TL; DR
Umshicileli oyedwa we-npm uthumele amaphakheji amancane ayisishiyagalombili amagama awo afundeka njengezinto zokwakha zansuku zonke ze-blockchain kanye nokuthuthukiswa kwesikhwama semali, base58-utils, abi-encode, eth-dev, arb-kit, layer2-sdk, solana-key-utils, eth-wallet-helpers, Futhi crypto-validate-lib. Ngayinye iqukethe isevisi esebenzayo. Nokho, okufakwe ngemuva kwaleyo sevisi, kuyibhulokhi yekhodi ezibizayo eqhuba ngesikhathi imodyuli ingeniswa.
Cishe imizuzwana engama-37 ngemuva kokungeniswa, lokho kuvimbela ukuqopha umthwalo othunyelwa ngaphakathi kwephakheji efihliwe njengethuluzi lokuhlola, kuwubhala kufayela elifihliwe ngaphansi kwesiqondisi sasekhaya somsebenzisi, uzibhalisele ukuqala kabusha njalo login Kuyo yonke iWindows, i-macOS, ne-Linux, bese iqala iskripthi esinqunyiwe njengenqubo ehlukanisiwe. Akukho lutho ngalokhu oluqala ngesikhathi sokufaka i-npm; kulinda ukuthi ikhodi ingeniswe futhi isebenze, okuyisikhathi esithule kunokufakwa.
Umthwalo okhokhelwayo awubonakali kalula. Uthunyelwa njengesisekelo esilula64, ngakho-ke ukuqopha "i-test fixture" kubuyisa isigaba sesibili ngokugcwele: a isikhwama semali se-crypto kanye nomenzi wezimfihlo olinda ukuthi umshini uhlale ungasebenzi, uvuna okhiye abayimfihlo kanye nemisho yembewu, ubhala ngemfihlo okutholakele ngakunye ngokhiye we-RSA-4096 onamakhodi aqinile, bese uwukhipha ngokuwunamathisela endaweni yokugcina i-IPFS yomphakathi, ubuyisele emuva njalo emahoreni ayi-12.
Silandelela iqembu njengoba I-PhantomSync. Wonke amaphakheji ayisishiyagalombili ayebukhoma kurejista ye-npm ngesikhathi sokuhlaziywa, anyatheliswa ngaphansi kwe-akhawunti eyodwa.
| Ecosystem | npm |
| Packages | base58-utils, abi-encode, eth-dev, arb-kit, layer2-sdk, solana-key-utils, eth-wallet-helpers, crypto-validate-lib |
| Amapulatifomu aqondiwe | IWindows, iMacOS, neLinux |
| Ukuziphatha okuyinhloko | I-dropper yesikhathi sokungenisa ebambezelekile ifihliwe njenge-fixture yokuhlola; ifaka ukuqhubeka kwe-cross-platform |
| Inkokhelo | Isikhwama semali esiyimfihlo kanye nokweba izimfihlo, ukubethela kwe-RSA-4096, ukukhishwa kwe-IPFS yomphakathi |
Ukwakheka komzimba kokuhlasela
Iphakheji ngayinye ibukeka ingavamile ekufundweni kokuqala. i-base58-utilsIsibonelo, ama-kilobytes ambalwa ekhodi yomsizi ye-Base58 / Bitcoin-WIF encike ku-zero — yilokho kanye igama elikuthembisayo. Ikhodi efanele ikhona ngemuva imodyuli ukuthunyelwa kwamanye amazwe kwemodyuli, lapho umfundi ofunda phezulu kwefayela engenakwenzeka ukuthi abukeke: umsebenzi ozibizayo ozihlela nge-timer.
Uchungechunge lwemisebenzi, olwakhiwe kabusha kusukela kumthombo wephakheji, lusebenza kanje:
