TL; DR
Umsebenzi omnye we-npm uchithe iiveki ezintandathu epapasha iipakeji zobuxoki ze-TypeScript "utility" ezifana ne ts-form-utils, ts-project-lint, yaye ts-enum-helper.
Ngelixa iipakeji zibonisa abancedisi abancinci ababonakala besemthethweni bokuqinisekisa, umthwalo wokwenyani uyasebenza xa kufakwa okanye kuqala kufuneke kwaye wenza ukuprintwa kweminwe yomsingathi, ukufunyanwa kweGitHub, ukwenziwa kwekhowudi yokugcina idatha, kunye nokukhutshwa kwekhowudi yomthombo.
Le malware ijolise ngokukodwa kwimibutho yeGitHub exabisa kakhulu, kuquka ezininzi Shopify iindawo zokugcina, emva koko zigcinwe kwaye zikhuphe imithi yemithombo efikelelekayo ziye kwindawo yokugcina ingqokelela ephakathi.
Njengenxalenye yomsebenzi wokuvumelana, umthwalo ohlawulwayo commitifayile ye-sa ibuyela kwiindawo zokugcina amaxhoba ngelixa izenza isazisi sekhowudi esizimeleyo sikaGoogle google-labs-jules[bot].
Silandelele iphulo - elibizwa ngokuba UJulesJacker — kwiiscopes ezininzi zabapapashi kunye nezizukulwana ezintlanu ubuncinane zomthwalo, kuquka iinguqulelo ezifihliweyo neziqondayo i-sandbox.
Olu hlobo lutsha lujolise ngokukodwa kwiziseko zohlalutyo lwe-malware: lusebenza kuphela ngaphakathi kwiindawo zohlalutyo, luba amathokheni eenkonzo ze-akhawunti ye-metadata yelifu, kwaye luhlola ii-Kubernetes control planes kunye neebhakethi zokugcina ilifu.
I-IOC ephambili eyabelwana ngayo kuzo zonke izizukulwana zemithwalo yisiphelo sokuqokelela aaronstack[.]com/jules-collect.
Ubunzima: bubalulekile.
Uhlaselo: Indlela Olusebenza Ngayo
Yonke iphakheji yeJulesJacker ilandela itemplate efanayo. iphakheji.json ithengisa umncedisi weTypeScript ongengobungozi onelayisenisi ye-MIT kwaye akukho ndawo yokugcina imithombo edibeneyo. index.js ithumela ngaphandle imisebenzi embalwa yokwenyani, esebenzayo — ii-regexes ze-imeyile, iimaphu ze-enum, iitafile zomthetho we-lint — ukuze umphuhlisi ongenisa iphakheji ngenene abone ukuziphatha okunokwenzeka. Ububi buhlala kwenye indawo: kwi postinstall ihoko, okanye kwibhloko ezantsi kwe index.js eqhuba ngexesha elifunekayo imodyuli.
Imithwalo yomvuzo iguqukele kwizigaba zangaphakathi ezibhalwe ngokucacileyo (umqhubi ubhala iilebheli zeziganeko zakhe zetelemetry sc1-, sc3-, sc4-, njalo njalo), kwaye ukubukela ukuba indaleko yeyona ndlela icacileyo yokuqonda eli phulo.
Isizukulwana 1–2: ubukrelekrele kunye nobusela be-git-config
Iipakeji zokuqala zazizizinto ezithatha ulwazi oluthe ngqo. Xa befaka bavuna iinguqu zendalo, ifayile yeGitHub CLI hosts, kunye noqwalaselo lwe-git lwehlabathi (uqwalaselo lwe-git –global –uluhlu, git kude -v), emva koko ndathumela iphakheji kwindawo yokugcina ingqokelela. Oku kwamisela utyikityo lomqhubi: ibali elingaphezulu kwesihloko esithi “TypeScript form validation utilities”, isibane esiphumayo kwidomeyini enye, kunye nomnqweno wokufumana iziqinisekiso zomphuhlisi endaweni yedatha yabathengi.
