TL; DR
Mumwe muparidzi wepaNpm akatumira mapakeji madiki masere ane mazita akafanana neaya emazuva ese ekugadzira blockchain uye wallet, base58-utils, abi-encode, eth-dev, arb-kit, layer2-sdk, solana-key-utils, eth-wallet-helpers, uye crypto-validate-libImwe neimwe ine chinhu chinoshanda. Asi, chinowedzerwa mushure mechinhu ichocho, ibhuroko rekodhi rinozvishandira rinotanga kana module yapinzwa.
Masekondi angangoita makumi matatu nemanomwe mushure mekupinza, iyo block inoongorora mutoro unotumirwa mukati mepakeji yakavanzika sechishandiso chekuyedza, inoinyora kufaira rakavanzika pasi pedhairekitori repamba remushandisi, inonyoresa pachayo kuti itangezve pane yega yega login muWindows, macOS, neLinux, uye inotanga script yakadhindwa senzira yakaparadzana. Hapana chinhu nezveizvi chinoitika panguva yekuisa npm; chinomirira kuti kodhi iunzwe uye ishande, inova nguva yakanyarara kupfuura kuiswa.
Mutoro wepayload hauonekwe zviri pachena. Unofamba sebase64 isina chinhu, saka kutsanangura "test fixture" kunodzosa danho rechipiri zvizere: a crypto-wallet uye muba zvakavanzika iyo inomirira kuti muchina ugare usina chinhu, inounganidza makiyi akavanzika uye mazwi embeu, inovharira chimwe nechimwe chakawanikwa nekiyi yeRSA-4096 yakaoma, uye inoiburitsa nekuiisa panzvimbo yekuchengetera yeIPFS yeruzhinji, ichidzoka maawa gumi nemaviri ega ega.
Tinotevedzera boka remapoka se PhantomSyncMapakeji ese masere aive aripo mu registry ye npm panguva yekuongorora, akaburitswa pasi peakaundi imwe chete.
| Ecosystem | npm |
| Mabhokisi | base58-utils, abi-encode, eth-dev, arb-kit, layer2-sdk, solana-key-utils, eth-wallet-helpers, crypto-validate-lib |
| Mapuratifomu akatarisana | Mahwindo, macOS, Linux |
| Maitiro epakati | Chidonhedzisiro chenguva yekupinza chanonoka chakavanzika sechishandiso chekuyedza; chinoisa cross-platform persistence |
| Payload | Crypto-wallet uye stealer yezvakavanzika, RSA-4096 encryption, exfiltration kuburikidza ne public IPFS pinning |
Muviri wekurwisa
Pakeji yega yega inoita seisingashamisi pakuverenga kwekutanga. base58-utilsSemuenzaniso, i kodhi yemubatsiri yeBase58 / Bitcoin-WIF ine makirobytes mashoma e zero-dependency — ndizvo chaizvo zvinovimbiswa nezita racho. Kodhi yakakodzera iripo. pashure module yacho module.kutumira kunze kwenyika, uko muverengi ari kuverenga pamusoro pefaira asingatarisi: basa rinozvipa iro rinoronga nguva.
Cheni yekushanda, yakavakwazve kubva panobva papakeji, inomhanya seizvi:
