Posachedwapa, Xygeni yawona njira yodetsa nkhawa pa nkhani ya kuukira kwa mapulogalamu mu 2025., yomwe ikupezeka m'magulu awiri otchuka owongolera ma phukusi: PyPI ndi npmMonga gawo la khama lathu lopitiliza la upangiri wa ziwopsezo,Chenjezo Loyambirira la Xygeni's Malware (MEW) chidachi chinapeza chitsanzo chosiyana koma chofanana ndi njira ya phukusi loipa lomwe linakwezedwa ku registry ina kale. Nkhaniyi ikuwonetsa momwe anthu omwe akuwopseza akusintha ndikugwiritsanso ntchito njira zowukira m'chilengedwe chonse, makamaka kudzera mu mapaketi a Python oipa ndi mapaketi a npm oipa, zomwe zimawonjezera chiopsezo cha ma phukusi oipa kulowa mu unyolo wopezera zinthu zotseguka.
Xygeni's MEW: Kuzindikira Kufanana
Chida cha Xygeni cha MEW chapangidwa kuti chizindikire ndikulemba ma phukusi oipa, makamaka omwe amagwirizana ndi Software Supply Chain Attacks mu 2025, akangosindikizidwa ku ma registry otseguka. Chimagwira ntchito pofufuza ma phukusi atsopano kuti apeze khalidwe lokayikitsa.
Pa nkhani imeneyi, anapeza awiri mapaketi a Python oipa (graphalgo pa PyPI) ndi mapaketi a npm oipa (express-cookie-parser pa npm).
Ma phukusi a Python ndi npm owopsa mu Mapulogalamu Othandizira Kuukira (2025)
Tiyeni tiwone makhalidwe omwe adagawana omwe adayambitsa machenjezo athu:
Kujambula typosquatting
Onse awiri anayesa kutsanzira ma phukusi otchuka omwe alipo.
- graphalgo (PyPI): "Phukusi la Python lopangira ndikusintha ma graph ndi ma network."Yakwezedwa ndi wogwiritsa ntchito dzina lake" "larrytech" Pa June 13, 2025, phukusili linadziwonetsa ngati njira ina ya PyPi m'malo mwa pulojekiti yoyambirira ya graphalgo yopanda chinyengo, yomwe pambuyo pake idasinthidwa kukhala graphdict.
- express-cookie-parser (npm)Phukusili linatsanzira phukusi lodziwika bwino la cookie-parser, ngakhale kuti linafanana ndi phukusi lake. README.md. Kudzionetsera koteroko ndi njira yakale yopezera ndalama zodalirika zomwe zilipo.
Kudzibisa ngati Mzere Woyamba wa Chitetezo
Ma phukusi onsewa adabisa ma code awo oyipa mkati mwa mafayilo oyambilira. graphalgo, khodi yobisika yapezeka mkati /utils/load_libraries.py. Kutengera pa chowunikira-ma cookie-express, cookie-loader.min.js munali katundu wobisika.
Gawo loyamba la kubisa deta nthawi zambiri limagwiritsidwa ntchito kulepheretsa kuyang'ana mwachisawawa komanso kusanthula kosasinthasintha. Kubisa deta kunali kosavuta: kubwerezabwereza kwa ZLib kuphatikiza Base64 encoding. Mtundu uwu wa kubisa deta umasonyeza bwino kuti pulogalamuyo ikuyesera kubisa khalidwe lake. Pamodzi ndi umboni wina, izi zinalola Xygeni MEW kugawa ma phukusiwo ngati pulogalamu yaumbanda. Pa nthawi yotsimikizira, owunikira athu adakonza mwachangu script yobisa deta yomwe idavumbulutsa gawo lodziwika bwino la kutsitsa deta.
Kutumiza Zinthu Zonyamula Zinthu Pamasitepe Ambiri ndi Malo Oyambira Ogawana
Ma phukusi onsewa ankagwira ntchito ngati "yoyamba"otsikira,” kukonza malo oti katundu weniweni apezeke. Iwo anali ndi njira yofanana yakunja “mbewu"Ulalo wa fayilo:"https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
Fayilo yofanana ya mbewu yakunja iyi ndi chizindikiro champhamvu cha woyambitsa chiwopsezo chogawana. Chochititsa chidwi n'chakuti, zomwe zili mu fayilo ya mbewu iyi zikuwoneka ngati zosintha zosavuta zachilengedwe (monga, JWT_SECRET, PORT), zomwe zingasokoneze kuwunika kwa ntchito yake yeniyeni.
Kusintha kwa Dynamic C2 ndi DGA
Njira yodziwika bwino yomwe imapezeka m'maphukusi oipa awa ndi kugwiritsa ntchito Domain Generation Algorithm (DGA) kuti ithetse seva ya Command and Control (C2) mosinthasintha. Njira imeneyi, yomwe nthawi zambiri imawoneka mu mapulogalamu apamwamba operekera mapulogalamu mu 2025, imadalira SHA256 hash yochokera ku zomwe zili mu fayilo ya mbewu, kuphatikiza ndi ma values ena okhazikika. Pochita izi, zomangamanga za C2 zimasintha pafupipafupi, zomwe zimapangitsa kuti kuletsa kwachikhalidwe kusakhale kogwira mtima kwambiri. Pankhaniyi, mtundu wa npm unagwiritsa ntchito mtengo wokhazikika wa 496AAC7E monga gawo la mfundo zake za DGA.
