TL; DR
Musi wa2026-05-21, muparidzi wenpm jaggle yakaburitsa shanduro pfumbamwe (1.0.0 kuburikidza 1.0.8) of @jaggle/resizeobserves muhwindo rinotora maawa maviri.
Pakeji iyi imhando yekunyora kwezviri pamutemo @juggle/resize-observer polyfill — pasuru inoshandiswa zvakanyanya ine mamiriyoni ekudhawunirodha vhiki nevhiki — asi haitumire kushandiswa kweResizeObserver chaiko.
Pane kudaro, pasuru yacho hoko mushure mekuisa inoisa bundled Python payload, inonyoresa persistent semutengesi wenguva yekumhanya-mhanya, uye inoshandisa cross-platform clipboard hijacker inotarisa kutengeserana kwe cryptocurrency.
Linux kutsungirira kunoonekwa se python3-dbus-helper, macOS as com.apple.python.runtime, uye Windows as PyRuntimeBroker.
Mutoro wekubhadhara unoramba uchitarisa clipboard kuti uone kero dzewallet dziri mukati ma blockchain anopfuura makumi mana uye inotsiva kero dzakakopwa chinyararire nemawallet anodzorwa nevanorwisa.
Malware iyi inoshanda munharaunda yese isina zvivakwa zveC2 zvinobuda, zvichiita kuti clipboard ichinje nzira yekubuditsa data.
IOC huru ndiro zita repakeji pacharo: @jaggle/resizeobserves — cherechedza vhawero rakadonhedzwa mu "jaggle" uye "s" yakawedzerwa mu "resizeobserves".
Kuoma: kwakakwirira.
Kurwiswa: Mashandiro Akwo
npm:@jaggle/resizeobserves hazviratidzike se malware pakombiyuta isina kurongeka maonero eNpm. Its README.md ndiwo mutauro chaiwo weREADME we npm:@juggle/resize-observer — mienzaniso yekodhi imwe chete, mirairo yekushandisa yakafanana, yakafanana pinza { ResizeObserver } kubva ku '@juggle/resize-observer' mareferensi ese. Kubiwa kwezvinyorwa kwakazara zvekuti chero munhu anotarisa magwaro acho angafunga kuti ari kuverenga magwaro epakeji yacho.
The package.json, zvakasiyana, hazvina kuwanda: kwete repository munda, imwe chete ndiri kupinda kunongedzera pa bin/clipboard-guardian.js, Uye postinstall chinyorwa chinomhanya node npm-install.jsMienzaniso yeREADME ye "Basic use" inotaura nezvekushandiswa kweJavaScript kusina chero kupi mu tarball. JavaScript chete iri mupakeji ndiyo install script.
Danho 1 — npm postinstall bootstraps a Python payload
npm-install.js inoziva nezvepuratifomu. Inowana Pip inogona kufambiswa nenzira yekutsvaga yakasimbiswa (/usr/bin/pip3, /usr/local/bin/pip, kudzokera shure ku python3 -m pip), inoisa bundled Python package kubva ku tarball directory, uye — paLinux — inodhonza mukati xclip or xsell Via zvakakodzera-kuwana, Pacman, kana dnf kana pasina kana chimwe chatovapo:
Kushandiswa -mapakeji ehurongwa hwekuputsa ndeyekuita nemaune: kugoverwa kweLinux kwemazuva ano kunotumira Python nePEP 668's externally-managed-environment marker yakagoneswa, iyo inovhara mapip installs ewebsite yese nedefault. Install script inomanikidza install kupinda.
Chinyorwa chacho chinozivawo sudo-aware. Kana uid iri kumhanya iri mhedzisiro ye sudo npm install, chinyorwa chacho chinoti SUDO_USER uye magokora akabuda getent passwd kuwana zvechokwadi dhairekitori repamba remushandisi, wobva wanyora mafaira aro ekutsungirira ipapo pane kupinda mu / root. Kugara kwenguva refu kunoenderana nemushandisi wega wega, kwete system yese.
