TL; DR
Pa 2026-05-21, wofalitsa wa npm jaggle yatulutsa mitundu isanu ndi inayi (1.0.0 kudzera 1.0.8) za @jaggle/resizeobserves muwindo la maola pafupifupi awiri.
Phukusili ndi typosquat ya zovomerezeka @juggle/resize-observer polyfill — phukusi lomwe limagwiritsidwa ntchito kwambiri lomwe lili ndi zotsitsa mamiliyoni ambiri sabata iliyonse — koma silitumiza kukhazikitsidwa kwenikweni kwa ResizeObserver.
M'malo mwake, phukusili mbedza yoyikika pambuyo imayika pulogalamu yolipira ya Python yolumikizidwa, imalembetsa kupirira ngati wogwiritsa ntchito nthawi yogwirira ntchito papulatifomu, ndipo imagwiritsa ntchito chida chogwiritsa ntchito clipboard hijacker chomwe chimayang'ana kwambiri zochitika za cryptocurrency.
Linux kupirira kumawoneka ngati python3-dbus-helper, macOS as com.apple.python.runtimendipo Windows as PyRuntimeBroker.
Katundu wolipira nthawi zonse amayang'anira clipboard kuti aone maadiresi a chikwama m'mbali zonse ma blockchain opitilira 40 ndipo amalowetsa ma adilesi okopedwa mwakachetechete ndi ma wallet olamulidwa ndi owukira.
Pulogalamu yaumbanda imagwira ntchito m'deralo popanda zomangamanga za C2 zotuluka, zomwe zimapangitsa kuti kusintha kwa clipboard kukhale njira yotulutsira deta.
IOC yoyamba ndi dzina la phukusi lokha: @jaggle/resizeobserves — onani vowel yotayika mu "jaggle" ndi "s" yowonjezera mu "resizeobserves".
Kuopsa: kwakukulu.
Kuukira: Momwe Kumagwirira Ntchito
npm:@jaggle/resizeobserves sizimawoneka ngati pulogalamu yaumbanda pa pulogalamu wamba mawonekedwe a npm. Zake README.md ndi README yeniyeni ya npm:@juggle/resize-observer — zitsanzo za code zomwezo, malangizo ofanana ogwiritsira ntchito, zomwezo lowetsani { ResizeObserver } kuchokera ku '@juggle/resize-observer' maumboni onse. Kuba zinthu mwachinyengo n'kokwanira kwambiri kotero kuti aliyense amene akuyang'ana zolembazo angaganize kuti akuwerenga zikalata zovomerezeka za phukusili.
The phukusi.jsonMosiyana ndi zimenezi, ndi zochepa: ayi malo munda, umodzi ndine kulowa kolozera pa bin/clipboard-guardian.js, Ndi atakhazikitsa script yomwe ikuyenda mfundo npm-install.jsZitsanzo za "Magwiritsidwe ntchito oyambira" za README zikunena za kukhazikitsa kwa JavaScript komwe kulibe kulikonse mu tarball. JavaScript yokhayo yomwe ili mu phukusili ndi script yokhazikitsa.
Gawo 1 — npm postinstall bootstraps a Python payload
npm-install.js imadziwa bwino za nsanja. Imapeza pip yogwiritsidwa ntchito potsatira njira yosakira yokhazikika (/usr/bin/pip3, /usr/local/bin/pipkubwerera ku pipi ya python3 -m), imayika phukusi la Python lophatikizidwa kuchokera ku chikwatu cha tarball, ndipo — pa Linux — imakoka xclip or xsel kudzera kupeza-bwino, pacmankapena dnf ngati palibe chomwe chilipo kale:
The ntchito -maphukusi a dongosolo losweka ndi cholinga: kugawa kwa Linux kwamakono kumatumiza Python ndi chizindikiro cha PEP 668 choyendetsedwa ndi malo ozungulira chomwe chimayatsidwa, chomwe chimatseka ma pip installs patsamba lonse mwachisawawa. Script yokhazikitsa imakakamiza kuyika.
Chikalatachi chimadziwikanso ndi sudo-aware. Pamene uid ikuthamanga ndi zotsatira za kukhazikitsa sudo npm, script ikuwerenga SUDO_USER ndi zipolopolo kupita ku getent passwd kupeza kwenikweni chikwatu cha kunyumba cha wogwiritsa ntchito, kenako amalemba mafayilo ake olimbikira pamenepo m'malo molemba mu / mizuKulimbikira kumachitika pa wogwiritsa ntchito aliyense, osati pa dongosolo lonse.
