Mapakeji matsva eNpm ane njodzi anonyepedzera seanobatsira pamberi pechinhu chisina njodzi asi ane kodhi isina njodzi.
Chikwata Chekutsvaga Zvekuchengetedza pa Xygeni takaona kuti mapakeji aya e npm: 'react-ui-notify', 'react-tmedia', 'react-ui-animates', 'react-medias', 'react-mandes' zvinhu zvakagadziriswa kubva ku 'bingo-logger', pachayo iforogo ine njodzi inotevedzera chimiro nemagwaro epakeji yakakurumbira yekunyora matanda 'pino' kuti zviite sezviri pamutemo. Chifukidziro ichocho chinoshandiswa kushandisa developer trust uye kukwezva kudhawunirodha. Muchokwadi, codebase ine faira risina hukama rakavharika rinoshanda munzvimbo dzeNode.
Nhoroondo yeActor Threat: Mushandirapamwe we "Kubvunzurudzwa Kwevanotapurirana"
The Mushandirapamwe weHurukuro Inotapukira inobatanidzwa neboka rezvipingamupinyi rinozivikanwa se 'UNC4034', iyo inotaura nezvehukama nevatambi vakabatana neNorth Korea Razaro Group or APT38, boka rinozivikanwa rinotsigirwa nehurumende rakabatana nehurumende yeNorth Korea. Vari kutyisidzira vari shure kwechirongwa ichi vane nhoroondo yekutarisa vagadziri kuburikidza nehurongwa hwe ecosystems hwakavhurika, vachigovera mapakeji akafanana anoita mabasa akavanzwa. Pakupedzisira vachiburitsa data rine chekuita ne crypto, kodhi yenzvimbo uye zvitupa kubva kumasisitimu ane hutachiona.
The maitiro, matekiniki, uye maitiro (TTPs) dzinoonekwa mumapakeji aya e-npm dzinotevera maitiro akafanana:
- Tevedzera mazita emapurojekiti anonyatsonzwika seakavimbika.
- Isa kodhi yakavharika mukati memafaira ekuyedza uye mascript ekuwedzera.
- Shandisa zvinhu zvakavanzika zvinounganidza ruzivo rwakakosha wozvitumira kune sevha iri kure yekuraira nekudzora (C2).
Zvakawanikwa zvehunyanzvi: Obfuscated Payload Analysis
Mutoro wemari wakawanikwa mukati '/test/fixtures/eval/node_modules/test.list' inoshandisa JavaScript yakavharika (index/array string lookups, encoded blocks) kuviga tambo dzinoverengeka uye control flow ichaitwa kana package yaiswa nekuda kwepostinstall script 'npm run test || npm transpile || npm run skip'mukati me package.json.
Ongororo yedu yakaratidza kuti mapakeji aya ane malware anochinjika akavakirwa kufamba muma operating system (Windows, macOS, kana Linux) uye munzvimbo dzevashandisi. Kugona kunoratidza kutarisa nemaune kune vashandisi vehunyanzvi vanowanzo shanda munzvimbo dzakasiyana siyana.
Kana yangogadzwa pahurongwa, malware inoongorora nharaunda yayo, ichiunganidza ruzivo rwakadzama rwehurongwa zvakaita se hostname, chikwiriro, dhairekitori repamba uye system tmp dir isati yawedzera kusvika kwayo mumapurogiramu anochengetedza ruzivo rwakakosha senge browsers (Chrome/Shinga/Edge/Opera) uye dijitar walletInotsvaga nzvimbo dzinozivikanwa dzebrowser profiles, mafaira ewallet, keychains uye mhando dzakawanda dzemagwaro/mafaira. Mazwi akakosha ekutsvaga anosanganisira wallet, mazwi ane chekuita nembeu uye akawanda mafaira ekuwedzera anogona kunge aine humbowo kana zvakavanzika (*.env, *.key, *.wallet, *.json, *.txt, *.doc, nezvimwewo.). Ine runyorwa rwezvisina kunyorwa zvemadhairekitori akajairika kudzivirira mafaira esystem ari pachena.
Mutoro wepayload unonyora chiratidzo chemuno/faira rekukiya kudzivirira kumhanya kwakawanda panguva imwe chete uye unonyora data rayo mukati memadhairekitori eOS temp kudzivirira kuonekwa.
Mutoro wepayload wakavanzika une nzira yekutaurirana kune sevha iri kure iyo inoshanda senzvimbo yayo yekuraira nekudzora. Kuburikidza nenzira iyi, inogona buritsa ruzivo rwakabiwa uye gamuchira mimwe mirairoKunyange zvazvo zvivakwa zvacho pachazvo zvichiita sezvishoma uye zvakavakwa nechinangwa, kuvapo kwazvo kunosimbisa chinangwa chemurwisi chekuchengetedza kudzora nguva dzose masisitimu ane utachiona.
