TL; DR
Phakathi komhla woku-1 ku-Epreli kunye nomhla wesi-3 kuMeyi 2026, umshicileli omnye we-npm, user0001, ibhaliswe kwidilesi yeGmail engaqinisekiswanga tanvisoul9@gmail.com, batyhala iipakethe ezintandathu ngokuthula besebenzisa amagama angacacanga ngabom, avakala ngathi asisiseko: centralogger, dom-utils-lite, node-fetch-lite, connector-agent, node-gyp-runtime, yaye node-env-resolve.
Iinguqulelo ezimbini zamva nje ze node-env-resolve, 1.0.7 kunye ne-1.0.8, zaphawulwa yinkqubo yeXygeni's Malware Early Warning (MEW) ngomhla wesi-2 kuCanzibe kwaye kwafunyaniswa ukuba zinobungozi ngomhla wesi-3 kuCanzibe.
I-implant ayiqhelekanga ngendlela engeyiyo: akukho zi-bots zeTelegram, akukho zi-callback ze-OAST, akukho ukugqitywa, kwaye akukho mzamo wokufumana iziqinisekiso ze-AWS ngexesha lokufaka. Endaweni yoko, postinstall.js ityala i-Windows boot-persistence entry, isebenzisa isitshixo se-HKCU Run esiqalisayo wscript.exe ngokuchasene ne-VBS stub. Emva koko ivelisa i-arhente yeNode.js ehlukanisiweyo ehlanganisa iimodyuli zokubamba imakrofoni, ukubiwa kwembali yesikhangeli, ukuthwebula imifanekiso, kunye nokulinganisa imawusi/ikhibhodi.
Sibiza eli qela I-DevTap, emva kokuba ikhithi ishiyeka isebenza kumatshini womphuhlisi.
Zonke iipakeji ezintandathu bezikho bukhoma ngo-npm ngexesha lokubhalwa kwale ncwadi. Sizithumele kwisitishi sokuxhatshazwa serejistri. Abakhuseli kufuneka bakhuphe naziphi na izinto ezifakiweyo kumshicileli ngelixa belinde ukususwa.
Iqela: Iipakeji ezintandathu, uMpapashi omnye
Iakhawunti yomshicileli user0001 ayiqinisekiswanga. Ayinawo SCM ukuqinisekiswa, akukho imeyile ehambelana nedomeyini, kwaye akukho mbali yangaphambili. Isiphatho seGmail tanvisoul9 ayiveli nakweyiphi na enye irekhodi yomshicileli we-npm esinokuyifumana.
Zonke iipakeji ezintandathu zidwelisa umgcini-zincwadi ofanayo, zipapashwe kwiakhawunti efanayo, kwaye zabelana ngokufanayo package.json i-boilerplate. Akukho repository, hayi homepage, kwaye akukho description inde kunomgca omnye.
Icebo lokuqamba amagama lelona candelo linomdla. Ngokungafaniyo nephulo lokuxhomekeka-ukudideka okanye iphulo lokubhala amagama, akukho nalinye kula magama elijolise kwithala leencwadi elithile elingaphezulu. Endaweni yoko, alungiswa ukuze anyamalale abe yincwadi yokwenyani. package.json or npm ls mveliso.
