TL; DR
I tukuna e te kaiwhakaputa npm kotahi e waru ngā mōkihi iti, ko ō rātou ingoa he rite ki ngā poraka hanga o ia rā mō te whanaketanga poraka mekameka me te pēke moni, base58-utils, abi-encode, eth-dev, arb-kit, layer2-sdk, solana-key-utils, eth-wallet-helpers, a crypto-validate-lib. He taputapu mahi kei roto i ia taputapu. Heoi, kei muri i taua taputapu he poraka waehere e karanga ana i a ia anō e rere ana i te wā e kawemai ana te kōwae.
Tata ki te 37 hēkona i muri i te kawemai, ka wetewetehia e taua poraka he kawenga e tukuna ana ki roto i te mōkihi e huna ana hei taputapu whakamātautau, ka tuhia ki tētahi kōnae huna i raro i te whaiaronga kāinga o te kaiwhakamahi, ka rēhita i a ia anō kia tīmata anō i ia login puta noa i te Windows, macOS, me te Linux, ā, ka whakarewahia te tuhinga kua wetewetehia hei tukanga motuhake. Kāore he mea mō tēnei e mura ana i te wā tāutanga npm; e tatari ana kia kawemaihia te waehere me te whakahaere, he wā marino ake tēnei i te tāutanga.
Kāore te utauta e mātotoru. Ka tukuna hei base64 noa, nō reira mā te wetewete i te "whakamātautau" ka whakahokia katoatia te wāhanga tuarua: a putea crypto me te tahae mea ngaro e tatari ana kia noho mangere te mīhini, ka hauhake i ngā kī tūmataiti me ngā kīanga purapura, ka whakamuna i ia kitenga me te kī RSA-4096 kua whakapūmautia, ā, ka tangohia mā te whakapiri ki te rokiroki IPFS tūmatanui, ka whakahoki mai i ia 12 hāora.
Ka aroturukihia e mātou te rōpū hei Tukutahitanga PhantomI te wā o te tātaritanga, e waru ngā mōkihi i roto i te rēhita npm, i whakaputaina i raro i te pūkete kotahi.
| Te haukori | npm |
| Kete | base58-utils, abi-encode, eth-dev, arb-kit, layer2-sdk, solana-key-utils, eth-wallet-helpers, crypto-validate-lib |
| Ngā tūāpapa kua arotahihia | Matapihi, macOS, Linux |
| Whēkau matua | Kua whakaroahia, kua huna te maturuturunga wā-kawemai hei taputapu whakamātautau; kua tāutahia te pumau whakawhiti-pūhara |
| Ko nga utunga | Te tahae i ngā putea matihiko me ngā mea ngaro, te whakamunatanga RSA-4096, te tango i te raraunga mā te whakapiri IPFS tūmatanui |
Anatomi whakaeke
He āhua korekore noa iho te āhua o ia kete i te pānui tuatahi. ngā taputapu-base58, hei tauira, he torutoru kiropaita o te waehere āwhina Base58 / Bitcoin-WIF kore-whakawhirinakitanga — koia tonu te mea e whakaaria ana e te ingoa. Kei te noho te waehere e tika ana i muri i te kōwae kaweake.kōwae, e kore pea e titiro te kaipānui e tirotiro noa ana i te tihi o te kōnae: he mahi e karanga ana i a ia anō e whakarite ana i a ia anō me te taima.
Ko te mekameka o ngā mahi, i hangaia anō mai i te pūtake mōkihi, ka rere penei:
