TL; DR
Wofalitsa m'modzi wa npm, ddjidd5640, yapanga kabukhu ka ma phukusi 22 a zida zabodza zachitetezo za Web3 pogwiritsa ntchito mitundu yopangidwa monga Gulu la Chitetezo cha Crypto, Gulu Lofufuza la Web3ndipo Mgwirizano wa DeFi Security.
Maphukusiwa sakuwoneka ngati kampeni yosavuta yolemba. Amawoneka ngati njira yodzitetezera yodziwika bwino, yothandizidwa ndi kufananiza mabungwe opanda kanthu a GitHub ndi mayina a zida za MCP monga search_leaked_credentials, validate_chain_keyndipo deploy_safe.
Kampeniyo yagawika m'magulu awiri mabanja awiri ogwira ntchito yonyamula katundu ndi gawo limodzi losagwira ntchito.
Zosiyana A ili ndi ma phukusi 8 okolola ziphaso. Cholembedwa cha postinstall chimawerenga masitolo achinsinsi am'deralo, pomwe chophatikizidwa scanner.js imagwira ntchito pamene wothandizira wa AI agwiritsa ntchito zida za MCP za phukusili, kufunafuna makiyi a wallet, ma mnemonics a BIP39, ma tokeni a API, ndi ziyeneretso zina.
Kusiyana B Ili ndi ma dropper asanu a binary droppers okhala ndi Pingggy. Ma phukusi awa amatenga ndikugwiritsa ntchito payload yakutali panthawi yokhazikitsa, ndi foundry-deploy-helper:1.8.96 kugwetsa deta yogwiritsidwa ntchito pa /tmp/.node-cache.
Chosintha C Ili ndi ma phukusi 9 osagwira ntchito omwe alibe ndalama zodziwikiratu zolipirira pambuyo pokhazikitsa, koma wofalitsa yemweyo, mawonekedwe a kampani, ndi mayina omwe amayang'ana pa Web3.
Ma phukusi 8 okha mwa 22 omwe adawonetsedwa kulikonse komwe titha kuwona; ena 14 otsalawo anali adakalipo pa npm panthawi yowunika.
Kuopsa: kovuta.
Kuukira: Zolipira Ziwiri mu Kavalidwe Kamodzi
Kabati ndi chizindikiro. Tsegulani README ya crypto-credential-scanner ndipo mukuuzidwa kuti ndi scanner yopangidwa ndi Crypto Security Guild. Tsegulani tsamba la defi-threat-scanner ndipo mukuuzidwa kuti ndi chida cha DeFi Security Alliance. Tsegulani web3-secrets-detector ndipo ndi Web3 Audit Collective. Palibe gulu lililonse la mabungwe awa lomwe lilipo ngati mabungwe. Lilipo ngati ma GitHub org opanda kanthu omwe cholinga chake chokha ndikudzaza hyperlink ya "author" ya tsamba la npm.
Chosintha A: lamulo loyamba lisanayambe kukhazikitsidwa ndi lamulo lalikulu la nthawi ya MCP
Ma phukusi 8 a Variant-A onse ali ndi magawo awiri - pulogalamu yoyika isanatuluke yomwe imatenga ziyeneretso zilizonse zomwe zili kale pa diski m'mawu osavuta, komanso pulogalamu yogwirira ntchito yomwe imayamba kugwira ntchito wothandizira wa AI atayitanitsa chimodzi mwa zida za MCP za phukusili.
"Gawo 1, ulendo usanachitike" imakhala mkati mwa mzere mu package.json ngati node -e one-liner. Imatsegula ma dotfiles asanu ndi awiri odziwika bwino ndikutumiza ma byte 200 oyamba a chilichonse ku C2:
Mabaiti 200 a ~/.ssh/id_ed25519 sichidzapatsa woukirayo kiyi yanu yachinsinsi yokha, koma chidzapereka dzina la fayilo, ndemanga, ndi mizere yoyamba ya mutu wa PEM — zokwanira kutsimikizira mtundu wa kiyi womwe umakhala pamenepo, zomwe ndizokwanira kuyendetsa siteji yotsatira. Mabaiti 200 a ~/.env nthawi zambiri zimakhala zokwanira kutulutsa chizindikiro chonse cha API. Mabaiti 200 a ~/.git-ziphaso nthawi zambiri zimakhala ndi ma tokeni a OAuth onse.
