TL, DR
2026-05-21, daabacaha npm jaggle sagaal nooc ayaa la sii daayay (1.0.0 iyada oo loo marayo 1.0.8) of @jaggle/resizeobserves daaqad qiyaastii laba saacadood ah.
Xirmadu waa qoraal khaldan oo ku saabsan qoraalka sharciga ah @juggle/resize-observer polyfill — xirmo si ballaaran loo isticmaalo oo leh malaayiin soo dejin toddobaadle ah — laakiin ma soo dirto hirgelinta ResizeObserver ee dhabta ah.
Taa beddelkeeda, xirmada jillaab ka dib rakibidda wuxuu rakibaa Python lacag-bixin ah oo la isku daray, wuxuu diiwaangeliyaa adkeysi ahaan inuu yahay dilaal u eg waqti-socod oo u eg madal, wuxuuna adeegsadaa afduube clipboard ah oo isku-dhafan oo bartilmaameedsanaya macaamillada cryptocurrency.
Linux adkaysigu wuxuu u muuqdaa sidii python3-dbus-helper, macOS as com.apple.python.runtime, Iyo Windows as PyRuntimeBroker.
Culaysku si joogto ah ayuu ula socdaa sanduuqa loogu talagalay cinwaanada boorsada jeebka ee ku yaal dhammaan in ka badan 40 blockchains oo si aamusnaan ah ugu beddelaya cinwaanada la koobiyay boorsooyinka ay weerarku xakameeyaan.
Malware-ku wuxuu si buuxda uga shaqeeyaa maxalli ahaan iyada oo aan lahayn kaabayaal dibadda ah oo C2 ah, taasoo ka dhigaysa beddelka clipboard-ka inuu yahay habka nadiifinta.
IOC-ga aasaasiga ah waa magaca xirmada laftiisa: @jaggle/resizeobserves — fiiri shaqalka la tuuray ee ku jira "jaggle" iyo "s" lagu daray "resizeobserves".
Darnaanta: sare.
Weerarkii: Sida uu u Shaqeeyo
npm:@jaggle/resizeobserves uma eka malware-ka ku jira qaab caadi ah aragtida npm. Its AKHRISO.md waa README-ka dhabta ah ee npm:@juggle/resize-observer — isla tusaalooyinka koodhka, tilmaamaha isticmaalka isku mid ah, isku mid ah soo dejiso { ResizeObserver } laga bilaabo '@juggle/resize-observer' Tixraacyada oo dhan. Xidhitaanka xogta aad ayuu u dhammaystiran yahay oo qof kasta oo fiirinaya dukumentiyada wuxuu u qaadan doonaa inuu akhrinayo dukumentiyada saxda ah ee xirmada.
The xirmo.json, marka la barbardhigo, waa yar tahay: maya boodh goob, hal waxaan ahay gelitaanka oo tilmaamaya qashin/clipboard-guardian.js, Oo ah postinstall qoraal socda nood npm-install.jsTusaalooyinka "Isticmaalka aasaasiga ah" ee README waxay tilmaamayaan hirgelinta JavaScript oo aan meelna ka jirin kubbadda tarball-ka. JavaScript-ka kaliya ee ku jira xirmada waa qoraalka rakibidda.
Marxaladda 1 - rakibidda npm kadib rakibidda bootstraps iyo Python payload
npm-install.js waa mid ka warqaba madal. Waxay heshaa howlfiican fulin kara waddo raadin go'an (/usr/bin/pip3, /usr/maxalli/bin/pip, dib ugu noqoshada pip-ka python3-m), wuxuu ku rakibayaa xirmada Python ee la xirxiray ee ka timid tusmada tarball-ka, iyo - Linux - wuxuu soo jiidanayaa xaydasho or xsell via apt-get, pacman, ama dnf haddii midkoodna uusan hore u jirin:
Isticmaalka - xirmooyinka nidaamka-jebinta waa mid ula kac ah: qaybinta casriga ah ee Linux waxay soo saartaa Python iyadoo la adeegsanayo calaamadda deegaanka ee PEP 668 ee si dibadda ah loo maamulo, taas oo xannibaysa rakibidda pips-ka goobta oo dhan si caadi ah. Qoraalka rakibiddu wuxuu ku qasbayaa rakibidda inay dhex marto.
Qoraalku sidoo kale waa mid sudo-aware. Marka uid-ku shaqeynayo uu yahay natiijada rakibidda sudo npm, qoraalka ayaa akhrinaya SUDO_USER iyo madaafiic lagu soo tuuro hel passwd si aad u hesho dhabta ah tusaha guriga ee isticmaalaha, ka dibna wuxuu faylalkiisa joogtada ah ku qoraa halkaas halkii uu ku qori lahaa / xididkaJoogteyntu waa isticmaale kasta, ee ma aha nidaamka oo dhan.