Kukhazikitsa Kulimbikira
Owukira onsewa ankafuna kukhazikitsa malo okhazikika pa makina omwe akhudzidwa. Njira yawo inali kuyika fayilo, startup.py (ya PyPi) kapena startup.js (ya npm), m'madiresi odziwika bwino a deta ya ogwiritsa ntchito a Google Chrome m'machitidwe osiyanasiyana ogwiritsira ntchito (Windows, Linux, macOS).
Kuyeretsa Pambuyo pa Kugwira Ntchito
Pofuna kuchepetsa zotsatira, zolemba zonse ziwiri zoyipa zinachita ntchito zoyeretsa. Izi zinaphatikizapo kuchotsa mafayilo awo oyamba otsitsa (load_libraries.py, cookie-loader.min.js) ndikusintha mafayilo ovomerezeka a phukusi (__init__.py, index.js) kuchotsa zolozera ku zigawo zomwe zachotsedwa tsopano.
Zizindikiro za Kugwirizana mu Maphukusi a Malicious Python ndi npm
- Phukusi la PyPI: graphalgo (yofalitsidwa ndi larrytech, June 13, 2025)
- Phukusi la npm: express-cookie-parser (makamaka mtundu 1.4.12)
- Kupeza URL ya Mbewu Yogawidwa:
https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
- Maina a Fayilo Osatha:
startup.py(Python)startup.js(JavaScript) - Njira Zodziwika Bwino Zosatha (zodalira OS): M'madiresi a deta ya ogwiritsa ntchito a Google Chrome (monga,
AppData\Local\Google\Chrome\UserData\Scripts\pa Mawindo,~/.config/google-chrome/Scripts/pa Linux, ndi zina zotero).
Momwe Mungadzitetezere ku Maphukusi Oyipa mu Mapulogalamu Othandizira Kuukira mu 2025
Njira Yoyenera Kwa Opanga Mapulani
Chochitikachi chikugwira ntchito ngati chitsanzo chabwino kwambiri pankhani yokhudza kuukira kwa mapulogalamu mu 2025. Chikuwonetsa momwe ma phukusi oipa a Python ndi ma phukusi oipa a npm amatha kulowa m'malo odalirika, nthawi zambiri kupewa kupezeka mpaka nthawi itachedwa. Ichi ndichifukwa chake kuzindikira koyambirira, kugwiritsa ntchito zida zanzeru, komanso ukhondo wamakina tsopano ndi zinthu zofunika kwambiri pa ntchito iliyonse yotetezeka ya DevOps. Opanga mapulogalamu akulimbikitsidwa kuganizira izi:
Kuwunikanso Kudalira
Ngati mapulojekiti anu aphatikizapo graphalgo or chowunikira-ma cookie-express, kungakhale kwanzeru kupitiriza kuwachotsa.
- Kwa PyPI:
pip uninstall graphalgo - Kwa npm:
npm uninstall express-cookie-parser
Ukhondo wa Dongosolo
Ganizirani kuchita scan yonse ya dongosolo. Ndikoyeneranso kuyang'ana pamanja njira zodziwika bwino za chikwatu cha data cha ogwiritsa ntchito a Chrome kuti muwone ngati pali chilichonse chosayembekezereka. startup.py or startup.js Mafayilo.
Njira Zachitetezo Zokhazikika
- Yesani Kudalira Kwatsopano: Khazikitsani ndondomeko yowunikira bwino ma phukusi atsopano musanawaphatikize, poganizira kwambiri omwe akuchokera kwa ofalitsa osawadziwa.
- Phatikizani Zida ZachitetezoZida monga Xygeni's MEW, pamodzi ndi mapulogalamu ena ofufuza kapangidwe ka mapulogalamu (SCA) mayankho, angapereke chitetezo chofunikira pozindikira makhalidwe okayikitsa ndi zofooka.
- Mwayi Wochepa Kwambiri: Malo ogwirira ntchito okhala ndi mfundo ya ufulu wochepa angathandize kuchepetsa zotsatira zomwe zingabwere chifukwa cha mgwirizano.
- Network KudziwitsaKuyang'anira kuchuluka kwa ma network omwe akubwera kuti awone ngati pali kulumikizana kwachilendo nthawi zina kumatha kuwulula kulumikizana kwa C2 komwe kumapangidwa ndi DGA.
Zigawo Zofunikira za load_libraries.py (kuchokera ku graphalgo)
download_remote_content(): Imasunga mafayilo kuchokera ku ma URL enaake.run_process(): Imagwiritsa ntchito ma script akunja a Python mwanjira yosiyana, kuletsa zotuluka kuti zisawonekere.get_output_file_path(): Imasankha malo oyenera a dongosolo la fayilo ya startup.py yomwe ikupitilizabe.remove_self(): Imakonza kuyeretsa mafayilo oyipa oyamba ndi kusintha kwa phukusi pambuyo pochita izi.simple_shift_encrypt()/simple_shift_decrypt(): Ntchito za cryptographic zapadera zobisa njira zolumikizirana, zofunika kwambiri pakugwiritsa ntchito DGA.load_libraries(): Ntchito yaikulu yomwe imagwirizanitsa njira yonse ya magawo ambiri, kuyambira kutsitsa koyamba mpaka kukonza ndi kuyeretsa komaliza.
Zotsatira
Monga momwe zilili ndi ma phukusi ena omwe angakhale oopsa omwe MEW yawazindikira, chitseko chotetezera chidateteza nthawi yomweyo ogwiritsa ntchito omwe angaphatikizepo ma phukusi oipawa m'madongosolo awo. Titatsimikizira, tinatsatira njira zodziwitsira ma registry onse awiri, omwe pambuyo powunikira adachotsa ma phukusi onse awiri.
