TL; DR
Wofalitsa m'modzi wa npm anatumiza ma phukusi ang'onoang'ono asanu ndi atatu omwe mayina awo amamveka ngati zinthu zomangira za blockchain ndi chikwama, base58-utils, abi-encode, eth-dev, arb-kit, layer2-sdk, solana-key-utils, eth-wallet-helpersndipo crypto-validate-libChilichonse chili ndi chida chogwirira ntchito. Komabe, chomwe chawonjezeredwa pambuyo pa chida chimenecho, ndi block ya code yomwe imadzipangira yokha yomwe imayendetsa nthawi yomwe gawolo lalowetsedwa.
Patatha pafupifupi masekondi 37 kuchokera pamene mwalowetsa, chomwe chimalemba fayilo yolipira yomwe imatumizidwa mkati mwa phukusi lobisika ngati choyesera, ndikulemba ku fayilo yobisika pansi pa chikwatu cha ogwiritsa ntchito, ndikulembetsa yokha kuti iyambirenso nthawi iliyonse login pa Windows, macOS, ndi Linux, ndipo imatsegula script yolembedwa ngati njira yosiyana. Palibe chilichonse chokhudza izi chomwe chimachitika panthawi ya npm install; chimadikira kuti code ilowetsedwe ndikuyendetsedwa, yomwe ndi nthawi yachete kuposa kukhazikitsa.
Katundu wolipirira si wowonekera bwino. Umatumizidwa ngati base64 wamba, kotero kutanthauzira "test fixture" kumabwezeretsa gawo lachiwiri lonse: a chikwama cha crypto ndi woba zinsinsi yomwe imadikira kuti makinawo agwire ntchito, imasonkhanitsa makiyi achinsinsi ndi mawu oyambira, imabisa chilichonse chomwe chapezeka ndi kiyi ya RSA-4096 yolimba, ndikuyitulutsa poyiyika pamalo osungira a IPFS, ndikuyibwezeretsa maola 12 aliwonse.
Timatsata gululo ngati PhantomSyncMaphukusi onse asanu ndi atatu analipo mu registry ya npm panthawi yosanthula, ndipo adasindikizidwa pansi pa akaunti imodzi.
| Makhalidwe | npm |
| phukusi | base58-utils, abi-encode, eth-dev, arb-kit, layer2-sdk, solana-key-utils, eth-wallet-helpers, crypto-validate-lib |
| Mapulatifomu olunjika | Mawindo, MacOS, Linux |
| Khalidwe lalikulu | Chotsitsa cha nthawi yolowera chomwe chachedwa, chabisika ngati choyesera; chimayika kupirira kwa nsanja zosiyanasiyana |
| Malipilo | Chikwama cha Crypto ndi kuba zinsinsi, RSA-4096 encryption, exfiltration kudzera pa IPFS pinning ya anthu onse |
Kapangidwe ka kuukira
Phukusi lililonse limawoneka losadabwitsa mukawerenga koyamba. base58-utilsMwachitsanzo, ndi ma kilobytes ochepa a Base58 / Bitcoin-WIF helper code — zomwe dzinalo limalonjeza. Khodi yoyenera ili pamenepo. pambuyo gawo la module kutumiza kunja kwa module, komwe wowerenga akufufuza pamwamba pa fayiloyo sangayang'ane: ntchito yodzipangira yokha yomwe imadzikonzera yokha ndi nthawi.
Mndandanda wa ntchito, womangidwanso kuchokera ku gwero la phukusi, ukuyenda motere:
1. Package is required() by the host project
2. A self-invoking function schedules a callback ~37,000 ms later (setTimeout)
3. On fire, the callback reads test/fixtures/keypairs.dat (a base64 blob)
4. It base64-decodes that blob into a Node.js script
5. It writes the script to ~/.cache-db/.node-sync/syncd.js (mode 0o700)
6. It installs login-persistence for that script (see below)
7. It spawns "node syncd.js" as a detached processZosankha ziwiri za kapangidwe zimaonekera bwino.
Katundu wolipira amayenda ngati njira yoyesera. Gawo lachiwiri silinalembedwe ngati code yodziwikiratu. Limakhala mu mayeso/zokonzera/keypairs.dat, fayilo ya base64 yomwe dzina lake limaphatikizidwa mu phukusi lomwe limati limagwira ma key pairs. Kwa munthu amene akufufuza tarball, imawoneka ngati chitsanzo cha deta; ku code yowonjezeredwa, ndi script yoti ichotsedwe ndikuyendetsa. Dopper yokha ilibe adilesi ya netiweki - yomwe ili mu gawo lachiwiri - koma palibe chobisika china: cholumikiziracho ndi gawo limodzi la base64, kotero chichotsedwe (base64 -d) abwezeretsa zonse syncd.js ndi machitidwe ake a netiweki. Gawo lotsatira likufotokoza zomwe gawo lobwezeretsedwalo limachita.
Kuphulika kumachedwa ndipo kumalumikizidwa ndi kulowetsa, osati kuyika. Chifukwa choyambitsa ndi amafuna () kuphatikiza nthawi ya ~masekondi 37 m'malo mwa mbedza yokhazikitsa, khalidwe limapewa macheke omwe amangoyang'ana npm kukhazikitsa sitepe, ndipo kuchedwaku kumatenga nthawi yayitali kuposa ma sandbox ambiri ndi ma CI omwe amachitika kwakanthawi kochepa. Pofika nthawi yomwe chilichonse chikugwira ntchito, kukhazikitsa komwe kudakopa phukusili kumakhala kwatha kale.
Kamodzi script yosinthidwa ili pa diski pa ~/.cache-db/.node-sync/syncd.js — njira yosankhidwa kuti iwerengedwe ngati chikwatu cha cache chachizolowezi — chotsitsacho chimapangitsa kuti chipulumuke kuyambiranso pamapulatifomu onse atatu akuluakulu:
- Linux: cholowera cha cron chomwe chimayambitsanso script. Choloweracho chimayikidwa posefa crontab yomwe ilipo kudzera grep -v synced, zomwe zili ndi zotsatira zoyipa zosiya cholembedwa chatsopano kuchokera pamndandanda wamba womwe umalemba dzina lomweli.
- Windows: ntchito yokonzedwa yotchedwa WinNodeSync, yakonzedwa kuti ibwererenso pa mphindi 12.
- MacOS: ntchito yoyambitsidwa yolembedwa com.apple.syncd, imapezeka m'maphukusi angapo — chizindikiro chomwe chimatsanzira ntchito yovomerezeka ya Apple system.
Kenako script imayambitsidwa nthawi yomweyo ngati njira yosiyana, kotero imapitiliza kugwira ntchito pulogalamu yolowetsa ikatha.
Zimene gawo lachiwiri limachita
Popeza chogwiriracho chili ndi gawo limodzi la base64, gawo lachiwiri limasinthidwa bwino ndipo limatha kuwerengedwa lonse. Mapaketi onse asanu ndi atatu ali ndi imodzi mwa mitundu itatu ya script yomweyi, yomwe imadzizindikiritsa yokha mu ndemanga yamutu ngati phantom syncd v3 - topo durmiente (“mole yogona”). Ntchito yake ndi kuba zinthu za cryptocurrency-wallet ndi zinsinsi za opanga mapulogalamu ndikuzitumiza kuchokera pamakina. Imayenda motere:
- 1. Yembekezani mpaka makinawo agwire ntchito. Musanachite chilichonse, syncd.js imayang'ana nthawi yomwe wogwiritsa ntchito wakhala osagwira ntchito ndipo imapitirira malire (pafupifupi mphindi 15) — xprintidle pa Linux, ioreg HIDleTime pa macOS, ndi PowerShell idle-time query pa Windows. Chifukwa chake, kukolola kumachitika ngati palibe amene ali pa kiyibodi.
- 2. Tengani switch yoyatsira yoyendetsedwa ndi kutali. Script imakoka kakonzedwe kakang'ono kuchokera ku dead-drop isanayambe kuchitapo kanthu. Gwero lalikulu ndi GitHub gist raw URL (gist.githubusercontent.com/juang55/…/cfg.txt); script imagwira ntchito pokhapokha ngati config imeneyo ikuwerenga yogwira ntchito = 1Ngati mfundo yaikulu sikupezeka, imabwerera ku zizindikiro zitatu za IPFS zokhazikika, zomwe zimatengedwa kudzera m'zipata za anthu onse. chipata.pinata.cloud, ipfs.iondipo cloudflare-ipfs.comIzi zimapatsa wogwiritsa ntchito mphamvu yolamulira mkono/kuchotsa zida pambuyo pake komanso njira yochepetsera kuchotsedwa. (Mtundu wocheperako, wotumizidwa mu crypto-validate-lib, othandizira-chikwama cha ethndipo zida-zofunikira-za solana, imachotsa gawo la gist ndipo imadalira ma identifier a IPFS okha.)