Danho rechipiri - Kuramba uchienderera mberi kweCross-OS pasi pemazita evanoshandisa maroja ekumhanya
Mushure mekunge Python package yaiswa, script inonyoresa auto-start entry pasi pezita rakasiyana pane yega yega operating system:
- Linux — systemd user unit pa ~/.config/systemd/user/python3-dbus-helper.serviceChikamu chacho tsananguro is Python D-Bus Runtime HelperChinyorwa ichi chinoedzawo kuchigonesa kuburikidza ne systemctl - shandisi inogonesa, kudzokera ku symlink yemaoko pasi pe default.target.wants/ kana systemctl ikatadza kushanda. Kana ichishanda pasi pesudo, script inochinja kuenda ku sudo -u systemctl -mushandisi, pamwe XDG_RUNTIME_DIR seta kuti kufona kwemushandisi-bhazi kushande.
- macOS — chirongwa cheLaunchAgent pa ~/Raibhurari/LaunchAgents/com.apple.python.runtime.plist ne RunAtLoad=chokwadi uye Ramba Uchiri Mupenyu = chokwadi, yozoiswa kuburikidza ne mutoro we launchctl.
- Windows — Basa Rakarongwa rinonzi PyRuntimeBroker, rakatanga AtLogOn, ine muganho wenguva yekuita we zero (kureva, hapana nguva yekubuda), yakanyoreswa kuburikidza nePowerShell.
Mazita ese matatu anovimbika kana ukangotarisa. python3-dbus-helper inotevera tsika yekupa mazita ekubatanidzwa kwePython-D-Bus paLinux desktops. com.apple.python.runtime inotevedzera reverse-DNS labeling yeApple yemasevhisi ayo. PyRuntimeBroker inotsanangura maWindows RuntimeBroker.exe — sevhisi chaiyo, yakasainwa yeMicrosoft iyo inobvumidza zvikumbiro zvemvumo zvemaapplication eUWP. Hapana kana chimwe cheizvi chiri masevhisi chaiwo eApple/Microsoft/Python mune iyi mamiriro, asi mudziviriri ari kuita scan yekuona nekukurumidza. systemctl -runyorwa rwevashandisi-mayuniti or Get-ScheduledTask hazvingamboiti kuti zviome.
Danho rechitatu - Mubavha we clipboard
Iyo Python payload, yakaiswa pa clipboard_guardian/guardian.py, inoita denderedzwa risingaperi richiongorora clipboard yesystem mamirisekonzi mazana mana ega ega. Pakunongedza kwega kwega, inodhonza zviri mukati me clipboard iripo kuburikidza pyperclip.paste() uye inoashandisa parunyorwa rwema "regular expressions" akanyorwa kare anopfuura makumi mana anofukidza ma "wallet-address formats" eEthereum, Bitcoin, Monero, Solana, TRON, TON, Ripple, Litecoin, Dogecoin, Polkadot, NEAR, Cosmos, Algorand, Stellar, Cardano, Bitcoin Cash, Dash, Zcash, Aptos, Sui, Tezos, MultiversX, Harmony, Terra, Injective, Osmosis, Kava, Celestia, Nano, Filecoin, Ronin, Ergo, DigiByte, Hedera, BNB Smart Chain, nedzimwe dzakawanda dzakaiswa mu "default config" (Sei, IOTA, Kaspa, Flow, Nervos, Decred, Ravencoin).
Kana mutambo wasvika, chinyorwa chinoverenga kero yemurwisi wecheni iyoyo kubva ~/.config/clipboard-guardian/config.json (kana zvakafanana nepuratifomu yayo) uye inobvisa clipboard nechinyorwa chakatsiviwa nacho:
Hapana network beacon. Clipper haifoneri kumba, hainyorese mahost ane hutachiona, haibudisi chero chinhu. Kubuda mufaira ndiko kuchinja pachako: kana mushandisi akakopa kero yemugamuchiri kubva muUI yewallet yake ndokuiisa mubhokisi rekutumira, kero yakanamatwa ndeyake. Mari yacho inorasika mubhendi, pachena kumushandisi.
