- Iilayibrari ezidumileyo ezifana I-Axios kunye neMastra ziye zachaphazeleka ngenxa yeeakhawunti zomgcini-akhawunti ezithiyiweyo, nto leyo echaphazela izigidi zee-downloads zeveki nganye.
- Abahlaseli basebenzise izixhobo eziphucukileyo postinstall amagwegwe ukuhambisa iingcango zangasemva ezisebenzisa amaqonga ahlukeneyo kunye nokuba iziqinisekiso eziyimfihlo kwiindawo zabaphuhlisi.
- Abenzi bezoyikiso, kuquka abo banxulumene Amaqela aseMantla Korea, baya besebenzisa ngakumbi ukuthembela kwabo kuxhomekeke kwimithombo evulekileyo endaweni yokufuna iziphene zesoftware.
- Iingcali zokhuseleko ziyacebisa ukukhubaza izikripthi zomjikelo wobomi kunye nokuphumeza ulawulo oluqinileyo lokuphuma kwinethiwekhi ukunciphisa impembelelo yeepakeji ezinetyhefu.
Abaphuhlisi bafumanisa ngendlela enzima ukuba indawo yophuhliso lwanamhlanje Iyaqhubeka nokuba yindawo enzima apho igama eliyimfihlo elinye elilityaliweyo linokubeka emngciphekweni amawaka eeprojekthi. Ihlabathi lezobuchwepheshe libone ukwanda okukhulu kwezehlo zothungelwano lokubonelela kutshanje, nto leyo ebonisa ukuba nezona zixhobo zithembekileyo kuphuhliso zinokujikwa kuzo ngemizuzu embalwa kungekho mntu uqaphelayo de kube sekwephuzile.
Idatha yangoku ibonisa ukuba sibona utshintsho olukhulu kwindlela abaphangi abasebenza ngayo, njengoko beyeka ukusebenzisa iindlela zemveli zokujongana nolwaphulo-mthetho. ukhuseleko lwekhonkco lokubonelelaNgokungena kwiinkqubo ze-ecosystems ezidumileyo ezifana ne-npm, abahlaseli banokusasaza ikhowudi enobungozi kwizigidi zeenkqubo ngaxeshanye, beguqula uhlaziyo lwesoftware olusemthethweni lube yindlela yokuhambisa izixhobo ze-malware kunye nokubiwa kwedatha kwinqanaba eliphezulu.
I-Mastra Ecosystem kunye ne-LinkedIn Phishing Trap
Phakathi kowama-2026, isakhelo seMastra, esisetyenziswa kakhulu ekwakheni usetyenziso lwe-AI, saba lixhoba lephulo elidibeneyo elaqala nge uhlaselo lobunjineli bentlalo oluntsonkothileyo. Umntu ofake isandla wafumana umyalezo okhohlisayo kwiLinkedIn, nto leyo ekugqibeleni eyakhokelela ekubeni ithokheni yabo yokupapasha ye-npm ingasebenzi. Umhlaseli akazange achithe xesha, wapapasha iinguqulelo ezingaphezu kwe-140 zeepakeji ezinobungozi phantsi kwesithuba segama leMastra, wafikelela kwisiseko sabasebenzisi esivelisa ukhuphelo olungaphezulu kwesigidi ngeveki.
Okwenza esi siganeko sibe sibi kakhulu kukuba ikhowudi yeMastra ngokwayo ayizange ichukunyiswe, njengoko i-malware yayifihliwe ngaphakathi kwi- ukuxhomekeka okutsha okongeziweyo ebizwa ngokuba yi-easy-day-js. Le phakheji yayiyi-clone yelayibrari yemihla edumileyo, eyenzelwe ukubonakala ingenatyala kuye nawuphi na umphuhlisi oskena okwethutyana umthi wokuxhomekeka kwakhe. Ngokusebenzisa uluhlu lwenguqulelo oluhambayo, umhlaseli waqinisekisa ukuba naluphi na ufakelo olutsha luya kuyitsala ngokuzenzekelayo inguqulelo enetyhefu, ngokuvula umnyango ongasemva kwindawo yokusebenza yomphuhlisi okanye kwi-CI/CD runner.