- 3. Kukolola zinthu ndi zinsinsi za chikwama. Chikalatacho chimayenda mu chikwatu cha ogwiritsa ntchito — ~/.config/solana, ~/.ethereum/store ya makiyi, ~/.foundry, ~/.hardhat, ~/.sshndipo kompyuta/Documents/Downloads (kuphatikiza mayina a zikwatu za Chisipanishi), kuphatikiza ~/.env ndi mafayilo a rc a chipolopolo, ndi zofanana AppData malo pa Windows. Imayang'ana makiyi achinsinsi a Ethereum, makiyi a Bitcoin WIF, mawu oyambira a BIP-39, makiyi a Solana, malo ogulitsira makiyi a Ethereum JSON, makiyi a SSH, ndi zosintha zachilengedwe zobisika. Mtundu waukulu (mu abi-encode, base58-utils, eth-dev) ili ndi dikishonale yonse ya mawu 2048 ya BIP-39 ndipo imagwiritsa ntchito mawu okhazikika kuti Tingafinye makiyi osiyanasiyana ndi mawu omveka bwino ochokera m'malemba aliwonse omwe amawerengedwa; mitundu iwiri yaying'ono m'malo mwake imagwirizanitsa mafayilo ndi mawu ofunikira (mbewu, zokongoletsa, chikwama, metamask, malodza, kaundula, trezor, ...) ndikukweza mafayilo athunthu.
- 4. Sungani ndi kutulutsa deta yanu kudzera muutumiki wotsegulira anthu onse. Chopeza chilichonse chimaphatikizidwa ndi chala cha wolandila (dzina lolowera @ dzina la wolandila, nsanja, nthawi yodindira) ndipo imasungidwa ndi kiyi ya RSA-4096 yolimba yomwe ili mkati mwa script. Kenako cholembedwacho chimakwezedwa pochiyika ku IPFS kudzera api.pinata.cloud/pinning/pinJSONToIPFS, yotsimikizika ndi ziphaso za Pinata API zokhazikika. Palibe seva ya C2 yopangidwira yokha yoti igwire: deta yobedwayo imayikidwa pamalo osungira anthu onse, ndipo wogwiritsa ntchitoyo amatha kuipeza pogwiritsa ntchito ma hashes omwe amabwera. Kutsitsa kumayikidwa ndi masekondi angapo a jitter yosasinthika, ndi mbiri yakomweko ya sitampu ya nthawi | mtundu wa kiyi | hash yobwezedwa imasungidwa pa ~/.cache-db/.node-sync/.sl.
- 5. Pitirizani ndi kuunikira pa nthawi ya maola 12. Gawo lachiwiri limakhazikitsanso kupirira kwake - kulowa kwa cron pa Linux, a com.apple.syncd yakhazikitsa ntchito pa macOS, ndi ntchito yokonzedwa yotchedwa WindowsNodeSync pa Windows — yakonzedwa kuti igwirenso ntchito maola 12 aliwonse. Dziwani kuti iyi ndi zosiyana Dzina la ntchito ya Windows kuchokera pa yomwe dropper imayika (WinNodeSync); zonse ziwiri ndi zoyenera kusaka.
Nthawi
Maphukusi asanu ndi atatuwa adasindikizidwa mwachangu pa 2026-07-13 ndi 2026-07-14. Ambiri ali ndi mitundu yoposa imodzi; chotsitsacho ndi chofanana m'mitundu yonse, ndipo mizere yokha imasintha pamene kukula kwa code yabwino pamwamba pake kumasintha.
