Xygeni munguva pfupi yapfuura yakaona maitiro anotyisa mumamiriro ekurwiswa kwesoftware supply chain muna 2025, ichibuda muvatariri vaviri vakakurumbira vemapakeji: P&PI uye npmSechikamu chekuedza kwedu kuri kuenderera mberi kwehungwaru hwekutyisidzira,Yambiro Yekutanga yeMalware yeXygeni (MEW) chishandiso chakaratidza muenzaniso wakasiyana asi wakafanana nenzira yehurongwa hwepakeji ine utsinye yakaiswa kune imwe registry kare. Nyaya iyi inoratidza kuti vanhu vari kutyisidzira vari kuchinja sei uye kushandisazve matekiniki ekurwisa munzvimbo dzakasiyana siyana, kunyanya kuburikidza ne mapakeji ePython ane hukasha uye yakaipa npm mapakeji, izvo zvinowedzera njodzi yekuti mapakeji ane hukasha apinde muhurongwa hwemagetsi hunovhurika.
Xygeni's MEW: Kuona Kufanana Kwazvo
Chishandiso cheMEW cheXygeni chakagadzirwa kuti chione uye chiratidze mapakeji ane njodzi, kunyanya ayo akabatana neSoftware Supply Chain Attacks muna 2025, kana angoburitswa kumahofisi emahara. Chinoshanda nekuongorora mapakeji matsva emaitiro asina chokwadi.
Muchiitiko ichi, yakaratidza mbiri mapakeji ePython ane hukasha (graphalgo paPyPI) uye yakaipa npm mapakeji (express-cookie-parser pa npm).
Mapakeji ePython ane njodzi uye npm muSoftware Supply Chain Attacks (2025)
Ngationgororei hunhu hwakagovaniswa hwakakonzera nyevero dzedu:
typosquatting
Vose vakaedza kutevedzera mapakeji akakurumbira aripo.
- graphalgo (PyPI): "Python package yekugadzira nekushandura magirafu nema network."Yakaiswa nemushandisi anonzi" "Larrytech" musi wa13 Chikumi, 2025, pasuru iyi yakazviratidza senzira yePyPi pane yekutanga graphalgo project isina kuipa, iyo yakazotumidzwa zita rekuti graphdict.
- express-cookie-parser (npm): Iyi pasuru yakatevedzera pasuru inozivikanwa ye cookie-parser, ichitoratidza kuti yakabatana nayo. README.md. Kutevedzera kwakadaro inzira yekare yekushandisa kuvimbana kuripo.
Kuvharidzirwa seMutsetse wekutanga wekudzivirira
Mapakeji ese ari maviri akavhara kodhi yavo yakaipa mukati memafaira ekutanga. girafu, kodhi yakavharika yakawanikwa mukati /utils/load_libraries.py. Kana muongorori we-express cookie, cookie-loader.min.js yaiva nemutoro wakavanzika.
Rutivi rwekutanga rwekuvharidzira runowanzo shandiswa kudzivirira kuongororwa kusingatarisirwi uye ongororo isingachinji. Kuvharidzira kwacho kwaive nyore: kudzokororwa kweZLib pamwe nekunyora Base64. Rudzi urwu rwekuvharidzira runoratidza pachena kuti software iri kuedza kuvanza maitiro ayo. Pamwe chete nehumwe humbowo, izvi zvakabvumira Xygeni MEW kuisa mapakeji aya muzvikamu seanogona kunge ari malware. Munguva yedanho rekusimbisa, vaongorori vedu vakakurumidza kugadzira script yekubvisa kuvharidzira yakaratidza danho rekudonhedza rakaipa.
Kuendeswa kweMutoro Wematanho Akawanda uye Nzvimbo Yekutanga Yakagovaniswa
Mapakeji ese ari maviri aishanda se "kutanga"kudonha,” vachigadzira nzira yemutoro chaiwo. Vaigovana chinhu chimwe chete chekunze “mbeu"URL yefaira:"https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
Faira rembeu rekunze rakafanana chiratidzo chakasimba chekuti pane munhu anotyisidzira pamwe chete. Zvinofadza kuti zviri mufaira rembeu iyi zvinoita sezviri nyore (semuenzaniso, JWT_SECRET, PORT), zvinogona kukanganisa kuongorora kwaro basa chairo.
Kugadziriswa kweC2 kwakasimba neDGA
Imwe nzira yakaoma inoonekwa mumapakeji aya ane hukasha ndeyekushandisa Domain Generation Algorithm (DGA) kugadzirisa Command and Control (C2) server nenzira inochinja. Iyi nzira, inowanzoonekwa mukurwisa kwesoftware supply chain muna 2025, inoshandisa SHA256 hash inobva muzviri mukati mefaira rembeu, pamwe chete nedzimwe hardcoded values. Nekuita izvi, C2 infrastructure inochinja kazhinji, zvichiita kuti blacklisting yechinyakare isashande zvakanyanya. Muchiitiko ichi, npm variant yakashandisa fixed value ye 496AAC7E sechikamu chepfungwa dzayo dzeDGA.
Kusimbisa Kuramba Uchienderera Mberi
Varwisi vese vakaedza kuratidza kuti varipo kwenguva refu pahurongwa hwacho. Nzira yavo yaisanganisira kudzima faira, startup.py (yePyPi) kana startup.js (ye npm), mumadhairekitori edata revashandisi veGoogle Chrome mumasisitimu akasiyana-siyana ekushanda (Windows, Linux, macOS).