1. Package is required() by the host project
2. A self-invoking function schedules a callback ~37,000 ms later (setTimeout)
3. On fire, the callback reads test/fixtures/keypairs.dat (a base64 blob)
4. It base64-decodes that blob into a Node.js script
5. It writes the script to ~/.cache-db/.node-sync/syncd.js (mode 0o700)
6. It installs login-persistence for that script (see below)
7. It spawns "node syncd.js" as a detached processSarudzo mbiri dzekugadzira dzinoonekwa.
Mutoro wacho unofamba semutambo wekuyedza. Danho rechipiri harina kunyorwa sekodhi iri pachena. Rinogara mu bvunzo/zvishandiso/keypairs.dat, faira rebase64 rine zita rinosanganiswa mupakeji inoti inobata makiyi maviri. Kune munhu ari kutsvaga tarball, inoita se data remuenzaniso; kune kodhi yakawedzerwa, ichinyorwa chekutsanangura nekumhanyisa. Iyo dropper pachayo haina kero yenetiweki - iyo inogara muchikamu chechipiri - asi hapana imwe obfuscation: iyo fixture ichikamu chimwe chete chebase64, saka inogadzirisa (hwaro64 -d) inodzosa zvese syncd.js uye maitiro ayo enetwork. Chikamu chinotevera chinotsanangura zvinoitwa nedanho iroro rekupora.
Kuputika kunononoka uye kwakabatana nekupinza, kwete kuisa. Nekuti chinotanga chiri inoda () pamwe chete ne ~37-second timer pane install hook, maitiro anotevedzera matanho anongotarisa chete npm install danho, uye kunonoka kunogara kwenguva pfupi kupfuura ma "sandbox" mazhinji uye ma "CI runs" mazhinji. Panguva iyo chero chinhu chinotanga kushanda, kuiswa kwakaburitsa pasuru kwapera kare.
Kana script yakadhindwa yave padiski pa ~/.cache-db/.node-sync/syncd.js — nzira yakasarudzwa kuverenga sedhairekitori rekuchengetedza data renguva dzose — iyo dropper inoita kuti irambe iripo pakudzokorodza data pamapuratifomu ese matatu makuru:
- Linux: chinyorwa checron chinovhurazve chinyorwa. Chinyorwa chinoiswa nekusefa crontab iripo kuburikidza grep -v yakabatana, iyo ine mhedzisiro yekusiya chinyorwa chitsva kubva pane rondedzero isina kujeka iyo greps yezita rimwe chete.
- Windows: basa rakarongwa rinonzi WinNodeSync, yakagadzirirwa kudzokorora mushure memaminitsi gumi nemaviri.
- macOS: basa rakatangwa rakanyorwa com.apple.syncd, inowanikwa mumapakeji akati wandei — label inotevedzera sevhisi yepamutemo yeApple system.
Chinyorwa chinotanga ipapo ipapo senzira isina kunyorwa, saka chinoramba chichishanda mushure mekunge chirongwa chekupinza chabuda.
Zvinoitwa nechikamu chechipiri
Nekuti chigadzirwa chacho chine chigadziko chimwe chete chebase64, danho rechipiri rinogadziriswa zvakanaka uye rinogona kuverengwa zvizere. Mapakeji ese masere ane imwe yemhando nhatu dzechinyorwa chimwe chete, icho chinozviratidza mumusoro wenyaya se phantom syncd v3 - topo durmiente (“muswe wehope”). Basa rayo nderekuba zvinhu zve cryptocurrency-wallet nezvakavanzika zvevagadziri uye kuzvitumira kubva muchina. Inomhanya nematanho aya:
- 1. Mirira kusvika muchina wapera kushanda. Usati waita chero chinhu, syncd.js inotarisa kuti mushandisi anga asingashande kwenguva yakareba sei uye inongopfuura mwero (anenge maminetsi gumi nemashanu) — xprintidle paLinux, ioreg HIDleTime pa macOS, uye PowerShell idle-time query pa Windows. Saka kukohwewa kunowanzoitika kana pasina ari pa keyboard.
