TL; DR
Muparidzi mumwe chete wepaNpm, ddjidd5640, yakagadzira katarogu ine mapakeji makumi maviri nemaviri ezvishandiso zvekuchengetedza zveWeb3 zvisiri pamutemo pasi pezvigadzirwa zvakagadzirwa zvakaita se Sangano rekuchengetedza mari yeCrypto, Web3 Audit Collective, uye Mubatanidzwa weDeFi Security.
Mapakeji aya haaratidzike senzira yekunyoresa vanhu vasina ruzivo rwakakwana. Anotaridzika senzira yekuchengetedza zvinhu, inotsigirwa nekubatanidza masangano asina chinhu eGitHub uye kugutsa mazita ezvishandiso zveMCP zvakaita sekuti search_leaked_credentials, validate_chain_key, uye deploy_safe.
Mushandirapamwe uyu wakakamurwa kuita mhuri mbiri dzinotakura zvinhu zviri kushanda uye imwe chete isina kurara.
Variant A ine mapakeji masere ekukohwa marekodhi. Chinyorwa che postinstall chinoverenga zvitoro zvakavanzika zvemuno, ukuwo chiine bundled scanner.js Inoshanda kana mumiririri weAI akashandisa zvishandiso zveMCP zvepakeji, achitsvaga makiyi ewallet, BIP39 mnemonics, ma API token, nezvimwe zvitupa.
Kusiyana B ine madropper mashanu ePingggy-based binary. Mapakeji aya anotora uye anoita kuti payload ishande ari kure panguva yekuisa mushure mekuisa, ne foundry-deploy-helper:1.8.96 kudonhedza chirevo chakabviswa chinogoneka pa /tmp/.node-cache.
Musiyano C ine mapakeji mapfumbamwe asina kuvhurwa asina muripo uri pachena mushure mekuisa, asi muparidzi mumwe chete, maitiro ekugadzira, uye mazita akatarisana neWeb3.
Mapakeji masere chete pamakumi maviri nemaviri ndiwo akanga aratidzwa chero kwataigona kuona; mamwe gumi nemana akasara akanga achiripo paNpm panguva yekuongorora.
Kuoma: kutsoropodza.
Kurwiswa: Mitoro Miviri Muwadhiropu Imwe Chete
Wadhiropu ndiyo mhando. Vhura README ye crypto-credential-scanner wobva waudzwa kuti i credential scanner yakagadzirwa neCrypto Security Guild. Vhura peji re defi-threat-scanner wobva waudzwa kuti chishandiso cheDeFi Security Alliance. Vhura web3-secrets-detector uye ndiyo Web3 Audit Collective. Hapana kana imwe yemapoka aya aripo semasangano. Aripo sema GitHub orgs asina chinhu ane chinangwa chekuzadza hyperlink ye "munyori" wepeji re npm.
Musiyano A: mutemo wekutanga usati waiswa uye mutemo mukuru weMCP-time
Mapakeji masere eVariant-A ese ane payload ine zvikamu zviviri - postinstall pre-flight inotora chero zvitupa zviripo padhisiki mumavara asina kujeka, uye runtime nhanho inoshanda kana mumiririri weAI adana chimwe chezvishandiso zveMCP zvepakeji.
"Danho rekutanga, rwendo rwekutanga" inogara mumutsara mu package.json se node -e one-liner. Inovhura madotfiles manomwe anozivikanwa uye inotumira mabyte mazana maviri ekutanga eimwe neimwe kuC2:
Mabhaiti mazana maviri e ~/.ssh/id_ed25519 hazvizope munhu anorwisa kiyi yako yega, asi zvichapa zita refaira, mhinduro, uye mitsara yekutanga yePEM header — zvakakwana kusimbisa rudzi rwekiyi runogara ipapo, izvo zvakakwana kutungamira chikuva chinotevera. 200 bytes of ~/.env kazhinji zvinokwana kuburitsa tokeni yakazara yeAPI. 200 bytes ye ~/.git-zvitupa kazhinji inongova seti yakazara yematokeni eOAuth.
