TL; DR
I waenganui i te 1 o Paenga-whāwhā me te 3 o Mei, 2026, kotahi te kaiwhakaputa npm, user0001, kua rēhitatia ki te wāhitau Gmail kāore anō kia manatokohia tanvisoul9@gmail.com, i tukuna pukutia e ia ngā mōkihi e ono me ngā ingoa ngāwari noa iho, he rite ki te hanganga: centralogger, dom-utils-lite, node-fetch-lite, connector-agent, node-gyp-runtime, a node-env-resolve.
Ngā putanga hou e rua o node-env-resolve, 1.0.7 me 1.0.8, i tohua e te pūnaha Whakatūpato Mōrearea Pūmanawa Kino (MEW) a Xygeni i te 2 o Mei, ā, i whakaūtia he kino i te 3 o Mei.
He rerekē te whakaurunga mō te mea ehara i te mea: kāore he karetao Telegram, kāore he karangatanga OAST, kāore whakapouri, ā, kāore he ngana ki te hopu i ngā tohu AWS i te wā tāutanga. Engari, postinstall.js ka whakatō i tētahi tāurunga pumau-whakaoho Windows, mā te whakamahi i tētahi kī HKCU Run e whakarewa ana wscript.exe ki tētahi pū VBS. Kātahi ka puta he kaihoko Node.js motuhake e paihere ana i ngā kōwae mō te hopu hopuoro, te tahae hītori tirotiro, te tango pikitia mata, me te whakatauira kiore/papapātuhi.
Kei te karanga mātou i tēnei rōpū DevTap, i muri i te kete ka waiho kia rere i runga i te mīhini a te kaiwhakawhanake.
I te wā i tuhia ai tēnei tuhinga, e ono ngā mōkihi e ora ana i runga i te npm. Kua tukuna atu e mātou ki te hongere tukino a te rēhita. Me tango e ngā kaiwawao ngā tāutanga katoa mai i te kaiwhakaputa i te wā e tatari ana kia tangohia.
Te Rōpū: E Ono Ngā Mōkihi, Kotahi te Kaiwhakaputa
Te pūkete kaiwhakaputa user0001 kāore anō kia manatokohia. Kāore he SCM manatoko, kāore he īmēra here-rohe, ā, kāore he hītori o mua. Ko te kakau Gmail tanvisoul9 kāore e puta mai i roto i tētahi atu pūkete kaiwhakaputa npm i kitea e mātou.
E ono ngā mōkihi e whakarārangi ana i te kaitiaki kotahi, i whakaputaina mai i te pūkete kotahi, ā, e tohatoha ana i te mea kotahi package.json papa whakapūmau. Kāore he repository, no homepage, ā, kāore description roa atu i te rārangi kotahi.
Ko te rautaki whakaingoa te wāhanga whakamere. He rerekē ki tētahi kaupapa whakawhirinaki-pōhēhē, ki tētahi kaupapa typosquat rānei, kāore tētahi o ēnei ingoa e aro ana ki tētahi whare pukapuka whakarunga. Engari, kua whakaritea kia ngaro atu ki tētahi mea tūturu. package.json or npm ls huanga.
| mōkī | Tuatahi | Putanga Hou | Tuhinga | Tūranga i roto i te Rōpū |
|---|---|---|---|---|
| kaiwhakahaere pokapū | 2026-04-01 12:46 UTC | 1.0.9 | 5, mai i te 1.0.5 ki te 1.0.9 | Te uhi o te "pūmanawa takiuru" a te rōpū; te whakaputanga tuatahi |
| dom-utils-lite | 2026-04-14 07:36 UTC | 1.0.3 | 3 | Uhi āwhina-DOM whānui |
| iti te tiki-pūngao | 2026-04-19 10:22 UTC | 1.0.2 | 3 | Ka whai i te whānau tiki-pūngao |
| kaihoko-hononga | 2026-04-25 05:12 UTC | 1.0.0 | 1 | "Kaihoko" ingoa whānui |
| wā-haere-pūngao-gyp | 2026-04-25 05:17 UTC | 1.0.0 | 1 | Ka whai i ngā taputapu hanga kōwae taketake |
| whakatau-pūngao-taiao | 2026-04-25 05:21 UTC | 1.0.9 | 10, mai i te 1.0.0 ki te 1.0.9 | Pūrere maturuturu hohe; whakaurunga katoa |
Nga ingoa rite centralogger, node-fetch-lite, a node-gyp-runtime kua hangaia kia kore e tautohetia i roto i te arotake waehere. He rite tonu ki ngā mea kua noho kē ki roto i te rākau whakawhirinakitanga o tētahi kaupapa.
