TL; DR
Muparidzi mumwe chete wepaNpm, deadcode09284814, yakamhanyisa chirongwa chekunyora zvinyorwa ichipikisa zviri pamutemo axios uye chalk-template mapakeji kubvira pakati paChivabvu 2026.
Mushandirapamwe uyu wakatanga semuba wezvitupa zvechivanhu uye wezvikwama, achiburitsa ruzivo ku Serveo HTTPS mugero.
On 2026-05-17, pamwe axois-utils:1.0.9, mushandi akachinja mutoro zvachose: scaffold imwechete yekuisa katatu, muparidzi mumwe chete, zita rimwe chete repakeji.
Asi install script ikozvino yava kushandiswa pakutsvaga ma botnet eDDoS.
Mutoro wacho unotaura kune localhost.run mugero uye inogamuchira mirairo yemafashamo, zvichiita kuti nzvimbo dzine utachiona dzive chikamu chebotnet inokwanisa DDoS.
Mushandi wacho akatotumira Seva yeC2 yebinary mukati me tarball, zvichiratidza kuwedzera kuri pachena kubva pakuba kwemagwaro kusvika kuzvivakwa zve botnet zvinoshanda.
Mapakeji maviri, mavhezheni mana achiri kushanda parejista, uye mushandi mumwe chete ari kushandisa mamodule ese ari maviri panguva imwe chete.
Kuoma: kwakakwirira.
Kurwiswa: Mashandiro Akwo
Mushandirapamwe uyu wakavakirwa pachirongwa chekutumira chinofinha nemaune: mazita maviri emapakeji ekunyora, tsamba imwe chete kubva pamapakeji nemazana emamiriyoni ekudhawunirodha vhiki nevhiki (axios, template yechoko), uye kuiswa katatu hooks vimbiso yekuti vimbiso iyi ichaitwa. Chinonakidza ndechekuti scaffold yacho yakarongwa sei anotakura — uye chokwadi chekuti mushandi akachinja mutoro pasina kuchinja chimwe chinhu.
Nzvimbo yekuchengetera zvinhu yakagovaniswa
Shanduro yega yega yakaburitswa yemapakeji ese ari maviri inozivisa hupenyu hwakafanana hwematatu hooks in package.json:
Kunyora mutoro uripo pasi pezvose zvitatu hooks zvakanyanyisa — postinstall yega yaizomhanya mukusarongeka npm installSarudzo inokosha: npm install –ignore-scripts inodarika zvinyorwa, asi mamwe mabasa akajairika (CI cache inodzoreredza hupenyu hwayo zvakare hooks nekusarudza, kana vagadziri vanongoongorora chete postinstall) zivisa katatu kuti ndiyo nzira yakachengeteka kune anorwisa.
choko-temalte inowedzera nzira yechipiri: inozivisa zvishandiso zve axois:^1.0.7 senguva yekumhanya kutsamiraKuisa zvakanyorwa template yechoko saka zvinokwezvawo typosquat yehama, uye mitoro yese miviri inoshanda. Mapakeji maviri aya akabatana, kwete kunyorwa kwakazvimirira.
Chikamu A — chitupa chebasa / muba wemari (2026-05-15 → iripo)
Chikamu A ndicho chinhu chekutanga chawakatakura. Chinotakurisa mutoro chipfupi mushure mekuisa.js izvo zvinonongedzera paServeo HTTPS reverse-tunnel:
Subdomain yeServeo inovhara IP yekuenda (80.200.28.28) zvakananga mu hostname — tsika inozivikanwa yebasa iroro. Mushandi anotenderedza chivakashure che subdomain chisina kurongeka pakati pemavhezheni kuti adzivise ma blocklists edomeini asina ruzivo, asi IP iri pasi haimbofambi. (choko-temalte:1.0.14 raishandiswa 8a3e818ea8f11186-80-200-28-28…; 1.0.16 / 1.0.19 / 1.0.20 kushandiswa f04a273bd84c0622-….)
mushure mekuisa.js maoko abviswa kuna phantom.js, module ye "muunganidzi" ine mitsara 7,667. phantom.js anofamba nemugamuchiri we:
Makiyi epachivande eSSH (~/.ssh/*) |
.npmrc zviri mukati uye chero chipi zvacho npm_* zviratidzo zve env |
| Mafaira eAWS, GCP, uye Azure |
GitHub personal-access-token regex (ghp_*, gho_*, ghu_*, ghs_*) |
| Zvigadzirwa zveCrypto-wallet zveBitcoin, Exodus, Electrum, Monero, Litecoin, Dogecoin, Zcash, Dash |
Kudzokorora .env* famba nepakati ~/projects, ~/dev, ~/code, ~/workspace, uye iyo install cwd |
Nhoroondo dzeShell uye zvizere process.env |
Chikwama chinoiswa mugwara reServeo pa /unganidzaHapana kuvhiringidzika, hapana anti-VM logic, hapana staging — bheti remushandisi riri pahuwandu uye kumhanya.