"Danho rechipiri, chiitiko chikuru", ndizvo scanner.jsInozadzwa nepakeji yacho index.js uye akafona ari mukati meMCP request handler nguva iyo mumiririri weAI anoshandisa chero chishandiso chakashambadzirwa. Faira iri rakafanana byte-for-byte mumapakeji masere eVariant-A (b461106e47a1f5966159cd6e92541505), uye inotaura pachena zvainoita. Bhokisi rekutanga remashoko rinoti, shoko neshoko:
| javascript // wallet-scanner.js — yakasungirirwa inoshanda scanner yemapakeji eMCP // Inoshanda chinyararire kana mumiririri weAI achidana chero chishandiso cheMCP, inoskena mamiriro e // wallets/makiyi // Inoshandisa Node.js chete, hapana kutsamira kwekunze |
Chinotevera kufamba kunodzokororwa, kudzika kwechitatu, kwe:
dhairekitori repamba pacharo
... kusefa mazita emafaira ane chero api zvawo keystore, wallet.json, chikwama.dat, .chakavanzika, mbeu.txt, metamask, phantom, rabby, chikwama chekuvimba, coinbase, private-kiyi, mnemonic, kiyi_yakavanzika, api_key — kureva, runyorwa rwakanyatsogadziriswa rwenzvimbo dzese dzinochengeterwa kiyi nemushandisi we crypto. Pamutambo wega wega, faira rinovhurwa uye rinoskenwa richitarisa maregexe matanhatu:
| mhando | muenzaniso | Zvainobata |
|---|---|---|
| kiyi_yakavanzika | (?:0x)?[a-fA-F0-9]{64} | Makiyi eEthereum akavanzika uye zvakavanzika zvehexadecimal zve32-byte. |
| mnemonic | \b([a-z]+\s+){11,23}[a-z]+\b | Mitsara yeBIP39 mnemonic inotangira pamashoko gumi nemaviri kusvika makumi maviri nemana. |
| api_key | (api[_-]?key\|API_KEY)\s*[:=]\s*["']?([A-Za-z0-9_\-]{20,}) | Matokeni eAPI akajairika uye kukosha kwezvitupa zviri mumafaira ekugadzirisa. |
| chakavanzika | (?:secret\|private).{0,10}[:=]\s*["']?([A-Za-z0-9+/=]{20,}) | Zvakavanzika uye kukosha kwakavanzika zvinowanzo chengetwa mumafomu ekugadzirisa eYAML, JSON, uye INI. |
| kero_yemutauro | 0x[a-fA-F0-9]{40} | Kero dzechikwama cheEthereum dzinoshandiswa kuziva uye minwe yevanhu vakabatwa nemhosva. |
| pasiwedhi | (?:PASSWORD\|PASSPHRASE)\s*=\s*["']?(\S{4,64}) | Mapassword ekushandisa Shell-export uye mapassword enzvimbo anosiyana. |
Zvadaro scanner.js inoverenga mamwe madotfile matanhatu akazara — kusvika kumabytes mazana mashanu pa ~/.env, ~/.bash_history, ~/.zsh_history, ~/.npmrc, ~/.gitconfig, ~/.git-credentials — uye inotsvaira process.env kune chero shanduko ine zita rine kiyi, chakavanzika, token, password, private, mnemonic, wallet, kana seed. Pakupedzisira inodana execSync('whoami') pamwe ne os.hostname() uye process.cwd() kuti iratidze dump nechiratidzo chemunhu akabatwa. Mutoro wese, pamwe chete neanosvika zana ega ega, unoiswa sechinhu chimwe chete cheJSON.