Amaqela ophando aqaphele umahluko omncinci kwinani lilonke lezinto ezichaphazelekayo, apho inani liqala ukusuka Iipakethi ezili-116 ukuya kwezili-145 kuxhomekeke kwixesha lohlalutyo. Oku kubonisa ukuguquguquka kwezi nkqubo, apho abahlaseli banokupapasha, batshintshe, kwaye bacime ubungqina ngokukhawuleza, nto leyo eshiya amaqela okhuseleko esokola ukuchaza yonke into enokwenzeka ngaphambi kokuba kugqitywe iindlela.
I-Axios Hijacked: Uqhagamshelo lwe-plain-crypto-js
Imeko yaba mbi nangakumbi xa i-Axios, umxhasi oyintloko we-HTTP kubaphuhlisi beJavaScript, yahlaselwa yimeko efanayo. isiganeko sokubiwa kweakhawuntiIinguqulelo 1.14.1 kunye no-0.30.4 zikhutshwe nge-hidden dependency ebizwa ngokuba yi-plain-crypto-js, eyayisebenza njenge-cross-platform Remote Access Trojan (RAT). Le malware yenzelwe ngokukodwa iinkqubo zokugcina izinto, ukumisela ukuqina, kunye nokukhupha idatha eyimfihlo kwiindawo zeWindows, macOS, kunye neLinux ngokufanayo.
Abahlalutyi bezokhuseleko abavela kwiYunithi 42 kunye ne-ESET badibanise isivumelwano se-Axios nomdlali osongelayo owaziwa ngokuba yi I-Sapphire Sleet okanye i-UNC1069, iqela elixelwe ukuba linxulumene nomdla waseMntla Korea. Olu nxibelelwano lubonisa injongo enamandla yezemali, njengoko i-malware yayineemodyuli ezikhethekileyo zokufumanisa nokujolisa ulwandiso lwe-cryptocurrency wallet. Yimeko eqhelekileyo yobuntlola bedijithali obufihlakele ngokucacileyo kwizixhobo esizisebenzisayo ukwakha ii-apps zewebhu ezisisiseko.
Ukuphunyezwa kobugcisa bekunempumelelo eyoyikisayo, kudla ngokugqitywa komjikelo opheleleyo wosulelo ngaphantsi kwemizuzwana elishumi elinesihlanu. Nje ukuba umthwalo uqaliswe, umfakeli wenze ukucoca okunamandla, esusa iifayile zokuseta ezinobungozi waza watshintsha i-manifest eguquliweyo nge-decoy ekhangeleka icocekile. Eli nqanaba lolwazi lwe-forensic lithetha ukuba umphuhlisi unokujonga ifolda yakhe ye-node_modules kwimizuzu embalwa emva kosulelo aze angaboni nto ingaqhelekanga.
Iinkqubo zobugcisa zeHook yokufakela emva
Injini ephambili yezi hlaselo yi-npm postinstall hook, uphawu oluvumela iipakethe ukuba zisebenzise izikripthi ngokuzenzekelayo emva kokufakwa. Nangona yenzelwe ukuba imisebenzi yokumisela esemthethweni, iye yaba lithuba elivulekileyo kakhulu kubahlaseli. Kuzo zombini iimeko zeMastra kunye neAxios, iskripthi se-postinstall siqalise i-obfuscated loader ekhubaza ukuqinisekiswa kwesatifikethi se-TLS, ivumela i-malware ukuba inxibelelane neeseva zomyalelo kunye nolawulo ngaphandle kokuphawulwa zizixhobo zokuhlola inethiwekhi eziqhelekileyo.