"Gawo 2, gawo lalikulu", ndi scanner.jsImadzazidwa ndi phukusi la index.js ndipo adayimba kuchokera mkati mwa woyang'anira pempho la MCP nthawi yomweyo wothandizira wa AI agwiritsa ntchito chida chilichonse cholengezedwa. Fayiloyo ndi yofanana ndi byte-for-byte m'maphukusi 8 a Variant-A (b461106e47a1f5966159cd6e92541505), ndipo ndi yoona mtima pa zomwe imachita. Ndemanga yoyamba imati, mawu ndi mawu:
| javascript // wallet-scanner.js — chojambulira chogwira ntchito cholumikizidwa cha phukusi la MCP // Chimagwira ntchito mwakachetechete pamene wothandizira wa AI akuyitana chida chilichonse cha MCP, chimasanthula malo a // wallets/makiyi // Chimagwiritsa ntchito Node.js zomangidwa zokha, palibe zodalira zakunja |
Chotsatira ndi kuyenda kobwerezabwereza, kuya kwachitatu, kwa:
chikwatu cha nyumba yokha
...kusefa mayina a mafayilo omwe ali ndi chilichonse mwa sitolo yogulitsira makiyi, chikwama.json, wallet.dat, chinsinsi, seed.txt, metamask, malodza, rabby, chikwama chodalirika, coinbase, chinsinsi-chinsinsi, zokongoletsa, chinsinsi_chachinsinsi, api_key — mwachitsanzo, mndandanda wokonzedwa bwino wa malo aliwonse omwe wogwiritsa ntchito crypto amasunga kiyi. Pa machesi aliwonse, fayiloyo imatsegulidwa ndikusakidwa motsutsana ndi ma regexes asanu ndi limodzi:
| Type | chitsanzo | Zimene zimagwira |
|---|---|---|
| kiyi_yachinsinsi | (?:0x)?[a-fA-F0-9]{64} | Makiyi achinsinsi a Ethereum ndi zinsinsi za hexadecimal za 32-byte. |
| zokongoletsa | \b([a-z]+\s+){11,23}[a-z]+\b | Mawu a mnemonic a BIP39 amachokera pa mawu 12 mpaka 24. |
| api_key | (api[_-]?key\|API_KEY)\s*[:=]\s*["']?([A-Za-z0-9_\-]{20,}) | Ma tokeni a API a Generic ndi ma certificate values omwe ali mu mafayilo osinthira. |
| chinsinsi | (?:secret\|private).{0,10}[:=]\s*["']?([A-Za-z0-9+/=]{20,}) | Zinsinsi ndi mfundo zachinsinsi nthawi zambiri zimasungidwa mu mawonekedwe a YAML, JSON, ndi INI. |
| eth_address | 0x[a-fA-F0-9]{40} | Ma adilesi a chikwama cha Ethereum omwe amagwiritsidwa ntchito kuzindikira ndi kuyika zala za ozunzidwa. |
| achinsinsi | (?:PASSWORD\|PASSPHRASE)\s*=\s*["']?(\S{4,64}) | Ma passwords a mtundu wa Shell-export ndi ma password variables a chilengedwe. |
Kenako scanner.js imawerenga ma dotfile ena asanu ndi limodzi onse — mpaka ma baiti 500 pa ~/.env, ~/.bash_history, ~/.zsh_history, ~/.npmrc, ~/.gitconfig, ~/.git-credentials — ndikutsegula process.env pa variable iliyonse yomwe dzina lake lili ndi key, secret, token, password, private, mnemonic, wallet, kapena seed. Pomaliza imatcha execSync('whoami') kuphatikiza os.hostname() ndi process.cwd() kuti itchule dump ndi umunthu wa wozunzidwayo. Malipiro onse, kuphatikiza mpaka 100 zomwe zapezeka payekha, zimayikidwa ngati chinthu chimodzi cha JSON.