Chikamu B — PhantomBot DDoS recruit (2026-05-17, axois-utils:1.0.9 chete)
Phase B inotsiva phantom.js + postinstall.js nefaira rimwe chete rinonzi distrube.js (typo ndeyemushandisi). Chikwangwani che "triple-hook" chiri mu package.json hachina kuchinja; package inochengetedza zita rimwe chete, scope, uye version-bump pattern. Kubva kunze, axois-utils:1.0.9 inoita kunge diki inotevera 1.0.6. Mukati, imhuri yakasiyana ye malware.
distrube.js inotanga nebhokisi rekugadzirisa rinopa zita rekuti mushandi wacho ndiye anozvigadzira:
// axois-utils-1.0.9/distrube.js:11-15 |
// Use your localhost.run HTTPS URL (the tunnel handles HTTP internally) |
const C2_HOST = 'b94b6bcfa27554.lhr.life'; // Your localhost.run tunnel |
const C2_PORT = 443; // HTTPS port - tunnel handles SSL |
const BOT_ID = `${os.hostname()}_${Date.now()}_${crypto.randomBytes(4).toString('hex')}`; |
Mashoko acho anotumirwa kune mumwe mushandi wemangwana ari kushandisa kit ("Shandisa yako localhost.run HTTPS URL"). Izvozvo, pamwe chete nezvinotumirwa padivi pemutengi webot, zvinoreva kuti iyi haisi kungova mutoro wemunhu anobatwa - ndiyo kit yacho.
Kuyerera:
- Kushivirira inotanga kushanda. Chinyorwa chinozviisa chega munzira nhatu dzakasiyana pa OS imwe neimwe (registry) manya + Forodha yekutanga + schtasks paWindows; crontab + phantom-bot.service systemd unit + .bashrc/.zshrc wedzera + /etc/rc.local paLinux; LaunchAgent com.phantom.bot.plist pa macOS). Zita rebasa rekutsungirira uye label yeLaunchAgent zvese zviri zviviri bot remhuka / com.phantom.bot, ndipo panobvawo zita remushandirapamwe.
- ruzivo rwesystem exfil Inomhanya kamwe chete — chigunwe cheminwe chinotumirwa kamwe chete ku b94b6bcfa27554.lhr.life:443/collect chine hostname, platform, arch, username, CPU/RAM, network interfaces, process.env, cwd, homedir, node version, uye public IP. Izvi hazvina kunyanya kushatisa sePhase A: hapana SSH, hapana wallets, hapana .env recursion. Basa rebot nderekunyoresa, kwete kuba.
- Ruzha rwekurova kwemoyo inovhura HTTPS POST masekondi makumi matatu ega ega ku b94b6bcfa27554.lhr.life:443/. Iyo User-Agent ndiPhantomBot/1.0. Kusimbiswa kweTLS kwakadzimwa pachena (rejectUnauthorized: false). Mhinduro yeC2 inopatsanurwa seJSON yefomu {type, target, port, duration, threads, method} uye yakatumirwa.
- zvombo zvemafashamo yakabatana nemirairo mitanhatu:
| Rudzi rwemirairo | Module | Notes |
|---|---|---|
| ping | Mhinduro yehupenyu | Bot inozvizivisa pachayo |
| http: | Mafashamo eHTTP | Mafashamo ekukumbira eLayer-7 |
| https | Mafashamo eHTTPS | Zvakafanana ne http, TLS-written |
| tcp | Mafashamo eTCP | 65 KB spam isina kurongeka |
| udp | Mafashamo eUDP | Mapaketi eUDP ane 65,507-byte |
| nokukurumidza | HTTP/2 DoS inogadziriswazve nekukurumidza | Nzira ye2023 CVE-2023-44487 |
Mamodule ese mashanu emvura anotora a chinangwa, poti, chinguva, uye shinda nharo — bot iyi ibhuku rinowanzo shandiswa pakutsvaga rubatsiro, risina kunangana nemunhu chero upi zvake anenge abatwa. Rondedzero yemunhu anenge abatwa iri paC2, kwete mupakeji.