Marxaladda 2 - Joogtaynta iskutallaabta OS ee hoos timaada magacyada dilaalka waqtiga-run-ka
Ka dib marka la rakibo xirmada Python, qoraalku wuxuu diiwaangeliyaa gelitaan otomaatig ah oo magac kale ku qoran nidaam kasta oo hawlgal ah:
- Linux - cutub isticmaale nidaamsan oo ku yaal ~/.config/systemd/user/python3-dbus-helper.serviceCutubka Description is Caawiyaha Waqtiga Runtime ee Python D-BusQoraalku wuxuu sidoo kale isku dayaa inuu awood u siiyo iyada oo loo marayo systemctl –user awood u yeelo, dib ugu noqoshada xiriir gacan-ku-dhig ah oo hoos yimaada default.target.wants/ marka systemctl uu guuldareysto. Haddii uu ku shaqeynayo sudo, qoraalka ayaa isu beddelaya sudo -u systemctl -user, la XDG_RUNTIME_DIR u deji si wicitaanka baska isticmaalaha uu u shaqeeyo.
- macOS - liiska LaunchAgent ee ~/Maktabad/LaunchAgents/com.apple.python.runtime.plist la RunAtLoad=run iyo Hayso Nolol = run, ka dibna lagu soo raray iyada oo loo marayo load launchctl.
- Windows — Hawsha la qorsheeyay oo la yiraahdo PyRuntimeBroker, ayaa kicisay AtLogOn, iyadoo waqtiga fulinta uu yahay eber (tusaale ahaan, waqti ma dhammaanayo), oo laga diiwaan geliyay PowerShell.
Saddexda magacba waa la isku halleyn karaa marka la eego. python3-dbus-helper waxay raacdaa xeerka magacaabista ee isdhexgalka Python-D-Bus ee saxda ah ee desktop-yada Linux. com.apple.python.runtime Waxay ku dayataa calaamadaynta dib-u-celinta DNS ee Apple adeegyadeeda u gaarka ah. PyRuntimeBroker waxay u egtahay Windows-yada RuntimeBroker.exe — adeeg Microsoft oo dhab ah oo la saxiixay oo dilaaliinta u oggolaanaya codsiyada barnaamijyada UWP. Midkoodna adeegyada Apple/Microsoft/Python dhab ah ma aha marka la eego xaaladdan, laakiin difaac ayaa sameynaya baaritaan muuqaal ah oo degdeg ah systemctl -user list-units or Hawsha la qorsheeyay uma badna inuu leexdo.
Marxaladda 3aad — Afduubaha clipboard-ka
Culayska Python-ka, oo lagu rakibay clipboard_guardian/guardian.py, wuxuu ku shaqeeyaa wareeg aan dhammaad lahayn oo codeynaya clipboard-ka nidaamka 400 millisecond kasta. Calaamad kasta, waxay soo jiidataa waxa ku jira clipboard-ka hadda jira iyada oo loo marayo pyperclip.paste() waxayna ku socotaa liis ka kooban afartan iyo ka badan oo tibaaxo joogto ah oo hore loo diyaariyey oo daboolaya qaababka cinwaanka boorsada ee Ethereum, Bitcoin, Monero, Solana, TRON, TON, Ripple, Litecoin, Dogecoin, Polkadot, NEAR, Cosmos, Algorand, Stellar, Cardano, Bitcoin Cash, Dash, Zcash, Aptos, Sui, Tezos, MultiversX, Harmony, Terra, Injective, Osmosis, Kava, Celestia, Nano, Filecoin, Ronin, Ergo, DigiByte, Hedera, BNB Smart Chain, iyo dhowr kale oo aan la hubin laakiin ku jira qaab-dhismeedka caadiga ah (Sei, IOTA, Kaspa, Flow, Nervos, Decred, Ravencoin).
Marka ciyaartu dhacdo, qoraalka ayaa akhrinaya cinwaanka weeraryahanka ee silsiladdaas laga soo bilaabo ~/.config/clipboard-guardian/config.json (ama wax u dhigma goobta) oo ku beddel qoraalka la beddelay:
Ma jiro hab-maamuuska shabakadda. Qalabka jarista ma soo waco guriga, ma diiwaan geliyo martigeliyeyaasha cudurka qaba, waxba ma soo saaro. Qalabka shubista ayaa ah beddelka laftiisa: marka isticmaaluhu uu nuqul ka sameeyo cinwaanka qaataha ee ku jira UI-ga boorsadiisa oo uu ku dhejiyo wadahadal dirista, cinwaanka la dhejiyay waxaa iska leh hawlwadeenka. Lacagaha waxaa lagu lumiyaa gudaha, si cadna waxaa ugu jira isticmaalaha.