| ipakethe | Ishicilelwe okokuqala | Inguqulelo yamva nje | iinguqulelo | Indima kwiQela |
|---|---|---|---|---|
| i-centralogger | 2026-04-01 12:46 UTC | 1.0.9 | 5, ukusuka kwi-1.0.5 ukuya kwi-1.0.9 | Ikhava "yolwazi olusebenzayo lokuloba" yeCluster; ushicilelo lokuqala |
| i-dom-utils-lite | 2026-04-14 07:36 UTC | 1.0.3 | 3 | Isigqubuthelo somncedisi we-DOM esiqhelekileyo |
| i-node-fetch-lite | 2026-04-19 10:22 UTC | 1.0.2 | 3 | Usapho lwe-Mimics node-fetch |
| iarhente yesixhumi | 2026-04-25 05:12 UTC | 1.0.0 | 1 | Igama eliqhelekileyo elithi “arhente” |
| ixesha lokusebenza le-node-gyp | 2026-04-25 05:17 UTC | 1.0.0 | 1 | Izixhobo zokwakha i-Mimics native-module |
| isisombululo se-node-env | 2026-04-25 05:21 UTC | 1.0.9 | 10, ukusuka kwi-1.0.0 ukuya kwi-1.0.9 | Idropha esebenzayo; i-implant epheleleyo |
Amagama afana centralogger, node-fetch-lite, yaye node-gyp-runtime Zenzelwe ukuba zibonakale zingenampikiswano xa kujongwa ikhowudi. Zivakala ngathi zizinto ebezisele zikho kumthi wokuxhomekeka kwiprojekthi.
Xa zidityaniswe nomshicileli omtsha, ongaqinisekiswanga kunye neekhonkco zokugcina izinto ezingekhoyo, zenza ipateni ebonakalayo: umdlali otyala amagama angaphantsi kwengxabano kwirejista, aze aphinde ngokukhawuleza kweyona ibalulekileyo. Kwimeko enjalo, node-env-resolve ifumene iinguqulelo ezilishumi kwiintsuku ezisibhozo.
Yintoni ehlala kwiWindows Dev Box
Ikhonkco elinobubi livuliwe node-env-resolve:1.0.8 imfutshane, ithe ngqo, kwaye inezinto ezininzi ngokungaqhelekanga kwi-npm RAT.
Emva kokufakela: Ukuqina kunye ne-Agent ehlukanisiweyo
package.json ibhengeza ikhonkco lokufaka elinye:
{ "scripts": { "postinstall": "node postinstall.js" } }postinstall.js wenza izinto ezintathu ngokulandelelana.
Okokuqala, ibeka i-installation directory ngaphandle komthi we-npm. Indlela ibalwa ngexesha lokusebenza kwiskripthi njenge INSTALL_DIREmva koko isebenzisa i-internal execSync('npm install --production --silent ...') ngaphakathi kuyo ukuze kutsalwe ukuxhomekeka kwexesha lokusebenza kwe-implant. Oku kubeka i-arhente kwidiski kwindawo ethile njengencwadi yesikhokelo node_modules uphicotho-zincwadi aluyi kufumana.
Okwesibini, ibhala isiqalisi seVBS kwaye iyibhalisele ukuba iqhubeke nokuqalisa:
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run \ /v ${AGENT_NAME} \ /t REG_SZ \ /d "wscript.exe \"${vbsPath}\"" /fwscript.exe yiWindows Script Host, i-binary yeMicrosoft esayiniweyo esebenza .vbs iifayile ezingenayo ifestile yekhonsoli. Oko kungaphambi kokubacisKutheni le nto ithandwa kakhulu kwii-autorun stubs?
Kukwakho nokuhambelana reg delete indlela engaphakathi src/index.js, nto leyo ebonisa ukuba i-implant yenzelwe ukuba isuswe ngokupheleleyo ngokomyalelo womqhubi.
Okwesithathu, kubangela inkqubo yomntwana ehlukanisiweyo:
spawn(node, [path.join(INSTALL_DIR, 'src/index.js')], { detached: true, env: { ...process.env, SERVER_URL } })Iinkcukacha ezimbini zibalulekile apha.
SERVER_URL ifundwa kwindawo engqongileyo. Ngenxa yoko, isiphelo se-C2 sinokucwangciswa ngokufakwa ngakunye kwaye asifakwanga kwiphakheji. Elo khetho lincinci kodwa elicwangcisiweyo liyoyisa uninzi lwee-static-IOC sweep.
