Muva nje i-Xygeni ibone iphethini ekhathazayo esimweni sokuhlaselwa kwe-software supply chain ngo-2025, kuvela kubaphathi ababili abadumile bephakheji: I-PyPI futhi npmNjengengxenye yemizamo yethu eqhubekayo yobuhlakani bezobunhloli,Isexwayiso Sangaphambi Kwesikhathi Se-Malware ye-Xygeni (MEW) ithuluzi lithole isibonelo esihlukile kodwa esifana nendlela yephakheji enonya elayishwe kwenye irejista ngaphambilini. Leli cala liqokomisa indlela abenzi bezinsongo abashintsha ngayo futhi abasebenzisa kabusha amasu okuhlasela kuzo zonke izindawo zemvelo, ikakhulukazi ngokusebenzisa amaphakheji e-Python anonya futhi amaphakheji we-npm anonya, okwandisa ingozi yokuthi amaphakheji anobungozi angene ezintanjeni zokunikezwa kwemithombo evulekile.
I-MEW ka-Xygeni: Ukubona Ukufana
Ithuluzi le-MEW lika-Xygeni lakhiwe ukuthola nokumaka amaphakheji anonya, ikakhulukazi lawo ahlobene nokuhlaselwa kwe-Software Supply Chain ngo-2025, ngokushesha nje lapho eshicilelwa kubabhalisi bemithombo evulekile. Lisebenza ngokuhlaziya amaphakheji amasha okuziphatha okusolisayo.
Kulesi simo, kutholakale ezimbili amaphakheji e-Python anonya (graphalgo ku-PyPI) kanye amaphakheji we-npm anonya (express-cookie-parser ku-npm).
Amaphakheji e-Python kanye ne-npm anonya ku-Software Supply Chain Attacks (2025)
Ake sihlole izici ezabiwe ezibangele izexwayiso zethu:
Ukuthayipha
Bobabili bazama ukuzenza amaphakheji adumile akhona.
- i-graphalgo (i-PyPI): "Iphakheji ye-Python yokudala nokulawula amagrafu namanethiwekhi."Kulayishwe ngumsebenzisi ogama lakhe lingu “i-larrytech” ngomhlaka-13 Juni 2025, leli phakethe laziveza njengenye indlela ye-PyPi esikhundleni sephrojekthi yokuqala ye-graphalgo engeyona enonya, kamuva eyabizwa ngokuthi i-graphdict.
- i-express-cookie-parser (npm): Le phakheji ilingise iphakheji eyaziwayo ye-cookie-parser, yaze yalingisa ngisho I-README.md. Ukuzenza ongeyena umuntu kuyindlela ejwayelekile yokusebenzisa ukwethenjwa okukhona.
Ukufiphaza njengoMgca Wokuqala Wokuzivikela
Womabili amaphakheji afihle ikhodi yawo enonya ngaphakathi kwamafayela okuqala. i-graphalgo, ikhodi efihliwe itholakale ngaphakathi /utils/load_libraries.py. Uma kwenzeka kuba i-express-cookie-parser, cookie-loader.min.js yayiqukethe umthwalo osindayo.
Lolu ngqimba lokuqala lokufiphaza luvame ukusetshenziselwa ukuvimbela ukuhlolwa okungahleliwe kanye nokuhlaziywa okungaguquki. Ukufiphaza bekulula impela: ukucindezela okuphindaphindwayo kwe-ZLib kanye nokubhala ikhodi kwe-Base64. Lolu hlobo lokufiphaza lubonisa ngokusobala ukuthi isofthiwe izama ukufihla ukuziphatha kwayo. Kanye nobunye ubufakazi, lokhu kuvumele i-Xygeni MEW ukuthi ihlukanise amaphakheji njenge-malware engaba khona. Phakathi nesigaba sokuqinisekisa, ababuyekezi bethu balungiselela ngokushesha iskripthi sokususa ukufiphaza esaveza isigaba sokuphonsa esinonya ngokusobala.