Isizukulwana sesi-3: ii-hypervisor kunye nee-kernel escape probes
Enye inguqulelo ephakathi kwephulo yajika ngamandla yaba kuhlaselo lweziseko zophuhliso. Endaweni yokuba i-config, yaqhuba uphando lwe-recon harness. AF_VSOCK iisokethi, iingingqi ze-MMIO ze-virtio, / dev / mem, kunye neeflegi zokuqinisa i-kernel, kunye nokuzama ukuphahlazeka kwe-kernel okubangelwa yi-sysrq — ukuziphatha okunxulunyaniswa nemizamo yokuphuma kumatshini okanye kwisikhongozeli esibonakalayo. Iithegi ze-telemetry (s0-vmm-recon, i-s1-vmm-vsock-fuzz, i-s2-vmm-mmio, iprobe ye-kernel ye-s3) yenze injongo yacaca. Olu tshintsho lwalujoliswe ngokucacileyo ku iindawo ze-cloud-sandbox kunye ne-serverless-runner — uhlobo lwe-VM yexeshana eyakha kwaye ivavanye ikhowudi engathembekanga.
Isizukulwana sesi-3 (SC3): i-cross-repo write worm
Isiseko somxhuzulane sephulo saba lisela elizisasaza ngokwalo. Xa lifakelwa, umthwalo womvuzo uqhuba ulandelelwano olunexesha eliqikelelweyo olunezigaba ezintlanu:
- Isigaba 0 (~100 ms): faka umnwe kumphathi — igama lomninimzi, ulwazi lomsebenzisi, isazisi se-git.
- Isigaba 1 (~3 s): misela ukuba ixhoba lilowuphi umbutho ngokuhlola git kude -v, uze ujonge ikhowudi elukhuni ORG_CONFIG itafile kwaye uvavanye ukufikelela kwi-repo nge git ls-remote — idluliselwe kwi-proxy ye-SSRF elawulwa ngumhlaseli kwi http://git@192.168.0.1:8080.
- Isigaba 2 (~imizuzwana eli-10): git clone yonke indawo yokugcina enokufikeleleka kuluhlu olujoliswe kulo, i-tarball kunye ne-gzip umthi, uyifake kwi-base64, kwaye uyikhuphe kwi-chunk-exfiltrate.
- Isigaba 3 (~45 s): "ubungqina bokufikelela" - yenza i-repo ebhaliweyo, lahla ifayile ebizwa ngokuba yi-SECURITY-POC.md, kwaye commit yibeke ku-google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com> kwaye umsebenzi womyalezo: hlaziya i-dependency cache, uze uyityhale uye kwisebe eliphambili lexhoba.
Uluhlu lwezinto ekujoliswe kuzo olunekhowudi aluqhelekanga. Lubala ngaphezulu kwamashumi amathathu Shopify iindawo zokugcina izinto ngegama — Shopify/shopify, Shopify/ubuwena, Shopify/ukuhlawulisa, Shopify/indawo yokugcina impahla, Iimfihlo zeShopify, Shopify/iziseko zophuhliso, Shopify/.github, kunye nezinye ezininzi — ecaleni kombutho wovavanyo, AaronStackBarnes, ukuba umqhubi ubonakala elawula kwaye esebenzisa njengenjongo yokubhala.
Isizukulwana sesi-4 (SC4): sifihliwe kwaye sivalwe ngegeyithi
Olu hlobo lutsha olujongene nomphuhlisi longeza iileya ezimbini zokubaleka phezu kwe-SC3 worm.
Okokuqala, umthwalo awusathunyelwa njengombhalo ocacileyo. Ingqiqo yokwenyani ikwi-blob efihliweyo ye-AES-256-CBC, lib/.perf.dat, kunye ne-IV kwii-bytes zayo zokuqala ezilishumi elinesithandathu. Isilayishi kwi index.js yakha kwakhona isitshixo sokuvula ikhowudi kwiinxalenye zentambo ezidityanisiweyo, ivula ikhowudi ye-blob, ize iyisebenzise Umsebenzi omtsha ()Kwanamagama eemodyuli ahlulwe ukuze kuphetshwe ii-static scanners — funa('crypt' + 'o'), funa('f' + 's').