Maxaa cusub halkan
Faahfaahin yar ayaa ka soocan marka la barbar dhigo qaabka guud ee loo yaqaan 'crypto-clipper template':
1. npm → Python crossover. Inta badan qalabka loo yaqaan 'crypto-clippers' ee aan ku aragno npm waa JavaScript saafi ah, oo inta badan lagu qariyo _0x wareegga safka ama eval(atob(…)) is dulsaar. Tusaalahan wuxuu u adeegsadaa kubbadda npm sidii wax aan ka badnayn duub gaarsiinta baakadka Python - Python nadiif ah - wuxuuna u oggolaanayaa pip inuu qabto ku tiirsanaanta (pyperclip, psutil, ikhtiyaari ah setproctitle) lagu sheegay liiska pyproject.tomlMa jirto wax JavaScript ah oo laga adkaan karo. Qalabka jarista laftiisu waa Python oo la akhrin karo.
2. Calaamadaha ku-adkeysiga Tri-OS ee loo doortay si loo suurogeliyo. Rakibayaal badan oo isdhaafsi ah ayaa diiwaangeliya adkeysi iyagoo hoos yimaada magacyo guud (cusbooneysiinta.adeeg, caawiye.plist) Tusaalahan wuxuu dhib ku qabaa in la doorto calaamado u eg dilaaliinta waqtiga-dhabta ah ee ku jira OS kasta. Magacaabista waa isku dayga kaliya ee qarsoon - ma jiro rootkit, ma jiro qarin dhul isticmaale, ma jiro xannibaad waddo. Sharadka ayaa ah in difaacayaashu ay dhif tahay inay baaraan. ~/.config/systemd/user/ iyo in adeeg la yiraahdo python3-dbus-helper dib u eegis aan caadi ahayn kuma soo bixi doono.
3. Qarsoodiga cinwaanka geeddi-socodka waa mid dhab ah, laakiin ka-hortagga falanqayntu waa mid aan firfircoonayn. Culayska Python wuxuu qeexayaa _qaab_u-qarin() shaqo dejisa cinwaanka habka iyada oo loo marayo setproctitle (Linux/macOS) ama SetConsoleTitleW (Windows) - iyo ugu weyn () way u yeertaa. Markaa ps aux muujin doonaa python3-dbus-helper halkii Python3 …/guardian.pySi kastaba ha ahaatee, isla module-ka ayaa qeexaya is_monitor_running() shaqo tirinaysa aaladaha la yaqaan ee la socodka habka (htop, btop, Maareeyaha Hawsha, Kormeeraha Hawlaha, Hacker-ka Habraaca, Kormeeraha Kheyraadka, Kormeerayaasha nidaamka GNOME / KDE / Xfce / MATE, iyo wixii la mid ah) — iyo ugu weyn () Weligaa ma soo wicin. Wareegga beddelka ah wuxuu si shuruud la'aan ah u shaqeeyaa, haddii isticmaaluhu leeyahay kormeere habraac oo furan iyo haddii kaleba. Hawshu waa kood aan shaqaynayn nooca la soo diray. Waxay u badan tahay inay ka hartay soo noqnoqoshadii hore, ama qaab-dhismeed loogu talagalay muuqaal aan weli la isku xidhin. Si kastaba ha ahaatee, dusha sare ee falanqaynta ee la daabacay ee lacagta badan waa hal magac oo loo beddelayo habka, maaha ka-baxsiga kormeeraha firfircoon.
4. Hab-dhaqanka isku-dhafka habaynta ee la isku daray. npm-install.js wuxuu qoraa liiska boorsada caadiga ah ~/.config/clipboard-guardian/config.json iyo, haddii faylka habaynta uu hore u jiray, wuxuu ku milmaa fure kasta oo qiimahiisu madhan yahay. Taas macnaheedu waa isticmaale hore u qaaday cudurka oo qayb ahaan nadiifiyay habaynta - tusaale ahaan, isagoo faarujinaya ethereum qiimaha — ayaa dib u buuxin doona rakibid kasta oo ku xigta oo ah xirmada xaasidnimada leh. Ma jiro nadiifin faylka joogtada ah ee dariiqa koodka.