Gawo 2 - Kupitirizabe kwa Cross-OS pansi pa mayina a ma broker a nthawi yothamanga
Pambuyo poti phukusi la Python lakhazikitsidwa, script imalembetsa cholowera choyambitsa chokha pansi pa dzina losiyana pa makina onse ogwiritsira ntchito:
- Linux — chipangizo chogwiritsa ntchito dongosolo pa ~/.config/systemd/user/python3-dbus-helper.service. Chipangizocho Kufotokozera is Wothandizira wa Python D-Bus Runtime. Chikalatachi chimayesetsanso kuchiyatsa kudzera mu systemctl - kuthandizira kwa ogwiritsa ntchito, kubwerera ku symlink yamanja pansi pa default.target.wants/ pamene systemctl yalephera. Ngati ikuyenda pansi pa sudo, script imasintha kupita ku sudo -u systemctl - wogwiritsa ntchito, ndi XDG_RUNTIME_DIR khazikitsani kuti foni ya ogwiritsa ntchito igwire ntchito.
- macOS — mndandanda wa LaunchAgent pa ~/Laibulale/LaunchAgents/com.apple.python.runtime.plist ndi RunAtLoad=zoona ndi Sungani Moyo = zoona, kenako kulowetsedwa kudzera katundu wa launchctl.
- Windows — Ntchito Yokonzedwa yotchedwa PyRuntimeBroker, yomwe inayambitsa AtLogOn, yokhala ndi malire a nthawi yogwirira ntchito a zero (mwachitsanzo, palibe nthawi yopuma), yolembetsedwa kudzera pa PowerShell.
Mayina onse atatu ndi odalirika pang'ono. python3-dbus-helper ikutsatira mwambo wopatsa mayina a kuphatikiza kovomerezeka kwa Python-D-Bus pa ma desktops a Linux. com.apple.python.runtime imatsanzira zilembo za Apple zotsutsana ndi DNS chifukwa cha ntchito zake. PyRuntimeBroker imabwereza za Windows RuntimeBroker.exe — ntchito yeniyeni ya Microsoft, yosainidwa bwino yomwe imathandizira mapempho a chilolezo cha mapulogalamu a UWP. Palibe chilichonse mwa izi chomwe chili ntchito zenizeni za Apple/Microsoft/Python pankhani iyi, koma woteteza yemwe akuchita scan yachangu ya systemctl - mndandanda wa ogwiritsa ntchito or Pezani Ntchito Yokonzedwa sizingatheke kuti zichitike.
Gawo 3 - Kusankha kwa katswiri wodziwa bwino ntchito
Python payload, yoyikidwa pa clipboard_guardian/guardian.py, imayendetsa kuzungulira kosatha komwe kumafufuza clipboard ya dongosolo ma milliseconds 400 aliwonse. Pa chizindikiro chilichonse, imakoka zomwe zili mu clipboard zomwe zilipo pano kudzera pyperclip.paste() ndipo imayendetsa motsutsana ndi mndandanda wa ma expression okhazikika opitilira makumi anayi omwe adapangidwa kale omwe amaphatikizapo mawonekedwe a ma wallet-address a Ethereum, Bitcoin, Monero, Solana, TRON, TON, Ripple, Litecoin, Dogecoin, Polkadot, NEAR, Cosmos, Algorand, Stellar, Cardano, Bitcoin Cash, Dash, Zcash, Aptos, Sui, Tezos, MultiversX, Harmony, Terra, Injective, Osmosis, Kava, Celestia, Nano, Filecoin, Ronin, Ergo, DigiByte, Hedera, BNB Smart Chain, ndi ena angapo omwe ali ndi ma stubbed koma opanda kanthu mu default config (Sei, IOTA, Kaspa, Flow, Nervos, Decred, Ravencoin).
Masewero akafika, script imawerenga adilesi ya wowukirayo kuchokera ku ~/.config/clipboard-guardian/config.json (kapena zofanana ndi nsanja yake) ndikulembanso mawu omwe asinthidwa pa clipboard:
Palibe chizindikiro cha netiweki. Chodulira sichimayimba foni kunyumba, sichilembetsa ma host omwe ali ndi kachilomboka, sichitulutsa chilichonse. Kutulutsa ndiko kusintha kokha: pamene wogwiritsa ntchito amakopera adilesi ya wolandila kuchokera ku UI yake ya chikwama ndikuyiyika mu dialog yotumizira, adilesi yomwe yaikidwayo ndi ya wogwiritsa ntchito. Ndalamazo zimatayika mkati, poyera kwa wogwiritsa ntchito.
