Iiphakheji ze-npm ezisandula ukufunyaniswa zizenza ngathi zincedisi zangaphambili ezingenabungozi kodwa ziqulethe ikhowudi efihliweyo enobubi.
Iqela loPhando loKhuseleko e I-Xygeni kugqitywe kwelokuba ezi phakheji ze-npm: 'ukwazisa nge-react-ui', 'ukwazisa nge-tmedia', 'ukwazisa nge-ui', 'ukwazisa nge-media', 'ukwazisa nge-react-ui' zizinto eziguquliweyo ezivela kwi 'umbhali webhingo', ngokwayo yifolokhwe enobungozi efana nolwakhiwo kunye namaxwebhu ephakheji ethandwayo yokuloba 'pino' ukuze kubonakale kusemthethweni. Eso sigqubuthelo sisetyenziselwa ukuxhaphaza ukuthembana kwabaphuhlisi kunye nokutsala ukhuphelo. Enyanisweni, i-codebase iqulethe ifayile engadibaniyo ne-obfuscated esebenza kwiindawo zeNode.
Imvelaphi ye-Actor ye-Trouble: Iphulo "lodliwanondlebe oluthelelanayo"
The Iphulo lodliwano-ndlebe olosulelayo inxulunyaniswa neqela leengozi elaziwa ngokuba yi 'UNC4034', exela amakhonkco anxulumene nabadlali abanxulumene neNorth Korea Iqela likaLazaro or APT38, iqela elixhasiweyo likarhulumente elaziwayo elinxulumene norhulumente waseNorth Korea. Abadlali abasongelayo abasemva kweli phulo banembali yokujolisa abaphuhlisi ngokusebenzisa iinkqubo zendalo ezivulelekileyo, besasaza iipakethe ezifanayo ezenza imithwalo efihliweyo. Ekugqibeleni bakhupha idatha enxulumene ne-crypto, ikhowudi yomthombo kunye neziqinisekiso kwiinkqubo ezosulelekileyo.
The amaqhinga, iindlela, kunye neenkqubo (ii-TTP) ezibonwe kwezi phakheji ze-npm zilandela iphethini efanayo:
- Amagama eeprojekthi avakala ngathi asemthethweni ukuze abonakale ethembekile.
- Faka ikhowudi efihliweyo kwiifayile zovavanyo kunye nezikripthi ezincedisayo.
- Sebenzisa imithwalo efihliweyo eqokelela idatha eyimfihlo uze uyithumele kwiseva yomyalelo nolawulo olukude (C2).
Iziphumo zobugcisa: Uhlalutyo lweMithwalo engaqondakaliyo
Umthwalo ofunyenwe ngaphakathi '/test/fixtures/eval/node_modules/test.list' isebenzisa iJavaScript efihliweyo (ukukhangela i-index/array string, iibhloko ezifakwe kwi-encoded) ukufihla imitya efundekayo kwaye ukuhamba kolawulo kuya kwenziwa xa iphakheji ifakiwe ngenxa yeskripthi sokufaka emva uvavanyo lwe-'npm run test || npm transpile || npm run skipngaphakathi kwe iphakheji.json.
Uhlalutyo lwethu lubonise ukuba ezi phakheji ziqulathe i-malware eguquguqukayo eyakhelwe ukuhamba kwiinkqubo zokusebenza (iiWindows, ii-macOS, okanye iiLinux) kunye neendawo zomsebenzisi. Amandla abonisa ukugxila ngabom kubasebenzisi bezobugcisa abadla ngokusebenza kwiindawo ezahlukeneyo.
Nje ukuba imiselwe kwinkqubo, i-malware ihlola indawo eyingqongileyo, iqokelela ulwazi lwenkqubo eneenkcukacha njenge igama lomkhosi, iqonga, ulawulo lwasekhaya kwaye inkqubo ye-tmp dir ngaphambi kokuba yandise ukufikelela kwayo kwii-apps ezigcina idatha eyimfihlo efana ne iiphequluli (I-Chrome/Isibindi/Umda/I-Opera) kunye ii wallet zedijithali. Iphinda-phinda ikhangela iindawo eziqhelekileyo zeeprofayili zesikhangeli, iifayile zewallet, ii-keychains kunye neentlobo ezininzi zamaxwebhu/iifayile. Amagama angundoqo okukhangela aquka i-wallet, amagama anxulumene nembewu kunye nolwandiso lweefayile ezininzi ezinokuqulatha iziqinisekiso okanye iimfihlo (*.env, *.key, *.wallet, *.json, *.txt, *.doc, njl..). Iqulethe uluhlu lokukhuphela ngaphandle kwiincwadi eziqhelekileyo ukuze kuthintelwe iifayile zenkqubo ezicacileyo.
Umthwalo wokuhlawula ubhala uphawu lwendawo/ifayile yokutshixa ukuthintela ukubaleka okuninzi ngaxeshanye kwaye ubhala idatha yayo ngaphakathi kwee-OS temp directories ukuthintela ukubhaqwa.
Umthwalo ofihliweyo ukwanayo nomjelo wonxibelelwano oluya kwiseva ekude esebenza njengehabhu yayo yokulawula nokulawula. Ngale mjelo, ingakwazi khupha ulwazi olubiweyo kwaye fumana imiyalelo engaphezuluNangona iziseko zophuhliso ngokwazo zibonakala zinqongophele kwaye zakhiwe ngenjongo ethile, ukubakho kwazo kuqinisekisa injongo yomhlaseli yokugcina ulawulo oluqhubekayo kwiinkqubo ezinentsholongwane.