Chii chitsva pano
Pane zvimwe zvinhu zvinoonekwa zvakasiyana kana tichienzanisa ne generic crypto-clipper template:
1. npm → Python crossover. Mazhinji ma crypto-clippers atinoona mu npm iJavaScript chaiyo, inowanzo vharwa ne _0x kutenderera kwe array kana eval(atob(…)) stacks. Muenzaniso uyu unoshandisa npm tarball sechinhu chinopfuura kuputira kwekutumira kwePython package - clean Python - uye inoita kuti pip ibatisise kuiswa kwekuvimba (pyperclip, psutil, zvokusarudza setproctitle) yakaziviswa mubundled pyproject.tomlHapana JavaScript obfuscation yekukunda. Clipper pachayo iPython isina kuoma, inoverengwa.
2. Mazita eTri-OS anosarudzwa kuti aonekwe seanogona kushandiswa. Vazhinji vanoisa mapuratifomu akasiyana vanonyoresa kutsungirira pasi pemazita akajairika (updater.service, mubatsiri.plist). Muenzaniso uyu unotora dambudziko rekusarudza mazita akafanana nemabhuroka ekushandisa nguva yekushanda papuratifomu yega yega. Kutumidza mazita ndiko chete kuedza kuvanza - hapana rootkit, hapana kuvanda kwemushandisi, kana nzira isina kuvharwa. Chinhu chikuru ndechekuti vadziviriri havawanzo ongorora. ~/.config/systemd/mushandisi/ uye kuti sevhisi inonzi python3-dbus-helper hazvizobudiriri muongororo isina kurongwa.
3. Kuvharidzira zita remaitirwo ezvinhu ndekwechokwadi, asi kusaongorora kwacho hakuna kujeka. Iyo Python payload inotsanangura a _maitiro_ekuviga() basa rinoisa musoro wemaitiro kuburikidza setproctitle (Linux/macOS) kana SetConsoleTitleW (Mahwindo) — uye chikuru () anodaro. Saka ps kuti zvicharatidza python3-dbus-helper panzvimbo ye python3 …/guardian.pyZvisinei, module imwecheteyo inotsanangura is_monitor_running() basa rinonyora maturusi anozivikanwa ekutarisa maitiro (htop, btop, Task Manager, Activity Monitor, Process Hacker, Resource Monitor, GNOME / KDE / Xfce / MATE system monitors, nezvimwewo) — uye chikuru () Hazvimboiti. Chinotsiva chinoshanda pasina miganhu, kunyangwe mushandisi ane process monitor yakavhurika kana kwete. Basa racho harina kodhi mushanduro yakatumirwa. Zvingangodaro kuti rasara kubva pane zvakamboitwa kare, kana kuti scaffolding yechinhu chisati chagadziriswa. Chero nzira, nzvimbo yekudzivirira kuongorora payload yakaburitswa inongova imwe chete inonzi process-title rename, kwete active monitor evaction.
4. Maitiro ekubatanidza marongero. npm-install.js anonyora runyorwa rwechikwama chakajairika ku ~/.config/clipboard-guardian/config.json uye, kana faira rekugadzirisa ratovepo, rinobatana mune chero makiyi ane kukosha kuripo kusina chinhu. Izvi zvinoreva mushandisi akambobatwa nehutachiona uye akachenesa zvishoma gadziriro yacho - ngatitii, nekuburitsa zvese zviri mu ethereum kukosha — kuchaita kuti iwanikwezve nekuisa kwega kwega kwepakeji ine njodzi. Hapana kucheneswa kwefaira repersistance mune chero nzira yekodhi.
