【高危】NPM组件 @azet/api 等窃取主机敏感信息
漏洞描述
当用户安装受影响版本的 @azet/api 等NPM组件包时会窃取用户的主机名、用户名、工作目录、IP地址等信息并发送到攻击者可控的服务器地址。
| MPS编号 | MPS-be0g-pqt1 |
|---|---|
| 处置建议 | 强烈建议修复 |
| 发现时间 | 2025-07-31 |
| 投毒仓库 | npm |
| 投毒类型 | 暂无 |
| 利用成本 | 低 |
| 利用可能性 | 中 |
影响范围
| 影响组件 | 受影响的版本 | 最小修复版本 |
|---|---|---|
| @twork-data-services/currency-config | [0.99.0, 2.99.0] | – |
| enkryptcom | [1.0.0, 1.0.0] | – |
| sentry-core | [1.0.0, 1.0.0] | – |
| @moonpig/web-core-analytics | [172.0.0, 172.0.0] | – |
| flowhint | [1.0.1, 1.0.2] | – |
| @video-platform/react-osd | [1.99.99, 1.99.99] | – |
| @twork-data-services/proxy-prime-api-v6-customer-account-lite-info | [0.99.0, 99.99.0] | – |
| twine-to-yoto | [7.7.7, 7.7.7] | – |
| rca-overlay-panel | [3.0.0, 3.0.0] | – |
| vite-plugin-react-ping | [8.9.8, 8.9.8] | – |
| @twork-data-services/customer-storage-api-v5-customer | [0.99.0, 99.99.0] | – |
| common-js-support | [1.0.0, 1.0.0] | – |
| @twork-data-services/company-notes | [0.99.0, 99.99.0] | – |
| @twork-data-services/customer-storage-api-v2-customer-email | [0.99.0, 9.99.0] | – |
| real-socket-rt | [2.12.1, 2.12.1] | – |
| node-log-stream | [1.0.12, 1.0.12] | – |
| spendesk | [99.99.99, 99.99.99] | – |
| @azet/api | [1.0.0, 1.0.0] | – |
| subchart | [1.0.0, 99.99.1] | – |
| @twork-data-services/sme-customer-employee-company | [0.99.0, 99.99.0] | – |
| @azl-react-components/molecules | [172.0.0, 172.0.0] | – |
| @nstark/angular.js | [1.0.0, 1.0.0] | – |
| @sme-configs/karma-coverage | [1.99.99, 1.99.99] | – |
| @twork-data-services/customer-storage-api-v3-customer-attribute | [0.99.0, 99.99.0] | – |
| @moonpig/web-core-utils | [172.0.0, 172.0.0] | – |
| openai-tsp | [16.0.0, 16.0.0] | – |
| shmam-test-apple | [1.0.0, 2.0.0] | – |
| @twork-data-services/company-employee | [0.99.0, 99.99.0] | – |
| tms-spike | [5.1.1, 5.1.1] | – |
| @twork-data-services/aggregator-sme-task-info | [0.99.0, 99.99.0] | – |
| @twork-data-services/aggregator-sme-group-queues | [0.99.0, 99.99.0] | – |
| @twork-data-services/company-tariff-partnum | [0.99.0, 99.99.0] | – |
| vvite-plugin-react-ping | [8.9.8, 8.9.8] | – |
| request-sentry | [1.2.1, 1.2.1] | – |
| @video-platform/react-core | [1.99.99, 1.99.99] | – |
| exceljs-ui | [2.14.4, 2.14.5] | – |
| @twork-data-services/company | [0.99.0, 99.99.0] | – |
| @mintstudiouicore/telemetry | [172.0.0, 172.0.0] | – |
| @twork-data-services/customer-storage-api-v3-customer-timezone | [0.99.0, 99.99.0] | – |
| @twork-data-services/customer-attribute-api-v3-customer-attribute-by-name | [0.99.0, 99.99.0] | – |
| @mintstudiouicore/coreutil | [172.0.0, 172.0.0] | – |