- 2. Tora switch ye "activation" inodzorwa kureChinyorwa chinoburitsa config diki kubva pa dead-drop isati yatanga kushanda. Chitubu chikuru iGitHub gist raw URL (gist.githubusercontent.com/juang55/…/cfg.txt); chinyorwa chinoshanda chete kana gadziriro iyoyo ichiverengwa inoshanda = 1Kana pfungwa yacho isingawanikwe, inodzokera kumashure kune matatu ma IPFS content identifiers, anotorwa kuburikidza nema public gateways. gedhi.pinata.cloud, ipfs.io, uye cloudflare-ipfs.comIzvi zvinopa mushandi simba rekutonga ruoko/kubvisa zvombo mushure mezvo uye simba rekudzivirira kubva pakubviswa kwezvombo. (Chinhu chidiki, chinotumirwa mu crypto-validate-lib, vabatsiri-vechikwama che eth, uye zvishandiso zve solana-key, ine gist layer yabviswa uye inovimba nema identifiers eIPFS chete.)
- 3. Kuunganidza zvinhu zvechikwama uye zvakavanzika. Chinyorwa chinofamba mudhairekitori repamba remushandisi — ~/.config/solana, ~/.ethereum/kiyi chitoro, ~/.foundry, ~/.hardhat, ~ / .ssh, uye Desktop/Documents/Downloads (kusanganisira mazita emafolda emutauro wechiSpanish), pamwe chete ~/.env uye mafaira e-shell rc, uye zvakaenzana AppData nzvimbo paWindows. Inotarisa makiyi eEthereum epachivande, makiyi eBitcoin WIF, mitsara yeBIP-39, makiyi eSolana, JSON yeEthereum keystore, makiyi eSSH, uye mavariable ekuchengetedza zvakavanzika. Mhando yakakura (mu abi-encode, base58-utils, eth-dev) ine duramazwi rakazara remazwi 2048 reBIP-39 uye inoshandisa mazwi akajairwa ku mushoma makiyi ega ega uye mitsara yembeu yakasimbiswa kubva pane chero chinyorwa chainoverenga; mhando mbiri diki dzinoenderana nefaira neshoko guru (mbeu, mnemonic, wallet, metamask, phantom, ledger, trezor, ...) uye rodha mafaira ese.
- 4. Encrypt uye buritsa ruzivo rwako kuburikidza nesevhisi yeruzhinji yekupina. Kuwanikwa kwega kwega kunosanganiswa nemunwe wemugamuchiri (zita rekushandisa @ zita remubati, puratifomu, timestamp) uye yakavharidzirwa neRSA-4096 public key yakavharidzirwa yakaiswa muscript. Rekodhi yakavharidzirwa inozoiswa nekuipinza kuIPFS kuburikidza ne api.pinata.cloud/pinning/pinJSONToIPFS, yakatenderwa nePinata API certifications. Hapana sevha yeC2 yakagadzirirwa kubata: data rakabiwa rinoiswa munzvimbo yekuchengetera yeruzhinji, rinogona kutorwa nemushandisi achishandisa hashes dzemukati dzinobuda. Kurodha kunopatsanurwa nemasekondi mashoma ekusagadzikana, uye log yemuno ye timestamp | key-type | returned-hash inochengetwa pa ~/.cache-db/.node-sync/.sl.
- 5. Ramba uchienderera mberi uye ramba uchitarisa padanho remaawa gumi nemaviri. Danho rechipiri rinotangazve kuramba kwaro — kupinda kwecron paLinux, a com.apple.syncd yakatanga basa pa macOS, uye basa rakarongwa rakatumidzwa zita WindowsNodeSync paWindows — yakagadzirirwa kudzokororwa maawa gumi nemaviri ega ega. Cherechedza kuti iyi i siyana Zita rebasa reWindows kubva pane iro rinoiswa nedropper (WinNodeSync); zvose zvakakodzera kuvhimwa.
Nemakore
Mapakeji masere aya akabudiswa zvishoma nezvishoma musi wa2026-07-13 na2026-07-14. Akawanda ane mavhezheni anopfuura rimwe chete; dropper yakafanana mumavhezheni ese, ine mitsetse chete inochinja sezvo saizi yekodhi yekushandiswa kwemagetsi iri pamusoro payo ichichinja.