1. Package is required() by the host project
2. A self-invoking function schedules a callback ~37,000 ms later (setTimeout)
3. On fire, the callback reads test/fixtures/keypairs.dat (a base64 blob)
4. It base64-decodes that blob into a Node.js script
5. It writes the script to ~/.cache-db/.node-sync/syncd.js (mode 0o700)
6. It installs login-persistence for that script (see below)
7. It spawns "node syncd.js" as a detached processIzinketho ezimbili zokuklama ziyagqama.
Umthwalo okhokhelwayo uhamba njengomdlalo wokuhlola. Isigaba sesibili asibhalwanga njengekhodi esobala. Sihlala ku ukuhlolwa/izinto ezisetshenziswayo/ama-keypairs.dat, ifayela le-base64 eligama lalo lihlangana nephakheji ethi liphatha ama-key pairs. Kumuntu ofunda i-tarball, libukeka njengedatha yesampula; kukhodi ehlanganisiwe, liyiskripthi okufanele siqoshwe futhi sisebenze. I-dropper ngokwayo ayinalo ikheli lenethiwekhi - lawo ahlala esigabeni sesibili - kodwa akukho ukufiphazwa okwengeziwe: i-fixture iyingqimba eyodwa ye-base64, ngakho-ke iyayichaza (isisekelo64 -d) ibuyisa konke i-syncd.js kanye nokuziphatha kwayo kwenethiwekhi. Isigaba esilandelayo sichaza lokho okwenziwa yileso sigaba esilulame.
Ukuqhuma kuyabambezeleka futhi kuhlobene nokungenisa, hhayi ukufakwa. Ngoba isisusa singu dinga() kanye ne-timer yemizuzwana engu-~37 kune-hook yokufaka, ukuziphatha okugwema izinyathelo kuhlola okubuka kuphela ukufaka i-npm isinyathelo, futhi ukubambezeleka kudlula imisebenzi eminingi ye-sandbox kanye ne-CI yesikhashana. Ngesikhathi noma yini isebenza, ukufakwa okudonse iphakheji sekuphelile kudala.
Uma iskripthi esihlungiwe sesikudiski ku- ~/.cache-db/.node-sync/syncd.js — indlela ekhethiwe ukuyifunda njengesiqondisi senqolobane evamile — i-dropper iyenza isinde ekuqaliseni kabusha kuzo zonke izinkundla ezintathu ezinkulu:
- I-Linux: ukufakwa kwe-cron okuqalisa kabusha iskripthi. Okufakiwe kufakwa ngokuhlunga i-crontab ekhona ngokusebenzisa i-grep -v ivumelanisiwe, okunomphumela omubi wokushiya okufakiwe okusha ohlwini olucacile olusebenzisa ama-greps egama elifanayo.
- Windows: umsebenzi ohleliwe obizwa ngokuthi I-WinNodeSync, isethwe ukuthi isebenze kabusha ngesikhawu semizuzu eyi-12.
- i-macOS: umsebenzi oqaliwe obhalwe ukuthi com.apple.syncd, ekhona emaphaketheni amaningana — ilebula elilingisa isevisi yesistimu ye-Apple esemthethweni.
Iskripthi siqalwa ngokushesha njengenqubo ehlukanisiwe, ngakho-ke siyaqhubeka nokusebenza ngemva kokuphuma kohlelo lokungenisa.
Lokho okwenziwa yisigaba sesibili
Ngenxa yokuthi i-fixture iyingqimba eyodwa ye-base64, isigaba sesibili sihlukaniswa kahle futhi singafundwa ngokugcwele. Wonke amaphakheji ayisishiyagalombili aphethe enye yezinhlobo ezintathu zeskripthi esifanayo, eziziveza kumazwana ekhanda njenge phantom syncd v3 - topo durmiente (“i-sleeping molecule”). Umsebenzi wayo ukweba izinto ze-cryptocurrency-wallet kanye nezimfihlo zonjiniyela bese uzithumela emshinini. Isebenza ngalezi zinyathelo:
- 1. Linda kuze kube yilapho umshini ungasebenzi. Ngaphambi kokwenza noma yini, i-syncd.js ihlola ukuthi umsebenzisi ubelokhu engasebenzi isikhathi esingakanani futhi iqhubeka idlule umkhawulo (cishe imizuzu eyi-15) — i-xprintidle ku-Linux, ioreg I-HIDIdleTime ku-macOS, kanye nombuzo we-PowerShell wesikhathi sokungasebenzisi i-idle ku-Windows. Ngakho-ke ukuvuna kuvame ukwenzeka uma kungekho muntu osebenzisa ikhibhodi.
- 2. Landa iswishi yokuvula elawulwa kude. Iskripthi sidonsa ukucushwa okuncane kusuka endaweni engenalutho ngaphambi kokuthatha isinyathelo. Umthombo oyinhloko yi-URL eluhlaza ye-GitHub (gist.githubusercontent.com/juang55/…/cfg.txt); iskripthi sisebenza kuphela uma lokho kulungiselelwa kufundwa esebenzayo=1Uma ingqikithi ingatholakali, ibuyela emuva ezihlonzini zokuqukethwe ze-IPFS ezintathu ezifakwe ikhodi eqinile, ezithathwe ngamasango omphakathi. isango.pinata.cloud, ipfs.io, Futhi i-cloudflare-ipfs.comLokhu kunikeza umqhubi ukulawula ingalo/ukukhumula izikhali ngemva kweqiniso kanye nokubuyela emuva okumelana nokususwa. (Uhlobo oluncane kakhulu, luthunyelwa ngo i-crypto-validate-lib, abasizi besikhwama semali, Futhi ama-utils-key-solana, isuse ungqimba lwe-gist futhi incike kuzihlonzi ze-IPFS kuphela.)