| Taariikh / Waqtiga (UTC) | Event |
|---|---|
2026-05-21 18:50:32 | @jaggle/resizeobserves@1.0.0 la daabacay. |
2026-05-21 19:55:55 | 1.0.1 la daabacay - noocii ugu horreeyay oo lagu calaamadeeyay sawir-qaadis dibadeed. |
2026-05-21 19:58:10 | 1.0.2 la daabacay. |
2026-05-21 20:05:03 | 1.0.3 la daabacay. |
2026-05-21 20:09:24 | 1.0.4 la daabacay. |
2026-05-21 20:13:48 | 1.0.5 la daabacay. |
2026-05-21 20:41:52 | 1.0.6 la daabacay. |
2026-05-21 20:43:56 | 1.0.7 la daabacay - waxay ku daraysaa try/catch duub ku wareegsan qaabka boorsada jeebka ah tallaabo qor npm-install.js. |
2026-05-21 20:46:15 | 1.0.8 la daabacay — rakibaha oo dib loo magacaabay npm-install.js → npm-install.cjs (baakad isku mid ah). |
2026-05-22 | Xukunnada iyo IOC-yada la daabacay. Noocyadu wali waxay ku jiraan diiwaanka waqtiga daabacaadda (waa socotaa). |
Sagaal nooc oo hal saac iyo konton iyo lix daqiiqo gudahood ah ayaa dhakhso badan xitaa haddii qoraalka khaladka ah la isticmaalo. Qaabku wuxuu la jaan qaadayaa ololaha daabacaadda iyo gubista — diiwaanka ku shub hal gacan, u ogolow ogaanshaha inuu jiho u maro, oo u gudub gacan cusub marka hal nooc laga saaro. Meelaha la arki karo ee socda oo dhan waa kuwo qurux badan: 1.0.1 lagu daray si cad /usr/bin/pip3-qaab-dhismeedyada liiska raadinta pip (sudo-compatibility), 1.0.7 wuxuu ku duubay qoraalka boorsada-qaabaynta isku day/qabasho, iyo 1.0.8 wuxuu u beddelay rakibaha laga bilaabo .js ilaa .cjs iyadoo qoraalladeeda ay isku mid yihiin. .cjs dib u magacaw raadadka iyadoo la adeegsanayo digniino npm ah oo ku saabsan xallinta moduleka aan caddayn ee baakadaha iyada oo aan si cad loo qeexin "nooca" goobta, waxayna noqon kartaa isku day lagu xakameynayo buuqa waqtiga rakibidda kaas oo soo jiidan kara dareenka. Culayska Python - qaybta kaliya ee dhab ahaantii xadda - isma beddelin sagaalka nooc.
Tilmaamayaasha Tanaasulka
Baakado
| deegaanka | Xidhmada | versions | Xaaladda |
|---|---|---|---|
| shm | @jaggle/resizeobserves | 1.0.0 iyada oo loo marayo 1.0.8 | Toos u ah daabacaadda; la codsaday in laga saaro. |
Faylasha & Xashiishka
| Jidka | Notes |
|---|---|
clipboard_guardian/guardian.py(md5 f7935c2c82bc881288611ab6cd634f17) | Isku mid ah dhammaan sagaalka nooc ee la daabacay (1.0.0 iyada oo loo marayo 1.0.8). Culayska goynta. |
npm-install.js (1.0.0 – 1.0.7)npm-install.cjs (1.0.8) | Rakibaye joogtayn ah; dhaqan isku mid ah oo dhammaad ilaa dhammaad ah. 1.0.7's .js iyo 1.0.8's .cjs waa isku mid. |
~/.config/clipboard-guardian/config.json | Qaabeynta joogtada ah ee Linux iyo xirmo boorso. |
~/Library/Application Support/clipboard-guardian/config.json | Qaabeynta joogtada macOS iyo xirmo boorso. |
%APPDATA%\clipboard-guardian\config.json | Qaabeynta joogtada Windows iyo xirmo boorso. |
~/.config/systemd/user/python3-dbus-helper.service | Joogteynta otomaatiga ah ee Linux. |
~/Library/LaunchAgents/com.apple.python.runtime.plist | Joogteynta macOS LaunchAgent. |
~/Library/Logs/com.apple.python.runtime.log | log macOS stdout/stderr ee wakiilka. |
Scheduled Task PyRuntimeBroker | Shaqada otomaatiga ah ee Windows-ka (AtLogOn, waqti nasasho ma jiro). |