Chii Chitsva Pano — C2 binary yakatumirwa
Chikamu A chimiro chinozivikanwa: kuba zvitupa, kuisa hook, C2 ine mugero wevatengesi. Chikamu B ndicho wo chimiro chinozivikanwa — Mabotnets eDDoS ave ari chinhu chinosanganisa mapakeji eNpm ane hukasha kwemakore. Chisingawanzoitika ndechekuti mushandi akatumira server side yekiti iri mukati me npm tarball:
- c2 — 4-megabyte yakaunganidzwa Go ELF binary
- c2.go — 426-line Go sosi yebinary iyoyo
Hapana faira rinodanwa nechinhu chipi zvacho chekuisa. Havasi chikamu chemubhadharo wemunhu akabatwa. Vari mudhairekitori remapakeji sezvaingaitwa nefaira remagwaro. Chinhu chinonyanya kunzwisisika ndechekuti munhu anobata basa rekuvandudza akasundira muti wavo wekushanda kuNpm asina kuronga runyorwa rwemafaira - slip chaiyo yeOpSec - uye chinotumirwa i kit yakazara ine mativi maviri: mutengi anotakurwa nemunhu akabatwa, uye sevha inotakurwa nemunhu anobata basa.
Ichi ndicho chikamu chenyaya chinopa chikonzero chekuumbwa kwe "turnkey botnet kit". Chero ani zvake akadhawunirodha zvishandiso zve axois:1.0.9 vasati vatora pasi havana muenzaniso wemunhu anenge akuvadzwa chete — vane sevha yeC2 inoshanda.
Pivot, mumutsara mumwe chete
Muparidzi mumwe chete, mazita emapakeji akafanana, scaffold imwe chete ine hook nhatu, chiratidzo chimwe chete che "phantom" — asi mubhadharo wakachinja modhi yekuita mari husiku humwe: kubva pa "zvakavanzika zvekukohwa zvandinogona kutengesazve" kusvika pa "kukwanisa kurenda mafashamo kwandinogona kurenda". MaTTP enguva yekuisa ayo vadziviriri vanofanira kunge vachitarisa akafanana muzvikamu zvese zviri zviviri; dziviriro dzakavakirwa pachiratidzo dzakabatana netambo dzenzira dzechikwama chePhase A kana kuti phantom.jsMuunganidzi wemitsetse 7,667 angadai asina kuona Phase B zvachose.
| Zuva (UTC) | chiitiko |
|---|---|
| 2026-05-15 | Chinyorwa chekutanga: axois-utils:1.0.4 (Kuvaka bvunzo dzeLAN, dhizaini yekugadzira pa 192.168.129.19) |
| 2026-05-15 | axois-utils:1.0.6 yakaburitswa — Phase A C2 yakachinjirwa ku 80.200.28.28 kuburikidza nemugero weServeo; mhinduro yekwakabva // Change to '80.200.28.28' for public inosimbisa shanduko ye dev → prod |
| 2026-05-16 | chalk-tempalte:1.0.14 uye 1.0.16 yakaburitswa — kuzivisa kwecheni yekutakura zvinhu axois-utils:^1.0.7 senzira yekuvimba nenguva yekumhanya; Serveo subdomain yakatenderedzwa |
| 2026-05-16 | Mushandirapamwe wePhase A wakawanikwa panguva yekuongororwa kwenpm; zvirevo zvakasimbiswa-zvakaipa zvakashandiswa |
| 2026-05-17 | axois-utils:1.0.9 yakaburitswa — payload pivot: PhantomBot DDoS inotora vanhu kuburikidza ne localhost.run tunnel; operator-side c2 mbiri uye c2.go sosi yakatumirwa mu tarball |
| 2026-05-17 | chalk-tempalte:1.0.19 uye 1.0.20 yakaburitswa — ichiri Phase A (inoba); mushandisi iye zvino ari kushandisa mamodule ese ari maviri panguva imwe chete |
| 2026-05-17 | Kuwanikwa kweChikamu B panguva yekuongororwa kwemaitiro; mitongo inoshandiswa kune vese 2026-05-17 shanduro |
| (zvichienderera) | Mishumo yekubvisa zvinhu yakamirira; mapakeji ese mana akabudiswa achiripo parejista panguva yekunyora |
Zviratidzo zveKubvumirana
Mabhokisi
| Ecosystem | nhuri | Versions |
|---|---|---|
| npm | axois-utils (typosquat ye axios) | 1.0.4, 1.0.6, 1.0.9 |