Kuchenesa Mushure meKuitwa
Kuti vaderedze zviratidzo, ma script ese ari maviri akaita mabasa ekuchenesa. Izvi zvaisanganisira kudzima mafaira avo ekutanga ekudonhedza (load_libraries.py, cookie-loader.min.js) uye kugadzirisa mafaira epakeji ari pamutemo (__init__.py, index.js) kubvisa zvinongedzo kuzvikamu zvabviswa izvozvi.
Zviratidzo zveCompromise muMalicious Python uye npm Packages
- Pakeji yePyPI: graphalgo (yakabudiswa na larrytech, Chikumi 13, 2025)
- npm Pakeji: express-cookie-parser (kunyanya vhezheni 1.4.12)
- Kuwana URL yeMbeu Yakagovaniswa:
https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
- Mazita Emafaira Anogara Aripo:
startup.py(Python)startup.js(JavaScript) - Nzira Dzakajairika Dzinogara Dzichienderera (dzinoenderana neOS): Mukati meGoogle Chrome data user directories (semuenzaniso,
AppData\Local\Google\Chrome\UserData\Scripts\paWindows,~/.config/google-chrome/Scripts/paLinux, nezvimwewo).
Maitiro Ekudzivirira Kubva Kumapakeji Anokuvadza muSoftware Supply Chain Attacks 2025
Nzira Inokurudzirwa Kune Vagadziri
Chiitiko ichi chinoshanda sechidzidzo chakakosha mukupararira kwenjodzi yekurwiswa kwesoftware supply chain muna 2025. Chinoratidza kuti mapakeji ePython ane njodzi uye mapakeji eNpm ane njodzi anogona sei kupinda munzvimbo dzinovimbwa, kazhinji kudzivirira kuonekwa kusvika zvanyanya kunonoka. Ndosaka kuonekwa nekukurumidza, kushandisa maturusi akangwara, uye hutsanana hwemasisitimu zvino zvave zvikamu zvakakosha zvebasa reDevOps rakachengeteka. Vagadziri vanokurudzirwa kufunga nezve zvinotevera:
Ongororo yeKuvimba
Kana mapurojekiti ako aisanganisira girafu or muongorori we-express cookie, zvingave zvakanaka kuenderera mberi nekubvisa kwavo.
- YePyPI:
pip uninstall graphalgo - Kwe npm:
npm uninstall express-cookie-parser
Hutsanana hweMaitiro
Funga nezvekuita scan yakazara yesystem. Zvinokurudzirwawo kuti utarise nemaoko nzira dzakajairika dzeChrome user data directory kuti uone kana paine chero chinhu chisingatarisirwi. startup.py or startup.js mafaira.
Proactive Chengetedzo Matanho
- Ongorora Vanhu Vatsva Vanovimba Nevamwe: Gadzirai purogiramu yekuongorora zvizere mapakeji matsva musati maabatanidza, muchitarisa pane anobva kune vaburitsi vamusingazive.
- Sanganisa Zvishandiso Zvekuchengetedza: Zvishandiso zvakaita seXygeni's MEW, pamwe chete nedzimwe Software Composition Analysis (SCA) mhinduro, dzinogona kupa dziviriro yakakosha nekuona maitiro anofungirwa uye kushaya simba.
- Kodzero Isina Kukosha: Nzvimbo dzekusimudzira mashandiro dzine musimboti wekuti hapana ropafadzo inogona kubatsira kuderedza mhedzisiro inogona kuitika kana paine chibvumirano.
- Network KuzivaKutarisa traffic ye network inopinda mu internet kana paine connections dzisina kujairika dzimwe nguva kunogona kuratidza kutaurirana kweC2 kunogadzirwa neDGA.
Zvikamu zvakakosha zve load_libraries.py (kubva kugraphalgo)
download_remote_content(): Inobata kutora mafaira kubva kuma URL akatarwa.run_process(): Inoita zvinyorwa zvekunze zvePython nenzira yakaparadzana, ichidzvinyirira zvinobuda kuti zvirambe zvakavanzwa.get_output_file_path(): Inosarudza nzvimbo yakakodzera yefaira re startup.py rinogara riripo.remove_self(): Inoronga kucheneswa kwemafaira ekutanga ane hutsotsi uye kugadziriswa kwemapakeji mushure mekuita basa.simple_shift_encrypt()/simple_shift_decrypt(): Mabasa ekriptografi akagadzirwa nemaoko ekuvhara nzira dzekutaurirana, akakosha pakushandiswa kweDGA.load_libraries(): Basa guru rinoronga maitiro ese ezvikamu zvakawanda, kubva pakudhawunirodha kwekutanga kusvika pakuitwa kwekupedzisira kwemutoro wepayload uye kuchenesa.
Aftermath
Sezvakaita mamwe mapakeji anogona kunge ane hutachiona akaonekwa neMEW, firewall yekudzivirira yakabva yadzivirira vashandisi vaizoisa mapakeji aya ane hutachiona muhutachiona hwavo. Mushure mekusimbiswa, takatevera nzira dzekuzivisa marejistri ese ari maviri, ayo mushure mekuongorora akabvisa mapakeji ese ari maviri.