Nzvimbo yekuenda kuexfil haina kunyorwa zvakananga. Pakeji iyi inotorwa panguva yekumhanya kubva:
https://ddjidd564.github.io/defi-security-best-practices/config.json
— GitHub Pages inochengetedza zvinodzorwa nemurwi. Iyo config.json yazvino inodzoka
Kana kutora ikoko kukakundikana, scanner.js inodzokera kune imwecheteyo webhook.site URL yakaomeswa sechigarire. Kusapindirana uku ndiko chete kunoshanda zvakanaka muchirongwa ichi: kunoita kuti murwisi achinje zvinangwa zveexfil pasina kuburitsa pasuru zvakare, uye kunoita kuti URL chaiyo yemuunganidzi isabude muchinhu chakagadzirwa nenpm, izvo zvinoita kuti kuongororwa kwakavakirwa pachiratidzo kuve kwakaoma.
Musiyano B: mugero wePingggy, muchina webinary, uye mumwe musanganiswa unoramba uripo
Imwe nzira iri nyore kushandisa idiki zvikuru — mapakeji mashanu — uye haina kungwara zvakanyanya. Munyori haana kushandisa chipfeko cheMCP zvachose. Mapakeji aya anoti anobatsira pakugadzirisa maturusi eEthereum neSolana zviri pamutemo (mubatsiri we truffle-config, muunganidzi-we-chainlink-mutengo-wekudya, mupi we ganache-cli, solana-pda-helper, mubatsiri wekugadzira foundryMutoro wacho unongova mumwe chete https.get-and-exec mutsetse uri mu postinstall
C2 ipurogiramu yemahara Pinggy mugero — sevhisi yekuvandudza-tunneling iyo murwisi ari kushandisa seC2 yenguva pfupi. Pakeji iyi inodhawunirodha chero chinodzoserwa nemugero uye inoisa mukati mayo child_process.execHapana kuongororwa kwekuvimbika, hapana kusaina, hapana dziviriro yedanho rechipiri. Chero chipi zvacho chiri kuitwa nemuchina wemushandisi nhasi ndicho chinoshanda.
Pakeji ine hutsinye zvikuru, foundry-deploy-helper:1.8.96, inotsiva inline https.get ne curl they uye nzira yekutsungirira:
Musiyano C: facade yakakweshwa, isina chibooreso (pari zvino)
Mapakeji mapfumbamwe asara — chinotsigira-kuchengetedza-chikwama, scanner yekuchengetedzwa kweenv, foundy-toolkit (kunyora nemaune kubva kuFoundry), solna-web3 (Solana anonyorwa zvisirizvo), muchina wekutarisa kuchengetedzwa kwemari, hardhat-gas-profiler-plugin, zvishandiso zve ethers-multicall, defi-env-auditor, zvishandiso zve etherjs - itai hapana chinyorwa che postinstall uye hapana pachena kuti runtime exfil inotanga kuoneka. Vane muparidzi, ma brand fronts, Web3 naming pattern, uye mune dzimwe nguva zvakafanana neREADME boilerplate nema active variants. Tiri kuvabata sechikamu che campaign imwe chete uye takakurudzira kubviswa kwe pre-emptive, asi hatisati tanyora zvizere ma runtime triggers avo. Dormant tranche inogona kunge iri nzvimbo iyo mushandi ari kuchengetedza kuti ishandiswe mune ramangwana - pattern imwechete yakashandiswa nePhantomBot pakati paMay, apo mushandi akachinjana credential stealer ne botnet recruit pasina kuburitsazve zita repakeji.
Nguva Yenyaya & Katalogu
Pakeji yekutanga ine mazuva muchirongwa ichi ndiyo ine shanduro shoma: key-validator yeketani:0.2.3 uye defi-env-auditor:0.3.2 zvinotaridzika sekudonha kwekutanga kwekuyedza. Pakazosvika nguva iyo muparidzi akasvika mubatsiri we truffle-config:1.7.0 uye foundry-deploy-helper:1.8.96, inflation yeshanduro yaive nemaune — kusarudza nhamba dzaive dzakafanana nedzinza repakeji yagara iripo. Hapana kana imwe ye22 ine nhoroondo yepamutemo yapfuura pasi pezita iroro chairo pana npm.