I te honoa ki tētahi kaiwhakaputa hou, kāore anō kia manatokohia, me ngā hononga putunga ngaro, ka hangaia he tauira e kitea ana: he kaiwhakaari e whakatō ana i ngā ingoa iti-waku ki roto i te rēhita, kātahi ka tere te mahi i te mea nui. I tēnei wā, node-env-resolve i whiwhi i ngā putanga tekau i roto i ngā rā e waru.
Ngā mea e tau ana ki runga i te Pouaka Whakawhanake Windows
Ko te mekameka kino kei runga node-env-resolve:1.0.8 he poto, he tika, ā, he nui ngā āhuatanga mō tētahi npm RAT.
Tāutatanga Muri: Te Pumau me te Ākena Wehe
package.json e kī ana i tētahi matau tāuta kotahi:
{ "scripts": { "postinstall": "node postinstall.js" } }postinstall.js e toru ngā mea e mahia ana i te raupapa.
Tuatahi, ka whakatūria he whaiaronga tāutanga ki waho o te rākau npm. Ka tatauhia te ara i te wā whakahaere i roto i te tuhinga penei INSTALL_DIR. Kātahi ka whakahaerehia he pūnaha ā-roto execSync('npm install --production --silent ...') i roto hei kukume i ngā whakawhirinakitanga wā-oma o te whakaurunga. Ka whakanohoia te kaihoko ki runga kōpae ki tētahi wāhi pukapuka ā-ringa node_modules e kore e kitea e te arotake.
Tuarua, ka tuhia e ia he pūwhakarewa VBS, ā, ka rēhitatia mō te pumau o te whakaara:
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run \ /v ${AGENT_NAME} \ /t REG_SZ \ /d "wscript.exe \"${vbsPath}\"" /fwscript.exe ko te Windows Script Host, he pūnaha rua Microsoft kua hainatia e whakahaere ana .vbs ngā kōnae kāore he matapihi papatohu. Koinā te mea o muaciste take i pai ai mō ngā porotiti whakahaere-aunoa.
He ōritetanga anō hoki reg delete ara i roto src/index.js, e kī ana i hangaia te whakatō kia ngāwari te tango mā te whakahau a te kaiwhakahaere.
Tuatoru, ka puta he tukanga tamaiti motuhake:
spawn(node, [path.join(INSTALL_DIR, 'src/index.js')], { detached: true, env: { ...process.env, SERVER_URL } })E rua ngā kōrero nui e whai tikanga ana i konei.
SERVER_URL ka pānuitia mai i te taiao. Nō reira, ka taea te whirihora i te pito mutunga C2 mō ia whakatinanatanga, ā, kāore e whakaurua ki roto i te mōkihi. Ko taua kōwhiringa iti engari āta whakaarohia ka hinga i te nuinga o ngā tātaritanga IOC-pūmau.
Waihoki, ka riro i te tamaiti i whānau mai te taiao matua katoa. Nō reira, ko tetahi NPM_TOKEN, AWS_*, GITHUB_TOKEN, kei roto rānei i te anga kaiwhakawhanake te hononga SSH-agent i te wā tāutanga e haere ana ki roto i te mahara o te kaihoko roa-ora.
Ngā mea e tukuna ana e te Kaihoko
Ko te mea kua tākaihia src/ kei roto i te rākau e toru ngā kōwae, ā, ko ō rātou ingoa anake te mea e kōrero ana i te pūrākau: audioCapture.js, browserHistory.js, a systemInfo.js.
Ko te rārangi whakawhirinakitanga wā-oma, i whakatauhia i te wā o te whakaaturanga npm install, e tautoko ana i a rātou.
Ka hurihia e tēnei huarahi tētahi mahi pōrearea hei urupare whakahaeretia.
Engari mō te tauhohe matapo, ka mahi tahi ngā tīma me te whakarite kaupapa matua mārama me te whakatika tere.
| whakawhirinaki | He aha te take i roto i tēnei horopaki |
|---|---|
| hopu mata-papamahi | Hopu mata ā-wā |
| @mārau-rākau-nati/mārau-nati | Te aunoatanga o te kiore me te papapātuhi / te whakatauira whakauru |
| pai ake-sqlite3 | Ngā pānui tika o ngā pātengi raraunga SQLite Hītori o Chrome, Edge, me Firefox |
| adm-zip | Te kohikohi i ngā taonga kua kohia i mua i te tangohanga |
| koi | Te whakarerekē i te rahi/te pēhi i ngā whakaahua mata me ngā taonga o te ahua |
| kiritaki-socket.io | Hongere C2 ahunga-rua pumau |
| te tau-mīhini-pūngao | Taputapu matimati pumau mō ia kaihautū mō te aroturuki i ngā patunga |
systemInfo.js piiraa os.networkInterfaces() mō ētahi atu tānga tapumati i mua i te rama tuatahi.