Kana malware ikawana data rakavanzika, inoribatanidza uye inoedza kuriisa kune remote endpoint iri pa cloud server ichishandisa multipart/form-data saka mafaira akabiwa anonamirwa kune zvikumbiro.
Zviratidzo zveKubvumirana uye Mazano ekuderedza Kukanganiswa
Masangano anorayirwa kubvisa zvinhu izvi zvine njodzi (react-ui-notify, react-tmedia, react-ui-animates, react-medias, react-mandes, bingo-logger) uye kuvandudza mamiriro aya kuti ive nechokwadi chekuti akavimbika. Masisitimu angave akafumurwa anofanira kunge aine maretifiketi ese uye ma access token anotenderedzwa nekukasika.
Vatongi venetwork vanofanira kudzora traffic inobuda kune aya ma IP 23.227.202.24, 131.153.22.25 uye ongororai kubatana kwazvino kuti muone kana paine zvinhu zvisina kumira zvakanaka. Kuvakazve nzvimbo dzakakanganiswa kubva kunzvimbo dzakasimbiswa uye dzakachena kunokurudzirwa zvikuru kudzivirira hutachiona zvakare uye kuona kuti cheni yemagetsi inoshanda zvakanaka.
Broad Context
Pamwe chete, mapakeji aya ndeimwe muenzaniso Nekuda kwekukura kwehuwandu hutsva hwekushandiswa kweJavaScript-based supply-chain attacks, vavengi vari kuwedzera kugadzira mapakeji akafanana anotora chimiro nemagwaro kubva kumapurojekiti akavimbika, kuwedzera modular uye kushandisa matekiniki ari nani ekuita kuti kuona nekugadzirisa kuve dambudziko.
Kuchinja uku kunowedzera mukana wekuti vagadziri vasingafungiri vaise zvinhu netsaona uye kunoita kuti vavengi vawane mukana wakadzama wekuvaka nzvimbo, CI/CD masisitimu uye nzvimbo dzekuchengetedza kodhi yekodhi.
Nzvimbo dzekuchengetedza ruzivo dzave nzvimbo inonyanya kufarirwa yekuparadzira mapurogiramu akadaro. Nekushandisa kuvimba kuripo pakati pevagadziri vezvirongwa muzvirongwa zvemunharaunda, vapambi vanogona kupinda muhurongwa hwekutengesa mapurogiramu pasina kushanda nesimba uye kazhinji pasina kuonekwa nekukurumidza kana mhedzisiro.
Yambiro Yekutanga YeMalware (MEW) neXygeni
Chiitiko ichi chakatanga kuzivikanwa kuburikidza neXygeni's Yambiro Yekutanga YeMalware system, iyo inogara ichitarisa ma open-source package registry akadai se npm, PyPI, Maven kuti aone mapakeji ane njodzi.
Injini yedu yekuona zvinhu yakazvizivisa yoga kuti mapakeji aya anofungidzirwa kuti anofungidzirwa nekuda kwemaumbirwo awo asina kujairika, script yekuisa mushure mekushandisa uye mutoro wakavanzika. Nekuda kweizvozvo, mapakeji ane njodzi (react-ui-notify, react-tmedia, react-ui-animates, react-medias, uye react-mandes) zvakaonekwa kuti zvine hutsinye nechikwata chedu chekuchengetedza uye zvakaziviswa kuna npm zvisati zvasvika pakubvumidzwa kukuru.
Nzira iyo Xygeni Early Warning inodzivirira nayo pipelines
- Real-time kutyisidzira kuona: Inoskena pasuru itsva kana yakagadziridzwa mugirafu yako yekuvimba uye inoratidza maitiro asina kunaka akadai sekufona kweOS system, kuraira, kodhi yakavharika, typosquatting nezvimwe zvakawanda.
- Zviziviso zvepakarepo: Inozivisa timu dzako dzekuchengetedza nedzeDevOps muSlack, Jira, kana kutumira email kana njodzi itsva yangobuda munzvimbo yako.
- Kugadzirisa nekudzvanya kamwe chete: Inogadzira pull requests dzinobvisa kana kutsiva mhando dzekuvimbana dzisina kusimba mumapurojekiti ako ese.
- Masisitimu Ezvakatipoteredza Anotsigirwa: Parizvino zvinosanganisira npm, PyPI, Maven uye Packagist.
- Xygeni inokubatsira kuti urambe uri pamberi pekurwiswa kwecheni yekutenga nekubata mapakeji ane njodzi pakutanga, asati asvika pachivakwa chako.
👉 Edza Xygeni Malware Early Warning isina uye ona kuti unogona kuona nekukurumidza sei uye kuderedza njodzi dzekutengesa mune yako pachako pipelines.