1. Package is required() by the host project
2. A self-invoking function schedules a callback ~37,000 ms later (setTimeout)
3. On fire, the callback reads test/fixtures/keypairs.dat (a base64 blob)
4. It base64-decodes that blob into a Node.js script
5. It writes the script to ~/.cache-db/.node-sync/syncd.js (mode 0o700)
6. It installs login-persistence for that script (see below)
7. It spawns "node syncd.js" as a detached processE rua ngā kōwhiringa hoahoa e tino kitea ana.
Ka haere te utanga hei taputapu whakamātautau. Kāore te wāhanga tuarua i tuhia hei waehere mārama. Kei roto i whakamātautau/tautuhinga/ngā takirua matua.dat, he kōnae base64 e hono ana tōna ingoa ki tētahi mōkihi e kī ana ka taea e ia te whakahaere i ngā takirua kī. Ki te tangata e tirotiro ana i te tarball, he rite ki te tauira raraunga; ki te waehere kua tāpirihia, he tuhinga hei wetewete me te whakahaere. Kāore he wāhitau whatunga i roto i te dropper tonu — kei te wāhanga tuarua ēnei — engari kāore he whakapouri tāpiri: ko te hononga he paparanga kotahi o te base64, nō reira ka wetewetehia (base64 -d) ka whakahokia mai te katoa syncd.js me tana whanonga whatunga. Ka whakamāramahia e te wāhanga e whai ake nei ngā mahi a taua wāhanga kua whakaorangia.
Ka whakaroahia te pahūtanga, ā, e herea ana ki te kawemai, ehara i te tāutanga. Nā te mea ko te mea whakaoho me tono() me te taima ~37-hekona kaua ki te matau tāuta, ka karohia e te whanonga ngā tirotiro e mātaki noa ana i te npm tāuta taahiraa, ā, ka roa ake te whakaroa i ngā oma o te pouaka onepu me te CI poto noa. I te wā e whakahaerehia ai tetahi mea, kua roa te otinga o te tāutanga i kukume mai i te mōkihi.
Kia tae te tuhinga wetewete ki runga i te kōpae i ~/.cache-db/.node-sync/syncd.js — he ara i whiriwhiria kia rite ki te whaiaronga keteroki noa — mā te dropper ka ora tonu i ngā whakaara anō i runga i ngā tūāpapa matua e toru:
- Linux: he tāurunga cron e whakarewa anō ana i te tuhinga. Ka tāutahia te tāurunga mā te tātari i te crontab o nāianei mā roto i grep -v tukutahi, ko te pānga taha ko te waiho i te tāurunga hou i waho o tētahi rārangi noa e hopu ana i te ingoa ōrite.
- Windows: he mahi kua whakaritea ko te ingoa TukutahiWinNode, kua whakaritea kia whakahaerehia anō i roto i ngā wā 12-meneti.
- macOS: he mahi whakarewa kua tapaina com.apple.syncd, kei roto i ētahi o ngā mōkihi — he tapanga e whai ana i tētahi ratonga pūnaha Apple tika.
Kātahi ka tīmata tonu te tuhinga hei tukanga motuhake, kia haere tonu ai i muri i te putanga o te papatono kawemai.
He aha te mahi a te wāhanga tuarua
Nā te mea he paparanga kotahi te turanga base64, ka mārama te wetewete o te wāhanga tuarua, ā, ka taea te pānui katoa. Kei roto i ngā kete e waru tētahi o ngā momo rerekē e toru o te tuhinga kotahi, e tohu ana i a ia anō i roto i te kōrero pane ko phantom syncd v3 — topo durmiente ("mole moe"). Ko tāna mahi he tahae i ngā rauemi o te pēke moni matihiko me ngā mea ngaro a te kaiwhakawhanake, ka tukuna atu i te mīhini. E whai ana i ēnei kaupae:
- 1. Taria kia noho mangere te mīhini. I mua i te mahi i tetahi mea, syncd.js ka tirohia te roa o te wā e kore ai te kaiwhakamahi e mahi, ā, ka neke noa i te paepae (tata ki te 15 meneti) — xprintidle i runga i te Linux, ioreg HIDIdleTime i runga i te macOS, me te patai wā-kore PowerShell i runga i te Windows. Nō reira, ka puta te hauhake i te wā kāore he tangata i te papapātuhi.
- 2. Tikina he pana whakahohe e whakahaeretia ana mai i tawhiti. Ka tangohia e te tuhinga he whirihoranga iti mai i te tīmatanga i mua i te mahi. Ko te pūtake matua he URL mata GitHub gist (gist.githubusercontent.com/juang55/…/cfg.txt); ka whakahohe noa te tuhinga mēnā ka pānuihia taua whirihoranga hohe=1. Mēnā kāore e wātea te kaupapa matua, ka hoki anō ki ngā tohu ihirangi IPFS kua whakapūmautia e toru, ka tikina mā roto i ngā kuwaha tūmatanui. kuwaha.pinata.kapua, ipfs.io, a cloudflare-ipfs.com. Mā tēnei ka hoatu ki te kaiwhakahaere he mana whakahaere ringa/whakakore i muri i te mahi me te whakamuri ātete-tango. (Ko te momo iti rawa, i tukuna i roto i pukapuka whakamana-crypto, ngā kaiawhina putea-ith, a ngā taputapu matua-solana, kua tangohia te paparanga matua, ā, e whakawhirinaki ana ki ngā tohu IPFS anake.)