Kupyolera mu kufalikira kumeneku, mbiri ya kaundula wa wofalitsayo inasintha kuchoka pa kukhala yopanda tsankho kumayambiriro kwa gululo kupita ku kukhala yoipa kwambiri pamene kupezeka kunawonjezeka — zotsatirapo zooneka za mapaketi omwe analembedwa chizindikiro, osati chinthu chopangidwa.
Zizindikiro za Kugwirizana
Zizindikiro zonse zomwe zili pansipa zatsimikiziridwa kuti zilipo panthawi yosanthula — zomwe zili mu matebulo a "Gawo Lachiwiri" polemba ma code mayeso/zokonzera/keypairs.dat ndi kuwerenga zomwe zapezeka syncd.js.
Mafayilo ndi njira
Zomangamanga za netiweki ya gawo lachiwiri (zobwezedwa kuchokera ku syncd.js)
Zolinga zosonkhanitsira za gawo lachiwiri (zopezeka kuchokera ku syncd.js)
Zinthu zakale zokhazikika
Makhalidwe
- Ntchito yodziyimbira yokha yawonjezeredwa pambuyo pake kutumiza kunja kwa module, ndandanda a setTimeout ya ~37,000 ms pakulowetsa.
- njira_yachibwana kuswana ("node", ) ndi seti ya zosankha zosiyana.
- Kuyambitsa kopanda chochita mu gawo lachiwiri (xprintidle / ioreg Nthawi yopuma ya HIDdleTime / PowerShell; ~mphindi 15).
- Kupeza RSA-4096 encryption, kenako HTTPS POST ku API ya IPFS pinning ya anthu onse.
Maphukusi ndi mitundu (npm, wofalitsa solbuilder_io)
wofalitsa
- solbuilder_io - angel_lopez89[@]proton[.]me, imelo yosatsimikizika, palibe akaunti yotsimikizika yowongolera gwero, palibe malo osungira omwe ali olumikizidwa.
Khalidwe ndi Kuonedwa
Maphukusi asanu ndi atatuwa amagawana akaunti imodzi yofalitsa ndi katundu umodzi wolipira. Phukusi lililonse ndi losafunika kwenikweni — ma kilobytes ochepa a code yeniyeni yokhala ndi dropper yomweyo yowonjezeredwa — yofalitsidwa popanda malo olumikizidwa komanso pansi pa imelo yosatsimikizika yotayika. Kufanana kumeneko, njira yogawana yotaya, zilembo zogawana zolimbikira, ndi zomwe zagawidwa makiyi.dat Fayilo yolumikizira ndi yomwe imagwirizanitsa gulu limodzi.
Ma phukusiwa ndi omveka bwino kwambiri pankhani ya khalidwe lawo. zida-zofunikira-za solana ali ndi ndemanga zomwe zimafotokoza chipika chowonjezeredwacho m'mawu osavuta - wina amachilemba PHANTOM: kupirira kosaoneka, lina (mu Chisipanishi) limawerenga Ejecutar topo en background, “yendetsani mole kumbuyo.” Izi ndi ndemanga za code zomwe zimafotokoza zomwe imachita; dzina la kampeni mu positi iyi latengedwa kuchokera ku chizindikiro choyambacho pamodzi ndi node yabodza ya "sync daemon" (syncd) kuti makina olimbikira amatsanzira.
Timangofotokoza zomwe code imachita. Kutchula ma phukusi - mawu onse a crypto, wallet, ndi blockchain - kumasonyeza omvera opanga mapulogalamu omwe angawatenge ndi mayina awo; sikuti kokha kumatsimikizira wofalitsayo. Gawo lachiwiri linkatha kubwezeretsedwa kwathunthu polemba makiyi a base64, ndipo machitidwe ake afotokozedwa pamwambapa: imasonkhanitsa makiyi a wallet, mawu oyamba, ndi zinsinsi ndikuzitulutsa, RSA-encrypted, ku malo osungira a IPFS kudzera pa Pinata. Chosankha chodziwika bwino cha kapangidwe ndi kusakhalapo kwa seva yachinsinsi ya C2 - kasinthidwe kamachokera ku gist ya GitHub ndi IPFS, ndipo deta yobedwa imayikidwa m'malo osungira a anthu onse omwe ali ndi hash yazinthu, zomwe zonse zimakhala zovuta kuzigwira kuposa host imodzi yolamulidwa ndi wowukira. Palibe malipoti apagulu omwe adapezeka panthawi yolemba izi.