Chatsopano ndi chiyani apa?
Zambiri zochepa zimaonekera bwino poyerekeza ndi template ya crypto-clipper:
1. npm → Python crossover. Ma crypto-clippers ambiri omwe timawaona mu npm ndi JavaScript yeniyeni, nthawi zambiri amakhala obisika ndi _0x kuzungulira kwa gulu kapena eval(atob(…)) stacks. Chitsanzochi chimagwiritsa ntchito npm tarball ngati cholembera chotumizira phukusi la Python — clean Python — ndipo chimalola pip kugwira ntchito yodalira kukhazikitsa (pyperclip, psutil, mwakufuna setproctitle) yalengezedwa mu bundled pyproject.tomlPalibe vuto la JavaScript loti ligonjetsedwe. Chodulira chokha ndi Python yosavuta kuwerenga.
2. Zolemba zolimbikira za Tri-OS zomwe zasankhidwa kuti zitheke. Okhazikitsa ambiri pa nsanja zosiyanasiyana amalembetsa kupirira pansi pa mayina wamba (ntchito yatsopano, wothandizira.plist). Chitsanzochi chimayesetsa kusankha zilembo zomwe zimafanana ndi ma broker a runtime omwe amagwiritsidwa ntchito pa pulatifomu iliyonse. Dzina lokhalo ndilo njira yokhayo yobisalira - palibe rootkit, palibe kubisala kwa ogwiritsa ntchito, kapena njira yobisika. Chosangalatsa ndichakuti oteteza nthawi zambiri samafufuza. ~/.config/systemd/user/ ndi kuti utumiki wotchedwa python3-dbus-helper Sizidzaonekera bwino mu ndemanga yosamveka bwino.
3. Kubisa mutu wa ndondomeko ndi zenizeni, koma kutsutsa kusanthula sikunagwiritsidwe ntchito. Python payload imatanthawuza a _njira_yobisa() ntchito yomwe imayika mutu wa ndondomeko kudzera setproctitle (Linux/macOS) kapena SetConsoleTitleW (Mawindo) — ndi chachikulu () amachitcha. Kotero ps ps ziwonetsa python3-dbus-helper m'malo mwa python3 …/guardian.pyKomabe, gawo lomweli limafotokoza is_monitor_running() ntchito yomwe imawerengera zida zodziwika bwino zowunikira njira (htop, btop, Task Manager, Activity Monitor, Process Hacker, Resource Monitor, GNOME / KDE / Xfce / MATE system monitors, ndi zina zotero) — ndi chachikulu () Sizikutchedwa. Chizunguliro chosinthira chimagwira ntchito mosasamala kanthu, kaya wogwiritsa ntchito ali ndi chowunikira cha process kapena ayi. Ntchitoyi ndi code yotayika mu mtundu wotumizidwa. Mwina ndi yotsala kuchokera ku kubwereza koyambirira, kapena scaffolding ya chinthu chomwe sichinalumikizidwebe. Mulimonsemo, malo oletsa kusanthula a payload yofalitsidwa ndi kusintha dzina la process-title, osati kupewa chowunikira chogwira ntchito.
4. Khalidwe la kusonkhanitsa ma bundled config. npm-install.js amalemba mndandanda wa chikwama chokhazikika ku ~/.config/clipboard-guardian/config.json ndipo, ngati fayilo yosinthira ilipo kale, imaphatikiza makiyi aliwonse omwe mtengo wake ulibe kanthu. Izi zikutanthauza wogwiritsa ntchito amene kale adadwalapo ndipo adayeretsa pang'ono makonzedwewo - mwachitsanzo, pochotsa ethereum value — idzadzazanso ndi pulogalamu iliyonse yoyipa yomwe yayikidwa pambuyo pake. Palibe kuyeretsa fayilo yopitilira mu njira iliyonse ya code.