Tilmaamayaasha Dhaqanka
| signal | Description |
|---|---|
pip install --break-system-packages laga bilaabo npm postinstall | Rakibaadda Python ee goobta oo dhan waxay ku qasabtaa inay dhaafto ilaalinta PEP 668. |
apt-get install -y xclip (ama pacman/dnf) | Ku rakib adeegyada kumbuyuutarrada Linux inta lagu jiro rakibidda xirmada. |
python3-dbus-helper.service cutubka isticmaalaha nidaamka | Adkaysigu wuxuu ku diiwaan gashan yahay magac caawiye runtime ah oo u muuqda mid macquul ah. |
com.apple.python.runtime LaunchAgent | Calaamadda joogtada ah ee ka baxsan waddooyinka nidaamka Apple ee sharciga ah. |
PyRuntimeBroker Hawsha Jadwalsan | Adkeysiga dilaalka Windows-ka ee been abuurka ah oo aan lahayn ilo rakibe oo sharci ah. |
Habka Python oo cinwaan looga dhigay python3-dbus-helper soo dejinta pyperclip iyo psutil | Is-waafaq la'aanta dhaqanka ee u dhaxaysa magaca habka la soo bandhigay iyo maktabadaha la soo dhoofiyay. |
| Saxanka qoraalka ayaa isbeddela ~0.4s ka dib nuqulka cinwaanka boorsada | Dhaqanka saxiixa ee beddelka cinwaanka cryptocurrency. |
Xirmada boorsada weerarka (liiska ugaarsiga difaaca)
Liiska boorsada waxaa lagu soo bandhigayaa si adag oo codaysan npm-install.js iyo clipboard_guardian/guardian.py. Difaacayaashu waxay u isticmaali karaan liiska labadaba liis xannibaad ah (ula dhaqmi karaan wixii wareejin ah ee cinwaanadan laga soo qaado boorsooyinka shirkadaha sidii wax laga shakiyo) iyo furaha ugaarsiga (u daawee joogitaanka mid ka mid ah xargahan faylka habaynta aan la xaqiijin, dhismaha farshaxanka, ama mashiinka horumariyaha sida tilmaame caabuq).
Xirmada boorsada weerarka
| Chain | Cinwaanka |
|---|---|
| Ethereum / BSC | 0x450c0E58Fc2ba03632d3F5780ad8C966648B6F18 |
| Ronin (EVM) | ronin:450c0E58Fc2ba03632d3F5780ad8C966648B6F18 |
| Bitcoin | bc1qs2mpls4p0f7fng073gy2rcdgjpf7la4eugpt6y |
| Bitcoin Cash | bitcoincash:qqmvyxxklzp7l3eslxavhc8phl6hprdf25lwc29nlt |
| Litecoin | ltc1qnefc8x59a9cwtqnflt8hmqvezqw4hc7lt3fkqe |
| Dogecoin | DNEJmYRZtzyK44tZea4S7wV3otTyRk48Fy |
| Dash | XtJ7E6mnhPK93Vib29PGQrTmQjhTTqFwbS |
| Zcash | t1d4hcEnBjdh9X6Wb6R2dxqjnxddJ6ocP8M |
| DigiByte | DPmH2dhiGK3hk3A69tZUMz6tHzGFHBzSrH |
| Monero | 42zhAidVhP7QETk83JAspS59ASALSHFio44vmu6MdDCz15cSqtqsG4QVyzY8vTrjGrTEA6zMbWW6Yft1Ynz1xLfCN5FVbXf |
| Solana | DWBAmQLi9gP6mk7UfJfQGYTV1UPK32WekLTqg83q1mc5 |
| TRON | TVgEgMemmJABYYnbNr1Wi8bSgADEkdEBt2 |
| TON | UQDTSkvwmptU9eG988KgxS3WjnYAZlXgfpJxnz4mhWZAvULr |
| Ripple | r9tj3cMCiqRijNYqNVYNuwKykkQfS8FE4H |
| polkadot | 1JSkYqXQE4d28HdcmTPhbgCrdiPFTfSHxD67tam16p53oBG |
| NEAR | 5d6aec44551529e8cd9ebd3aaa84b3832fc3c7463596b2b6e72635b80096a364 |
| Cosmos | cosmos1pzfl3kv5g8g0ernj86rwpar08u2zl9suthx28e |
| ingriiska | osmo1pzfl3kv5g8g0ernj86rwpar08u2zl9surv463t |
| Celestia | celestia1pzfl3kv5g8g0ernj86rwpar08u2zl9su6ah6a5 |
| Durid | inj1g5xquk8u9wsrvvkn74uq4kxfvejgkmccn578gh |
| Kava | kava1kjfvgcz4q0y9yae2f3pa33vhj2estxxj3sqqux |
| Harmony | one19hn0n7dzkhtl9ta9ekv5592s85jwstpka76t3a |
| Terra | terra1h0dwu8z405jagdlr0fgr9jllac2sxajzlgme5x |