Zotsatira, Zochitika & Malangizo kwa Oteteza
Ndani wawululidwa. Aliyense amene anawonjezera limodzi mwa ma phukusi awa ku pulojekiti ya Node kenako n’kuyendetsa code yomwe imalowetsamo. Popeza kuphulika ndi nthawi yolowetsamo osati nthawi yokhazikitsa, kungokhala ndi phukusili sikokwanira - koma kugwiritsa ntchito kulikonse kwachizolowezi komwe kumakweza module kumafika pamtengo wolipira. Mayina a nyambo amayang'ana opanga mapulogalamu omwe amamanga pa Ethereum, Solana, Arbitrum, Layer-2, ndi zida zonse za chikwama/zolembera - anthu ambiri amakhala ndi katundu womwe gawo lachiwiri limafunafuna. Aliyense amene anayendetsa limodzi mwa ma module awa pamakina okhala ndi ma kiyi a chikwama, mawu oyambira, ma keystores, ma key a SSH, kapena .fm zinsinsi ziyenera kuwona ziyeneretso zimenezo ngati zosayenera ndikuzisintha.
Mapangidwe awiri oyenera kuganiziridwa mkati. choyamba, katundu wolipidwa ngati chokonzekera: kutumiza gawo lachiwiri ngati base64 mkati mwa fayilo ya data yodziwika bwino (mayeso/zokonzera/keypairs.dat) imasunga gwero looneka la phukusili likuwoneka loyera ndipo imayika zinthu zoipa mu fayilo yomwe imayang'ana zida zowunikira ndipo nthawi zambiri anthu amawona ngati deta yosagwira ntchito. Chachiwiri, nthawi yolowera yachedwa kuchitidwa ndi kupitilira kwa nsanja zosiyanasiyana: kusuntha choyambitsa kuchokera pa mbedza yokhazikitsa, kuwonjezera nthawi, kenako kupitiriza kudutsa cron, ntchito zokonzedweratu, ndikuyambitsa ndi sitepe yodziwikiratu kutali ndi njira zokhazikitsira-script zomwe zimangoyang'ana kwambiri registry scanning.
Malangizo kwa oteteza ndi osamalira:
- Konzani code yowonjezera pambuyo pake kutumiza kunja kwa module monga chinthu chofunika kwambiri pakuwunikanso — dropper logic nthawi zambiri imabisala pansi pa malo enieni a module.
- Musaganize kuti mafayilo a deta ndi osagwira ntchito. Pansi pa bokosi la base64 mayeso/masewera/ zomwe zimawerengedwa panthawi yogwiritsira ntchito ndipo zimasinthidwa ndizomwe zimayendetsedwa; onetsani mawerengedwe a nthawi yogwiritsira ntchito mafayilo omwe amadyetsa a ntchito/eval/lemba-ndiye-spawn unyolo.
- Kusaka njira yotsika ~/.cache-db/.node-sync/ ndi mayunitsi olimbikira WinNodeSync (ntchito yokonzedwa) ndi com.apple.syncd (launchd) pa makina opanga mapulogalamu omwe adatulutsa mayina awa.
- Chenjezo pa njira za Node zomwe zimapanga zolemba za cron, ntchito zokonzedwa, kapena ntchito zoyambitsidwa — malaibulale ovomerezeka nthawi zambiri samachita izi akalowetsedwa.
- Sankhani mafayilo otsekeka ndi mitundu yokhomedwa, ndipo onaninso kusiyana kwa kudalira kulikonse kwatsopano kwa "utility", makamaka Ma phukusi odalira zero afalitsidwa ndi maakaunti osatsimikizika opanda malo osungira omwe ali olumikizidwa.
Kwa oteteza registry, mfundo yofunika kuiganizira ndi yakuti kuyang'anira kukhazikitsa ndi mbedza ndikofunikira koma sikokwanira: kutsitsa nthawi yolowera, nthawi yochedwetsedwa yomwe ili mkati mwa fayilo ya data idzadutsa cheke cha nthawi yokhazikitsa yokha, ndipo sitepe yolimbikira nthawi zambiri imakhala chizindikiro chomveka bwino chomwe chatsala kuti chigwire.