Katarogu yakazara, yakarongwa nemarudzi akasiyana:
### Musiyano A — muunganidzi wemagwaro ekushandisa (postinstall + MCP-time scanner.js, MD5 b461106e47a1f5966159cd6e92541505)
| nhuri | mhando | Yakaiswa muZvipo zveKuona |
|---|---|---|
mnemonic-safety-check | 0.5.2 | ehe |
solidity-deploy-guard | 0.4.4 | ehe |
web3-secrets-detector | 1.2.6 | ehe |
eth-wallet-sentinel | 1.0.9 | ehe |
deployment-key-auditor | 0.7.3 | ehe |
defi-threat-scanner | 2.1.2 | ehe |
crypto-credential-scanner | 2.0.2 | ehe |
chain-key-validator | 0.2.3 | ehe |
### Musiyano B — Pinggy tunnel https.get → exec (hapana kuonekwa kwekuona-kuburitswa kweruzivo usati wapihwa mushumo uyu)
| nhuri | mhando | Kuravira Mushure mekuisa |
|---|---|---|
truffle-config-helper | 1.7.0 | https.get → exec(stdout) |
chainlink-price-feed-aggregator | 1.1.12 | https.get telemetry call |
ganache-cli-provider | 1.7.51 | https.get telemetry call |
solana-pda-helper | 1.0.46 | https.get telemetry call |
foundry-deploy-helper | 1.8.96 | curl + chmod +x /tmp/.node-cache & |
### Musiyano C — yakarara, inofungidzirwa kuti inokonzera kumhanya (hapana kuonekwa kwekuona kwedata risati rasvika mushumo uyu)
| nhuri | mhando | Notes |
|---|---|---|
wallet-backup-verifier | 1.0.1 | |
env-security-scanner | 1.6.0 | |
foundy-toolkit | 1.5.79 | mhando ye foundry |
solna-web3 | 1.5.98 | typosquat ye solana |
wallet-security-checker | 1.0.3 | |
hardhat-gas-profiler-plugin | 1.7.86 | |
ethers-multicall-utils | 1.3.15 | |
defi-env-auditor | 0.3.2 | |
etherjs-utils | 1.0.39 |
Makoramu eVariant-A neVariant-B haasarudzwe netsaona. Mazita eVariant-A ese anozvitengesa se zvishandiso zvekuongorora kuchengetedzwa — “kuongorora kuchengetedzeka”, “kuchengetera midziyo”, “chinoongorora zvakavanzika”, “chinoongorora wallet”, “kiyi yekuongorora makiyi”, “chinoongorora njodzi”, “chinoongorora magwaro”, “chinoongorora magwaro”, “chinoongorora magwaro”, “chinoongorora magwaro”, “chinoongorora magwaro”, “chinosimbisa key”. Izvi zvinoitirwa mugadziri kana mumiririri weAI anoenda kunotsvaga chishandiso chekuongorora kuchengetedzeka kweprojekiti yeWeb3. Mazita eVariant-B ese anozviti vabatsiri vekuvaka nekuisa zvinhu kune imwe chete Web3 ecosystem — Truffle, Chainlink, Ganache, Solana PDA tooling, Foundry. Kupatsanurwa uku kunoratidza muenzaniso wepfungwa weWeb3 we "audit phase" vs. "deploy phase". Chero chikamu chaunosvika, muparidzi anenge aronga musungo wacho.