Ukulethwa Kwemithwalo Eminingi Yeziteji kanye Nephuzu Lokuqala Elihlanganyelwe
Womabili amaphakheji asebenze njenge-"yokuqala"amaconsi,” bebeka isisekelo somthwalo wangempela. Babehlanganyela “indlela efanayo yangaphandle”imbewu"I-URL yefayela:https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
Leli fayela lembewu langaphandle elifanayo liyisibonakaliso esinamandla somdlali osongelayo ohlanganyelwe. Ngokuthakazelisayo, okuqukethwe kwaleli fayela lembewu kubonakala kuyizinto eziguquguqukayo zemvelo ezilula (isb., i-JWT_SECRET, i-PORT), okungase kudukise ukuhlolwa komsebenzi walo wangempela.
Isixazululo se-Dynamic C2 esine-DGA
Icebo eliyinkimbinkimbi elibonwe kula maphakheji anonya ukusetshenziswa kwe-Domain Generation Algorithm (DGA) ukuxazulula iseva ye-Command and Control (C2) ngendlela eguquguqukayo. Le ndlela, evame ukubonakala ekuhlaselweni kwe-software supply chain ethuthukisiwe ngo-2025, incike ku-SHA256 hash ethathwe kokuqukethwe kwefayela lembewu, kuhlanganiswe namanye amanani aqinile. Ngokwenza kanjalo, ingqalasizinda ye-C2 iyashintsha njalo, okwenza ukufakwa ohlwini olumnyama kwendabuko kungasebenzi kahle kakhulu. Kulokhu, i-npm variant isebenzise inani elihleliwe le- 496AAC7E njengengxenye ye-DGA logic yayo.
Ukusungula Ukuphikelela
Bobabili abahlaseli babefuna ukusungula ukuba khona okuhlala njalo ezinhlelweni ezithintekile. Isu labo lalihilela ukulahla ifayela, startup.py (ye-PyPi) noma startup.js (ye-npm), ku-Google Chrome, ku-directory yedatha yomsebenzisi evamile kuzo zonke izinhlelo zokusebenza ezahlukahlukene (i-Windows, i-Linux, i-macOS).
Ukuhlanzwa Ngemva Kokusebenza
Ukuze kuncishiswe ukulandelelwa, womabili ama-script anobungozi enze imisebenzi yokuhlanza. Lokhu kwakuhlanganisa nokususa amafayela awo okuqala e-dropper (load_libraries.py, cookie-loader.min.js) kanye nokushintsha amafayela ephakheji asemthethweni (__init__.py, index.js) ukususa izinkomba zezingxenye ezisusiwe manje.
Izinkomba Zokuyekethisa Kumaphakheji E-Malacious Python kanye ne-npm
- Iphakheji ye-PyPI: i-graphalgo (eyanyatheliswa yi-larrytech, ngoJuni 13, 2025)
- Iphakheji ye-npm: i-express-cookie-parser (ikakhulukazi inguqulo 1.4.12)
- Ukufinyelela ku-URL Yembewu Eyabiwe:
https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
- Amagama Amafayela Aqhubekayo:
startup.py(Python)startup.js(I-JavaScript) - Izindlela Ezivamile Eziqhubekayo (ezixhomeke ku-OS): Ngaphakathi kweziqondisi zedatha yomsebenzisi ze-Google Chrome (isb.,
AppData\Local\Google\Chrome\UserData\Scripts\ku-Windows,~/.config/google-chrome/Scripts/ku-Linux, njll.).