Okwesibini, ivalwe yi-host-gated. Uhlobo olunye luyayicima kwaye lusebenze kuphela xa igama lomphathi () lingana ibhokisi yokwazisa or ubuntu-fc-uvm (i-Firecracker microVM engagqibekanga) okanye iqulethe umtya ongaphantsi ibhokisi yokwazisaAmanye amasango xa kukho .jules/ uludwe lweencwadi olusebenzayo:
Ngamanye amazwi, umthwalo we-SC4 wenzelwe ukuhlala ungasebenzi kwi-laptop yomphuhlisi oqhelekileyo kwaye uvuke kuphela ngaphakathi kwi-arhente ye-AI ezenzekelayo kwaye iindawo zebhokisi yesanti umqhubi ufuna ngokwenene ukuyekelela.
Ukuvula iLebhu: i-Analysis-Infrastructure Variant
Eyona phakheji intsha kakhulu kwiphulo, umncedisi we-ts-enum, ayihlaseli abaphuhlisi okanye iShopify konke konke. Yiyo emva kokufaka.sh ivula ngesango elinika umdlalo ithuba:
Iskripthi asenze nto ngaphandle kokuba i-environment variable ethile kwi-malware-analysis platform isetiwe. Xa isenziwa, i-payload iyazi ukuba isebenza ngaphakathi kwi-sandbox ekhoyo ukuze iqhumise kwaye ifunde iipakeji ezifana nale - kwaye iyahlasela.
Okokuqala itsala ithokheni ye-OAuth ye-GCP service-account kwi-instance metadata server ize iyikhuphe. Emva koko, isebenzisa loo tokheni, isusa i- Inqwelomoya yokulawula iKubernetes iyafikeleleka kwi kubernetes.default.svc:
- uluhlu lweClusterRoleBindings, iClusterRoles, kunye neeNodes;
- iphanda iipods, iimfihlo, kunye neemephu zoqwalaselo kuyo yonke indawo inkqubo ye-kube, Engagqibekanga, kube-public, ukuqeshisa i-kube-node, kunye nesithuba segama lohlalutyo;
- imiba ethi SelfSubjectAccessReview ibiza ukuba ichaze kanye into evunyelweyo ukuba yenziwe ngumntu obiweyo.
Ekugqibeleni inyanzela amagama ebhakethi ye-Google Cloud Storage eyakhiwe nge-ID yeprojekthi ye-GCP eneenkcukacha ezinzima (utyikityo olungaqhelekanga-437603-p9) kunye nenombolo yeprojekthi, iindibaniselwano zokuqikelela ezifana *-yakha, *-izinto zobugcisa, kunye neqela ukungasebenzi kakuhle izimaphambili (iziphumo ze-malysis, iipakethe ze-malysis, iiskeni ze-malysisYonke ikhowudi yempendulo kunye nomzimba ubhalwe phantsi kwaye uthunyelwe kwakhona kwi-POST efanayo. ukuqokelela iijules isiphelo.
Le yimeko engaqhelekanga yomthwalo we-supply-chain owakhelwe ngokukodwa ukuhlasela iziseko zophuhliso zabakhuseli. Ibali elikwiphepha eliphambili kulo lonke iphulo - iziqwenga zazo ezivela ngaphakathi kwemithwalo ye-payloads njengezimvo ezichaza indlela yokuziphatha njenge-"Security Research PoC ... cross-repo write via overscoped git proxy token" - yindlela efanayo yokuzithethelela, nokuba injongo yexesha lokusebenza yi-Shopify monorepo okanye iseva ye-metadata yeqela lohlalutyo.
Ixesha kunye nokuFuduka koMda
I-JulesJacker ayiloxesha lokuphosa nje. Yinkqubo eqhubekekayo eyasinda ekususweni kwerejista ngokutshintsha nje igama layo.