| Algorand | XSAMN3FTB5SUHUQFENBDDRXIMOPNFVLKAWA3RNOU54DWROMDZ6SR7DZ2PI |
| Dhalinyaro | GACNZSV4EQO65NZZUOBS3TMJM7GFTSRNKQBVJOX5P2G7U7SEBQ2ZUDJE |
| Cardano | addr1qyj050vla4cglmyrgm4vzf3dxtn0gynpks4t7vp7s3lg49e9wt0s94hcztzdgecxcz5hu9uk56q60yth6d66w026s2kq3ma56f |
| MultiverseX | erd1slvlgqsmwzk0c8xtksm4eq5vdfnc26slpzqsyxhz456zvme5rpasue6ge0 |
| ku habboon | 0x580ecda1ebd6ca5a46be2097568d013308bd54ef1d147acb880b59f7709f280e |
| Sui | 0xf7e8a9a970fa65c058745c4b2cf2a856cc0283863e4ed1e142648f26097b0c78 |
| nano | nano_393n56a5pfz8zg3nkzf7mytfgagzhu5mn9i3xiqg54weq8n1u8jgezxas7dn |
| Faylasha | f1fypyww3xubopfnv7q6yh5l4bko44wmfktf3ckui |
| Tezos | tz1RccjnorHk61bt73ArLXcdgFjEj6T1ochk |
| Ergo | 9g1pNQGnFg7Hk1d9Z66bgHMkguGU7R41btypAnbG1NF5FJoNdBA |
| Hedera | 0.0.10488092 |
Silsiladaha leh daboolka regex laakiin boosaska jeebka madhan ee ku jira qaab-dhismeedka caadiga ah — Sei, IOTA, Kaspa, Flow, Nervos, Decred, Ravencoin, Beacon-Chain BNB — si firfircoon looguma beddelo dhismahan laakiin waa la ogaadaa. Ula dhaqan sida baaxadda kormeerka halkii aad ka ahaan lahayd baaxadda beddelka.
Tilmaamaha iyo Dhiirigelinta
Ololaha wuxuu bixiyaa dusha sare ee sifeynta khafiifka ah. Ma aanan awoodin inaan xaqiijino aqoonsiga hawlwadeenka. Waxa aan duubi karno:
- Xogta macluumaadka daabacaha. Akoonka npm jaajuus liiska emailkiisa sida olgascarlet@deltajohnsons.comDomain-ka deltajohnsons.com kuma xalliso aqoonsi shirkadeed waan xaqiijin karnaa. Akoonka npm ma muujinayo xaqiijin iimayl mana muujinayo maya SCM xaqiijin. Ma jiro joogitaan dadweyne oo lala xiriirinayo GitHub.
- Goobta Kaydka. The xirmo.json maya ayuu sitaa boodh goobta. Sharciga ah npm:@juggle/resize-observer Waxay tilmaamaysaa kayd GitHub oo dhab ah oo leh kumanaan xiddigood iyo arrimo firfircoon. Maqnaanshaha isku xirka kaydka ayaa ah muuqaalka ugu dhaqsaha badan ee ku jira UI-ga npm.
- KA QAADASHADA README. Xirmada README waa mid sharci ah @juggle/dib u cabbir-kormeer README byte-for-byte, oo ay ku jiraan dejinta tusaalooyin tilmaamaya @juggle/dib u cabbir-kormeer laftiisa (ma aha xirmada daabacaadda). Hawlwadeenku xitaa ma uusan dhibin inuu dib u qoro waxyaabaha la soo dejiyo - calaamad caadi ah oo muujinaysa in akhriska la qaaday, aan la habayn.
- Ma jiraan kaabayaal dhaqaale oo la beddeli karo. Ma jiro dhammaadka C2, ma jiro raadinta DNS, ma jiro IP. Dhaqanka xaasidnimada leh wuxuu si buuxda ugu xiran yahay jarista maxalliga ah iyo xirmada boorsada adag ee lambaraysan. Tani waxay ka dhigaysaa rogrogmada ku salaysan domain-ka ama ASN mid aan la heli karin. Difaacayaasha ku wareegaya ololaha waa inay ku dhejiyaan boorsooyinka marka loo eego jarista hore ee ay ku hayaan faylka; dib u isticmaalka boorsada baakadaha waa isku xirka ololaha ugu badan ee la kala saari karo.
- Doorashada magacyada. @jaggle/dib u habeyn cabbirkooda hal xaraf ayaa ka baxsan @juggle iyo hal isbeddel oo ka yimid kuwa caanka ah cabbir-kormeerahaMasaafada tafatirka ee isku dhafan waa laba sawir oo muuqaal ah. Kani waa isku dhac muuqaal ah oo ula kac ah, ee maaha isku-dhac guud.