| Zuva / Nguva (UTC) | chiitiko |
|---|---|
2026-05-21 18:50:32 | @jaggle/resizeobserves@1.0.0 rakabudiswa. |
2026-05-21 19:55:55 | 1.0.1 yakaburitswa — vhezheni yekutanga yakaratidzwa nekuskena kwekunze. |
2026-05-21 19:58:10 | 1.0.2 rakabudiswa. |
2026-05-21 20:05:03 | 1.0.3 rakabudiswa. |
2026-05-21 20:09:24 | 1.0.4 rakabudiswa. |
2026-05-21 20:13:48 | 1.0.5 rakabudiswa. |
2026-05-21 20:41:52 | 1.0.6 rakabudiswa. |
2026-05-21 20:43:56 | 1.0.7 yakaburitswa — inowedzera a try/catch wrapper yakatenderedza wallet-config write step in npm-install.js. |
2026-05-21 20:46:15 | 1.0.8 yakaburitswa — mugadziri akatumidzwa zita idzva npm-install.js → npm-install.cjs (zviri mukati zvakafanana nebyte). |
2026-05-22 | Zvisarudzo neIOC zvakaburitswa. Mavhezheni achiripo murejistri panguva yekuburitswa (zviri kuenderera mberi). |
Mavhezheni mapfumbamwe muawa imwe chete nemaminitsi makumi mashanu nematanhatu anokurumidza kunyangwe kune munhu anonyora zvinyorwa zvisiri izvo. Maitiro acho anoenderana ne mushandirapamwe wekuburitsa nekupisa — wedzera muchina wekunyora pasi pemubato mumwe chete, rega kuonekwa kuenderere mberi, uye famba uchienda kumubato mutsva kana imwe shanduro yabviswa. Ma deltas anooneka ari mukati memutsara anonakidza: 1.0.1 yakawedzerwa pachena /usr/bin/pip3-style paths kuenda ku pip search list (sudo-compatibility), 1.0.7 yakaputira wallet-config write mu try/catch, uye 1.0.8 yakatumidza zita rekuti installer kubva .js to .cjs ukuwo zvichiramba zviri mukati mayo zvakafanana. .cjs tumidzazve matraki nenyevero dze npm nezve mhinduro ye module inonetsa mumapakeji asina kujeka "rudzi" munda, uye ingave kuedza kudzvinyirira ruzha rwenguva yekuisa runogona kukwezva kutariswa. Iyo Python payload - chikamu chega chinoba - hachina kuchinja mumavhezheni ese mapfumbamwe.
Zviratidzo zveKubvumirana
Mabhokisi
| Ecosystem | nhuri | Versions | chinzvimbo |
|---|---|---|---|
| npm | @jaggle/resizeobserves | 1.0.0 kuburikidza 1.0.8 | Mhenyu painoburitswa; kudzingwa kwakumbirwa. |
Mafaira & Hashes
| Nzira | Notes |
|---|---|
clipboard_guardian/guardian.py(md5 f7935c2c82bc881288611ab6cd634f17) | Zvakafanana muzvinyorwa zvese zvipfumbamwe zvakaburitswa (1.0.0 kuburikidza 1.0.8). Mutoro wekucheka zvidimbu. |
npm-install.js (1.0.0 – 1.0.7)npm-install.cjs (1.0.8) | Mugadziri we persistence; maitiro akafanana kubva pakutanga kusvika pakupedzisira. 1.0.7's .js uye 1.0.8's .cjs zvakafanana nebyte. |
~/.config/clipboard-guardian/config.json | Linux persistence config uye wallet bundle. |
~/Library/Application Support/clipboard-guardian/config.json | macOS persistence config uye wallet bundle. |
%APPDATA%\clipboard-guardian\config.json | Windows persistence config uye wallet bundle. |
~/.config/systemd/user/python3-dbus-helper.service | Kuenderera mberi kweLinux kutanga otomatiki. |