Kwakhona, umntwana ozelweyo udla ilifa imeko-bume epheleleyo yomzali. Ke ngoko, nawuphi na NPM_TOKEN, AWS_*, GITHUB_TOKEN, okanye i-SSH-agent socket ekhoyo kwiqokobhe lomphuhlisi ngexesha lokufakwa ingena kwimemori yearhente ehlala ixesha elide.
Oko I-Arhente Ithumela Nakho
I bundled src/ Umthi uquka iimodyuli ezintathu ezigama lazo lodwa libalisa ibali: audioCapture.js, browserHistory.js, yaye systemInfo.js.
Uluhlu lokuxhomekeka kwixesha lokusebenza, lusonjululwe ngexesha lokwenziwa kwesigaba npm install, iyabaqinisekisa.
Le ndlela iguqula isiganeko esingaqhelekanga sibe yimpendulo elawulwayo.
Endaweni yokusabela ngokungazi, amaqela asebenza ukubekwa phambili okucacileyo kunye nokulungiswa ngokukhawuleza.
| ukuXhomekeka | Iyintoni na kule meko? |
|---|---|
| idesktop-yesikrini | Ukuthathwa kwesikrini rhoqo |
| @ifolokhwe-yomthi-wamantongomane/ifolokhwe-yamantongomane | Ukulinganisa okuzenzakalelayo kwemawusi kunye nekhibhodi / ukufaka |
| ngcono-sqlite3 | Ukufundwa ngqo kweenkcukacha zedatha ze-SQLite zeChrome, Edge, kunye neFirefox History |
| i-adm-zip | Ukuhlanganisa izinto zakudala eziqokelelweyo ngaphambi kokuba ziphume emanzini |
| Bukhali | Ukutshintsha ubungakanani/ukucinezela imifanekiso yesikrini kunye nezinto ezenziweyo |
| umxhasi we-socket.io | Itshaneli ye-C2 eqhubekayo emacala mabini |
| i-node-machine-id | Iminwe yeminwe ezinzileyo ngomntu ngamnye yokulandelela ixhoba |
systemInfo.js iifowuni os.networkInterfaces() ukuze kufakwe ezinye iimpawu zeminwe ngaphambi kokuba kuboniswe ibhakoni yokuqala.
Kutheni i-Audio Capture iyisignali ebalaseleyo
Uninzi lwee-npm RAT esizihlolayo kwi-MEW ziyayeka xa ubusela buyimfihlo ngexesha lokufaka. ~/.npmrc, funda ~/.aws/credentials, ukukrwela process.env, THUMELA kwi-webhook, uze uphume. Oko kuhambelana nemodeli yezoqoqosho ekhawulezayo neyokubanjwa. Iziqinisekiso zinobomi obufutshane, kwaye umhlaseli kufuneka enze imali ngokukhawuleza.
node-env-resolve yahlukile ngesimo.
Ukuzingisa kumiselwe ukuze kuqhubeke ukuqalisa kwakhona. Iarhente isebenza ngokwahlukeneyo kwaye ihlala ixesha elide phantsi wscript.exeIsixhobo esiphetheyo senzelwe ukuba sisebenze kumatshini womphuhlisi, kungekhona esokubamba size sihambe: irekhoda yemakrofoni, i-keyboard/mouse driver, i-full browser-hist ingest, i-screen capture, kunye ne-interactive Socket.IO channel back to a configurable C2.
Ukubanjwa kwemakrofoni ngokukodwa ngumgca owela eli phulo uninzi lwe-malware ye-npm.
Indawo yokusebenza yabaphuhlisi, ngakumbi, ikwayindawo yokusebenza apho abaphuhlisi bathatha khona amanyathelo okuma, iifowuni zabathengi, iingxoxo zoyilo, kunye neebhulorho zokufowuna. I-implant erekhoda imakrofoni ayilandeli ithokheni ye-npm yomphuhlisi. Ilandela oko kuthethwa ngumphuhlisi phambi kwelaptop.
