Kurwiswa kwevashandisi veNPM directory kwaonekwa. Musi waFebruary 20, pamusoro pe15 mapakeji akawedzerwa kune NPM repository. Mafaira avo e README aive nemalink ekuphishing saiti kana mareferral links anounza mari. Ongororo yemapakeji yakaratidza 190 yakasarudzika phishing kana advertising links, inotora 31 domains.
Mazita emapakeji akasarudzwa kuti akwezve kutarisisa kweruzhinji, semuenzaniso, "yemahara-tiktok-vateveri," "yemahara-xbox-code," "instagram-vateveri-vakasununguka," zvichingodaro. Chinangwa chaive chekuzadza rondedzero yezvichangobva kuitika paNPM peji yekumba nemapakeji e spam. Tsananguro yepakiti iyi yaisanganisira zvinongedzo zvinovimbisa zvemahara kupa, zvipo, cheats yemitambo, uye masevhisi emahara ekusimudzira vateveri uye zvavanoda pamapuratifomu enhau seTikTok uye Instagram. Aka hakasi kekutanga kurwisa kwakadaro; muna Zvita, 144 spam mapakeji akaburitswa muNuGet, NPM, uye PyPi.
Zvemukati zvepasuru zvakagadzirwa otomatiki uchishandisa Python script, sezviri pachena yakasiiwa mumapakeji, uye yaisanganisira zvitupa zvakashandiswa panguva yekurwiswa. Iwo mapakeji akaburitswa pasi peakaunti akawanda akasiyana achishandisa matekiniki anoita kuti zviome kutsvaga uye nekukasira kuona mapakeji ane dambudziko.
Pamusoro pekuita zvekubiridzira, kuedza kwakati wandei kuburitsa mapakeji ane hutsinye kwakawanikwa muNPM nePyPi repositori:
- 451 mapakeji akashata akawanikwa muPyPI repository akazviita semaraibhurari akakurumbira achishandisa typosquatting (kupa mazita akafanana ane mavara akasiyana, akadai vper pachinzvimbo che vyper, bitcoinnlib pachinzvimbo che bitcoinlib, ccryptofeed pachinzvimbo che cryptofeed, ccxtt pachinzvimbo che ccxt, cryptocommpare pachinzvimbo che cryptocompare, selenium etc.installer etc Iwo mapakeji aisanganisira obfuscated cryptocurrency-kuba kodhi iyo yakaona maID wallet maID mu clipboard uye akatsiva iwo nechikwama cheanorwisa (pfungwa ndeyekuti munhu akabatwa haazocherechedzi nhamba yewallet yakasiyana yakakopwa kubva pa clipboard kana uchibhadhara). Kutsiva kwacho kwakaitwa nebrowser add-on iyo yaimhanya mumamiriro epeji rega rega rewebhu rinoonekwa.
- Mutsara wemaraibhurari eHTTP akashata akawanikwa muPyPI repository. Chiitiko chakashata chakawanikwa mumapaketi makumi mana nerimwe, ane mazita akasarudzwa pachishandiswa nzira dzekutaipa uye akafanana nemaraibhurari anozivikanwa (aio41, chikumbiro, ulrlib, urlb, libhttps, piphttps, httpxv5, nezvimwewo). Iwo mabhadhiro akataridzwa kuita seanoshanda eHTTP raibhurari kana kukopa kodhi yemaraibhurari aripo, uye tsananguro yaive nezvirevo pamusoro pezvakanakira uye kuenzanisa nemaraibhurari eHTTP ari pamutemo. Chiitiko chakashata chaisanganisira kurodha malware kune system kana kuunganidza nekutumira zvakavanzika data.
- NPM yakawanikwa iine 16 JavaScript mapakeji (speedte*, trova*, lagra) ayo, mukuwedzera kune yavo yakataurwa mashandiro (bandwidth yekuyedza), yaivewo nekodhi yekuchera cryptocurrency pasina ruzivo rwemushandisi.
- Mapakeji 691 ane njodzi akaonekwa muNPM. Mapakeji mazhinji ane matambudziko aitevedzera mapurojekiti eYandex (yandex-logger-sentry, yandex-logger-qloud, yandex-sendsms, nezvimwewo) uye aisanganisira kodhi yekutumira ruzivo rwakavanzika kumaseva ekunze. masevaZvinotendwa kuti avo vakaisa mapakeji aya vaiedza kutsiva ma dependency avo pachavo pavaivaka mapurojekiti muYandex (nzira yekutsiva internal dependencies). MuPyPI repository, vaongorori vamwe chete vakawana mapakeji makumi mana nemapfumbamwe (reqsystem, httpxfaster, aio6, gorilla2, httpssos, pohttp, nezvimwewo) ane obfuscated malicious code inodhawunirodha uye inoshandisa faira rinogoneka kubva kuseva yekunze. server.
Source: opennet.ru