~/Library/LaunchAgents/com.apple.python.runtime.plist | Kuenderera mberi kweMacOS LaunchAgent. |
~/Library/Logs/com.apple.python.runtime.log | macOS stdout/stderr log yemumiriri. |
Scheduled Task PyRuntimeBroker | Basa rekutanga otomatiki reWindows (AtLogOn, hapana nguva yekumira). |
Zviratidzo Zvemaitiro
| Chiratidzo | tsananguro |
|---|---|
pip install --break-system-packages kubva npm postinstall | Inomanikidza kuiswa kwePython pawebhusaiti yese ichipfuura dziviriro dzePEP 668. |
apt-get install -y xclip (kana pacman/dnf) | Inoisa zvishandiso zve clipboard paLinux panguva yekuisa package. |
python3-dbus-helper.service systemd mushandisi unit | Kuramba kwakanyorwa pasi pezita rekuti runtime-helper rinotaridzika kunge rinogoneka. |
com.apple.python.runtime LaunchAgent | Chiratidzo chekugara chiri kunze kwenzira dzepamutemo dzeApple system. |
PyRuntimeBroker Basa Rakarongwa | Kuramba kuripo kweWindows runtime broker pasina chikonzero chepamutemo chekuisa. |
Maitiro ePython ane musoro python3-dbus-helper importing pyperclip uye psutil | Kusawirirana kwemaitiro pakati pezita remaitiro anoratidzwa nemaraibhurari akaiswa kunze kwenyika. |
| Chinjo dzebhodhi remapepa ~0.4s mushure mekopi yekero yewallet | Maitiro echiratidzo chekutsiva kero ye cryptocurrency. |
Chikwama chemurwisi (rondedzero yekuvhima vadziviriri)
Rondedzero yezvikwama inotumirwa yakanyorwa mu npm-install.js uye clipboard_guardian/guardian.pyVadziviriri vanogona kushandisa runyorwa urwu serunyorwa rwekuvharira (funga nezve chero kutumirwa kune aya makero kubva kumawallet emakambani sekusanzwisisika) uye kiyi yekuvhima (funga nezve kuvapo kwechero yeiyi tambo mufaira rekugadzirisa risingazivikanwe, build artifact, kana muchina wekugadzira sechiratidzo chehutachiona).
Chikwama Chekurwisa
| cheni | adhiresi |
|---|---|
| Ethereum / BSC | 0x450c0E58Fc2ba03632d3F5780ad8C966648B6F18 |
| Ronin (EVM) | ronin:450c0E58Fc2ba03632d3F5780ad8C966648B6F18 |
| Bitcoin | bc1qs2mpls4p0f7fng073gy2rcdgjpf7la4eugpt6y |
| Bitcoin Cash | bitcoincash:qqmvyxxklzp7l3eslxavhc8phl6hprdf25lwc29nlt |
| Litecoin | ltc1qnefc8x59a9cwtqnflt8hmqvezqw4hc7lt3fkqe |
| Dogecoin | DNEJmYRZtzyK44tZea4S7wV3otTyRk48Fy |
| Dash | XtJ7E6mnhPK93Vib29PGQrTmQjhTTqFwbS |
| Zcash | t1d4hcEnBjdh9X6Wb6R2dxqjnxddJ6ocP8M |
| DigiByte | DPmH2dhiGK3hk3A69tZUMz6tHzGFHBzSrH |
| Monero | 42zhAidVhP7QETk83JAspS59ASALSHFio44vmu6MdDCz15cSqtqsG4QVyzY8vTrjGrTEA6zMbWW6Yft1Ynz1xLfCN5FVbXf |
| Solana | DWBAmQLi9gP6mk7UfJfQGYTV1UPK32WekLTqg83q1mc5 |
| TRON | TVgEgMemmJABYYnbNr1Wi8bSgADEkdEBt2 |
| TON | UQDTSkvwmptU9eG988KgxS3WjnYAZlXgfpJxnz4mhWZAvULr |
| Ripple | r9tj3cMCiqRijNYqNVYNuwKykkQfS8FE4H |
| Polkadot | 1JSkYqXQE4d28HdcmTPhbgCrdiPFTfSHxD67tam16p53oBG |
| PEDYO | 5d6aec44551529e8cd9ebd3aaa84b3832fc3c7463596b2b6e72635b80096a364 |
| Cosmos | cosmos1pzfl3kv5g8g0ernj86rwpar08u2zl9suthx28e |
| Osmosis | osmo1pzfl3kv5g8g0ernj86rwpar08u2zl9surv463t |