| Tsiku / Nthawi (UTC) | chochitika |
|---|---|
2026-05-21 18:50:32 | @jaggle/resizeobserves@1.0.0 lofalitsidwa. |
2026-05-21 19:55:55 | 1.0.1 yofalitsidwa — mtundu woyamba wodziwika ndi kusanthula kwakunja. |
2026-05-21 19:58:10 | 1.0.2 lofalitsidwa. |
2026-05-21 20:05:03 | 1.0.3 lofalitsidwa. |
2026-05-21 20:09:24 | 1.0.4 lofalitsidwa. |
2026-05-21 20:13:48 | 1.0.5 lofalitsidwa. |
2026-05-21 20:41:52 | 1.0.6 lofalitsidwa. |
2026-05-21 20:43:56 | 1.0.7 yofalitsidwa — ikuwonjezera try/catch chokulunga mozungulira chikwama cha wallet-config lembani sitepe yolowera npm-install.js. |
2026-05-21 20:46:15 | 1.0.8 yofalitsidwa — wokhazikitsa dzina lake lasinthidwa npm-install.js → npm-install.cjs (zolemba zofanana ndi za byte). |
2026-05-22 | Zigamulo ndi ma IOC afalitsidwa. Mabaibulo akadalipobe mu kaundula panthawi yofalitsa (ikupitirira). |
Mabaibulo asanu ndi anayi mu ola limodzi ndi mphindi makumi asanu ndi limodzi ndi asanu ndi limodzi ndi ofulumira ngakhale kwa munthu amene walembapo. Kachitidwe kake kakugwirizana ndi kampeni yofalitsa ndi kuwotcha — lowetsani mu registry pansi pa chogwirira chimodzi, lolani kuti kuzindikira kuchitike, ndikusunthira ku chogwirira chatsopano mukangochotsa mtundu umodzi. Ma deltas owoneka bwino nthawi yonseyi ndi okongola: 1.0.1 yawonjezeredwa momveka bwino /usr/bin/pip3-style paths to pip search list (sudo-compatibility), 1.0.7 inakulunga wallet-config write mu try/catch, ndipo 1.0.8 inasintha dzina la installer kuchokera .js ku .cjs pamene akusunga zomwe zili mkati mwake mofanana. .cjs Sinthani dzina la nyimbo ndi machenjezo a npm okhudza kusasinthika kwa module yosamveka bwino m'maphukusi opanda mawu omveka bwino "Mtundu" gawo, ndipo mwina ndi kuyesa kuletsa phokoso la nthawi yoyika lomwe lingakope chidwi. Python payload - gawo lokhalo lomwe limaba - silinasinthe m'mitundu yonse isanu ndi inayi.
Zizindikiro za Kugwirizana
phukusi
| Makhalidwe | phukusi | Versions | kachirombo |
|---|---|---|---|
| npm | @jaggle/resizeobserves | 1.0.0 kudzera 1.0.8 | Nkhaniyi ikuchitika nthawi yofalitsa; yapemphedwa kuti ichotsedwe. |
Mafayilo ndi Ma Hashe
| Njira | zolemba |
|---|---|
clipboard_guardian/guardian.py(md5 f7935c2c82bc881288611ab6cd634f17) | Zofanana m'mabaibulo onse asanu ndi anayi ofalitsidwa (1.0.0 kudzera 1.0.8). Katundu wolipirira kudula. |
npm-install.js (1.0.0 – 1.0.7)npm-install.cjs (1.0.8) | Chokhazikitsa chokhazikika; khalidwe lomwelo kuyambira kumapeto mpaka kumapeto. 1.0.7's .js ndi 1.0.8's .cjs ndi ofanana ndi byte. |
~/.config/clipboard-guardian/config.json | Makonzedwe okhazikika a Linux ndi phukusi la chikwama. |
~/Library/Application Support/clipboard-guardian/config.json | macOS persistence config ndi chikwama chachikwama. |
%APPDATA%\clipboard-guardian\config.json | Makonzedwe okhazikika a Windows ndi phukusi la chikwama. |
~/.config/systemd/user/python3-dbus-helper.service | Kupitiriza kwa Linux kuyambitsa yokha. |