Mukati menguva iyi, mukurumbira wemuparidzi werejistri wakabva pakusava nedivi rawo pakutanga kweboka kuenda pakusava nepfungwa dzakanaka sezvo kuwanikwa kwacho kwakawedzera — mhedzisiro inoonekwa yemapakeji ari kuratidzwa, kwete chinhu chakagadzirwa.
Zviratidzo zveKubvumirana
Zviratidzo zvese zviri pazasi zvakasimbiswa kuti zviripo panguva yekuongorora — izvo zviri mumatafura e "danho rechipiri" nekunyora makodhi bvunzo/zvishandiso/keypairs.dat uye kuverenga zvakadzorerwa syncd.js.
Mafaira nenzira
Nzvimbo ye network yedanho rechipiri (yakatorwa kubva ku syncd.js)
Zvinangwa zvekuunganidza zvedanho rechipiri (zvakatorwa kubva kusyncd.js)
Zvinhu zvemazuva ano
Kuzvibata
- Basa rekuzvidaidza rinowedzerwa mushure me module.kutumira kunze kwenyika, kuronga a setTimeout ye ~37,000 ms pakupinza.
- maitiro_emwana kubereka ("node", ) nesarudzo dzakaparadzana dzakasarudzwa.
- Kushanda kwepagedhi risina chinhu muchikamu chechipiri (xprintidle / ioreg HIDleTime / PowerShell nguva isina basa; ~muganho wemaminitsi gumi nemashanu).
- Kutsvaga kwega kwega RSA-4096 encryption, wobva waisa HTTPS POST kune API yeIPFS pinning yeruzhinji.
Mapakeji neshanduro (npm, muparidzi solbuilder_io)
mutsikisi
- solbuilder_io - angel_lopez89[@]proton[.]me, email isina kusimbiswa, hapana account ye source-control yakasimbiswa, hapana repository yakabatana.
Hunhu & Maitiro Akacherechedzwa
Mapakeji masere aya ane account imwe chete yemuparidzi uye payload imwe chete. Rimwe nerimwe ipakeji diki - makirobytes mashoma ekodhi chaiyo yekushandiswa ine dropper imwechete yakawedzerwa - yakaburitswa isina repository yakabatana uye pasi peemail isina kusimbiswa. Kufanana ikoko, nzira yekudonha yakagoverwa, ma label ekutsungirira akagoverwa, uye akagoverwa keypairs.dat faira rekugadzira zvinhu (staging file) ndiro rinosanganisa cluster.
Mapakeji acho anotaura pachena nezvemaitiro avo. zvishandiso zve solana-key ine mashoko ari mukati anotsanangura bhokisi rakabatanidzwa nemashoko akajeka - mumwe anoritumidza kuti PHANTOM: kuramba kusingaonekwe, imwe (muchiSpanish) inoti Ejecutar topo en background, “mhanyisa mole kumashure.” Aya ndiwo mashoko ekodhi yacho ezvainoita; zita remushandirapamwe muchinyorwa chino rakatorwa kubva pazita rekutanga pamwe chete ne "sync daemon" yenhema (yakabatana) iyo michina yekutsungirira inotevedzera.
Isu tinotsanangura chete zvinoitwa nekodhi iyi. Kutumidzwa kwemapakeji - ese mazwi e crypto, wallet, uye blockchain-tooling - kunoratidza vateereri vevagadziri vanogona kuatora nemazita avo; hazvizivise kuti ndeapi muparidzi. Danho rechipiri raigona kudzoserwa zvizere nekusarudza dhizaini ye base64, uye maitiro ayo anotsanangurwa pamusoro apa: inounganidza makiyi ewallet, mitsara yembeu, nezvakavanzika uye inoaburitsa, akavharirwa neRSA, kuchengeterwa kweruzhinji kweIPFS kuburikidza nePinata. Sarudzo huru yekugadzira ndeyekusavapo kweseva yeC2 yakavanzika - configuration inobva kuGitHub gist neIPFS, uye data rakabiwa rinoiswa munzvimbo yekuchengetera yeruzhinji yakavharirwa ne content hash, ese ari maviri akaoma kubata kupfuura host imwe chete inodzorwa neattacker. Hapana mishumo yeruzhinji yapfuura inoenderana neboka iri yakawanikwa panguva yekunyora uku.