| Nini | umcimbi |
|---|---|
| Phakathi ku-Epreli 2026 | Iiphakheji zokuqala zivela phantsi komda womshicileli wokuqala: i-TS-utility façade, i-environment kunye ne-git-config exfiltration. |
| Ekuqaleni kukaMeyi 2026 | I-Hypervisor kunye ne-kernel-escape reconnaissance variant ipapashwe. |
| Phakathi ukuya ekupheleni kukaMeyi 2026 | I-SC3 cross-repo write worm ivela ecaleni kwemithwalo ejolise kwiShopify kwaye google-labs-jules[bot] ukulingisa. I-SC4 yazisa ii-loaders ezifakwe kwi-AES kunye nezifakwe kwi-host-gated. |
| Ekupheleni kukaMeyi 2026 | i-npm isusa umda womshicileli wokuqala; amagama eephakheji atshintsha abe ziindawo zokugcina ukhuseleko ezingenanto. |
| Iveki enye | Umsebenzisi ufudukela kwindawo efana kakhulu aze aphinde ayipapashe le worm, kuquka nohlobo lwe-analysis-infrastructure. |
Ukufuduka yinxalenye abakhuseli abafanele bahlale nayo. Ukususwa kwesikali sokuqala akuzange kuphelise iphulo okanye kulicothise. Umsebenzisi wayesele ecwangcise isikali esilinganayo esigama laso lahlukileyo kwelokuqala ngomlinganiswa omnye, waza waqhubeka nokupapasha kwiveki enye. Okwangoku, esikali sitsha izixhobo ze-ts-form (iinguqulelo 1.0.0 ukuya ku-1.1.0), i-ts-project-lint (1.0.0 kunye ne-1.1.0), kunye ne-standalone umncedisi we-ts-enum (1.0.0) isenokufakeka.
Iimpawu zokuvumelana
Zonke izalathisi ezingezantsi ziqinisekisiwe ngokuchasene nomthombo wephakheji.
| uhlobo | Isalathisi | amaNqaku |
|---|---|---|
| Inethiwekhi (C2) | aaronstack[.]com/jules-collect | Indawo yokuqokelela enye kuzo zonke izizukulwana; ifumana i-JSON telemetry kunye ne-base64-gzip repository tarball chunks. |
| Inethiwekhi (iproksi ye-SSRF) | http://git@192.168.0.1:8080 | Ngaphambili kwethokheni ye-git proxy ebanzi esetyenziselwa ukufikelela kwiindawo zokugcina imibutho ekujoliswe kuyo. |
| Inethiwekhi (ilifu) | metadata.google.internal/computeMetadata/v1kubernetes.default.svcstorage.googleapis.com/storage/v1/b | Isetyenziswa kuphela lutshintsho lohlalutyo-lweziseko zophuhliso kwi-token steal kunye ne-Kubernetes control-plane reconnaissance. |
| isazisi | google-labs-jules[bot]161369871+google-labs-jules[bot]@users.noreply.github.com | Yenziwe commit ubuwena bombhali butyhalelwe kumasebe aphambili exhoba. |
| ifayile | lib/.perf.dat | I-AES-256-CBC-encrypted payload blob; IV igcinwe kwii-bytes zokuqala ezili-16 kwaye isitshixo sakhiwe ngokutsha ngokuguquguqukayo kwi index.js. |
| ifayile | SECURITY-POC.md | Ilahliwe kwaye commitndibuyiselwe kwiindawo zokugcina amaxhoba ngomyalezo chore: update dependency cache. |
| ifayile | scripts/postinstall.sh | Ifakwe kwisango $MALYSIS_ANALYSIS_ID; ichonga uhlobo olujolise kuhlalutyo-kwiziseko zophuhliso. |
| Ukuziphatha | os.hostname() iitshekhi ze devbox / ubuntu-fc-uvm | I-Sandbox kunye ne-AI-agent zivaliwe ngaphambi kokuba kususwe ukubethelwa kunye nokusetyenziswa kwe-payload. |
| Ukuziphatha | .jules/ kwaye /app/.jules i-directory ifundwa | Ukujoliswa ngokucacileyo kwiindawo zokusebenza ze-AI-agent. |
| Ukuziphatha | sc1-, sc3-, sc4-, s0-vmm-recon | Iilebhile zesigaba se-telemetry ezichazwe ngumsebenzisi eziluncedo ekufumaneni nasekuzingeleni. |
| Ithagethi yelifu | rare-signer-437603-p9malysis-* uqikelelo lwebhakethi | Izihlonzi zeprojekthi ze-GCP ezifakwe ikhowudi eqinileyo kunye neepateni zokubala zebhakethi yokugcina izinto ezifakwe kuhlobo lohlalutyo-lweziseko zophuhliso. |
| Ubume bephakheji | I-façade yephakheji ye-TS-utility engenandawo yokugcina izinto | Itemplate yephulo ehambelanayo: iipakethe zesixhobo seTypeScript zobuxoki ezinemithwalo enobungozi efakwe ngaphakathi postinstall hooks okanye eyongezwe kwi index.js. |