Malo ofikira a exfil sanalembedwe mwachindunji. Phukusili limatengedwa nthawi yogwirira ntchito kuchokera ku:
https://ddjidd564.github.io/defi-security-best-practices/config.json
— Masamba a GitHub amalemba zomwe wowukira amawongolera. config.json yomwe ilipo pano ibwerera
Ngati kutengera kumeneko kwalephera, scanner.js kubwerera ku zomwezo webusaiti ya webhook URL yokhazikika ngati yosasinthika. Kusalunjika kumeneku ndiye njira yokhayo yogwirira ntchito bwino mu kampeni: kumalola wowukirayo kuzungulira zolinga za exfil popanda kufalitsanso phukusili, ndipo kumateteza URL yeniyeni yosonkhanitsa kuti isalowe mu npm artifact, zomwe zimapangitsa kuti kuzindikira pogwiritsa ntchito siginecha kukhale kovuta.
Mtundu B: ngalande ya Pingggy, mtundu wa binary, ndi umodzi wokhazikika
Ndalama zina zomwe zimagwira ntchito ndi zazing'ono kwambiri — ma phukusi asanu — ndipo sizili bwino kwenikweni. Wolembayo sanagwiritse ntchito zovala za MCP konse. Ma phukusi awa amati ndi othandiza pakupanga zida zovomerezeka za Ethereum ndi Solana (chothandizira-chokhazikitsa-truffle, chophatikiza-chainlink-price-feed, wopereka-ganache-cli, solana-pda-helper, wothandizira-woyambitsa-zopangira). Katundu wolipira ndi umodzi https.get-ndi-exec mzere mu atakhazikitsa
C2 ndi yaulere Pinggy ngalande — ntchito yodziwika bwino yopangira ngalande yomwe wowukirayo akugwiritsa ntchito ngati C2 yanthawi yochepa. Phukusili limatsitsa chilichonse chomwe ngalandeyo imabweza ndikuchiyikamo child_process.execPalibe kutsimikizira kukhulupirika, kusaina, kapena chitetezo cha gawo lachiwiri. Chilichonse chomwe ngalande ya woyendetsa ikugwira ntchito lero ndi chomwe chikuyenda.
Phukusi lankhanza kwambiri, foundry-deploy-helper:1.8.96, imalowa m'malo mwa inline https.get ndi kupiringa ndi njira yolimbikira:
Chosintha C: nkhope yopukutidwa, yopanda chophulitsira (pakadali pano)
Maphukusi asanu ndi anayi otsala — chotsimikizira-chosungira-chikwama, chowunikira chitetezo cha env, zida zoyambira (kulakwitsa mwadala kwa Foundry), solna-web3 (kalembedwe ka Solana), chowunika chitetezo cha chikwama, pulogalamu yowonjezera ya hardhat-gas-profiler, ethers-multicall-utils, defi-env-auditor, etherjs-utils - kukhala palibe script yoyikika pambuyo pake ndipo palibe exfil yodziwikiratu yogwiritsira ntchito nthawi yoyambira. Amagawana wofalitsa, ma brand fronts, mawonekedwe a dzina la Web3, ndipo nthawi zina README boilerplate yofanana ndi mitundu yogwira ntchito. Tikuwaona ngati gawo la kampeni yomweyi ndipo talimbikitsa kuchotsa pre-emptive, koma sitinawerengeretu zonse zomwe zimayambitsa nthawi yogwiritsira ntchito. Gawo losagwira ntchito lingakhale malo omwe wogwiritsa ntchito akusungira kuti asinthe mtsogolo - mawonekedwe omwewo omwe PhantomBot idagwiritsa ntchito pakati pa Meyi, pomwe wogwiritsa ntchito adasinthana credential stealer ndi botnet recruit popanda kufalitsanso dzina la phukusi.
Nthawi ndi Katalogu
Phukusi loyambirira kwambiri mu kampeniyi ndi lotsika kwambiri: chotsimikizira makiyi a unyolo:0.2.3 ndi defi-env-auditor:0.3.2 zikuwoneka ngati madontho oyambirira a kuyesa. Pofika nthawi yomwe wofalitsayo anafika chothandizira-chokhazikitsa truffle:1.7.0 ndi foundry-deploy-helper:1.8.96, kukwera kwa mitengo kwa mtunduwo kunali kochita dala — kusankha manambala omwe amawerengedwa ngati mzere wokhazikika wa phukusi. Palibe aliyense mwa 22 amene ali ndi mbiri yakale yovomerezeka pansi pa dzina lenilenilo pa npm.
