Lethathamong la PyPI (Python Package Index), ho ile ha fumanoa liphutheloana tse mpe tse 26 tse nang le khoutu e hlakileng ho setup.py script, e khethollang boteng ba li-identifiers tsa crypto wallet ka har'a clipboard ebe e li fetola sepacheng sa mohlaseli (ho nahanoa hore ha ho etsoa tefo, motho ea hlokofalitsoeng a ke ke a hlokomela hore chelete e fetisitsoeng ka nomoro ea sepache ea phapanyetsano ea li-clipboard e fapane).
Ho kenya sebaka ho etsoa ke JavaScript script, eo, ka mor'a ho kenya sephutheloana se kotsi, se kenngoa ho sebatli ka mokhoa oa ho eketsa sebatli, se etsoang ho latela moelelo oa leqephe le leng le le leng la websaete le shebiloeng. Ts'ebetso ea ho kenya li-add-on e totobetse sethaleng sa Windows 'me e kenngoa ts'ebetsong bakeng sa libatli tsa Chrome, Edge le Brave. E ts'ehetsa phetisetso ea li-wallet bakeng sa li-cryptocurrensets tsa ETH, BTC, BNB, LTC le TRX.
Liphutheloana tse kotsi li patiloe bukeng ea PyPI joalo ka lilaebrari tse ling tse tsebahalang tse sebelisang typequatting (ho fana ka mabitso a tšoanang a fapaneng ka litlhaku tse fapaneng, mohlala, mohlala, ho fapana le mohlala, djangoo sebakeng sa django, pyhton sebakeng sa python, joalo-joalo). Kaha li-clone tse bōpiloeng li pheta-pheta ka ho feletseng lilaebraring tse molaong, li fapane feela ka ho kenngoa ka lonya, bahlaseli ba itšetlehile ka basebelisi ba sa tsotelleng ba entseng typo mme ba sa hlokomele phapang ea lebitso ha ba ntse ba batla. Ha ho nahanoa ka botumo ba lilaebrari tsa pele tse molaong (palo ea likopi tse jarollotsoeng e feta limilione tse 21 ka letsatsi), tseo li-clones tse mpe li ipatileng joalo ka, monyetla oa ho ts'oara mohlaseluoa o phahame haholo; mohlala, hora kamora ho phatlalatsoa sephutheloana sa pele se kotsi, se kopitsoe makhetlo a fetang 100.
Hoa hlokomeleha hore bekeng e fetileng sehlopha se le seng sa bafuputsi se ile sa tsebahatsa liphutheloana tse ling tse 30 tse mpe ho PyPI, tseo tse ling tsa tsona li neng li ipapisitse le lilaebrari tse tsebahalang. Nakong ea tlhaselo, e ileng ea nka libeke tse ka bang peli, liphutheloana tse lonya li ile tsa kopitsoa ka makhetlo a 5700. Sebakeng sa mongolo oa ho nkela li-wallet tsa li-crypto sebakeng sa liphutheloana tsena, ho ile ha sebelisoa karolo e tloaelehileng ea W4SP-Stealer, e batlisisang sistimi ea lehae bakeng sa li-password tse bolokiloeng, linotlolo tsa phihlello, li-wallet tsa crypto, li-tokens, li-cookie tsa seboka le tlhaiso-leseling e meng ea lekunutu, 'me e romella lifaele tse fumanoeng. ka Discord.
Mohala o lebisitsoeng ho W4SP-Stealer o entsoe ka ho kenya polelo "__import__" sebakeng sa setup.py kapa __init__.py lifaele, tse neng li arotsoe ke libaka tse ngata ho etsa mohala ho __import__ ka ntle ho sebaka se bonahalang ho mohlophisi oa mongolo. "__import__" block e ile ea hlakisa boloko ba Base64 mme ea e ngolla faeleng ea nakoana. Sebaka sena se ne se e-na le script bakeng sa ho khoasolla le ho kenya W4SP Stealer tsamaisong. Sebakeng sa polelo ea "__import__", "block" e mpe ho liphutheloana tse ling e kentsoe ka ho kenya sephutheloana se eketsehileng ho sebelisoa mohala oa "pip install" o tsoang ho setup.py script.
Liphutheloana tse mpe tse khethiloeng tse senyang linomoro tsa crypto wallet:
- sopho e monate4
- beautifulsup4
- cloorama
- cryptography
- setšoantšo sa crpytography
- djangoo
- hello-lefatše-mohlala
- hello-lefatše-mohlala
- ipyhton
- lengolo-tsoibila
- mysql-sehokelo-pyhton
- notebok
- pyautogiu
- pygaem
- pythorhc
- python-dateuti
- python-flask
- python3-flask
- pyyalm
- rqeuest
- slenium
- sqlachemy
- sqlcemy
- tkniter
- urllib
Liphutheloana tse mpe tse bonts'itsoeng tse romellang lintlha tsa bohlokoa ho tsoa ho sistimi:
- typeutil
- mofuta oa mofuta
- sutiltype
- duonet
- fatnoob
- strinfer
- pydprotect
- incrivelsim
- twine
- pyptext
- instola
- LBH
- colorwin
- likopo-httpx
- colorsama
- shaasigma
- khoele
- felpesviadinho
- kyprese
- pystyte
- pyslyte
- pystyle
- pyurllib
- algorithmic
- oiu
- iao
- curlapi
- mofuta-mmala
- li-pyhints
Source: opennet.ru