Nje ukuba inqanaba lesibini le-malware lilandwe, lidla ngokuvela njengenkqubo ehlukanisiweyo, oko kuthetha ukuba ikhowudi enobungozi iya qhubeka ubaleka ngasemva kwanasemva kokuba inkqubo yokufaka i-npm igqityiwe. Kwiinkqubo zeWindows, i-malware ibonwe ithimba ii-binary ezisemthethweni ezifana nePowerShell ukuze isebenzise izikripthi zayo, ngelixa kwi-macOS nakwiLinux, isebenzisa iinkonzo zenqanaba lenkqubo ukuqinisekisa ukuba iya kusinda ekuqaliseni kwakhona, nto leyo eyenza ukususwa okulula kwephakheji kungasebenzi.
Ngaphandle kokuba nje i-crypto, ezi implants zazikwazi ukubamba imbali yesikhangeli kunye nokukhangela iziqinisekiso zomboneleli welifu okanye izitshixo ze-SSH. Kwinkampani entsha yezobuchwepheshe, le yimeko embi apho imeko-bume yendawo yomphuhlisi iba yindlela yokuba umhlaseli angene kwiiseva zemveliso okanye kwiindawo zokugcina iikhowudi zabucala. Kuyavela ukuba ukhuseleko lwenkampani yakho lunokuxhomekeka kumntu ongamaziyo ngokupheleleyo ongabi nosuku olubi ngolawulo lwakhe lwegama lokugqitha.
Ukuqinisa uMbhobho Ukulwa Neengozi Zexesha Elizayo
Izixhobo zokhuseleko eziqhelekileyo ezifana ne-npm audit zihlala zisilela ukubamba ezi ziganeko kwizigaba zazo zokuqala kuba zixhomekeke kwi iidathabheyisi ezaziwayo zobuthathaka ezinokuthi zishiyeke emva kweephulo ezisebenzayo ze-malware. Ukuze kukhuselwe ngokwenene umbutho, amaqela kufuneka asebenzise iindlela zokuzikhusela ezisebenzayo, ezifana ukusebenzisa ukufakelwa ngeflegi ye- –ignore-scripts ngokuzenzekelayo. Eli nyathelo lilula lithintela ukwenziwa kwee-hook ze-postinstall, ezizezona vector ziphambili zohlaselo oluninzi lwe-supply chain olusekelwe kwi-npm.
Elinye icebo elibalulekileyo libandakanya ukutshintshela kwimodeli yokungathembeki ncam xa kuxhomekeke kwizinto ezixhomekeke kuzo. iifayile ezitshixiweyo kunye neerejista zabucala, iinkampani zinokwenza indawo ye-buffer apho iinguqulelo ezintsha zeepakeji zihlalutywa khona ukuze kujongwe ukungaqheleki kokuziphatha ngaphambi kokuba zivunyelwe kwipayipi yokwakha ephambili. Ukuthintela ukuphuma kwenethiwekhi ukusuka kubagijimi be-CI/CD ukuya kwiidomeyini ezivunyiweyo kuphela kunokwaphula unxibelelwano olufunekayo yi-malware ukuze ilande imithwalo yayo yesibini okanye ikhuphe iithokheni ezibiweyo.
Ekugqibeleni, uxanduva luwela kubagcini kunye nabathengi besoftware evulelekileyo ukuba qinisa ulawulo lokufikelela kwaye usebenzise uqinisekiso lwezinto ezininzi olungenakugqithwa ziithokheni ze-automation. Njengoko ishishini lisiya phambili, ukuphatha ithala leencwadi ngalinye lomntu wesithathu njengomngcipheko onokubakho endaweni yempahla ethembekileyo yindlela ekuphela kwayo yokuhamba kwixesha apho uthotho lweenkonzo ngokwalo luye lwaba sesinye sezixhobo ezisebenzayo kwizixhobo ze-hacker.