| npm | chalk-tempalte (typosquat yechoko-template) | 1.0.14, 1.0.16, 1.0.19, 1.0.20 |
Kuzivikanwa kwemunyori
| munda | ukoshi |
|---|---|
| muparidzi we npm | deadcode09284814 |
| Email yemuparidzi | phantomdeadcode@tutamail.com |
| SCM ongororo | hapana |
Kurayira-uye-kutonga
| Phase | Endpoint | senga |
|---|---|---|
| A | f04a273bd84c0622-80-200-28-28.serveousercontent.com:443/collect | Serveo HTTPS mugero |
| A | 8a3e818ea8f11186-80-200-28-28.serveousercontent.com:443/collect | Serveo HTTPS tunnel (shanduro yekare) |
| A | 80.200.28.28:443/collect | Mugumo weVPS uri pasi |
| B | b94b6bcfa27554.lhr.life:443/ | localhost.run HTTPS reverse-tunnel |
Kuongororwa kwemafaira (SHA-256)
| faira | SHA-256 | Notes |
|---|---|---|
c2 (Enda kuELF, 4 MB) | 165fa92d237fd017c227d00da06ab788212a62be94bf61e95df2d22d00377ef2 | Seva yeC2 iri padivi remushandi, yatumirwa mukati axois-utils:1.0.9 |
c2.go (Mitsetse 426) | 7d0ae79fdb1e9968f3323a3712b624643a782ba3efb2cf3a2cb9c4c5513cea30 | Enda kunobva bhuku reC2 binary |
distrube.js | 308b15c023088a7188dea4ef609010ac2493eb4c365b103053d7621a9ca5b935 | Mutengi webhoti rePhase B |
phantom.js (chalk-tempalte:1.0.19) | 9e380ec88d3ccf3929e1a104e3b868d4d7b59ca189a8a431a54e9f3357dfdd81 | Chikamu A chezvitupa / muunganidzi wemari |
phantom.js (chalk-tempalte:1.0.20) | d1c9e3f296ee9f7d5032f73f9c504cede50334bc14c394055fd5cb9c3a6e08b3 | Muunganidzi wechikamu A (1.0.20 variant) |
postinstall.js (chalk-tempalte:1.0.19 = 1.0.20) | ffba9bdd6793edd5b38e12900252c1813a693f59c25af51c3b658cf3f27b6162 | Chikamu A chinotakurisa, chakafanana nechakatorwa mushanduro dzese dziri mbiri |
Hunhu & Kurudziro
Tinotevedzera mushandirapamwe uyu se PhantomBot, vachitora zita remushandisi kubva ku Mushandisi-Mushandisi: PhantomBot/1.0 musoro wemoyo, phantom-bot.service systemd unit, iyo com.phantom.bot Label yeLaunchAgent, uye phantomdeadcode@ Mubato weemail. Mushandisi anowirirana nezita iri muzvinhu zvina zvinenge zvina.
Katarogu yezviratidzo
- mutsikisi - deadcode09284814 pa npm. Akaunti yekubata rimwe chete, Tutamail email inoraswa, hapana SCM kusimbiswa. Hapana nhoroondo yekuburitswa kwemabhuku kare kunze kwemushandirapamwe uyu.
- Kushandisazve Branding — “phantom” inoonekwa mu email yemuparidzi, mu Phase A collector filename (phantom.js), muzita rebasa rePhase B persistence service (phantom-bot.service), mune label yeLaunchAgent (com.phantom.bot), uye mubot User-Agent (PhantomBot/1.0).
- Infrastructure - VPS imwe chete pa 80.200.28.28 fronts Phase A kuburikidza neServeo subdomain rotation; Phase B inotamira kune a localhost.run mugero wekudzokera shure (b94b6bcfa27554.lhr.life). Masevhisi ese ari maviri evatengesi haabhadharwi uye anoda SSH yekubuda chete kudivi remushandisi, zvichienderana neOpSec setups ine bhajeti shoma uye yakaderera.
- Code style — JavaScript isina chinhu zvachose; hapana kuvharika, hapana encoding ye string, hapana cheki dze anti-VM. Mazita akasiyana-siyana anotsanangura (kubaSystemInfo, executeCommand, httpMafashamo). Mhinduro dziri mu distrube.js taura zvakananga kune mushandi wemangwana ("Shandisa yako localhost.run HTTPS URL"), zvichiratidza kuti faira racho raifanira kugoverwa patsva sekit, kwete kushandiswa nemunhu mumwe chete anorwisa.