| Celestia | celestia1pzfl3kv5g8g0ernj86rwpar08u2zl9su6ah6a5 |
| Zvinokuvadza | inj1g5xquk8u9wsrvvkn74uq4kxfvejgkmccn578gh |
| Kava | kava1kjfvgcz4q0y9yae2f3pa33vhj2estxxj3sqqux |
| Harmony | one19hn0n7dzkhtl9ta9ekv5592s85jwstpka76t3a |
| Terra | terra1h0dwu8z405jagdlr0fgr9jllac2sxajzlgme5x |
| Algorand | XSAMN3FTB5SUHUQFENBDDRXIMOPNFVLKAWA3RNOU54DWROMDZ6SR7DZ2PI |
| Stellar | GACNZSV4EQO65NZZUOBS3TMJM7GFTSRNKQBVJOX5P2G7U7SEBQ2ZUDJE |
| Cardano | addr1qyj050vla4cglmyrgm4vzf3dxtn0gynpks4t7vp7s3lg49e9wt0s94hcztzdgecxcz5hu9uk56q60yth6d66w026s2kq3ma56f |
| MultiversX | erd1slvlgqsmwzk0c8xtksm4eq5vdfnc26slpzqsyxhz456zvme5rpasue6ge0 |
| apt | 0x580ecda1ebd6ca5a46be2097568d013308bd54ef1d147acb880b59f7709f280e |
| sui | 0xf7e8a9a970fa65c058745c4b2cf2a856cc0283863e4ed1e142648f26097b0c78 |
| Nano | nano_393n56a5pfz8zg3nkzf7mytfgagzhu5mn9i3xiqg54weq8n1u8jgezxas7dn |
| Filecoin | f1fypyww3xubopfnv7q6yh5l4bko44wmfktf3ckui |
| Tezos | tz1RccjnorHk61bt73ArLXcdgFjEj6T1ochk |
| Ergo | 9g1pNQGnFg7Hk1d9Z66bgHMkguGU7R41btypAnbG1NF5FJoNdBA |
| Hedhera | 0.0.10488092 |
Macheni ane regex coverage asi asina chinhu muwallet slots mu default config — Sei, IOTA, Kaspa, Flow, Nervos, Decred, Ravencoin, Beacon-Chain BNB — haatsiviwi zvakanyanya mu build iyi asi anowanikwa. Atore se monitoring scope pane substitution scope.
Hunhu & Kurudziro
Mushandirapamwe uyu une nzvimbo diki yekutsanangura. Hatina kukwanisa kusimbisa hunhu hwemushandisi. Zvatinogona kunyora:
- Metadata yemuparidzi. Akaunti yeNpm jaggle inoronga email yayo se olgascarlet@deltajohnsons.comNzvimbo iyi deltajohnsons.com Hazvina kutsanangura kuti kambani ingave yei sezvatinogona kuongorora. Akaundi ye npm hairatidzi kusimbiswa kweemail uye hapana SCM kusimbiswa. Hapana kuwanikwa kweGitHub kweveruzhinji kwakabatana.
- Munda wekuchengetedza zvinhu. The package.json haitore repository munda wepamutemo. npm:@juggle/resize-observer Mapoinzi ari panzvimbo chaiyo yeGitHub ine zviuru zvenyeredzi nematambudziko anoshanda. Kushaikwa kwenzvimbo yekubatanidza ndiyo nzira inokurumidza kuona pa npm UI.
- README kuba. Pakeji README ndiyo yepamutemo @juggle/resize-observer README byte-for-byte, kusanganisira imupota mienzaniso inotaura @juggle/resize-observer pachayo (kwete pasuru yekuburitsa). Mushandi haana kana kumbozvinetsa nekunyora patsva zvinhu zvakapinzwa - chiratidzo chakajairika chekuti readme yabviswa, haina kugadziriswa.
- Hapana zvivakwa zvekushandisa pazviri. Hapana C2 endpoint, hapana DNS lookup, hapana IP. Hunhu hwakashata hwacho hwakavharirwa zvizere mu clipper yemuno pamwe newallet bundle ine hard-coded. Izvi zvinoita kuti switching yakavakirwa padomain-kana ASN isashande. Vadziviriri vanotenderera muma campaigns vanofanira kufananidza wallets nechero clipper yavakamboshandisa; kushandiswazve kwewallet mumapakeji ndiyo nzira inonyanya kushandiswa pakurwisa.