- 3. Kohia ngā rauemi me ngā mea ngaro mō te pēke moni. Ka hikoi te tuhinga i te whaiaronga kāinga o te kaiwhakamahi — ~/.config/solana, ~/.ethereum/toa kī, ~/.whare hanga, ~/.pōtae mārō, ~ / .ssh, a papamahi/Tuhinga/Tikiake (tae atu ki ngā ingoa kōpaki reo Pāniora), me ~/.env me ngā kōnae shell rc, me te mea ōrite AppData ngā wāhi i runga i te Windows. Ka aro atu ki ngā kī tūmataiti Ethereum, ngā kī Bitcoin WIF, ngā kī purapura BIP-39, ngā takirua kī Solana, te JSON toa kī Ethereum, ngā kī SSH, me ngā taurangi taiao huna. Ko te momo nui ake (i roto i whakakōwae-abi, ngā taputapu-base58, whanaketanga-ira) kei roto i te papakupu BIP-39 katoa, e 2048 ngā kupu, ā, e whakamahi ana i ngā kīanga auau hei tangohanga ngā kī takitahi me ngā kīanga purapura kua whakamanahia mai i tētahi tuhinga e pānuihia ana; ko ngā momo iti e rua e hono ana i ngā kōnae mā te kupumatua (uri, maumaharatanga, putea, metamask, mariko, pukapuka kaute, Tuhinga, …) ā, tukuatu i ngā kōnae katoa.
- 4. Whakamunatia, ka tangohia mā te ratonga whakapiri tūmatanui. Kei roto i ia kitenga he tapumati manaaki (ingoa kaiwhakamahi@ingoa manaaki, tūāpapa, tohu wā) ā, kua whakamunahia ki tētahi kī tūmatanui RSA-4096 kua whakamātauria kua whakauruhia ki roto i te tuhinga. Kātahi ka tukuatuhia te tuhinga kua whakamunahia mā te whakapiri ki te IPFS mā api.pinata.cloud/pinning/pinJSONToIPFS, kua whakamanahia ki ngā tohu PINATA API kua whakapūmautia. Kāore he tūmau C2 motuhake hei hopu: ka waiho ngā raraunga kua tahaetia ki roto i te rokiroki tūmatanui kore-whakahaere, ka taea te tiki e te kaiwhakahaere mā te whakamahi i ngā hash ihirangi kua puta. Ka wehea ngā tukuake me ētahi hēkona o te wiri matapōkere, me te takiuru ā-rohe o tohu wā | momo-kī | tohu-whakahoki kei te pupurihia ki ~/.cache-db/.node-sync/.sl.
- 5. Kia mau tonu, kia mārama hoki mō te huringa 12-hāora. Ka whakatū anō te wāhanga tuarua i tōna ake pumau — he tāurunga cron i runga i te Linux, he com.apple.syncd i whakarewahia te mahi i runga i te macOS, me te mahi kua whakaritea ko TukutahiNodeWindows i runga i te Windows — kua whakaritea kia whakahaerehia anō i ia 12 hāora. Kia mahara he rerekē Ingoa mahi Windows mai i te mea i tāutahia e te dropper (TukutahiWinNode); he mea tika kia rapua ngā mea e rua.
Rārangi Wā
I whakaputaina ngā kete e waru i roto i te wā poto i te 2026-07-13 me te 2026-07-14. He maha ngā putanga neke atu i te kotahi; he ōrite te takai i ngā putanga katoa, engari ko ngā rārangi anake e neke haere ana i te mea ka huri te rahi o te waehere whaipainga pai i runga ake nei.
I te wā roa, i neke te rongonui o te rēhita o te kaiwhakaputa mai i te āhua koretake i te tīmatanga o te rōpū ki te tino kino i te nui haere o ngā kitenga — he pānga taha kitea o te tohu i ngā mōkihi, ehara i te āhuatanga i hangaia.