~/Library/LaunchAgents/com.apple.python.runtime.plist | Kupitiriza kwa macOS LaunchAgent. |
~/Library/Logs/com.apple.python.runtime.log | macOS stdout/stderr log ya wothandizira. |
Scheduled Task PyRuntimeBroker | Ntchito yoyambitsa yokha ya Windows (AtLogOn, palibe nthawi yopuma). |
Zizindikiro za Khalidwe
| Chizindikiro | Kufotokozera |
|---|---|
pip install --break-system-packages kuchokera ku npm postinstall | Imakakamiza kukhazikitsa kwa Python patsamba lonse kudutsa chitetezo cha PEP 668. |
apt-get install -y xclip (kapena pacman/dnf) | Kuyika zinthu zosungiramo zithunzi pa Linux panthawi yoyika phukusi. |
python3-dbus-helper.service chipangizo cha ogwiritsa ntchito cha systemd | Kulimbikira kunalembedwa pansi pa dzina looneka ngati lothandiza nthawi yogwirira ntchito. |
com.apple.python.runtime Woyambitsa | Chizindikiro chokhazikika kunja kwa njira zovomerezeka za Apple. |
PyRuntimeBroker Ntchito Yokonzedwa | Kupitiriza kwachinyengo kwa broker wa Windows popanda gwero lovomerezeka la okhazikitsa. |
Njira ya Python yotchedwa python3-dbus-helper kutumiza pyperclip ndi psutil | Kusagwirizana kwa khalidwe pakati pa dzina la njira zomwe zawonetsedwa ndi malaibulale omwe atumizidwa. |
| Kusintha kwa bolodi la zithunzi ~0.4s pambuyo pa kopi ya adilesi ya chikwama | Khalidwe lodziwika bwino la kusintha ma adilesi a cryptocurrency. |
Chikwama cha ankhondo (mndandanda wa oteteza)
Mndandanda wa zikwama umatumizidwa molimba mtima mu npm-install.js ndi clipboard_guardian/guardian.pyOteteza angagwiritse ntchito mndandandawu ngati mndandanda woletsa (onani kusamutsa kulikonse kupita ku ma adilesi awa kuchokera ku ma wallet amakampani ngati kokayikitsa) komanso kiyi yosakira (onani kupezeka kwa zingwe izi mu fayilo yosatsimikizika, chinthu chomangira, kapena makina opanga mapulogalamu ngati chizindikiro cha matenda).
Chikwama cha Attacker
| Unyolo | Address |
|---|---|
| Ethereum / BSC | 0x450c0E58Fc2ba03632d3F5780ad8C966648B6F18 |
| Ronin (EVM) | ronin:450c0E58Fc2ba03632d3F5780ad8C966648B6F18 |
| Bitcoin | bc1qs2mpls4p0f7fng073gy2rcdgjpf7la4eugpt6y |
| Bitcoin Cash | bitcoincash:qqmvyxxklzp7l3eslxavhc8phl6hprdf25lwc29nlt |
| Litecoin | ltc1qnefc8x59a9cwtqnflt8hmqvezqw4hc7lt3fkqe |
| Dogecoin | DNEJmYRZtzyK44tZea4S7wV3otTyRk48Fy |
| Dash | XtJ7E6mnhPK93Vib29PGQrTmQjhTTqFwbS |
| Zcash | t1d4hcEnBjdh9X6Wb6R2dxqjnxddJ6ocP8M |
| DigiByte | DPmH2dhiGK3hk3A69tZUMz6tHzGFHBzSrH |
| Mwezi | 42zhAidVhP7QETk83JAspS59ASALSHFio44vmu6MdDCz15cSqtqsG4QVyzY8vTrjGrTEA6zMbWW6Yft1Ynz1xLfCN5FVbXf |
| Solana | DWBAmQLi9gP6mk7UfJfQGYTV1UPK32WekLTqg83q1mc5 |
| TRON | TVgEgMemmJABYYnbNr1Wi8bSgADEkdEBt2 |
| TON | UQDTSkvwmptU9eG988KgxS3WjnYAZlXgfpJxnz4mhWZAvULr |
| Ripple | r9tj3cMCiqRijNYqNVYNuwKykkQfS8FE4H |
| Polkadot | 1JSkYqXQE4d28HdcmTPhbgCrdiPFTfSHxD67tam16p53oBG |
| Pafupi | 5d6aec44551529e8cd9ebd3aaa84b3832fc3c7463596b2b6e72635b80096a364 |
| Cosmos | cosmos1pzfl3kv5g8g0ernj86rwpar08u2zl9suthx28e |
| Osmosis | osmo1pzfl3kv5g8g0ernj86rwpar08u2zl9surv463t |