Dhiirigelin, oo ku salaysan hab-dhaqanka culayska: lacag-ururin saafi ah iyada oo loo marayo beddelka shaashadda fursad-u-helidda. Ma jiro wax-soo-ururin aqoonsi, ma jiro faraha martida loo yahay, ma jiro wax-akhris isbeddel deegaan ah. Hawl-wadeenku dan kama laha cidda dhibbanaha ah - waxay danaynayaan in wareejinta xigta ee dhibbanaha ay calaamadiso mid ka mid ah cinwaanada liiska ku jira. Daboolidda afartan silsiladood waa qaabka bakhtiyaa-nasiibka ee ficilka ku jira: ballaaran, waxaan rajeynayaa in hal koollo qiimo sare leh uu soo dego hal mar rakib kasta oo N ah.
Hawl-wadeenku wuxuu u muuqdaa mid aan dan ka lahayn soo saarista. Daabacaadda sagaal nooc laba saacadood gudahood iyadoo la adeegsanayo isla mashiinnada waxay u muuqataa sidii gacan daabacan oo gubasho ah: kor u qaad raadadka diiwaanka ka hor inta uusan soo gaarin daahitaanka soo dejinta, ka dibna sii wad. Ma aanan arag @jaggle dib-u-daabacaadda iyadoo la adeegsanayo qaab cusub wakhtiga qorista, laakiin waxaan filan karnaa muuqaallo u eg (@jaggie, @juggle-, @soggle) inuu soo muuqdo maalmaha soo socda haddii hawlwadeenku wali shaqeynayo.
Saamaynta, Isbeddellada & Waxa ay Difaacayaashu Sameyn Karaan
Saameynta
Saamaynta tirinta lacagta dhabta ah suurtagal maaha xogta hadda jirta. Qalabka jarista ma qoro telemetry-ga, boorsooyinkana weli lama arag iyagoo helaya wareejin beddel ah ilaa dhammaadka falanqaynta (tijaabin dabagal ah oo silsiladaha liiska ku jira ayaa ku jira liiskayaga). npm:@juggle/resize-observer Celcelis ahaan waxay si fiican u soo dejistaan toddobo tiro oo toddobaadle ah - bartilmaameedka taraafikada oo aad u badan - xirmada xaasidnimada ahna waxay shaqeyneysay wax ka yar 24 saacadood markii la shaaciyay, taas oo xaddidaysa dadka la soo bandhigay laakiin aan eber ahayn.
Qalabka qaraxa ee u qalma in la raaco ma aha mid si toos ah loo soo dejisto @jaggle/dib u habeyn cabbirkooda — kuwaas waxay u badan tahay inay yar yihiin. Waa **rakibaad ku-meel-gaar ah**: horumariye ku daraya xirmada mashruuc sanduuq ciid ah, oo socodsiinaya rakibaadda dharka, ka dibna waxaan ilaaway jillaabkii rakibidda ee waligiis socday. Mashiin kasta oo farsameeyay postinstall hadda wuxuu leeyahay afduube clipboard ah oo isticmaale kasta ku jira oo ku jira bilawga otomaatiga ah, iyadoon loo eegin haddii mashruucu wali ku jiro diskka. Ka saarista tusmada baakadaha laga bilaabo node_modules ma **ma ** ka saarto adkeysiga.
Qaababka soo baxaya
Laba isbeddel ayaa tusaale u ah ololahan.
npm oo ah duubista keenista Python-payload. Kubbadda npm waa rakibe 4-xariiq ah; xatooyada dhabta ah waa Python, oo lagu rakibay nidaamka oo dhan howlfiican laga soo bilaabo buugga la xirxiray. Tani ma aha mid cusub - waxaan aragnay xirmooyinka npm oo hoos u dhigaya Python ka hor - laakiin waxay noqoneysaa qaab la cabbiri karo oo caadi ah ololaha crypto-clipper. Faa'iidada uu u leeyahay hawlwadeenka waa laba qaybood: Maktabadaha Python clipboard (pyperclip marka hore iyaga ka mid ah) waa kuwo ka nadiifsan oo ka badan kuwa u dhigma JavaScript, iyo Iskaan-qaadayaasha npm-ka ee ugu otomaatiga ah ayaa miisaan culus ku leh faylasha JavaScript iyo Python .py si khafiif ah u xidhxidh. Qiimaha ayaa ah in raadadka rakibiddu ay aad u qaylo badan yihiin - cusub pip rakibid way adag tahay in lagu qariyo mashiinka horumariyaha oo aan caadiyan sameynin pip rakibid inta lagu guda jiro rakibaadda dharka.