Indlela Yokuzivikela Kumaphakheji Anobungozi Ekuhlaselweni Kwe-Software Supply Chain 2025
Indlela Enconywayo Yabathuthukisi
Lesi sigameko sisebenza njengesifundo esibalulekile esimweni esisongelayo sokuhlaselwa kwe-software supply chain ngo-2025. Siqokomisa indlela amaphakheji e-Python anonya kanye namaphakheji e-npm anonya angangena ngayo ezindaweni zemvelo ezithembekile, ngokuvamile agweme ukutholwa kuze kube sekwephuzile. Yingakho ukutholwa kusenesikhathi, amathuluzi ahlakaniphile, kanye nokuhlanzeka kwesistimu okusebenzayo manje sekuyizingxenye ezibalulekile zanoma yikuphi ukuhamba komsebenzi okuphephile kwe-DevOps. Abathuthukisi bakhuthazwa ukuthi bacabangele okulandelayo:
Isibuyekezo Sokuxhomekeka
Uma amaphrojekthi akho efakiwe i-graphalgo or i-express-cookie-parser, kungaba ukuhlakanipha ukuqhubeka nokususwa kwabo.
- Nge-PyPI:
pip uninstall graphalgo - Ngo-npm:
npm uninstall express-cookie-parser
Ukuhlanzeka Kwesistimu
Cabanga ngokwenza ukuskena kwesistimu okuphelele. Kunconywa futhi ukuthi uhlole ngesandla izindlela ezivamile zohlu lwedatha yomsebenzisi we-Chrome ukuze uthole noma yikuphi okungalindelekile. startup.py or startup.js amafayela.
Izinyathelo Zokuvikela Ezisebenzayo
- Hlola Ukuthembela Okusha: Hlela inqubo yokuhlola ngokuphelele amaphakheji amasha ngaphambi kokuhlanganiswa, ugxile kulawo avela kubashicileli abangajwayelekile.
- Hlanganisa Amathuluzi OkuphephaAmathuluzi afana ne-Xygeni's MEW, kanye nokunye ukuhlaziywa kokwakheka kwesofthiwe (SCA) izixazululo, zinganikeza ungqimba olubalulekile lokuzivikela ngokuhlonza ukuziphatha okusolisayo kanye nobuthakathaka.
- Ilungelo Elincane Kakhulu: Izindawo zokuthuthukiswa kokusebenza ezinesimiso samalungelo amancane zingasiza ekunciphiseni umthelela ongaba khona wesivumelwano.
- Ukuqwashisa NgenethiwekhiUkuqapha ithrafikhi yenethiwekhi ephumayo ukuze kutholakale ukuxhumana okungavamile ngezinye izikhathi kungaveza ukuxhumana kwe-C2 okukhiqizwe yi-DGA.
Izingxenye Ezibalulekile ze load_libraries.py (kusuka ku-graphalgo)
download_remote_content(): Iphatha ukulanda amafayela kuma-URL athile.run_process(): Isebenzisa izikripthi ze-Python zangaphandle ngendlela ehlukanisiwe, icindezela umphumela ukuze uhlale uyimfihlo.get_output_file_path(): Inquma indawo efanele yesistimu yefayela le-startup.py eliqhubekayo.remove_self(): Ihlela ukuhlanzwa kwamafayela okuqala anonya kanye nokuguqulwa kwephakheji ngemva kokusetshenziswa.simple_shift_encrypt()/simple_shift_decrypt(): Imisebenzi ye-cryptographic eyenziwe ngokwezifiso yokufihla iziteshi zokuxhumana, ebalulekile ekusetshenzisweni kwe-DGA.load_libraries(): Umsebenzi oyinhloko ohlanganisa yonke inqubo yezigaba eziningi, kusukela ekulandeni kokuqala kuya ekusetshenzisweni kokugcina komthwalo kanye nokuhlanza.
Nemiphumela
Njengakwamanye amaphakheji angaba yingozi ahlonzwe yi-MEW, i-dependency firewall yavikela ngokushesha abasebenzisi ababezofaka la maphakheji yingozi ekuthembekeni kwabo. Ngemva kokuqinisekiswa, silandele izinqubo zesaziso kuzo zombili izindawo zokubhalisa, okwathi ngemva kokubuyekezwa zasusa womabili amaphakheji.