| Celestia | celestia1pzfl3kv5g8g0ernj86rwpar08u2zl9su6ah6a5 |
| Zopanda pake | inj1g5xquk8u9wsrvvkn74uq4kxfvejgkmccn578gh |
| Kava | kava1kjfvgcz4q0y9yae2f3pa33vhj2estxxj3sqqux |
| Chiyanjano | one19hn0n7dzkhtl9ta9ekv5592s85jwstpka76t3a |
| Terra | terra1h0dwu8z405jagdlr0fgr9jllac2sxajzlgme5x |
| Algorand | XSAMN3FTB5SUHUQFENBDDRXIMOPNFVLKAWA3RNOU54DWROMDZ6SR7DZ2PI |
| Stellar | GACNZSV4EQO65NZZUOBS3TMJM7GFTSRNKQBVJOX5P2G7U7SEBQ2ZUDJE |
| Cardano | addr1qyj050vla4cglmyrgm4vzf3dxtn0gynpks4t7vp7s3lg49e9wt0s94hcztzdgecxcz5hu9uk56q60yth6d66w026s2kq3ma56f |
| MultiversX | erd1slvlgqsmwzk0c8xtksm4eq5vdfnc26slpzqsyxhz456zvme5rpasue6ge0 |
| zoyenera | 0x580ecda1ebd6ca5a46be2097568d013308bd54ef1d147acb880b59f7709f280e |
| sui | 0xf7e8a9a970fa65c058745c4b2cf2a856cc0283863e4ed1e142648f26097b0c78 |
| nano | nano_393n56a5pfz8zg3nkzf7mytfgagzhu5mn9i3xiqg54weq8n1u8jgezxas7dn |
| Filecoin | f1fypyww3xubopfnv7q6yh5l4bko44wmfktf3ckui |
| Tezos | tz1RccjnorHk61bt73ArLXcdgFjEj6T1ochk |
| Ergo | 9g1pNQGnFg7Hk1d9Z66bgHMkguGU7R41btypAnbG1NF5FJoNdBA |
| Hedera | 0.0.10488092 |
Ma chain okhala ndi regex coverage koma opanda ma wallet slots mu default config — Sei, IOTA, Kaspa, Flow, Nervos, Decred, Ravencoin, Beacon-Chain BNB — sakusinthidwa mwachangu mu build iyi koma amapezeka. Awoneni ngati scope yowunikira m'malo mwa scope yosinthira.
Udindo ndi Chilimbikitso
Kampeniyi imapereka mawonekedwe ochepa ofotokozera. Sitinathe kutsimikizira kuti ndi ndani wa wogwiritsa ntchito. Zimene tingalembe:
- Metadata ya wofalitsa. Akaunti ya npm jaggle imalemba imelo yake ngati olgascarlet@deltajohnsons.com. Malo olamulira deltajohnsons.com Sichikutsimikizira kuti kampani ndi yeniyeni. Akaunti ya npm sikuwonetsa kutsimikizira kwa imelo ndipo palibe SCM kutsimikizira. Palibe kupezeka kwa anthu onse pa GitHub komwe kukugwirizana ndi izi.
- Malo osungiramo zinthu. The phukusi.json sanyamula malo munda wovomerezeka. npm:@juggle/resize-observer malo osungira zinthu a GitHub enieni okhala ndi nyenyezi zikwizikwi komanso nkhani zomwe zikugwira ntchito. Kusowa kwa ulalo wa malo osungira zinthu ndiye njira yofulumira kwambiri yowonera zithunzi pa npm UI.
- README kuba. Phukusi la README ndi lovomerezeka @juggle/resize-observer README byte-for-byte, kuphatikiza inatha zitsanzo zomwe zimasonyeza @juggle/resize-observer yokha (osati phukusi lofalitsa). Wogwiritsa ntchito sanavutike kulembanso zomwe zatumizidwa - chizindikiro chodziwika bwino chakuti readme yachotsedwa, sinasinthidwe.
- Palibe zomangamanga zoti musinthe. Palibe C2 endpoint, palibe DNS lookup, kapena IP. Khalidwe loipali lili mkati mwa clipper yapafupi komanso phukusi la chikwama cholimba. Izi zimapangitsa kuti kusintha kwa domain- kapena ASN-based pivoting kusapezeke. Oteteza omwe amasinthasintha pakati pa kampeni ayenera kufananiza ma wallets ndi clipper iliyonse yomwe ali nayo kale; kugwiritsanso ntchito chikwama m'maphukusi ndiye njira yabwino kwambiri yolumikizirana.
