whakaeke tika e tuku ana i te āheinga whakamahi-rua ka mahi mārama: pūtake ka taea te pānui, ngā ūnga i tukuna e te kaiwhakahaere, me te kore he karanga-kāinga huna. Ka hurihia e tēnei mōkihi ia o aua āhuatanga - ka hunaia, ka hunaia hoki tana waehere whakahaere, ā, ka tohu ki te hanganga kaiwhakahaere pumau kaua ki te ūnga i tukuna e te kaiwhakamahi. Ko te whanonga, ehara i te tapanga, te whakahaere i te whakatau, he kino.
Kāore te whāinga i te whakapuakina i konei. E whakaahua ana te pou i ngā mahi a te waehere — te tono i tētahi waehere taputapu, te pānui i tētahi pouaka mēra mā Graph, te tuku mēra papatipu mā ngā whakawhiti kua whirihorahia, te tohu ki tētahi kaihautū pumau — ā, kāore e whakahuatia te whāinga.
Pānga, au me te aratohu a te kaiwawao
E rua ngā pānga tāutanga-wā e whai tikanga ana. Tuatahi, ko tētahi kaiwhakawhanake, ko tētahi kaihoko CI rānei e tāuta ana kaihoko-kore-mutunga ka kawea mai te anga ki taua kaihautū, ā, ka whakatū i te kāinga-waea ki api[.]kore-mutunga[.]xyzTuarua, ka horapa atu te āheinga waehere-pūrere ki tua atu i te kaihautū tāuta: ka pānuitia tika mā Graph te pouaka mēra Microsoft 365 e akiakihia ana te rangatira ki te whakaae i tētahi waehere kua tukuna, ā, kāore he kupuhipa e whiti i te waea.
Ko te ia whānui ko te mea e whakarotohia ana. Kua nekehia te hītinihanga waehere-pūrere (AiTM) mai i te hanganga hītinihanga takitahi ki roto i tētahi mōkihi i runga i tētahi rēhita tūmatanui — te tohatoha e npm tāuta kaua mā te hononga īmēra. Mā te tākai i te kete pēnei ka whakawhiti i te raruraru manaaki me te tuku hononga a te kaiwhakahaere hītinihanga mō te toronga o te rēhita, ā, ka huna i te waehere whakahaere i muri i tētahi matau tāutanga ma me tētahi whaiaronga huna kua tapaina ko te kōnae ira e hinga ai te tirotiro ā-ringa tere.
Mō ngā kaiwawao:
- Arotake i te rēhita me te whakawhirinakitanga. Maimoatia he kete nona matua/ahau ka whakatau ki roto i tētahi whaiaronga huna (kua whakapūmauhia ki te ira) o te waehere tuatahi kua whakapōreareatia, he tino mōrearea i runga i te hanganga anake, ahakoa te āhua ma o te matau tāuta. Ehara te whakaiti i te whakapōrearea — he kuaha i runga i te waitohu wetewaehere aho-huinga, ehara i te roa o te rārangi.
- Te whakapakeketanga o Microsoft 365. Whakawhāitihia te rere whakamanatanga waehere-pūrere me te Āheitanga Ā-Whārite ki ngā wāhi kāore e hiahiatia ana; ko ngā tuku waehere-pūrere he momo AiTM e mōhiotia ana, ā, he onge te hiahiatanga o ngā kaiwhakamahi tauwhitiwhiti. Arotakehia ngā takiuru waehere-pūrere, ā, muri iho ka tatau tonu i te pouaka mēra Graph.
- Te kimi whatunga. Āraia, ā, whakatūpatohia api[.]kore-mutunga[.]xyzRapua ngā rangitaki DNS me ngā rangitaki takawaenga puta noa i ngā hanganga kaiwhakawhanake me ngā hanganga hanga.
- Te kimi ara mēra. te kaiwhakamahi@kaihautū Ngā puka tinihanga URL (pono[.]com@…) ka kitea i te keti mēra me te takawaenga; ko ngā hononga haki ko tōna wāhanga mana kei mua i te @.
I te wā o te tātaritanga, i ora te mōkihi i runga i te npm. Nā te mea e kapi ana te anga huna i te putanga katoa kua whakaputaina me te putanga o nāianei hou Kei a te tūtohu (1.0.307) te āheinga waehere-pūrere, me hipoki te tango rēhita i ngā putanga katoa, kaua ko te putanga-muri kotahi anake.