Mhedzisiro, Mafambiro & Gwara reVadziviriri
Ndiani afumurwa. Chero ani zvake akawedzera rimwe remapakeji aya kuNode project obva ashandisa kodhi inoripinza. Nekuti kuputika kuri import-time pane install-time, kungova nepakeji iripo hazvina kukwana - asi chero kushandiswa kwakajairika kunoisa module kunosvika payload. Mazita eruve anotarisa vagadziri vanovaka paEthereum, Solana, Arbitrum, Layer-2, uye general wallet/encoding tooling - vanhu vazhinji vanogona kunge vaine pfuma chaiyo inotsvakwa padanho rechipiri. Chero ani zvake akashandisa imwe yeaya mamodule pamuchina une makiyi ewallet, seed phrases, keystores, SSH keys, kana .env zvakavanzika zvinofanira kubata zvitupa izvozvo sezvisina kunaka uye kuzvitenderedza.
Mapatani maviri akakodzera kuverengerwa mukati. Chekutanga, mutoro wekubhadhara: kutumira chikamu chechipiri se base64 mukati mefaira redata rine zita rinofungidzirwa (bvunzo/zvishandiso/keypairs.dat) inoita kuti panowanikwa mashoko ari mupakeji parambe pakachena uye inosundira mashoko ane njodzi mufaira iro maturusi ekuongorora uye ruzivo rwevanhu runowanzoonekwa sedata risina basa. Chechipiri, kunonoka kwekupinda-nguva yekuisa nekutsungirira kwepuratifomu: kufambisa trigger kubva pa install hook, kuwedzera timer, uye kuramba uchienderera mberi ne cron, scheduled tasks, uye launchd idanho remaune kubva pamaitiro e install-script ane ruzha ayo automated registry scanning inotarisa zvakanyanya.
Gwaro revanorwira nevanochengetedza:
- Bata kodhi yakawedzerwa mushure me module.kutumira kunze kwenyika sechinonyanya kukosha pakuongorora — dropper logic inowanzovanda pasi pe "chaiyo" module pamusoro.
- Usafunge kuti mafaira edata haana basa. Blob re base64 riri pasi bvunzo/mitambo/ iyo inoverengwa panguva yekumhanya uye yakaderedzwa iri pedyo ne executable; ratidza kuti nguva yekumhanya inoverengwa yemafaira ekugadzirisa anodyisa a basa/eval/nyora-ipapo-spawn cheni.
- Tsvaga nzira yekudonha ~/.cache-db/.node-sync/ uye kune zvikamu zvekutsungirira WinNodeSync (basa rakarongwa) uye com.apple.syncd (yakatangwa) pamichina yekugadzira yakatora mazita aya.
- Yambiro pamusoro pemaitiro eNode anogadzira zvinyorwa zve cron, mabasa akarongwa, kana mabasa akatangwa — maraibhurari epamutemo haawanzoiti izvi kana zvatorwa.
- Sarudza mafaira ekukiya uye mavhezheni ane pinned, uye ongorora kusiyana kwechero "utility" itsva inoshandiswa, kunyanya mapakeji asina kutsamira akabudiswa nemaakaundi asina kusimbiswa asina nzvimbo yakabatana.
Kune vanodzivirira registry, chidzidzo ndechekuti kutarisa kwe install-hook kwakakosha asi hakuna kukwana: import-time, timer-delay dropper yakaiswa mukati me data file ichapasa install-time-time check chete, uye nhanho ye persistent inowanzova chiratidzo chinoonekwa zvakanyanya chinosara kuti chibatwe.