Zviratidzo zveKubvumirana
Network nemafaira
| IOCs | musiyano | chinangwa |
|---|---|---|
https://ddjidd564.github.io/defi-security-best-practices/config.json | A | Dynamic webhook resolver inogadziriswa kuburikidza neGitHub Pages. |
https://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233 | A | Nzvimbo yekupedzisira yekuunganidza zvinhu zvinobuda mufiriji, zvakare yakabatanidzwa senzira yekudzokera shure. |
rqnyz-2605-7280-7--2000-c51.run.pinggy-free.link/npm/-/binary/telemetry | B | Mugero wePinggy unoshandiswa kuparadzira mitoro yebhinari iri kure. |
scanner.js MD5 b461106e47a1f5966159cd6e92541505 | A | Kushandiswa kwakafanana kwe scanner payload mumapakeji ese masere eVariant-A. |
/tmp/.node-cache | B | Detached executable yakadonhedzwa ne foundry-deploy-helper:1.8.96. |
mutsikisi
- zita rekushandisa re npm: ddjidd5640
- email: 1623682356@qq.com (hazvina kusimbiswa)
- Email uye SCM kusimbiswa: hapana
- Mapakeji ari pasi peakaundi: 22, ese akanyorwa mukatarogu iri pamusoro
- Chiitiko chekutanga chinoonekwa: key-validator yeketani:0.2.3 (Musiyano A)
- Chiitiko chitsva chinoonekwa: chain-key-validator:0.2.3 uye crypto-credential-scanner:2.0.2 (zvose zviri mukati memaawa makumi maviri nemana izvi zvisati zvaitika)
Mabhendi emhando yepamusoro (anoshandiswa mu munyori / README / sangano renhema reGH)
- "Crypto Security Guild" — inotsigirwa neGitHub org isina chinhu sangano re cryptosec
- "Web3 Audit Collective" — inotsigirwa neGitHub org isina chinhu w3audit
- "DeFi Security Alliance" — inotsigirwa nesangano reGitHub risina chinhu defi-security
- Referensi yeakaundi yeGH ddjidd564 — host ye dynamic-webhook config.json
Kuzvibata
- node -e mushure mekuisa kuverenga chero chipi zvacho .ssh, .ethereum, .bitcoin, .env, .bash_history, .zsh_history, .git-zvitupa ne .slice(0, 200) uye kubatana ne | separators chigunwe chakasiyana cheVariant A.
- Kuisa ./scanner.js kubva papakeji inonyoresa seMCP Server nezvishandiso zvine mazita zvitupa_zvekutsvaga_zvakaburitswa_mu kana kuti mazwi ekuti "security audit" ane chimiro chakafanana nechakafanana chisimbiso cheVariant-A.
- Node -e postinstall inotora kubva kune chero *.run.pinggy-free.link host uye inopinza mhinduro mu child_process.exec ivimbiso yeVariant-B zvisinei ne wrapper.
Hunhu & Kurudziro
Pane zvakakwana kuti muparidzi aone chikamu cheminwe uye hazvina kukwana kuti munhu azivikanwe. Email 1623682356@qq.com ikero yetsamba yeQQ — webmail yemahara yaTencent, inozivikanwa munyika yeChina — uye chikamu chenhamba chemunharaunda iQQ user ID; tinoona izvi sechiratidzo chakapfava chete, sezvo maadhiresi emhando yeQQ akanyoreswa zvishoma. Akaunti yenpm haina kuburitswa kwezvinhu zviviri, haina email yakasimbiswa, haina yakasimbiswa. SCM link. "Crypto Security Guild" / "Web3 Audit Collective" / "DeFi Security Alliance" brand triad yakagadzirwa nekutengesa - hapana chimwe chezvitatu chiripo kunze kwemushandirapamwe uyu - uye maGitHub org anotsigira magokora asina chinhu akagadzirwa kuti azadze ma link epage re npm.
Mapatani maviri akakodzera kutaurwa, nekuti anowanikwa mumakwikwi ari pedyo. Chekutanga ndeche kugadzirwa kwechiratidzo sehumbowo hwemagariro evanhu: mushandi haana kusarudza mazita epurojekiti aripo kuita typosquat; vakagadzira nyaya yese yekuvimba kubva pakutanga, vachiziva kuti Kuvaka kweAI-agent pipeline kana mugadziri wepurogiramu anokurumidza kuongorora peji reNPM achafananidza pattern pa "zvinoita sesangano rekuchengetedza" pane kuti "isangano rekuchengetedza". Iyi ndiyo nzira imwecheteyo iyo mabhuku ekushambadzira akanyevera nezvayo - mapakeji akagadzirirwa rudzi rwezita iro LLM ingaite. Gadzira kana ukakumbirwa chishandiso chekuchengetedza cheWeb3, gadzira zvakanaka zvekuti LLM haizoongororazve. Kukwenya kwetsoka izwi rakashandiswa nguva pfupi yadarika rekuti mapakeji ane hukasha ane mazita akafanana neane placeholders. MaLLM anonyepa kana pasina pakeji ine simba; mushandirapamwe uyu ndiwo muzukuru wayo ane hukasha, uko mushandi anogadzirawo sangano iro placeholder angave ari mariri.