- Kusankha mayina. @jaggle/resizeobserves pali khalidwe limodzi losiyana ndi @juggle ndi kusintha kamodzi kuchokera kwa odziwika bwino wowonera kukula. Kusinthasintha kophatikizana kwa mtunda ndi ma glyph awiri. Uku ndi kugundana kowoneka mwadala, osati squat wamba.
Chilimbikitso, chozikidwa pa khalidwe la kulipira: kupeza ndalama mwa njira yopezera mwayi wosinthana ndi clipboard. Palibe kusonkhanitsa ziphaso, palibe kusindikiza zala za wolandila, palibe kuwerenga kosinthasintha kwa chilengedwe. Wogwiritsa ntchito sakusamala kuti wozunzidwayo ndi ndani - amasamala kuti kusamutsa kotsatira kwa wozunzidwayo kumawonekera pa imodzi mwa maadiresi omwe alembedwa. Kuphimba kwa unyolo makumi anayi ndi chitsanzo cha lottery chomwe chikugwira ntchito: kuponyedwa konse, ndikuyembekeza kuti paste imodzi yamtengo wapatali ifika kamodzi pa N installs.
Wogwiritsa ntchitoyo akuwoneka kuti alibe nkhawa ndi kuchotsa. Kufalitsa mitundu isanu ndi inayi mkati mwa maola awiri pansi pa gawo lomwelo kumawerengedwa ngati chogwirira chofalitsa ndi kutentha: kukulitsa kuchuluka kwa registry musanatsike kuchotsedwa, kenako pitirizani. Sitinawonepo. Sitinawonepo. @jaggle kusindikizanso pansi pa gawo latsopano panthawi yolemba, koma tikuyembekezera ma scope ofanana (@jaggie, @juggle-, @joggle) kuti ziwonekere masiku akubwerawa ngati wogwiritsa ntchitoyo akadali wogwiritsa ntchito.
Zotsatira, Zochitika & Zimene Oteteza Ayenera Kuchita
Zotsatira
Kuyeza kuchuluka kwa ndalama zenizeni sikungatheke kuchokera ku deta yomwe ilipo. Chodulira sichilemba telemetry ndipo ma wallets sanawoneke akulandira ndalama zina kuchokera ku gawo lomaliza la kusanthula (kufufuzidwa kwa maunyolo omwe alembedwa kuli pamndandanda wathu). npm:@juggle/resize-observer Pa avareji ya kutsitsa kwa anthu asanu ndi awiri mlungu uliwonse — cholinga cha olemba nkhani ambiri — ndipo phukusi la nkhanzali linali lamoyo kwa maola osakwana 24 panthawi yowululidwa, zomwe zimachepetsa chiwerengero cha anthu omwe akhudzidwa koma sizikutanthauza kuti ndi losafunika.
Kuthamanga kwa radius komwe kumafunika kutsatiridwa sikotsitsa mwachindunji @jaggle/resizeobserves — mwina zimenezo ndi zazing'ono. Ndi **zokhazikitsa zosintha**: wopanga mapulogalamu akuwonjezera phukusi ku pulojekiti ya sandbox, ikuyenda npm kukhazikitsa, kenako nkuiwala kuti mbedza yokhazikitsa idagwirapo ntchito. Makina onse omwe adakonza postinstall tsopano ali ndi clipboard hijacker pa wogwiritsa ntchito aliyense pa auto-start, mosasamala kanthu kuti pulojekitiyo ikadali pa disk. Kuchotsa chikwatu cha phukusi kuchokera zigawo sikuchotsa kulimbikira.
Mapangidwe atsopano
Kampeni iyi ikupereka zitsanzo ziwiri.
npm ngati cholembera chotumizira cha Python-payload. Npm tarball ndi makina okhazikitsa mizere 4; stealer yeniyeni ndi Python, yomwe imayikidwa mu system yonse ndi pip kuchokera ku bundled directory. Izi si zatsopano - taonapo ma npm package akusiya Python kale - koma akukhala mawonekedwe ofala kwambiri pamakampeni a crypto-clipper. Ubwino kwa wogwiritsa ntchito ndi awiri: malaibulale a Python clipboard (pyperclip choyamba pakati pawo) ndi oyera komanso ogwirizana kwambiri kuposa ofanana ndi JavaScript, ndipo Makina ambiri ojambulira a npm omwe amangodziyendetsa okha amalemera kwambiri mafayilo a JavaScript ndi Python .py mapaketi pang'ono. Mtengo wake ndi wakuti malo oyikapo ndi okwera kwambiri - atsopano pip kukhazikitsa N'zovuta kubisala pa makina opanga mapulogalamu omwe nthawi zambiri samachita pip kukhazikitsa pa npm kukhazikitsa.