- 3. Vuna izinto zesikhwama semali kanye nezimfihlo. Isikripthi sihamba kufolda yasekhaya yomsebenzisi — ~/.config/solana, ~/.ethereum/isitolo sezikhiye, ~/.i-foundry, ~/.hardhat, ~ / .ssh, Futhi Ubuso bekhompyutha/Imibhalo/Play (kufaka phakathi amagama amafolda olimi lwesiSpanishi), kanye ~/.env namafayela e-shell rc, kanye nokulingana I-app data izindawo ku-Windows. Ihlose okhiye abazimele be-Ethereum, okhiye be-Bitcoin WIF, imishwana yembewu ye-BIP-39, okhiye be-Solana, i-Ethereum keystore JSON, okhiye be-SSH, kanye neziguquguquko zemvelo eziyimfihlo. Uhlobo olukhulu (ku i-abi-encode, i-base58-utils, i-eth-dev) iphethe isichazamazwi se-BIP-39 esiphelele samagama angu-2048 futhi isebenzisa izinkulumo ezivamile ukuze akhiphe okhiye ngabanye kanye nemisho yembewu eqinisekisiwe evela kunoma yimuphi umbhalo ofundwayo; izinhlobo ezimbili ezincane esikhundleni salokho zifanisa amafayela ngegama elingukhiye (imbewu, i-mnemonic, isikhwama, metamask, phantom, ileja, kuphephile, ...) bese ulayisha amafayela aphelele.
- 4. Bhala ngemfihlo bese ukhipha ulwazi ngesevisi yomphakathi yokuphina. Ukutholwa ngakunye kuhlanganiswa ngomunwe womsingathi (igama lomsebenzisi@igama lomphathi, ipulatifomu, isitembu sesikhathi) futhi ibethelwe ngokhiye womphakathi we-RSA-4096 onamakhodi aqinile ofakwe kusikripthi. Irekhodi elibethelwe bese lilayishwa ngokulinamathisela ku-IPFS nge api.pinata.cloud/pinning/pinJSONToIPFS, kuqinisekiswe ngeziqinisekiso ze-Pinata API ezifakwe ikhodi eqinile. Ayikho iseva ye-C2 eyenzelwe wena okufanele uyibambe: idatha eyebiwe ipakwe endaweni yokugcina yomphakathi ehlukanisiwe, ingatholwa ngumsebenzisi esebenzisa ama-hashes okuqukethwe avelayo. Ukulayisha kuhlukaniswe ngemizuzwana embalwa ye-jitter engahleliwe, kanye nelogi yendawo ye isitembu sesikhathi | uhlobo lokhiye | i-hash ebuyiselwe igcinwa ku- ~/.cache-db/.node-sync/.sl.
- 5. Phikelela futhi ukhanyise umjikelezo wamahora ayi-12. Isigaba sesibili siphinde simise ukuphikelela kwaso — ukungena kwe-cron ku-Linux, a com.apple.syncd umsebenzi wethulwe ku-macOS, kanye nomsebenzi ohleliwe oqanjwe ngokuthi I-WindowsNodeSync ku-Windows — isethwe ukuthi isebenze kabusha njalo emahoreni ayi-12. Qaphela ukuthi lokhu ezahlukene Igama lomsebenzi weWindows kusukela kulowo ofakwa yi-dropper (I-WinNodeSync); zombili zikufanele ukuzingelwa.
esibekelwe
Amaphakheji ayisishiyagalombili ashicilelwe ngokushesha okukhulu ngomhlaka-2026-07-13 kanye nomhlaka-2026-07-14. Amaningana anezinguqulo ezingaphezu kweyodwa; i-dropper iyafana kuzo zonke izinguqulo, kanye nokushintsha komugqa kuphela njengoba usayizi wekhodi yokusetshenziswa engeyona ingozi ngaphezulu kwayo ushintsha.