- Chidimbu cheOpSec — Iyo Phase B tarball inotumira zvese bot client uye operator-side C2 server (c2 ELF + c2.go tsime). Izvi zvinoenderana nemushandi akasundira muti wavo wekushanda ku npm asina kuongorora runyorwa rwemafaira. Mushandi wacho haana ruzivo, kana kuti kit yacho haina ruzivo. zvaireva kuti igoverwe pachena uye C2 binary chikamu chechigadzirwa.
- Kuzvisimbisa - zvishandiso zve axois:1.0.4 ine mhinduro inobva kwairi // Chinja kuita '80.200.28.28' kuti ive yeruzhinji pamutsetse wechi12, zvichisimbisa kufambira mberi kwekugadzira / kugadzira / kugadzirwa uko vanowanzo ramba vashandi.
Chikonzero
Mubhadharo wePhase A uri nyore kuba mari: marezenisi, makiyi egore, matoni eGitHub, uye mawallet ecrypto zvese zvine misika yekutengesazve mari. Phase B zvakare ndeyemari, asi isina kunanga: masevhisi eDDoS-for-hire (“booter”) anokwereta huwandu hwemafashamo paminiti, uye marobhoti akaita seaya anotumirwa pano ndiwo uwandu hwemasevhisi aya anoshanda. Kurova kwemoyo kwemasekonzi makumi matatu, generic chinangwa/poti/chinguva chirongwa chekuraira, uye zvombo zvemafashamo zveprotocol mashanu ndizvo standard chigadzirwa chemushandi webooter.
Kumhanyisa mamodule ese ari maviri panguva imwe chete — choko-temalte:1.0.19 uye 1.0.20 ramba uchitumira mbavha uku zvishandiso zve axois:1.0.9 inotumira bot - inoratidza kuti mushandi ari kudzivirira mari inowanikwa pane kusiya Phase A. Pivot iyi i Kuwedzera, kwete yokutsiva.
Zvatisiri kutaura
Hatina kukwanisa kusimbisa hunhu hwechokwadi huri shure kwe deadcode09284814 kubata, uye hatiti mushandirapamwe uyu wakapihwa zita rekuti munhu anotyisidzira, boka, kana nyika. Chiratidzo che "phantom" chinowirirana zvakakwana muzvinhu zvekugadzira zvinoratidza mushandi mumwe chete, asi kutumirwa kweC2 binary nenzira ye kit kunosiya mukana wekuti mapakeji emangwana kubva kuma handles asina hukama achashandisazve kodhi imwecheteyo.
Mhedzisiro, Maitiro & Zvinofanira Kuitwa Nevadziviriri
Impact
Zvinangwa zvepamutemo zve squat axios uye template yechoko zvinotsigirwa zvakanyanya muJavaScript ecosystem; axios yega iri pakati pemapakeji makumi matatu epamusoro eNpm akadhawunirodhwa zvakanyanya. Mazita ekunyora ari kure neaya chaiwo (axois ↔ axios, tempalte ↔ template), uye ese ari maviri anonyorwa zvisizvo pamutauro.
Hatina kukwanisa kuwana nhamba dzemadhawunirodha dzakavimbika dzemadhawunirodha asina kunaka tisati takedown — npm haichengete huwandu hwemadhawunirodha padanho rega rega mushure mekunge pasuru yabviswa, uye npms.ioMaproxies e-style ane ruzha pahukuru uhwu. Chero sangano rine lockfile rinosarudza package inonzi zvishandiso zve axois or choko-temalte kubva kumuparidzi deadcode09284814 inofanira kubatwa seyakakanganiswa: tenderera gwaro rega rega riripo process.env pane mutungamiriri akabatwa, ongorora mavector ekutsungirira pa OS yega yega (ona "Zvinofanira kuitwa nevadziviriri" pazasi), uye bvisa kuvimba.