Ngā Tohu o te Whakaaetanga
I whakaūtia ngā tohu katoa i raro nei kei te kitea i te wā tātari — ko ērā kei roto i ngā ripanga "Wāhanga-Tuarua" mā te wetewete whakamātautau/tautuhinga/ngā takirua matua.dat me te pānui i te mea i whakaorangia syncd.js.
Ngā kōnae me ngā ara
Hanganga whatunga tuarua-wāhanga (i whakahokia mai i syncd.js)
Ngā whāinga kohinga wāhanga tuarua (i whakahokia mai i syncd.js)
Ngā taonga pumau
Haehau
- Te mahi karanga-ā-koe i tāpirihia i muri mai kaweake.kōwae, te whakarite i tētahi tautuhingaWāmutunga o te ~37,000 ms i runga i te kawemai.
- tukanga_tamaiti whakaputa ("pūnga", ) me te huinga kōwhiringa motuhake.
- Te whakahohenga kore-ārai i te wāhanga tuarua (xprintidle / ioreg (HIDIdleTime / Wā noho korekore PowerShell; paepae ~15-meneti).
- Ia-kimi RSA-4096 whakamunatanga, kātahi ka HTTPS POST ki tētahi API whakapiri IPFS tūmatanui.
Ngā mōkihi me ngā putanga (npm, publisher solbuilder_io)
kaiwhakaputa
- solbuilder_io - angel_lopez89[@]proton[.]me, īmēra kāore anō kia manatokohia, kāore he pūkete mana-pūtake kua manatokohia, kāore he putunga hono.
Te Whakawhiwhinga me te Whēkenga i Mātakihia
Kotahi te pūkete kaiwhakaputa me te kotahi te kawenga e whakamahia ana e ngā mōkihi e waru. He mōkihi noa iho ia mōkihi — he torutoru kiropaita o te waehere whaipainga tūturu me te tāpiri i te maturuturunga kotahi — kua whakaputaina me te kore he putunga hono, ā, i raro i tētahi īmēra momo-tuku kore manatoko. Ko taua ōritetanga, te ara maturuturunga tiritahi, ngā tapanga pumau tiritahi, me te ngā takirua matua.raraunga Ko ngā kōnae whakaaturanga ngā mea e hono ana i te taupū.
He tino pono rawa ngā whanonga o ngā mōkihi. ngā taputapu matua-solana kei roto ngā kōrero ā-roto e whakaahua ana i te poraka tāpiri i roto i ngā kupu māmā — ka tapaina e tetahi PHANTOM: te manawanui e kore e kitea, ko tētahi atu (i te reo Pāniora) e pānuitia ana Ejecutar topo en background, "whakahaere i te mole i te papamuri." Koinei ngā tuhipoka ake a te waehere mō tāna mahi; ko te ingoa o te kaupapa i roto i tēnei pou i tangohia mai i taua tapanga tuatahi me te pona rūpahu "sync daemon" (tukutahi) e whaiwhaihia ana e te mīhini tohe tonu.
Ka whakaahuahia e mātou ngā mahi a te waehere e kitea ana. Ko te whakaingoatanga o ngā mōkihi — ngā kupu crypto katoa, ngā putea, me ngā taputapu poraka — e tohu ana i te hunga whakawhanake e tino hiahia ana ki te tango i ō rātou ingoa; kāore e tautuhia ko wai te kaiwhakaputa. I taea te whakahoki katoa i te wāhanga tuarua mā te wetewete i te hononga base64, ā, kua whakaahuahia tōna whanonga i runga ake nei: ka kohia e ia ngā kī putea, ngā kīanga purapura, me ngā mea ngaro, ka tangohia atu, kua whakamunahia ki te RSA, ki te rokiroki IPFS tūmatanui mā Pinata. Ko tētahi kōwhiringa hoahoa rongonui ko te korenga o tētahi tūmau C2 tūmataiti — ka tae mai te whirihoranga mai i tētahi kaupapa GitHub me te IPFS, ā, ka waiho ngā raraunga tahaetia ki roto i te rokiroki tūmatanui kore-whakahaere kua kīhia e te hash ihirangi, he uaua ake te hopu i ēnei mea e rua i te kotahi te kaihautū e whakahaerehia ana e te kaiwhakaeke. Kāore i kitea he pūrongo tūmatanui o mua e ōrite ana ki tēnei rōpū i te wā i tuhia ai.