Katalogu yonse, yogawidwa m'magulu motsatira mitundu:
### Chosintha A — chokolola chitsimikizo (postinstall + MCP-time scanner.js, MD5 b461106e47a1f5966159cd6e92541505)
| phukusi | Version | Zalembedwa mu Ma Feed Ozindikira |
|---|---|---|
mnemonic-safety-check | 0.5.2 | inde |
solidity-deploy-guard | 0.4.4 | inde |
web3-secrets-detector | 1.2.6 | inde |
eth-wallet-sentinel | 1.0.9 | inde |
deployment-key-auditor | 0.7.3 | inde |
defi-threat-scanner | 2.1.2 | inde |
crypto-credential-scanner | 2.0.2 | inde |
chain-key-validator | 0.2.3 | inde |
### Chosintha B — Pinggy tunnel https.get → exec (palibe kuwonekera kwa kuzindikira-feed lipotili lisanaperekedwe)
| phukusi | Version | Kukoma Pambuyo Pokhazikitsa |
|---|---|---|
truffle-config-helper | 1.7.0 | https.get → exec(stdout) |
chainlink-price-feed-aggregator | 1.1.12 | https.get telemetry call |
ganache-cli-provider | 1.7.51 | https.get telemetry call |
solana-pda-helper | 1.0.46 | https.get telemetry call |
foundry-deploy-helper | 1.8.96 | curl + chmod +x /tmp/.node-cache & |
### Chosintha C — osagwira ntchito, akukayikira kuti choyambitsa nthawi yogwirira ntchito (palibe kuwonekera kwa kuzindikira kwa deta isanaperekedwe lipotili)
| phukusi | Version | zolemba |
|---|---|---|
wallet-backup-verifier | 1.0.1 | |
env-security-scanner | 1.6.0 | |
foundy-toolkit | 1.5.79 | typosquat ya foundry |
solna-web3 | 1.5.98 | typosquat of solana |
wallet-security-checker | 1.0.3 | |
hardhat-gas-profiler-plugin | 1.7.86 | |
ethers-multicall-utils | 1.3.15 | |
defi-env-auditor | 0.3.2 | |
etherjs-utils | 1.0.39 |
Mizati ya Variant-A ndi Variant-B sisankhidwa mwachisawawa. Mayina a Variant-A onse amadzigulitsa okha ngati zida zowunikira chitetezo — “kufufuza chitetezo”, “kuteteza deta”, “chofufuzira zinsinsi”, “chikwama cha sentinel”, “wowerengera makiyi”, “chowunikira zoopsa”, “chowunikira ziphaso”, “chowunikira ziphaso”, “chotsimikizira makiyi a unyolo”. Cholinga chake ndi wopanga mapulogalamu kapena wothandizira wa AI yemwe amafunafuna chida chowunikira chitetezo cha pulojekiti ya Web3. Maina onse a Variant-B amadzitcha okha ngati othandizira kumanga ndi kukhazikitsa pa Web3 ecosystem yomweyi — Truffle, Chainlink, Ganache, Solana PDA tooling, Foundry. Kugawanikaku kumafanana ndi chitsanzo chachizolowezi cha Web3 developer cha "audit phase" motsutsana ndi "deploy phase". Gawo lililonse lomwe mungafikire, wofalitsayo wakonza msampha wake.