Magacyada asalka ah ee madal-ku waa qarsoodiga kaliya. Dhowr farsamoyaqaanno dhawaan la jarjaray iyo kuwa xaday alaab yar yar ayaa gebi ahaanba ka tanaasulay qarixii heerka koodhka iyagoo u janjeera calaamadaha joogtada ah ee u muuqda kuwo sharci ah. python3-dbus-helper, com.apple.python.runtime, Iyo PyRuntimeBroker waa tusaalooyin buug-gacmeed - magacyada indhaha difaacaha ayaa ka boodi doona liiska afartan adeeg oo isticmaale ah. Kani waa qaab qarsoodi ah oo raqiis ah oo waara: ka saarista waa xirmo kasta, laakiin faylasha joogtada ah waxay ka badbaadaan ka saarista, adeegga loogu magac daray qayb madal oo muuqaal dhab ah lehna laguma nadiifin doono wax aan ahayn baaritaan cad.
Waxa ay tahay in difaacayaashu sameeyaan
- Hantidhawrka ~/.config/systemd/user/, ~/Library/LaunchAgents/, iyo Hawsha Jadwalka wax soo saarka mashiinnada horumariyayaasha ee qoraallada ku qoran IOC-yada. Ka saarista xirmada npm waxay ka dhigaysaa kuwaan meelahooda; waxay u baahan yihiin in gacanta laga saaro.
- Jooji wareejinta cinwaanada boorsada liiska ku qoran xuduudaha khasnadaha shirkadaha iyo boorsada DeFi halkaas oo liiska ogolaanshaha cinwaanada laga heli karo.
- U raadi ~/.config/clipboard-guardian/config.json (iyo wax u dhigma madal) oo dhan qalabka horumariyaha-mashiinka. Joogitaanka faylka waa caabuq kalsooni sare leh iyadoon loo eegin nooca xirmada ee uu keenay.
- Ka raadi node_modules/ si aad u hesho clipboard_guardian/guardian.py Sawirrada dhidibka-kaydinta ee laga yaabo inay ka horreeyaan qaadista. md5-ka faylka waa mid deggan dhammaan noocyada la eegay.
- Biin-xariiq-xariiq @juggle/dib-u-hagaajin-observer (xirmada sharciga ah) sidaa darteed rakibidda mustaqbalka ma xallin karto wax kale oo ku hoos jira nooc khaldan oo hal xaraf ah, gaar ahaan shaqooyinka aan faylka qufulka lahayn sida npx.
- Ku daawee wixii npm postinstall ah ee soo wacaya rakibidda pip sida darnaanta sare dhismaha-pipeline siyaasadda. Ma jirto sabab sharci ah oo xirmada npm loogu baahan yahay pip waqtiga rakibidda — Qalabka Python wuxuu qaybiyaa qalabka Python.
- Raadi process_iter()-xogta la socodka ee la barbar dhigi karo ee hababka loogu magac daray python3-dbus-helper ee soo dejiya pyperclip — is-waafaqla'aanta qarsoon (kaaliyaha D-Bus oo haya maktabad sawireed) waa tilmaameha dhaqanka ugu nadiifsan ee aan haysanno.
- Wareeji cinwaanada boorsada jeebka ee laga dhejiyay mashiinnada cudurka qaba. Afduubaha shaashadda ayaa khalkhal geliya waddada u dhaxaysa UI-ga jeebka iyo bartilmaameedka koobiyeynta; cinwaannada la koobiyeeyay inta uu cudurka ku dhacay waxaa laga yaabaa in si aamusnaan ah loo beddelo. Wax kasta oo la diro inta lagu jiro daaqadda caabuqa waa in loola dhaqmo sidii kuwo si khaldan loo hago.
Qodobka la qaadanayo: adkaysigu wuu ka cimri dheer yahay ka saarista. Diiwaanku ugu dambeyntii wuu ka saari doonaa @jaggle/dib u habeyn cabbirkooda dhammaan sagaalka nooc; cutubka nidaamka, LaunchAgent, iyo Hawsha Jadwalka leh isma saari doonaan.
tixraacyada
- @juggle/dib u cabbir-observer marka aad ku jirto npm — xirmada saxda ah ee qoraalkan khaldan uu iska dhigo; waxtar u leh saldhig u ah byte-for-byte README.
- @jaggle/resizeobserves xogta diiwaanka — daabac shaambooyinka waqtiga ee sagaalka nooc ee xaasidnimada leh, oo waxtar u leh jadwalka baaritaanka dambiyada.