Kuyo yonke le nkinga, idumela lomshicileli lokubhalisa lishintshe lisuka ekubeni hlangothi ekuqaleni kweqoqo laya ekubeni libi kakhulu njengoba ukutholwa kuqongelela — umphumela obonakalayo wamaphakheji ahlatshwe umkhosi, hhayi isici esiklanyelwe.
Izinkomba Zokuyekethisa
Zonke izinkomba ezingezansi ziqinisekisiwe ukuthi zikhona ngesikhathi sokuhlaziya — lezo ezisetafuleni “zesigaba sesibili” ngokuzichaza ukuhlolwa/izinto ezisetshenziswayo/ama-keypairs.dat nokufunda okutholiwe i-syncd.js.
Amafayela nezindlela
Ingqalasizinda yenethiwekhi yesigaba sesibili (etholwe ku-syncd.js)
Izinhloso zokuqoqwa kwesigaba sesibili (ezitholwe ku-syncd.js)
Izinto zobuciko eziqhubekayo
Ukuziphatha
- Umsebenzi wokuzibiza ungeziwe ngemva ukuthunyelwa kwamanye amazwe kwemodyuli, ukuhlela i- setTimeout okungu-~37,000 ms ekungenisweni.
- inqubo_yengane ukuvela ("i-node", ) ngesethi yezinketho ezihlukanisiwe.
- Ukusebenza okuvaliwe okungenalutho esigabeni sesibili (i-xprintidle / ioreg Isikhathi sokungenzi lutho se-HIDIdleTime / PowerShell; ~umkhawulo wemizuzu eyi-15).
- Ukuthola ngokubethela kwe-RSA-4096, bese kuba yi-HTTPS I-POST ku-API yokuphina ye-IPFS yomphakathi.
Amaphakheji nezinguqulo (npm, umshicileli solbuilder_io)
Umshicileli
- i-solbuilder_io - angel_lopez89[@]proton[.]me, i-imeyili engaqinisekisiwe, ayikho i-akhawunti yokulawula umthombo eqinisekisiwe, ayikho indawo yokugcina exhunyiwe.
Ukuchazwa kanye nokuziphatha okubonwayo
Amaphakheji ayisishiyagalombili abelana nge-akhawunti eyodwa yomshicileli kanye nomthwalo owodwa wokukhokha. Ngayinye iyiphakheji encane - amakhilobhayithi ambalwa ekhodi yangempela yokusetshenziswa ene-dropper efanayo ehlanganisiwe - eshicilelwe ngaphandle kwendawo yokugcina exhunyiwe futhi ngaphansi kwe-imeyili yesitayela esilahlwayo engaqinisekisiwe. Lokho kufana, indlela yokulahla eyabiwe, amalebula okuphikelela okwabiwe, kanye nokwabelana okwabiwe ama-keypairs.dat ifayela lesiteji yilona elihlanganisa iqembu ndawonye.
Amaphakheji akhuluma ngokungajwayelekile ngokuziphatha kwawo. ama-utils-key-solana iphethe amazwana asemgqeni achaza ibhulokhi ehlanganisiwe ngamagama alula — umuntu uyiqamba ngokuthi I-PHANTOM: ukuphikelela okungabonakali, enye (ngesiSpanishi) ifundeka kanje I-Ejecutar topo en background, “sebenzisa i-mole ngemuva.” Lezi yizincazelo zekhodi ngokwazo zalokho ekwenzayo; igama lomkhankaso kulokhu okuthunyelwe lithathwe kulelo lebula lokuqala kanye ne-node mbumbulu ethi “sync daemon” (ivumelanisiwe) ukuthi imishini yokuphikelela ilingisa.
Sichaza kuphela lokho okwenziwa yikhodi ngokubonakalayo. Ukuqanjwa kwamaphakheji — wonke amagama e-crypto, i-wallet, kanye ne-blockchain-tooling — kubonisa ukuthi izilaleli zonjiniyela cishe zizowadonsa ngamagama; akuzivezi ngokwazo ukuthi ungubani umshicileli. Isigaba sesibili sasitholakala ngokugcwele ngokuchaza ikhodi ye-base64, futhi ukuziphatha kwayo kuchazwe ngenhla: iqoqa okhiye be-wallet, imisho yembewu, kanye nezimfihlo bese izikhipha, zibethelwe yi-RSA, kwisitoreji se-IPFS somphakathi nge-Pinata. Ukukhetha okuphawulekayo kokuklama ukungabikho kweseva ye-C2 yangasese — ukucushwa kuvela ku-GitHub gist kanye ne-IPFS, futhi idatha eyebiwe ipakwe endaweni yokugcina yomphakathi ehlukaniswe yi-hash yokuqukethwe, kokubili okunzima ukuyibamba kune-host eyodwa elawulwa ngumhlaseli. Akukho ukubika komphakathi kwangaphambilini okufana naleli qembu okwatholakala ngesikhathi sokubhala.
