- Amaphakheji amabili we-npm, i-colortoolsv2 ne-mimelib2, adonsele umyalo nokulawula ama-URL ezinkontileka ezihlakaniphile ze-Ethereum ukuze alande uhlelo olungayilungele ikhompuyutha lwesigaba sesibili.
- Umsebenzi uboshelwe kunethiwekhi ebanzi ye-GitHub yobunjiniyela bezenhlalo enezindawo mbumbulu zokuhweba-i-bot kanye namamethrikhi okuzibandakanya akhuphukile.
- Abahlaseli bashintshanisa amaphakheji ngemva kokwehliswa futhi baphinde basebenzisa inkontileka ye-on-chain efanayo, okusiza ithrafikhi ukuthi ihlangane nomsebenzi osemthethweni we-blockchain.
- Abacwaningi bashicilele ama-IoC futhi banxusa onjiniyela ukuthi baqinisekise abanakekeli, bahlole ukuncika, futhi baqaphe ukubheka okungajwayelekile kwe-on-chain.
Abahlaziyi bezokuphepha bachaze kabanzi ngokungena kwe-supply chain lapho amaphakheji e-npm athinta khona izinkontileka ezihlakaniphile ze-Ethereum ukuze athole izixhumanisi zokulanda ezifihliwe zemithwalo eyengeziwe. Leli qhinga lifihla ingqalasizinda enonya ngemuva kwezingcingo zomphakathi ze-blockchain, okwenza kube nzima ukuskena okuvamile kanye nokuphendula kwezehlakalo.
Amaphakheji amabili, i-colortoolsv2 kanye ne-mimelib2 , avele ngoJulayi 2025 futhi asuswa ngokushesha kurejista. Iqondise kubathuthukisi ohlelweni lwe-crypto, ikhodi isebenze njengesilandi esincane esihlanganisa umsebenzi wayo wenethiwekhi nemibuzo evamile yochungechunge , ngokusho kocwaningo olwenziwe yinkampani yokunikezela ngesoftware i-ReversingLabs.
Okutholwe ngabacwaningi
Esikhundleni sama-endpoints aqinile, amaphakheji alande ama-URL esigaba esilandelayo kwinkontileka ehlakaniphile ye-Ethereum noma nini lapho esetshenziswa noma engeniswa njengokuxhomekeka. Lokho kuqondisa kubonisa amasu angaphambilini ayimfihlo njenge-EtherHiding futhi kwavumela usongo ukuthi lubonakale njengethrafikhi ye-blockchain esemthethweni . Ngenkathi ukuziphatha okubi kukhodi ye-npm kwakuqondile, amaphrojekthi ahlobene ne-GitHub asebenze kanzima ukuze abonakale ethembekile.
Indlela inkombandlela ye-on-chain esebenze ngayo
Abaphenyi bathole ukuthi i-colortoolsv2 ithumele i-minimum loader (kufaka phakathi i-index.js routine) ebuze ngenkontileka ye-on-chain yenani lentambo elimelela indawo yokulanda yesigaba sesibili. Inkontileka eku-0x1f171a1b07c108eae05a5bccbe86922d66227e2b iveze imisebenzi yokufunda ebuyisele i-URL, eyasetshenziswa yi-loader ukudonsa umthwalo okhokhelwayo kuseva elawulwa ngumhlaseli.
Ngemva kokuthi i-npm ivimbe i-colortoolsv2 cishe ekuqaleni kukaJulayi, opharetha bethule i-mimelib2 nge-logic efanayo kanye nereferensi yenkontileka efanayo, benciphisa izinguquko ngenkathi begcina isiteshi sabo sokulawula singasebenzi. Ingxenye yesigaba sesibili yasebenza ngemva kokuthola, kanye ne-hash yayo yaxhunyaniswa abacwaningi ukuthola kanye nokuhlola i-forensic.
Ilure ye-GitHub ehlanganisiwe
Ukulayishwa kwe-npm kutshalwe ngenethiwekhi yama -repository e-GitHub akhohlisayo akhangisa amathuluzi okuhweba azenzakalelayo, njenge-solana trading bot v2, ethereum mev bot v2, arbitrage bot, kanye ne-hyperliquid trading bot. Ama-akhawunti angemuva kwala maphrojekthi ayenezindlela zomsebenzi ezenzelwe ukubukeka ziyiqiniso: izinkanyezi ezikhuphukile nababukeli, imisebenzi evame ukwenziwa (ezinye ezingabalulekile), kanye nabanakekeli abaningi abasohlwini.
Abahlaziyi bahlobanisa lo mzamo wokukhulisa ulwazi ne- Stargazers Ghost Network , iqembu lokusabalalisa njengesevisi elihlanganisa izinkanyezi, amafoloko, libukele, futhi lizibophezele ekuqiniseni ukubonakala kwezindawo zokugcina eziyingozi. Ezinye izibambo zomsebenzisi ezicashunwe emlandweni we-commit zengeze ukuncika okunonya ngqo, futhi okungenani i-akhawunti eyodwa ehlobene ne-GitHub isisusiwe.