| react-icon-maker | [1.1.1, 1.1.4] | – |
| testing-octa | [1.0.0, 1.0.0] | – |
| weavejs-backend | [10.4.5, 10.4.5] | – |
| @platform-ui-storybook/copy-button | [12.999.99, 12.999.99] | – |
| @twork-data-services/sme-agent-company-relation | [0.99.0, 99.99.0] | – |
| json-configs | [8.9.8, 8.9.8] | – |
| @azl-react-components/svgs | [172.0.0, 172.0.0] | – |
| react-qrcode-icon | [1.0.1, 1.0.3] | – |
| @twork-data-services/proxy-cms-customer-pay-tokens | [0.99.0, 2.99.0] | – |
| @twork-data-services/proxy-prime-acc-info | [0.99.0, 99.99.0] | – |
| node-loggerx | [0.3.0, 0.3.1] | – |
| display-notifications | [3.3.4, 3.3.4] | – |
| vite-singleparse | [1.0.0, 1.0.0] | – |
| @twork-data-services/proxy-invest-v2-api-v2-broker-account-customer-info | [0.99.0, 99.99.0] | – |
| jexnpm | [1.0.0, 1.0.1] | – |
| @twork-data-services/customer-api-v2-customer-vip-status | [0.99.0, 99.99.0] | – |
| actions-set-env-vars | [2.4.5, 10.2.4] | – |
| @moonpig/web-core-app | [172.0.0, 172.0.0] | – |
| surpaonchainagent | [7.7.7, 7.7.7] | – |
| redux-eslint-saga | [12.14.1, 12.14.1] | – |
| @twork-data-services/company-attributes | [0.99.0, 99.99.0] | – |
| @video-platform/core | [1.99.99, 1.99.99] | – |
| cookie-loggers | [8.9.8, 8.9.8] | – |
| epic-games-nav-share | [1.0.0, 1.0.1] | – |
| @twork-data-services/proxy-get-client-id-by-acc-number | [0.99.0, 99.99.0] | – |
| vite-log-plugin | [1.0.1, 1.0.1] | – |
| @twork-data-services/sme-company-search | [0.99.0, 99.99.0] | – |
| @viihdeonline/react-app | [99.49.50, 172.0.0] | – |
| @azl-react-components/atoms | [172.0.0, 172.0.0] | – |
参考链接
https://www.oscs1024.com/hd/MPS-be0g-pqt1
安全处理建议
- 排查是否安装了受影响的包：
使用墨菲安全软件供应链安全平台等工具快速检测是否引入受影响的包。 - 立即移除受影响包：
若已安装列表中的恶意包，立即执行 npm uninstall <包名>，并删除node_modules和package-lock.json后重新安装依赖。 - 全面检查系统安全：
运行杀毒软件扫描，检查是否有异常进程、网络连接（重点关注境外 IP 通信），排查环境变量、配置文件是否被窃取（如数据库密码、API 密钥等），必要时重置敏感凭证。 - 加强依赖管理规范：
- 仅从官方 NPM 源安装组件，避免使用第三方镜像或未知来源的包。
- 使用npm audit、yarn audit定期检查依赖漏洞。
- 限制package.json中依赖的版本范围（如避免*或latest），优先选择下载量高、社区活跃的成熟组件。
- 集成墨菲安全软件供应链安全平台等工具自动监控风险。
一键自动排查全公司此类风险
墨菲安全为您免费提供一键排查全公司开源组件漏洞&投毒风险服务，可一键接入扫描全公司的代码仓库、容器镜像仓库、主机、制品仓库等。
试用地址：https://www.murphysec.com/adv?code=FZEU
提交漏洞情报：https://www.murphysec.com/bounty
关于本次投毒的分析
-
包名：@twork-data-services/*@[0.99.0, 99.99.0]
攻击目标：twork-data-services相关企业项目
理由：大量@twork-data-services子包受影响，版本范围宽，可能针对使用该系列组件的企业，窃取内部主机敏感信息。 -
包名：@moonpig/web-core-*@172.0.0
攻击目标：Moonpig Web应用
理由：@moonpig/web-core-analytics等核心组件被投毒，版本统一，可能定向影响Moonpig的Web项目。 -
包名：@azl-react-components/*@172.0.0
攻击目标：Azl React组件使用者
理由：@azl-react-components的atoms/molecules/svgs组件受影响，版本一致，可能针对使用该组件库的React项目。