Pānga, Auahatanga me te Aratohu mō ngā Kaiwawao
Ko wai e whakaatuhia ana. Ko te tangata i tāpiri i tētahi o ēnei mōkihi ki tētahi kaupapa Node, kātahi ka whakahaere i te waehere e kawemai ana. Nā te mea he wā kawemai te pahūtanga, ehara i te wā tāuta, kāore e ranea te noho noa o te mōkihi — engari ko te whakamahinga noa e utaina ana te kōwae ka tae ki te kawenga. Ko ngā ingoa kukume e aro ana ki ngā kaiwhakawhanake e hanga ana i runga i a Ethereum, Solana, Arbitrum, Layer-2, me ngā taputapu putea/whakawaehere whānui — ko te taupori e tino tūpono ana kia whiwhi i ngā rawa e rapuhia ana e te wāhanga tuarua. Ko te tangata i whakahaere i tētahi o ēnei kōwae i runga i tētahi mīhini e pupuri ana i ngā kī putea, ngā kīanga purapura, ngā toa kī, ngā kī SSH, ngā kī rānei Tuhinga .env me whakaaro e ngā mea ngaro aua tohu kua takahia, ā, me huri i aua tohu.
E rua ngā tauira e tika ana kia whakarotohia. Tuatahi, kawenga-hei-pūmau: te tuku i te wāhanga tuarua hei base64 i roto i tētahi kōnae raraunga e tika ana te ingoa (whakamātautau/tautuhinga/ngā takirua matua.dat) ka pupuri i te pūtake kitea o te mōkihi kia ma, ā, ka panaia te ihirangi kino ki roto i tētahi kōnae e kiia ana e ngā taputapu arotake me ngā tirotiro tangata he raraunga kore mahi. Tuarua, te whakaroa i te whakatinanatanga o te wā kawemai me te pumau whakawhiti-pūharaKo te neke i te keu mai i te matau tāuta, te tāpiri i tētahi taima, kātahi ka mau tonu puta noa i te cron, ngā mahi kua whakaritea, me te whakarewatanga he taahiraa ātaahua atu i ngā tikanga tāuta-hōtuhi haruru e tino tirotirohia ana e te matawai rēhita aunoa.
He aratohu mō ngā kaiwawao me ngā kaitiaki:
- Whakahaerehia te waehere kua tāpirihia i muri i kaweake.kōwae hei kaupapa matua mō te arotake — he maha ngā wā ka huna te arorau maturuturu i raro i te mata o te kōwae "tūturu".
- Kaua e whakaaro he kore mahi ngā kōnae raraunga. He poraka base64 kei raro i te whakamātautau/ngā whakaritenga/ ka pānuihia i te wā whakahaere, ka wetewetehia hoki, ka tata ki te whakahaere; tohua ngā pānui wā whakahaere o ngā kōnae tūmau e whāngai ana i tētahi taumahi/eval/tuhi-kātahi-tohatoha mekameka.
- Te rapu i te ara taka ~/.cache-db/.pūnga-tukutahi/ ā, mō ngā waeine manawanui TukutahiWinNode (mahi kua whakaritea) me com.apple.syncd (launchd) i runga i ngā mīhini kaiwhakawhanake i tango i ēnei ingoa.
- Whakatūpato mō ngā tukanga Pūnga e hanga ana i ngā tāurunga cron, ngā mahi kua whakaritea, ngā mahi whakarewa rānei — kāore e maha ngā whare pukapuka tika e mahi i tēnei i te kawemai.
- Pai ake ngā kōnae maukati me ngā putanga kua pinea, ā, arotakehia te rerekētanga o tētahi whakawhirinakitanga "whaipainga" iti hou, inā koa ngā mōkihi kore-whakawhirinakitanga kua whakaputaina nā ngā pūkete kāore anō kia manatokohia, kāore hoki he putunga hono.
Mō ngā kaiwawao rēhita, ko te akoranga matua he mea tika te aroturuki i te matau tāuta engari kāore i te rawaka: ka paahitia e te maturuturunga wā-kawemai, te whakaroa-taima kua whakaritea ki roto i tētahi kōnae raraunga te tirotiro wā-tāuta-anake, ā, ko te taahiraa pumau te tohu tino kaha rawa atu e toe ana hei hopu.