Mayina ochokera ku pulatifomu ngati chinthu chokhacho chobisika. Ma clipper angapo aposachedwa komanso ma small-payload stealers asiya kugwiritsa ntchito code-level obfuscation m'malo mogwiritsa ntchito ma code ooneka ngati odalirika. python3-dbus-helper, com.apple.python.runtimendipo PyRuntimeBroker ndi zitsanzo za m'mabuku — mayina omwe diso la woteteza lidzadutsa pamndandanda wa mautumiki makumi anayi ogwiritsa ntchito. Iyi ndi njira yotsika mtengo komanso yolimba yobisalira: kuchotsa kumachitika pa phukusi lililonse, koma mafayilo opitilira amapulumuka kuchotsa, ndipo ntchito yotchulidwa dzina la gawo lenileni la nsanja sidzayeretsedwa ndi china chilichonse kupatula kuwunika kowonekera.
Zimene oteteza ayenera kuchita
- Audit ~/.config/systemd/user/, ~/Laibulale/LaunchAgents/, ndi Get-ScheduledTask Zotsatira pa makina opanga mapulogalamu a zolemba zomwe zalembedwa mu IOCs. Kuchotsa phukusi la npm kumasiya izi pamalo ake; ziyenera kuchotsedwa ndi dzanja.
- Kutumiza kwa block kupita ku ma adilesi a chikwama omwe alembedwa pamalire a kampani, chuma cha kampani ndi chikwama cha DeFi komwe kuli malo olembetsera ma adilesi.
- Fufuzani ~/.config/clipboard-guardian/config.json (ndi zofanana ndi nsanja) m'gulu lonse la opanga mapulogalamu. Kupezeka kwa fayiloyi ndi kachilombo kodalirika kwambiri mosasamala kanthu kuti ndi mtundu uti wa phukusi lomwe laperekedwa.
- Sakani node_modules/ kuti mupeze clipboard_guardian/guardian.py muzithunzithunzi za build-cache zomwe zingakhalepo kale isanafike nthawi yochotsa. Md5 ya fayiloyi ndi yokhazikika m'mitundu yonse yowunikidwa.
- Pin ya Lockfile @juggle/resize-observer (phukusi lovomerezeka) kotero kuti kuyika mtsogolo sikungathe kuthetsa china chilichonse pansi pa cholakwika cha khalidwe limodzi, makamaka mu ntchito zopanda mafayilo otsekedwa monga npx.
- Chitani chilichonse chokhudza npm postinstall chomwe chikugwiritsa ntchito pip install monga kuopsa kwakukulu mu zomangamanga-pipeline ndondomeko. Palibe chifukwa chomveka choti phukusi la npm lifunikire pip panthawi yokhazikitsa - Python tooling imagawa Python tooling.
- Sakani deta yowunikira yofananira ya process_iter() ya njira zotchedwa python3-dbus-helper zomwe zimatumiza pyperclip — kusafanana kwa zinthu zobisika (wothandizira wa D-Bus yemwe ali ndi laibulale ya clipboard) ndiye chizindikiro choyera kwambiri cha khalidwe chomwe tili nacho.
- Tembenuzani maadiresi a chikwama cholumikizidwa kuchokera ku makina omwe ali ndi kachilomboka. Chobera clipboard chimasokoneza njira pakati pa UI ya chikwama ndi cholinga chopachika; maadiresi omwe amakopedwa ali ndi kachilombo angasinthidwe mwakachetechete. Chilichonse chomwe chatumizidwa panthawi yopachikira matenda chiyenera kuonedwa ngati cholakwika.
Mfundo yofunika kuiganizira: kupirira kumapitirira kuchotsedwa. Kaundula adzachotsa pamapeto pake @jaggle/resizeobserves m'mitundu yonse isanu ndi inayi; gawo la systemd, LaunchAgent, ndi Scheduled Task sizidzadzichotsa zokha.
Zothandizira
- @juggle/resize-observer pa npm — phukusi lovomerezeka lomwe typosquat iyi imatsanzira; lothandiza ngati maziko a byte-for-byte README cragiarism.
- @jaggle/resizeobserves metadata ya registry — falitsani zizindikiro za nthawi za mitundu isanu ndi inayi yoyipa, yothandiza polemba nthawi ya forensic.