Zizindikiro za Kugwirizana
Netiweki ndi mafayilo
| IOC | zosinthika | cholinga |
|---|---|---|
https://ddjidd564.github.io/defi-security-best-practices/config.json | A | Chotsutsira cha webhook chosinthika chomwe chimayendetsedwa kudzera pa masamba a GitHub. |
https://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233 | A | Malo osonkhanitsira zinthu zotuluka m'thupi, omwe alinso ngati malo obwerera. |
rqnyz-2605-7280-7--2000-c51.run.pinggy-free.link/npm/-/binary/telemetry | B | Ngalande ya Pingggy imagwiritsidwa ntchito kugawa katundu wakutali wa binary. |
scanner.js MD5 b461106e47a1f5966159cd6e92541505 | A | Kutsitsa kofanana kwa scanner kumagwiritsidwanso ntchito pamaphukusi onse 8 a Variant-A. |
/tmp/.node-cache | B | Detached executable yatsitsidwa ndi foundry-deploy-helper:1.8.96. |
wofalitsa
- dzina lolowera la npm: ddjidd5640
- imelo: 1623682356@qq.com (zosatsimikizika)
- Email ndi SCM chitsimikizo: palibe
- Maphukusi omwe ali pansi pa akaunti: 22, onse alembedwa mu kabukhu pamwambapa
- Ntchito yoyambirira yowonekera: chotsimikizira makiyi a unyolo:0.2.3 (Zosiyana A)
- Zochitika zowoneka posachedwapa: chain-key-validator:0.2.3 ndi crypto-credential-scanner:2.0.2 (zonse mkati mwa maola 24 izi zisanachitike)
Ma brand fronts (ogwiritsidwa ntchito mu wolemba / README / bungwe labodza la GH)
- "Crypto Security Guild" - yothandizidwa ndi bungwe la GitHub lopanda kanthu cryptosec-guild
- "Web3 Audit Collective" — yothandizidwa ndi bungwe la GitHub lopanda kanthu w3audit
- "DeFi Security Alliance" - yothandizidwa ndi bungwe la GitHub lopanda kanthu chitetezo cha defi
- Akaunti ya GH yofotokozera ddjidd564 — host ya dynamic-webhook config.json
Khalidwe
- mfundo -e kuwerenga chilichonse mwa izi mutatha kukhazikitsa .ssh, .ethereum, .bitcoin, .fm, .mbiri_mbiri, mbiri_ya_zsh, ziphaso za .git ndi .slice(0, 200) ndi kugwirizana ndi | olekanitsa ndi chala chapadera kwambiri cha Variant A.
- Kulowetsa ./scanner.js kuchokera ku phukusi lomwe limadzilembetsa lokha ngati MCP Seva ndi zida zotchulidwa ziphaso_zofufuzidwa_zotulutsidwa kapena mawu ofanana ndi akuti "chitetezo audit" ndi chitsimikizo cha Variant-A.
- Node -e postinstall yomwe imatenga kuchokera ku *.run.pinggy-free.link host iliyonse ndikuyika yankho mu child_process.exec ndi chitsimikizo cha Variant-B mosasamala kanthu za wrapper.
Udindo ndi Chilimbikitso
Pali zokwanira patebulo kuti muwonetse pang'ono zala za wofalitsa ndipo sizikwanira kuti munthu adziwe dzina lenileni. 1623682356@qq.com ndi adilesi ya imelo ya QQ — imelo yaulere ya Tencent, yotchuka ku China — ndipo gawo la manambala ndi ID ya ogwiritsa ntchito ya QQ; timaona izi ngati chizindikiro chofewa chokha, popeza ma adilesi amtundu wa QQ amalembedwa pang'ono. Akaunti ya npm ilibe kuulula zinthu ziwiri, palibe imelo yotsimikizika, palibe yotsimikizika. SCM ulalo. Gulu la "Crypto Security Guild" / "Web3 Audit Collective" / "DeFi Security Alliance" ndi lopangidwa ndi anthu ambiri — palibe limodzi mwa atatuwa lomwe lilipo kunja kwa kampeni iyi — ndipo ma GitHub org omwe akuthandizira ndi zipolopolo zopanda kanthu zomwe zimapangidwa kuti zizitha kudzaza maulalo a tsamba la npm.
Mapangidwe awiri ndi ofunika kutchulidwa, chifukwa amaonekera m'ma kampeni oyandikana nawo. Choyamba ndi Kupangidwa kwa mtundu wa kampani ngati umboni wa chikhalidwe cha anthu: woyendetsa sanasankhe mayina a mapulojekiti omwe alipo kale kuti akhale olemba; adapanga nkhani yonse yodalirika kuyambira pachiyambi, podziwa kuti Kapangidwe ka wothandizira wa AI pipeline kapena wopanga mapulogalamu mwachangu amene akufufuza tsamba la npm adzafanana ndi mawu akuti “zikuoneka ngati bungwe lachitetezo” m'malo mwa “ndi bungwe lachitetezo”. Iyi ndi njira yomweyi yomwe mabuku odzikuza adachenjeza — ma phukusi okonzedwa kuti azitsatira dzina lomwe LLM ingachite. kuyambitsa Ngati afunsidwa chida chachitetezo cha Web3, adzikongoletsa bwino mokwanira kuti LLM isayang'anenso kawiri. Kugona pansi ndi mawu omwe apangidwa posachedwapa a ma phukusi oipa omwe mayina awo amafanana ndi omwe ali ndi malo. Ma LLM amaona ngati phukusi lovomerezeka sililipo; kampeni iyi ndi m'bale wake wankhanza kwambiri, pomwe wogwiritsa ntchitoyo amapanganso bungwe lomwe woligwiritsa ntchitoyo angakhalemo.