He aha te Hopu Ororongo te Tohu Tino Hiranga
Ko te nuinga o ngā RAT npm e whakarōpūtia ana e mātou i roto i te MEW ka mutu i te tahae huna i te wā tāutanga. Ka pānuihia e rātou ~/.npmrc, pānui ~/.aws/credentials, waru process.env, TUKU ki tētahi tukutuku hono, ka puta. He rite tēnā ki tētahi tauira ōhanga tere-mō-te-hopu. He poto te haurua-ora o ngā tohu, ā, me tere te whiwhi moni a te kaiwhakaeke.
node-env-resolve he rerekē te āhua.
Kua whakaritea te pumau kia ora ai i te whakaara anō. Ka oma motuhake te kaihoko, ā, ka roa te ora i raro i te wscript.exeKo te kete kei roto he mea hei pupuri i runga i te mīhini a te kaiwhakawhanake, ehara i te mea hei hopu me te wehe atu: he hopu hopuoro, he taraiwa papapātuhi/kiore, he whakauru hītori tirotiro katoa, he hopu mata, me te hongere Socket.IO tauwhitiwhiti ki te C2 ka taea te whirihora.
Ko te hopu hopuoro te rārangi e takahia ana e tēnei kaupapa e te nuinga o ngā pūmanawa kino npm.
Ko te teihana mahi a ngā kaiwhakawhanake, e piki haere ana te maha, ko te teihana mahi hoki e tū ai ngā kaiwhakawhanake ki te tū, ki te waea atu ki ngā kiritaki, ki te kōrero mō te hoahoa, me te waea atu. Ko te whakaurunga hopuoro ehara i te mea e whai ana i te tohu npm a te kaiwhakawhanake. Engari e whai ana i ngā kōrero a te kaiwhakawhanake i mua i te pona.
Ko taua huinga āheinga, me te kore o te whakapouri me te kore o tetahi tangohanga whakamīharo i te wā tāutanga, e kiia ana he tūnga-mua mō te urunga kua tohua, kaua ki te tahae tohu tuakiri whai take.
Kāore mātou e kī ana he mea tēnei anake te take. Kei te aro atu mātou ki te āhua o te mahi.
Ko te auau whakahōutanga e waru ngā rā i runga i node-env-resolve ko te kōrero tino whai kiko i roto i te rārangi wā.
Ehara tēnei i te tukunga ahi-ā-wareware. Kei te pupuri tonu te kaiwhakaputa i te tukunga, ko te tikanga o tēnei he rua ngā mea. Kei te whakatikatika rātou i te tukunga ki ngā taiao whakamātautau i mua i te whakatinanatanga whānui, kei te hoki mai rānei ā rātou tauwhitinga tāutanga, ā, kei te whakautu atu ki tēnei.
Kāore i kitea he huringa i muri i te whakaputanga tuatahi o ngā mōkihi e rima. He rite tēnei ki te tauira "wāhanga kotahi, waiho kua whakaingoatia" mō te rōpū tautoko, ko te mahi hangarau e aro ana ki te mōkihi e mahi ana.
Whakawhiwhinga: Ngā Tohu Iti, Kāore he Whakatau Pūmau
Public OSINT He angiangi ngā tohu, ā, e kore mātou e whakaroa i aua tohu. Ngā mea ka kitea:
Te kakau Gmail tanvisoul9 he āhua rite ki tētahi ingoa i hoatu ki te Tonga o Āhia, ko "Tanvi." He tohu ngoikore tēnei. Ehara ngā kakau Gmail i te tuakiri, ā, ko te mea kei muri soul9 he whānui. Kāore i te haumaru te whakatau i te whenua mai i te wāhanga-ā-rohe īmēra anake.
Kāore he mea whakamiharo te momo waehere o Node.js: standard ngā waeatanga whare pukapuka pērā i os, child_process, spawn, a reg addKāore he whakapōrearea, kāore he hurihanga aho, kāore hoki he arorau ārai-patuiro. E pai ana te kaituhi ki ngā kaupapa taketake o te rēhita Windows me te whakaritenga tukanga tamariki-motuhake, engari te āhua nei kāore ia e rapu ana i ngā mahi hokohoko huna e taea ana e rātou te whakamahi.
Kāore rawa ngā whakawhirinakitanga i te wātea, ā, e mōhiotia whānuitia ana: screenshot-desktop, nut-js, better-sqlite3, a socket.io-clientKāore he kawa ritenga, kāore he puranga C2 i hurihia mai i te tīmatanga, ā, kāore he mahi uaua hou i tua atu i te pukapuka ako. Kī Whakahaere HKCUHe kaiwhakauru matatau tēnei, ehara i te kaituhi taputapu.
Kāore i kitea e mātou he aho ehara i te reo Ingarihi, he kōrero tāmau, he raraunga rohe, he tohu tapumati rohe wā putanga-kaitātari rānei i roto i ngā taonga tuku iho kua whakaputaina.