Kungani lokhu kugwema ukuzivikela okujwayelekile
Ngenxa yokuthi umlandi uthintane ne -blockchain yomphakathi ukuze athole imiyalelo yayo, izihlungi ezijwayelekile kanye nohlu lokuvimba ama-URL bekungasebenzi kahle. Amathuluzi amaningi okuphepha awafaki uphawu lwezingcingo zenkontileka zokufunda kuphela, futhi umhlaseli angazungeza ama-endpoints okusingatha ngokubuyekeza idatha ye-on-chain kunokuthinta ikhodi yephakheji noma ingqalasizinda ephakathi . Leyo nhlanganisela iphakamisa ibha yokuthola nokususa.
Abacwaningi baphawule ukuthi imibono efanayo iye yavela ngaphambili emisebenzini egxile kwi-crypto, kodwa ukusebenzisa inkontileka ehlakaniphile ukusetha izindawo ze-C2 ze-npm malware kuphawula ushintsho oluphawulekayo endleleni okuhlolwa ngayo izimiso zemvelo ezivulekile. Imikhankaso eqoshiwe ehlobene ne-crypto kuma-repos omphakathi yanda ngo-2024, ngamacala angaphezu kwamashumi amabili abhalwe phansi, futhi lesi sigameko sibonisa ukuthi la masu ayavuthwa.
Izinkomba zokuvumelana (IoCs)
Lezi zihlonzi ezilandelayo zixhunywe emkhankasweni futhi zingasiza ekuzingeleni nasekutholeni izinsongo:
- izinguqulo ze-npm colortoolsv2: 1.0.0 (SHA1 678c20775ff86b014ae8d9869ce5c41ee06b6215), 1.0.1 (SHA1 1bb7b23f45ed80bce33a6b6e6bc4f99750d5a34b), 1.0.2 (SHA1 db86351f938a55756061e9b1f4469ff2699e9e27)
- izinguqulo ze-npm mimelib2: 1.0.0 (SHA1 bda31e9022f5994385c26bd8a451acf0cd0b36da), 1.0.1 (SHA1 c5488b605cf3e9e9ef35da407ea848cf0326fdea)
- Ukulayishwa kwesigaba sesibili: SHA1 021d0eef8f457eb2a9f9fb2260dd2e39ff009a21
- Inkontileka ehlakaniphile: 0x1f171a1b07c108eae05a5bccbe86922d66227e2b
Umthelela wonjiniyela nokuhlola okunconyiwe
Kumaqembu athembele ku-npm, icala ligcizelela ukuthi izimpawu zokuthandwa zingakhiqizwa . Hlola abanakekeli kanye nomlando we-commit, hlola ukukhishwa kwakamuva kokuziphatha okungajwayelekile kokufaka noma kokufaka ngemuva, futhi uhlole ukuncika okwenza izingcingo ze-blockchain API noma izicelo zenethiwekhi enamandla ngesikhathi sokusebenza.
Izinhlangano kufanele zihlanganise uhlu lwezimvume zephakheji , ukuphina ubuqotho (kufaka phakathi ama-hashes okuncika kokuguquguquka), kanye nokwakhiwa okuphindaphindwayo ngokuhlaziywa okungaguquki nokuziphatha. Ukuqapha inethiwekhi okumaka izingcingo eziphumayo ezingalindelekile kubahlinzeki be-RPC noma ithrafikhi engazelelwe ezizindeni ezingajwayelekile nakho kungaveza ukusetshenziswa kabi kokuqondisa okuku-chain.
Ngaphambi kokufaka amathuluzi aqanjwe ngokuthi ama-robot okuhweba noma abasizi be-MEV, qinisekisa ukuthi ama-akhawunti abhekiselwe kuwo kanye nezindawo zokugcina zinerekhodi langempela, hhayi nje umsebenzi oqhumayo ezinsukwini ezimbalwa. Donsa amaphakheji endaweni ukuze ubuyekezwe ngesandla, skena ama-loaders afihliwe, bese ubheka ikhodi efunda isitoreji senkontileka esihlakaniphile ukuze uthole ama-URL asebenzisekayo.
Abacwaningi batusa futhi ukumaka noma yiziphi izinkomba ezisetshenziswa yizikripthi zokwakha noma zesikhathi sokusebenza, ukuqapha izibuyekezo zesimo senkontileka ezingaqondisa kabusha ukulanda, nokubhala phansi ama-IoC ngaphakathi ukuze izexwayiso ziqhubeke noma ngabe ukufakwa ohlwini noma ama-akhawunti omphakathi kususwa.
Uma kuhlanganiswa, okutholakele kugqamisa indlela izinkontileka ezihlakaniphile ze-Ethereum ezisetshenziswe ngayo kabusha njenge-relay eguquguqukayo yolwazi lwe-C2, indlela i-npm ne-GitHub ezihlanganiswe ngayo endleleni yokulethwa, nokuthi kungani ukuhlanzeka okujulile kwephakheji kanye nokuqapha okuqaphile kwe-chain manje sekuyizingqinamba zamaqembu okuthuthukisa asebenza ngamathuluzi avulekile kanye ne-crypto.