Umthelela, Izitayela kanye Nesiqondiso Sabavikeli
Ubani odaluliwe. Noma ubani owengeze elinye lala maphakheji kuphrojekthi ye-Node wabe esesebenzisa ikhodi elingenisa. Ngenxa yokuthi ukuqhuma kuyisikhathi sokungenisa kunokuba isikhathi sokufaka, ukuba nephakheji nje akwanele - kodwa noma yikuphi ukusetshenziswa okuvamile okulayisha imodyuli kufinyelela umthwalo okhokhelwayo. Amagama e-lure ahlose onjiniyela abakha ku-Ethereum, Solana, Arbitrum, Layer-2, kanye nethuluzi lesikhwama/lokufaka ikhodi elijwayelekile - abantu cishe bazoba nempahla efunwa yisigaba sesibili. Noma ubani osebenzise elinye lala ma-module kumshini ophethe okhiye besikhwama, imishwana yembewu, izitolo zokhiye, okhiye be-SSH, noma .inv izimfihlo kufanele ziphathe lezo ziqinisekiso njengezingavikelekile futhi zijike.
Amaphethini amabili afanele ukujwayelaniswa ngaphakathi. Okokuqala, umthwalo-njengoba-uhleliwe: ukuthumela isigaba sesibili njenge-base64 ngaphakathi kwefayela ledatha eliqanjwe ngegama elisobala (ukuhlolwa/izinto ezisetshenziswayo/ama-keypairs.dat) igcina umthombo obonakalayo wephakheji ubukeka uhlanzekile futhi ifaka okuqukethwe okunonya kufayela elibukeza amathuluzi kanye nokuskena kwabantu okuvame ukubhekwa njengedatha engasebenzi. Okwesibili, ukungeniswa kwesikhathi sokulibaziseka kokwenziwa ngokuphikelela kwe-cross-platform: ukususa i-trigger ku-install hook, ukwengeza i-timer, bese uqhubeka kuyo yonke i-cron, imisebenzi ehleliwe, kanye ne-launchd kuyisinyathelo esiqondile kude namasu okufaka-iskripthi anomsindo kakhulu lapho ukuskena kwerejista okuzenzakalelayo kuqapha kakhulu.
Isiqondiso sabavikeli nabalondolozi:
- Phatha ikhodi engeziwe ngemuva ukuthunyelwa kwamanye amazwe kwemodyuli njengento eza kuqala ekubuyekezweni — i-dropper logic ivame ukufihla ngaphansi kobuso bemojuli "yangempela".
- Ungacabangi ukuthi amafayela edatha awasebenzi. I-base64 blob ngaphansi ukuhlolwa/imidlalo/ okufundwa ngesikhathi sokusebenza futhi okuhunyushwe ngekhodi kuyasebenza; funda isikhathi sokusebenza samafayela okulungisa adla i- Umsebenzi/eval/bhala-bese-izalela iketanga.
- Zingela indlela yokulahla ~/.cache-db/.node-sync/ kanye namayunithi okuphikelela I-WinNodeSync (umsebenzi ohleliwe) kanye com.apple.syncd (launchd) kumishini yonjiniyela ekhiphe la magama.
- Isexwayiso ngezinqubo ze-Node ezidala okufakiwe kwe-cron, imisebenzi ehleliwe, noma imisebenzi eqalisiwe — imitapo yolwazi esemthethweni ayivamile ukwenza lokhu lapho ingeniswa.
- Khetha amafayela okukhiya kanye nezinguqulo eziphiniwe, bese ubuyekeza umehluko wanoma yikuphi ukuthembela okuncane "kokusetshenziswa", ikakhulukazi kushicilelwe amaphakheji okuthembela ku-zero ngama-akhawunti angaqinisekiswanga angenalo i-repository exhunyiwe.
Kwabavikeli bokubhalisa, okubalulekile ukuthi ukuqapha ukufakwa kwe-hook kuyadingeka kodwa akwanele: i-dropper yesikhathi sokungenisa, ebambezelekile yesikhathi ehlelwe ngaphakathi kwefayela ledatha izodlula ukuhlolwa kwesikhathi sokufaka kuphela, futhi isinyathelo sokuphikelela ngokuvamile siyisignali ebonakala kakhulu esele ishiywe ukubanjwa.