Loo mandla, kunye nokungabikho kokufihla kunye nokungabikho kokuphuma ngexesha lokufaka okukhawulezayo, kufundeka njengokubekwa kwangaphambili kokufikelela okujoliswe kuko kunokuba bubusela obungenamsebenzi bokufumana iinkcukacha.
Asitsho nje ukuba oku kuxhomekeke koku kuphela. Siphawula iprofayili yokusebenza.
I-cadence yeentsuku ezisibhozo yokuphindaphinda node-env-resolve yeyona nkcukacha ichazayo kakhulu kwixesha lexesha.
Oku akusiyonto yokuphosa nje. Umshicileli ugcina idropper ngenkuthalo, nto leyo edla ngokuthetha enye yezinto ezimbini. Nokuba bayayilungisa ngokuchasene neendawo zovavanyo ngaphambi kokuba isetyenziselwe ngokubanzi, okanye sele benayo i-install telemetry kwaye bayayiphendula.
Ezinye iipakeji ezintlanu azizange zifumane tshintsho emva kokupapashwa kwazo kokuqala. Oko kuhambelana nepatheni ethi "inqanaba elinye, shiya igama" kwiqela elixhasayo ngelixa umzamo wobunjineli ugxile kwipakeji eyenza umsebenzi.
Inkcazo: Izikhokelo Ezincinci, Akukho Sigwebo Siqinileyo
kawonke wonke UTSHINTSHO Imiqondiso incinci, kwaye asiyi kuyisolula. Okubonakalayo:
Isiphatho seGmail tanvisoul9 ifana kancinci negama laseMzantsi Asia, elithi “Tanvi.” Olu luphawu olubuthathaka. Izibambo zeGmail azizozazo, kwaye zilandela emva soul9 yinto eqhelekileyo. Akukhuselekanga ukuqikelela ijografi usebenzisa i-imeyile yendawo kuphela.
Isitayile sekhowudi asibalulekanga kangako iiNode.js: standard iifowuni zethala leencwadi ezinje os, child_process, spawn, yaye reg addAkukho obfuscation, akukho string rotation, kwaye akukho anti-debug logic. Umbhali ukhululekile ngee-Windows registry primitives kunye ne-detached-child-process orchestration, kodwa kubonakala ngathi akafuni urhwebo olufihlakeleyo abanokuthi balusebenzise.
Ukuxhomekeka akusekho mfuneko kwaye kwaziwa kakuhle: screenshot-desktop, nut-js, better-sqlite3, yaye socket.io-clientAkukho protocol eyenzelwe wena, akukho roll-frotch C2 stack, kwaye akukho qhinga litsha lokuqhubeka ngaphandle kwencwadi yesifundo. Isitshixo sokubaleka se-HKCULo ngumdibanisi ofanelekileyo, hayi umbhali wezixhobo.
Asifumananga imitya engeyoyasesiNgesi, izimvo ezifakiweyo, idatha yendawo, okanye iminwe yexesha le-compiler-output ngaphakathi kwezinto zakudala ezipapashiweyo.
Sijonge ukuba kukho ukudibana kwekhowudi kwiiphulo zangaphambili esele sizilandelela, kuquka Shai Hulud, I-Owlvion, iBuildkite, kunye neheibai yakutshanje / claude-code-best Usapho lwe-Anthropic-CLI clone. Asifumananga nto: akukho zipateni ze-C2 ezabelwana ngazo, akukho zakhiwo zefayile ezabelwana ngazo, kwaye akukho magama adityanisiweyo.
Into esingenakuyithetha: ukuba lo ngumdlali welizwe, iqela elaziwayo, okanye onxulumene nelizwe elithile ngokwendawo.
Iprofayili yokusebenza ihambelana neqela elincinci, elinobuchule obuphakathi elenza uhlolo lwe-developer-workstation. Kusenokwenzeka ukuba ikhuthazwa yimali ngokusebenzisa ukufikelela okungaphantsi, kodwa mhlawumbi nokuhlola njengenkonzo yomthengi owahlukileyo.