I tirohia e mātou mēnā he taupatupatu waehere ki ngā kaupapa o mua kua aroturukihia e mātou, tae atu ki Shai Hulud, Ouriwiona, Buildkite, me te heibai hou / claude-code-best Whānau tāruarua Anthropic-CLI. Kāore i kitea e mātou: kāore he tauira C2 tiritahi, kāore he tahora kōnae tiritahi, ā, kāore he kīwaha tiritahi.
Ko tā mātou e kore e kī: he kaiwhakaari kāwanatanga tēnei, he rōpū e mōhiotia ana, he hononga ā-rohe rānei ki tētahi whenua motuhake.
He rite tonu te āhua o te mahi ki tētahi tīma iti, he pūkenga āhua-tauira e mahi ana i te tirotiro a ngā kaiwhakawhanake-teihana mahi. Tērā pea he mea tautoko i te taha pūtea mā te whakamahi i te urunga ki raro iho, engari tera pea he tirotiro-hei-ratonga mā tētahi atu kaihoko.
E rua ngā kōrero ā-kore e tautoko ana i taua mea: te karo i ngā tikanga tango raraunga e kukume ana i te aro ka tere te tahu i te tautau, pērā i ngā karetao Telegram, oastify.com, ngā canarytokens rānei, me ngā ingoa mōkihi ngāwari noa iho, e pai ake ai ngā tāutanga hiku-roa mārire i te pikinga poto o te rahinga nui.
Ngā Tohu o te Whakatutukitanga me te Kitenga
| Ngā Mōkihi me te Kaiwhakaputa | |
|---|---|
| Field | uara |
| kaiwhakaputa npm | user0001 |
| Īmēra a te kaiwhakaputa | tanvisoul9@gmail.com, kāore anō kia manatokohia |
| Kete | centralogger, dom-utils-lite, node-fetch-lite, connector-agent, node-gyp-runtime, node-env-resolve |
| Kua whakaūtia te kino | pūnga-taura-whakatau@1.0.7, pūnga-taura-whakatau@1.0.8 |
| Ngā Taonga Taonga a te Kaihautū | |
|---|---|
| momo | uara |
| Kī manawanui | HKCU\Pūmanawa\Microsoft\Windows\Putanga o Nāianei\Whakahaere |
| Uara pumau | Ingoa taurangi; raraunga o te puka wscript.exe " \\ .vbs" |
| Tāutahia te matau | postinstall: te pūnga postinstall.js i roto i te whakaaturanga mōkihi |
| Ngā kōwae whakatō | src/audioCapture.js, src/browserHistory.js, src/systemInfo.js |
| Whaiaronga whakaaturanga | I whakatauhia te INSTALL_DIR i waho o te node_modules o te kaupapa; i whakatakotoria te tauwāhi e postinstall.js i te wā tāutanga |
| whatunga | |
|---|---|
| momo | uara |
| Te kawe waka C2 | socket.io-kiritaki, hongere ahunga-rua pumau |
| Te pito mutunga C2 | I tukuna ki te kaihoko mā te taurangi taiao SERVER_URL; kāore i whakaurua ki roto i ngā taonga kua whakaputaina |
Ngā Tuhipoka Kimi
E rua ngā ture e mau ana i tēnei whānau me te kore e hiahiatia te pito C2.
Tuatahi, tohua ngā tuhinga whai muri i te tāutanga e mahi ana i tētahi mahi ā-roto npm install ki roto i tētahi ara i waho o te whaiaronga ake o te mōkihi. Ko tētahi kai-tango-mua tika, pērā i node-gyp ngā hanga anō, ngā tango-rua kua hangaia i mua, ngā tuhi i roto i te mōkihi, i roto rānei i te tūāpapa-standard ngā ara keteroki me ngā hash kua manatokohia. Kāore e tuhi ki roto i tētahi mea hou kua hangaia INSTALL_DIR i tētahi atu wāhi i runga i te kōpae.
Tuarua, tohua ngā tuhinga whai muri i te tāutanga e puta ana reg add HKCU\…\Run mā te wscript.exe hei kaiwhakarewa. Kāore rawa tēnei i te tika mai i tētahi mōkihi npm. Tohua, ā, wehea.
He whai hua te tuatoru o ngā mahi whakaaroaro mō te kimi i te mōkihi teina e whai ake nei i mua i te whakaū: he kaiwhakaputa npm hou kāore he SCM manatoko, he īmēra Gmail, kāore repository āpure, me ngā ingoa mōkihi poto, whānui, me te ahua hanganga maha e whakaputaina ana i roto i ngā rā kotahi, he nui noa iho hei arotake ā-ringa.
Kua tukuna ki te rēhita npm. Ka whakahoutia e mātou tēnei pou ina tangohia te pūkete kaiwhakaputa.