- Sarudzo yemazita. @jaggle/resizeobserves hunhu humwe chete kubva pa @juggle uye kuchinja kumwe chete kubva pane zvinozivikanwa muoni wekuchinja saizi. Kugadzirisa-daro rakabatana imifananidzo miviri. Uku kugongana kwekuona nemaune, kwete kugonyana kwakajairika.
Chido, chakavakirwa pamaitiro ekubhadhara: kuwana mari chete kuburikidza nekutsiva clipboard nenzira yekuda. Hapana kukohwa marekodhi, hapana kutora mifananidzo yeminwe yemugamuchiri, hapana kuverenga kunochinja-chinja kwenharaunda. Mushandisi haana hanya kuti munhu akabatwa ndiani - vane hanya kuti munhu akabatwa anotamiswa pane imwe yekero dzakanyorwa. Kufukidzwa kwemakumi mana ndiyo modhi yerotari iri kushanda: cast wide, tarisiro kuti paste imwe chete ine mutengo wakakwira inowira kamwe chete paN installs.
Mushandisi anoita seasina hanya nekutora pasi. Kuburitsa mavhezheni mapfumbamwe mukati memaawa maviri pasi pechipimo chimwe chete chinoverengwa se "publish-and-burn handle": kuwedzera huwandu hwe "registry footprint" usati wasvika pakutora pasi, wobva waenderera mberi. Hatina kuona kuti "takedown" yasvika. Hatina kuona kuti "takedown" yasvika. @jaggle kuburitswa patsva pasi pechirongwa chitsva panguva yekunyora, asi taizotarisira kuti zviratidzike zvakafanana (@jaggie, @juggle-, @joggle) kuti zvionekwe mumazuva anotevera kana mushandi achiri kushanda.
Mhedzisiro, Maitiro & Zvinofanira Kuitwa Nevadziviriri
Impact
Kuyera kukosha kwemari chaiyo hakugoneki kubva padata razvino. Clipper hainyore telemetry uye mawallet haasati aonekwa achigamuchira mari yakachinjirwa kubva pakuchekwa kweongororo (kutsvagurudza kwecheni dzakanyorwa kuri pane yedu runyorwa). npm:@juggle/resize-observer paavhareji inosvika nhamba nomwe dzekudhawunirodha pasvondo — chinangwa chekunyora chinofambiswa nevanhu vakawanda — uye pasuru iyi yaivepo kwemaawa ari pasi pemakumi maviri nemana panguva yekuburitswa kwemashoko, izvo zvinoderedza huwandu hwevanhu vari kuburitswa asi hazvibvisi pachena.
Iyo blast radius yakakodzera kuteverwa haisi yekudhawunirodha zvakananga kubva @jaggle/resizeobserves — izvo zvingangoita zvidiki. Izvi **zvinogadziriswa zvinochinjika**: mugadziri ari kuwedzera pasuru kupurojekiti yesandbox, iri kushanda npm install, wobva wakanganwa kuti install hook yakamboshanda. Muchina wese wakagadzirisa postinstall ikozvino wava ne clipboard hijacker yemunhu wega wega pa auto-start, zvisinei nekuti purojekiti ichiri padiski here. Kubvisa package directory kubva node_modules hazvibvisi kuramba kuripo.
Emerging mapatani
Mafambiro maviri anoratidzwa nechirongwa ichi.
npm sePython-payload delivery wrapper. Iyo npm tarball inoisa mitsara mina; iyo chaiyo inoba iPython, yakaiswa system-wide na Pip kubva mudhairekitori rakaunganidzwa. Izvi hazvisi zvitsva - takamboona npm packages dzichidonhedza Python kare - asi zviri kuva chimiro chakajairika mumakwikwi e crypto-clipper. Zvakanakira mushandi zviri zviviri: Python clipboard libraries (pyperclip yekutanga pakati padzo) dzakachena uye dzakanyanya kupatsanurana kupfuura JavaScript yakafanana, uye ma scanners e-npm anoomesesa zvakanyanya anorema mafaira eJavaScript zvakanyanya uye Python .py mabundles zvishoma. Mutengo ndewekuti nzvimbo yekuisa yakakura zvikuru - itsva pip kuisa zvakaoma kuvanza pamuchina wekugadzira zvinhu usingawanzoiti pip kuisa munguva npm install.