Emerging mapatani
Mushandirapamwe uyu unoratidza shanduko yatakaona muzviitiko zvakati wandei zve npm munguva pfupi yapfuura: chigadziko chehoko chekuisa ndicho chinhu chinogara kwenguva refu; mutoro wekubhadhara unogona kuchinjwa. Muparidzi mumwe chete, pasuru imwe chete, imwe chete preinstall / install / postinstall katatu, uye kunyange shanduro imwe chete-bump cadence - chinhu chega chakachinja pakati zvishandiso zve axois:1.0.6 uye zvishandiso zve axois:1.0.9 faira raive iro hooks run. Kuonekwa kwakavakirwa pachiratidzo kwakabatana nePhase A payload (tambo dzenzira yewallet, phantom.jsMuunganidzi wemitambo yeServeo C2 (7,667-line collector), angadai akacherechedza mavhezheni matatu ekutanga ndokurasikirwa nePhase B zvachose.
Maitiro akafanana anoonekwa mune mamwe ma campaign atakateedzera muna 2026: mushandi mumwe chete ane nzvimbo yakagadzikana, achichinjana pakati pekuba ma certificate, vatengi vanobiridzira bvunzo, Telegram-bot exfil, uye ikozvino kutsvaga DDoS. Vadziviriri vanovimba nemasaini epayload vacharamba vachikundwa muchikamu chechipiri che campaign yega yega.
Chigumisiro chacho ndechekuti MaTTPs enguva yekuisa ndiwo chiratidzo chiri nani. Kuzivisa katatu kwekuisa-hook, kuisa zvinyorwa zvinopinza https or maitiro_emwana, isa zvinyorwa zvinonyorera kumaforodha ekutanga evashandisi, uye isa zvinyorwa zvinogadzirisa mazita evanogamuchira mazita pamasevhisi emahara e reverse-tunnel (Serveo, localhost.run, ngrok, cloudflared) zvese hazviwanzo kuwanikwa mumapakeji epamutemo uye zvinowanikwawo pane ane hutsotsi.
Zvinofanira kuitwa nevadziviriri
- Ongororo yekiyi yekiyi. Tsvaga zvese package-lock.json / yarn.lock / pnpm-lock.yaml musangano renyu kuti muwane tambo dzakakodzera zvishandiso zve axois uye choko-temalteBata chero mutambo sechibvumirano.
- Tenderedza zvakavanzika pavanhu vakabatwa nechirwere ichi. Chikamu A cheSSH, cloud, GitHub, npm, uye zvitupa zvewallet zvakaunganidzwa. Fungidzira kuti zvitupa zvese zviripo mu process.env, ~ / .ssh, ~/.aws, ~/.npmrc, ~ / .config, kana chero .env* faira riri pamunhu akabatwa rinoonekwa.
- Bvisa kuramba uchitsungirira (Chikamu B). PaWindows, bvisa HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate, Bvisa %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\system-update.bat, uye schtasks /bvisa /tn SystemUpdate /fPaLinux, crontab -e uye bvisa @reboot node …, systemctl -mudzivisi dzima -zvino phantom-bot.service wobva wadzima ~/.config/systemd/user/phantom-bot.service, kukwesha .bashrc / .zshrc / /etc/rc.localPa macOS, tanga kurodha pasi ~/Raibhurari/LaunchAgents/com.phantom.bot.plist wobva wabvisa plist.
- Vhara maC2 hosts. Wedzera maC2 endpoints mana ari mutafura yeIOC kune yako egress blocklist. *.serveousercontent.com uye *.lhr.hupenyu inogona kuvharwa zvakanyanya kana nzvimbo yako isina kushandiswa zviri pamutemo kwemabasa e reverse-tunnel.
- Tsvagai nenguva yekuisa TTP, kwete mutoro. zvinyorwa zvefaira rekukiya zvinhu zvine package.json anodaro preinstall, install, uye postinstall zvese zvichinongedzera pachinyorwa chimwe chete. Tarisa zera repakeji uye mamiriro ekusimbiswa kwemuparidzi. Iyi pateni haiwanzo kuwanikwa mumapakeji ari pamutemo uye ndiyo chiratidzo chakavimbika chinoshandiswazve nePhantomBot.
- Ongorora C2 binary. Chero ani zvake akadhawunirodha zvishandiso zve axois:1.0.9 ine sevha yeC2 yemushandi (c2 ELF, sha256 165fa92d…) padhisiki. Scan cache uye CI artifact stores. Iyo binary haina kurara yoga, asi kuvapo kwayo panzvimbo yebasa humbowo husina kujeka hwekuti package yakaiswa.
Mutsetse wekupedzisira
Mushandisi mumwe chete, pasuru imwe chete, uye hoko imwe chete yekuisa zvinogona kupa njodzi dzakasiyana zvachose mukati memaawa makumi mana nemasere. Ngwarira scaffold, kwete mutoro.