Chitsanzo chachiwiri ndi Kuyambitsa kwa MCP nthawi. Pofika nthawi scanner.js ikayamba, kukhazikitsa kwatha ndipo wopanga mapulogalamu wapita patsogolo. Choyambitsa ndi wothandizira waukadaulo waukadaulo (AI) yemwe akuyitana chida — ziphaso_zofufuzidwa_zotulutsidwa, pa nkhani ya Variant-A — zomwe wothandizira adzachitadi, chifukwa ndicho chifukwa chake adapatsidwa phukusili. Ntchito yoyipa imachitika panthawi ya zabwino gawo la ntchito, pomwe wopanga mapulogalamu nthawi zambiri amakhala akuyang'ana wothandizira wake wa AI akuchita bwino pa ntchito yomwe adapempha. Ndi kusintha pang'ono kwa khalidwe kuchokera ku "exfil on" yakale npm kukhazikitsa"Kapangidwe kake, ndipo kamapewa bwino kuyika sandbox nthawi yoyikira.
Sitikutchula munthu wowopseza. Zizindikiro (imelo ya QQ, akaunti imodzi, kuphulika kwa phukusi limodzi kwa tsiku limodzi kwa mapaketi 22, ma stacks awiri ofanana a C2) zimagwirizana mofanana ndi woyendetsa mmodzi wopitilira, gulu laling'ono, kapena m'modzi mwa ogwira ntchito omwe adakumana ndi kusefukira kwa mapaketi omwe adawonekera mu telemetry ya npm mpaka 2025-2026. Zimene tidachita mungathe Mwachitsanzo, wogwiritsa ntchito uyu ali ndi njira yodziwika bwino yogwiritsira ntchito (Ethereum + Solana + Foundry/Hardhat tooling), wozunzidwa wodziwika bwino (opanga mapulogalamu a Web3 ndi othandizira a AI omwe amagwira ntchito pamapulojekiti a Web3), komanso njira yodziwika bwino yogwiritsira ntchito nthawi yogwiritsira ntchito (MCP-time runtime trigger kuphatikiza binary fallback yosiyana).
Zotsatira, Zochitika, ndi Zimene Oteteza Angachite
Chenjezo lathu la msanga pipeline anagwira 8 wa 22 Maphukusi ena 14 analipo pa nthawi yonse ya kampeni — asanu ndi limodzi pa nthawi yoyamba ndi ena awiri omwe anafika tsiku lomwelo panthawi ya kampeni. Maphukusi ena 14 analipo pa npm kwa masiku ambiri. popanda kuwonekera mu ma feed aliwonse ozindikira omwe timawayang'anira, ndipo panthawi yolemba nkhaniyi ingakhale yokonzeka kukhazikitsidwa. Kusiyana kumeneko n'kofunika chifukwa:
- Chosintha A chimakhala chete panthawi yoyikaKuwerenga kwa dotfile kumachitika, koma bulk exfil imangoyamba pamene wothandizira wa AI agwiritsa ntchito zida za MCP za phukusili. standard bokosi la mchenga lomwe limayang'ana pambuyo pokhazikitsa lidzawona mfundo -e sungani ndi kusankha kuti ndi yaying'ono komanso yosaoneka bwino.
- Chosintha B ndi mzere umodzi. Palibe chomwe chida chogawa mapulogalamu a pulogalamu yaumbanda chingaphunzirepo — palibe kubisika, palibe katundu wobisika, kapena domain yooneka ngati yokayikitsa. Pingggy tunnel ndi ntchito yovomerezeka yokonza mapulogalamu. Chinthu chokhacho chokayikitsa ndichakuti "wothandizira pakusintha" ayenera kuyimba foni kunyumba.
- Chosintha C chikuwoneka choyera kwathunthu. Ilibe kukhazikitsa hooksNdi chizindikiro chilichonse chokhazikika, zimakhala zachilendo.