Xa i-malware ifumana idatha eyimfihlo iyayihlanganisa ize izame ukuyilayisha kwindawo ekude egcinwe kwiseva yelifu isebenzisa i-multipart/form-data ukuze iifayile ezibiweyo zincamathiselwe kwizicelo.
Iimpawu zeNgcebiso zokuVumelana nokuNciphisa
Imibutho iyacetyiswa ukuba isuse ezi zinto zinobungozi ezixhomekeke kuzo (i-react-ui-notify, i-react-tmedia, i-react-ui-animations, i-react-medias, i-react-mandes, i-bingo-logger) kwaye uhlaziye ezi meko ukuqinisekisa ukuthembeka. Iinkqubo ezinokuba zityhilekile kufuneka zijikeleziswe zonke iziqinisekiso kunye neethokheni zokufikelela ngoko nangoko.
Abalawuli benethiwekhi kufuneka banciphise ithrafikhi ephumayo kwezi IP 23.227.202.24, 131.153.22.25 kwaye uphonononge unxibelelwano lwakutshanje ukuze ubone izinto ezingaqhelekanga. Ukwakha kwakhona iindawo ezichaphazelekileyo ngemithombo eqinisekisiweyo necocekileyo kuyacetyiswa kakhulu ukuthintela ukosuleleka kwakhona nokuqinisekisa ukuthembeka kwekhonkco lokubonelela.
Umxholo oBanzi
Zizonke, ezi phakheji ngomnye umzekelo Ngenxa yenqanaba elitsha lokuvuthwa kohlaselo lwe-supply-chain olusekelwe kwiJavaScript, iintshaba ziya zisanda ukudala iipakethe ezifanayo eziboleka isakhiwo kunye namaxwebhu kwiiprojekthi ezithembekileyo, ukwandiswa kwemodyuli kunye nokusebenzisa iindlela ezingcono zokwenza ukufumanisa kunye nokunciphisa kube ngumceli mngeni.
Olu tshintsho lunyusa amathuba okufakwa ngengozi ngabaphuhlisi abangalindelanga kwaye lunika iintshaba ukufikelela nzulu kwiindawo zokwakha, CI/CD iinkqubo kunye neendawo zokugcina ikhowudi yomthombo.
Iinkqubo ze-ecosystem ezivulelekileyo ziye zaba yindawo ekhethwayo yokusasaza kwiiphulo ezinjalo. Ngokusebenzisa indawo yabaphuhlisi bentembeko abakhoyo kwiiphakheji zoluntu, abahlaseli banokungena kwikhonkco lobonelelo lwesoftware ngomzamo omncinci kwaye rhoqo ngaphandle kokubhaqwa ngokukhawuleza okanye iziphumo.
Isilumkiso Sasekuqaleni Se-Malware (MEW) yiXygeni
Esi siganeko saqatshelwa ekuqaleni ngeXygeni's Isilumkiso saKwangoko seMalware inkqubo, ehlala ijonga iirejista zeepakeji ze-open-source ezifana ne-npm, i-PyPI, i-Maven kwiipakeji ezinobuthi.
Injini yethu yokufumanisa iziphawule ngokuzenzekelayo ezi phakheji njengezingaqinisekanga ngenxa yesakhiwo sazo esingaqhelekanga, iskripthi sokufaka emva kokufaka kunye nomthwalo ofihliweyo. Ngenxa yoko, iiphakheji ezinobuthi (i-react-ui-notify, i-react-tmedia, i-react-ui-animations, i-react-medias, kunye ne-react-mandes) ziqinisekiswe ukuba zinobungozi liqela lethu lezokhuseleko kwaye zaxelwa kwi-npm ngaphambi kokuba zifikelele ekuvunyweni ngokubanzi.
Indlela iXygeni Early Running eyikhusela ngayo pipelines
- Ubhaqo lwesisongelo ngexesha lokwenyani: Iskena yonke iphakheji entsha okanye ehlaziyiweyo kwigrafu yakho yokuxhomekeka kwaye ibonise ukuziphatha okukrokrisayo okufana neefowuni zenkqubo ye-OS, ukuphunyezwa komyalelo, ikhowudi efihliweyo, ukubhala amagama phakathi kwezinye ezininzi.
- Izaziso zangoku: Yazisa amaqela akho okhuseleko kunye namaqela e-DevOps eSlack, eJira, okanye uthumele i-imeyile kwangoko xa kuvela usongo olutsha kwindawo okuyo.
- Ukulungiswa kokucofa kube kanye: Iyavelisa pull requests ezisusa okanye ezitshintsha iinguqulelo zokuxhomekeka ezibuthathaka kuzo zonke iiprojekthi zakho.
- Iinkqubo zeNdalo ezixhaswayo: Okwangoku ziquka i-npm, i-PyPI, i-Maven kunye ne-Packagist.
- I-Xygeni ikunceda uhlale uphambili kuhlaselo lwe-supply chain ngokubamba iipakethe ezinobungozi kwinqanaba lokuqala, ngaphambi kokuba zifike kwisakhiwo sakho.
???? Zama i-Xygeni Malware Early Warning free kwaye ubone ukuba ungazibona ngokukhawuleza kangakanani kwaye unciphise iingozi ze-supply-chain kwi-intanethi yakho pipelines.