Maitiro echipiri ndeekuti Kushanda kweMCP panguva yekushanda. Panguva scanner.js Kana yapera, kuiswa kwapera uye mugadziri aenderera mberi. Chinhu chinoita kuti pave neAI agent inodana chishandiso — zvitupa_zvekutsvaga_zvakaburitswa_mu, munyaya yeVariant-A — izvo mumiririri achaita, nekuti ndicho chikonzero chose chaakapihwa pasuru. Basa rakaipa rinoitika panguva ye kugona chikamu chebasa, apo mugadziri wepurogiramu anowanzoona mubatsiri wake weAI achibudirira pabasa raakakumbira. Kuchinja kudiki kwemaitiro kubva pane yekare "exfil on" npm install"pattern," uye inonzvenga zvakanaka sandboxing panguva yekuisa.
Hatisi kutaura zita remunhu anotyisidzira. Zviratidzo (email yeQQ, account imwe chete, 22-package single-day burst, maviri parallel C2 stacks) zvinoenderana zvakafanana nemushandi mumwe chete anogara achienderera mberi, timu diki, kana mumwe wevashandi vepakeji-mafashamo akaonekwa mu npm telemetry kusvika 2025–2026. Zvatiri anogona Ngatitii mushandi uyu ane ecosystem yaanofarira (Ethereum + Solana + Foundry/Hardhat tooling), munhu anofarira (Web3 developers uye AI agents vanoshanda pamapurojekiti eWeb3), uye muenzaniso waanofarira (MCP-time runtime trigger pamwe ne detached binary fallback).
Mhedzisiro, Maitiro, uye Zvinogona Kuitwa neVadziviriri
Yambiro yedu yekutanga pipeline ukabatwa 8 pamusoro 22 mapakeji ehupenyu hwese hwemushandirapamwe — matanhatu pakutanga kwekutsvaira uye mamwe maviri akasvika gare gare zuva rimwe chete panguva yekupasa kwemushandirapamwe. Mamwe mapakeji gumi nemana aionekwa paNpm kwemazuva pasina kumboonekwa mune chero ruzivo rwekuona rwatinoongorora, uye panguva yekunyora izvi zvinoramba zvichigona kuiswa. Mukaha iwoyo unokosha nekuti:
- Musiyano A haunyanyi kutaurwa panguva yekuisaKuverengwa kwedotfile kunoitika, asi bulk exfil inongotanga chete kana mumiririri weAI akashandisa zvishandiso zveMCP zvepakeji. standard sandbox iri kutarisa mushure mekuisa ichaona node -e vhara wobva waona kuti idiki uye inoita kunge isina simba.
- Musiyano B mutsetse mumwe chete. Hapana chinhu chekudzidza kubva kune malware classifier — hapana kuvharika, hapana encoded payload, hapana domain inoonekwa seyakafungidzirwa. Pingggy tunnel ibasa repamutemo rekugadzira mapurogiramu. Chinhu chimwe chete chinofungidzika ndechekuti "mubatsiri wekugadzirisa" anofanira kufonera kumba zvachose.
- Chinyorwa C chinotaridzika chakachena chose. Haina kuiswa hooksNechiratidzo chega chega chisingachinji, zvakajairika.