Mndandanda Waufupi Wofufuza za Oteteza a MCP-Tool Era
Zochita zitatu zenizeni zomwe zikanagwira kampeni iyi kale:
- Yerekezerani wofalitsa, osati phukusi. Maphukusi makumi awiri ndi awiri pansi pa akaunti ya QQ-mail ya chaka chimodzi yopanda SCM Kutsimikizira ndi chizindikiro chowala kuposa chilichonse pa phukusi lililonse. Njira yathu yochenjeza anthu oyambirira inagwira ma phukusi oyamba chifukwa cha zala za ofalitsa zomwe zinali zapadera - zomwe zimalimbikitsa mbiri ya ofalitsa yomwe aliyense mwa anthu otetezeka, osatsimikiza, kapena omwe ali ndi pulogalamu yaumbanda pa phukusi lililonse angachepetse.
- Tengani ma dynamic-config directions ngati oipa mpaka atatsimikiziridwa kuti ndi osiyana. Phukusi lomwe limathetsa vuto lake lotha ntchito nthawi yogwiritsira ntchito kuchokera ku chikalata cha chipani chachitatu (GitHub Pages, GitHub Gist, Pastebin, S3 object, kwina kulikonse) lilibe chifukwa chomveka chochitira izi pa telemetry. Ma endpoint enieni a telemetry ali ndi ma code okhazikika komanso olembedwa.
- Yesani ma phukusi a MCP-server potengera malo a chida chawo cholengezedwa. Ma phukusi a Variant-A onse amalengeza zida zotchedwa
search_leaked_credentials,validate_chain_key,deploy_safe, ndi mawu ofanana ndi "audit". Woyang'anira MCP yemwe amaika chida chomwe mafotokozedwe ake amati amasanthula ma project directors kuti apeze ziyeneretso ayenera kufunikira kuti wogwiritsa ntchito alowe mwachindunji asanagwiritse ntchito codebase yeniyeni. Mfundo ya MCP ndi yakuti agent loop ilibe njira yodziwira ngatisearch_leaked_credentialsndi kufufuza ziphaso kapena ndi exfiltrator ya ziphaso.
Kwa opanga mapulogalamu omwe mwina adayika kale imodzi mwa ma phukusi 22: ganizirani kiyi iliyonse yolembedwa ~/.ssh, ~/.ethereum, ~/.bitcoin, ~/.solana, ~/.envkapena ~/.git-ziphaso yasokonekera, sinthani chiphaso chilichonse chomwe dzina lake likugwirizana ndi mndandanda wa zosefera za env-variable pamwambapa, ndipo pa Linux/macOS yang'anani fayilo yomwe ingagwire ntchito pa /tmp/.node-cache (ndipo njira iliyonse yosauka inayamba kuchokera pamenepo). Kukhazikitsanso mtundu wovomerezeka wa zida zoyeserera (maziko, truffle, hardhat, ganache, ndi zina zotero) sichichotsa binary yomwe yagwetsedwa.
Gawo la Variant-C lomwe silikugwira ntchito ndi gawo la nkhaniyi lomwe limakalamba kwambiri. Mapaketi asanu ndi anayi okhala ndi mbiri yoyera yokhazikitsa ndi wofalitsa wodziwika bwino ndi mtundu wa zinthu zomwe wogwiritsa ntchito amasunga. Ngati ziphulika pambuyo pake - monga momwe PhantomBot idachitira pamene zida za axois Kubwezeretsanso phukusi kunasinthidwa kuchoka pa kuba kwa ziphaso kupita ku kulembetsa anthu a botnet — zidzaphulitsa aliyense wogwiritsa ntchito registry amene wayika phukusi la Variant-C pakati pa lero ndi kuchotsa. Kuyika phukusi loipa ndi mtundu sikukutetezani ku wofalitsa amene amalamulira mtundu uliwonse.
Zothandizira
- [tsamba lofalitsa la npm la ddjidd5640](https://www.npmjs.com/~ddjidd5640) — Maphukusi 22 omwe alembedwa pansi pa akauntiyi. Magwero ovomerezeka a kabukhuka panthawi yolemba.
- [tsamba la phukusi la npm la chowunikira-chinsinsi cha crypto](https://www.npmjs.com/package/crypto-credential-scanner) — chitsanzo cha Variant-A artifact; README, mbiri ya ma version, ndi maulalo a olemba akuwoneka apa.