Mazita echivanhu epuratifomu ndiwo ega akavanzika. Makambani akati wandei ekucheka machira neanoba zvinhu zvishoma munguva pfupi yapfuura akasiya zvachose kuvharika kwekodhi vachisarudza ma "persistence labels" anoita seari pamutemo. python3-dbus-helper, com.apple.python.runtime, uye PyRuntimeBroker mienzaniso yemabhuku ekudzidza — mazita ayo ziso remudziviriri richapfuura pane runyorwa rwemasevhisi makumi mana evashandisi. Iyi inzira isingadhuri uye inogara kwenguva refu yekuvanda: kubvisa pasi kunoitwa papakeji imwe neimwe, asi mafaira ekutsungirira anopona kubviswa, uye sevhisi yakatumidzwa zita rechikamu chepuratifomu chinotaridzika chaizvo haizocheneswi nechero chinhu kunze kwekuongorora kwakajeka.
Zvinofanira kuitwa nevadziviriri
- Ongorora ~/.config/systemd/user/, ~/Raibhurari/LaunchAgents/, uye Get-ScheduledTask Output pamichina yevagadziri vezvinyorwa zvakanyorwa muIOCs. Kubvisa npm package kunosiya izvi zviri panzvimbo; zvinofanira kubviswa nemaoko.
- Kutumirwa kweBlock kuenda kukero dzewallet dzakanyorwa pamiganhu yemakambani-treasury uye DeFi-wallet uko kune mvumo yekero inowanikwa.
- Tsvaga ~/.config/clipboard-guardian/config.json (uye zvakafanana nepuratifomu) muboka rese remainjiniya. Kuvapo kwefaira iri kunoratidza chivimbo chakawanda zvisinei nekuti nderipi package rayo rakatumirwa.
- Tsvaga node_modules/ clipboard_guardian/guardian.py mu "node_modules/" mumifananidzo ye build-cache inogona kunge yakatorwa kare. Md5 yefaira iyi yakagadzikana mune ese mavhezheni akaongororwa.
- Lockfile-pin @juggle/resize-observer (pakeji yepamutemo) saka kuiswa kwemangwana hakugone kugadzirisa chero chimwe chinhu pasi pemhando imwe chete, kunyanya mumabasa ekushanda asina kuvharwa se npx.
- Bata chero npm postinstall ichikoka pip install sekurwadziwa kukuru mukuvaka-pipeline mutemo. Hapana chikonzero chepamutemo chekuti package ye npm ide pip panguva yekuisa - Python tooling inogovera Python tooling.
- Tsvaga data rekutarisa rinoenderana ne process_iter() remaitiro anonzi python3-dbus-helper anopinza pyperclip — kusawirirana kwemavara echinyakare (mubatsiri weD-Bus akabata raibhurari ye clipboard) ndicho chiratidzo chehunhu chakachena chatinacho.
- Tenderedza kero dzewallet dzakanamirwa kubva kumashini ane utachiona. Chinhu chinobvisa mapikicha emakombiyuta chinokanganisa nzira iri pakati pewallet UI nepaste target; kero dzakakopwa dzichiri nehutachiona dzinogona kuchinjwa chinyararire. Chero chinhu chinotumirwa panguva yehutachiona chinofanira kutorwa sechisina kurongeka.
Chidzidzo: kuramba uchitsungirira kunorarama kupfuura kubviswa. Registry ichapedzisira yabviswa @jaggle/resizeobserves mushanduro dzese pfumbamwe; systemd unit, LaunchAgent, uye Scheduled Task hazvizozvibvisi pachazvo.
References
- @juggle/resize-observer pa npm — pasuru yepamutemo iyo iyi typosquat inotevedzera; inobatsira senzira yekutanga yekubata-bata kwe byte-for-byte README.
- @jaggle/resizeobserves metadata yerejistri — buritsa nguva dzemavhezheni mapfumbamwe ane hukasha, zvinobatsira pakunyora nguva dzezvemhosva.