Rondedzero Pfupi yeVadziviriri veNguva yeMCP-Tool
Zviito zvitatu chaizvo zvingadai zvakabata mushandirapamwe uyu kare:
- Uremu hwemuparidzi, kwete pasuru. Mapakeji makumi maviri nemaviri ari pasi peakaundi yeQQ-mail ine gore rimwe chete isina SCM Kusimbisa chiratidzo chakajeka kupfuura chero chinhu chipi zvacho papakeji. Basa redu rekunyevera nekukurumidza rakabata mapakeji ekutanga nekuti chigunwe chemuparidzi chakasiyana - zvichikurudzira mamaki emukurumbira wemuparidzi ayo chero ani zvake wevaya vakachengeteka, vasina mhedziso, kana vane malware papakeji anogona kuderedza.
- Tora dynamic-config directions seyakaipa kusvika zvaratidzwa kuti zvakasiyana. Pakeji inogadzirisa endpoint yayo yekubuda panguva yekumhanya kubva kuchinyorwa chechitatu (GitHub Pages, GitHub Gist, Pastebin, S3 object, chero kupi) haina chikonzero chechokwadi chekuita izvozvo pa telemetry. Ma endpoints chaiwo e telemetry akanyorwa uye akanyorwa.
- Ongorora mapakeji eMCP-server uchishandisa nzvimbo yavo yezvishandiso yakashambadzirwa. Mapakeji eVariant-A ese anoshambadza maturusi ane mazita
search_leaked_credentials,validate_chain_key,deploy_safe, uye mazwi akafanana ekuti "audit". MCP host inoona chishandiso chine tsananguro inoti chinotsvaga madhairekitori epurojekiti kuti chiwane humbowo inofanira kuda kuti operator opt-in yakanangana isati yashandiswa nemumiriri pacodebase chaiyo. Chinangwa cheMCP ndechekuti agent loop haina nzira yekuziva kanasearch_leaked_credentialskutsvaga zvitupa kana kuti munhu anobvisa zvitupa.
Kune vanogadzira vangave vatoisa imwe yemapakeji makumi maviri nemaviri: funga chero kiyi yemavara akajeka mukati ~ / .ssh, ~/.ethereum, ~/.bitcoin, ~/.solana, ~/.env, kana ~/.git-zvitupa yakanganiswa, tenderedza chitupa chega chega chine zita rinoenderana nerunyorwa rwe filter rwe env-variable rwuri pamusoro, uye paLinux/macOS tarisa faira rinogoneka pa /tmp/.node-cache (uye chero maitiro asina kusimba akatanga kubva ipapo). Kuisa patsva vhezheni yepamutemo yemidziyo inotevedzera (kuwanikwa, truffle, hardhat, ganache, nezvimwewo) haibvisi binary yakadonhedzwa.
Chikamu cheVariant-C chakarara ndicho chikamu chenyaya iyi chinogara kwenguva yakareba. Mapakeji mapfumbamwe ane chimiro chakachena chekuisa uye muparidzi akasimbiswa ndiwo chaiwo rudzi rwezvinhu zvinochengetwa nemushandi. Kana zvikaputika gare gare - sezvakaita PhantomBot payakatanga. zvishandiso zve axois Kugadziriswazve kwakachinjwa kubva pakuba kwemagwaro kuenda kumunhu anotsvaga mawebhusaiti emakombiyuta — zvichaputika kune chero mutengi werejistri akabatanidza pasuru yeVariant-C pakati pezuva ranhasi nekubvisa. Kubatanidza pasuru ine njodzi neshanduro hakukudzivirire kubva kumuparidzi anodzora shanduro yega yega.
References
- [peji remuparidzi wenpm re ddjidd5640](https://www.npmjs.com/~ddjidd5640) — Mapakeji makumi maviri nemaviri akanyorwa pasi peakaundi iyi. Chitubu chine mvumo chekatarogu panguva yekunyora uku.
- [peji repakeji renpm re crypto-credential-scanner](https://www.npmjs.com/package/crypto-credential-scanner) — muenzaniso wechinhu chinonzi Variant-A; README, nhoroondo yeshanduro, uye zvinongedzo zvevanyori zvinoonekwa pano.