Amanqaku amabini angangqalanga axhasa oku kulandelayo: ukuphepha iindlela zokukhupha ingqwalasela ezitsala ingqalelo eziya kutshisa iqela ngokukhawuleza, njengee-Telegram bots, oastify.com, okanye ii-canarytoken, kunye namagama eephakheji ezingacacanga ngabom, akhetha ukufakwa kwe-long-tail ethule ngaphezu kwe-spike emfutshane ephezulu.
Iimpawu zokuvumelana nokuchongwa
| Iipakethi kunye noMpapashi | |
|---|---|
| intsimi | ixabiso |
| umshicileli we-npm | user0001 |
| I-imeyile yomshicileli | tanvisoul9@gmail.com, ayiqinisekiswanga |
| Iipakethi | i-centralogger, i-dom-utils-lite, i-node-fetch-lite, i-connector-agent, i-node-gyp-runtime, i-node-env-resolve |
| Iqinisekisiwe ukuba inenkohlakalo | node-env-resolve@1.0.7, node-env-resolve@1.0.8 |
| Izinto zoBugcisa boMsingathi | |
|---|---|
| uhlobo | ixabiso |
| Isitshixo sokuzingisa | HKCU\Software\Microsoft\Windows\ CurrentVersion\Run |
| Ixabiso lokuqhubeka | Igama eliguqukayo; idatha yefomu ye-wscript.exe " \\ ".vbs" |
| Faka ihaki | ukufaka emva: i-node postinstall.js kwi-package manifest |
| Iimodyuli zokufakelwa | src/audioCapture.js, src/browserHistory.js, src/systemInfo.js |
| Ulawulo lwesiteji | INSTALL_DIR isonjululwe ngaphandle kwee-node_modules zeprojekthi; indawo imiselwe yi-postinstall.js ngexesha lokufaka |
| womnatha | |
|---|---|
| uhlobo | ixabiso |
| Uthutho lwe-C2 | socket.io-client, itshaneli eqhubekayo ye-bidirectional |
| Isiphelo se-C2 | Inikwe iarhente ngokusebenzisa i-SERVER_URL environment variable; ayifakwanga kwiinkcukacha-manani ezishicilelweyo |
Amanqaku okuFumanisa
Imithetho emibini ibamba olu sapho ngaphandle kokufuna isiphelo se-C2.
Okokuqala, phawula izikripthi ze-postinstall ezenza umsebenzi wangaphakathi npm install ungene kwindlela engaphandle kwesikhokelo sephakheji. Nasiphi na isixhobo sokukhuphela esakhiwe kwangaphambili esisemthethweni, esifana node-gyp iyakha kwakhona okanye ikhuphele izinto ezimbini ezakhelwe kwangaphambili, ibhala ngaphakathi kwiphakheji okanye kwiqonga-standard iindlela ze-cache ezine-hashes eziqinisekisiweyo. Ayibhali kwi-excented design INSTALL_DIR kwenye indawo kwidiski.
Okwesibini, phawula izikripthi ze-postinstall ezikhuphayo reg add HKCU\…\Run kunye wscript.exe njengesixhobo sokuqalisa. Oku akukaze kube semthethweni kwiphakheji ye-npm. Yiphawule kwaye uyivalele.
I-heuristic yesithathu iluncedo ekuboneni iphakheji elandelayo yomntakwabo ngaphambi kokuba iqinisekiswe: umshicileli omtsha we-npm ongenazo SCM ukuqinisekiswa, i-imeyile ye-Gmail, akukho repository intsimi, kunye namagama amaninzi amafutshane, aqhelekileyo, avakala ngathi ziziseko ezisisiseko apapashwe kwiintsuku ezimbalwa, ngokwawo, anele ukuba afanele ukuphononongwa ngesandla.
Ixelwe kwirejista ye-npm. Siza kuyihlaziya le posi xa iakhawunti yomshicileli isusiwe.
