【高危】NPM组件 @axaclient-socle-front/redux-helpers 等窃取主机敏感信息
漏洞描述
当用户安装受影响版本的 @axaclient-socle-front/redux-helpers 等NPM组件包时会窃取主机的主机名、用户名、IP地址、/etc/passwd 文件等信息并发送到攻击者可控的服务器地址。
| MPS编号 | MPS-t65p-h7sz |
|---|---|
| 处置建议 | 强烈建议修复 |
| 发现时间 | 2025-08-26 |
| 投毒仓库 | npm |
| 投毒类型 | 主机信息收集 |
| 利用成本 | 低 |
| 利用可能性 | 中 |
影响范围
| 影响组件 | 受影响的版本 | 最小修复版本 |
|---|---|---|
| @espace-client-axafr/redux-ajax-auth | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/atp-digital | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/savings-webservices | [1.0.0, 1.0.0] | – |
| @axaclient-socle-front/webmodule | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/sso-agipi | [1.0.0, 1.0.0] | – |
| remote-dom-1 | [10.0.1, 10.0.1] | – |
| @espace-client-axafr/sticker-policy-list | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/resiliation | [1.0.0, 1.0.0] | – |
| vite-plugin-uni-i18n | [1.0.2, 1.0.2] | – |
| @espace-client-axafr/popin-header | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/document-card | [1.0.0, 1.0.0] | – |
| react-milton | [19.1.1, 19.1.1] | – |
| @espace-client-axafr/latest-reimbursements | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/phygital-offres | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/alert-resilience-message | [1.0.0, 1.0.0] | – |
| tailwind-round-icon | [1.0.2, 1.0.2] | – |
| @espace-client-axafr/shared-types | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/otp-form | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/update-social-security | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/mes-documents-contrat | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/sdj | [1.0.0, 1.0.0] | – |
| tailwind-color-icon | [1.0.2, 1.0.2] | – |
| gulp-wimp | [1.0.0, 2.0.0] | – |
| @espace-client-axafr/tchat-ecco | [1.0.0, 1.0.0] | – |
| model-viewer-docs | [10.0.1, 10.0.1] | – |
| @espace-client-axafr/otp-code | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/redux-contrib | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/lme | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/mise-en-avant | [1.0.0, 1.0.0] | – |
| utility-nodes | [10.0.1, 10.0.1] | – |
| @espace-client-axafr/icc-ma-maison | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/contact-form | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/remplacement-auto | [1.0.0, 1.0.0] | – |
| d-aliased2 | [10.0.1, 10.0.1] | – |
| msmg-frontend-task | [2.0.5, 2.0.9] | – |
| tailwind-beauty-icon | [1.0.2, 1.0.2] | – |
| @espace-client-axafr/configure-store | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/advisor | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/savings-distribution | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/bonus-euro-plus | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/popin-resilience | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/bloc-business | [1.0.0, 1.0.0] | – |
| peer1 | [10.0.1, 10.0.1] | – |
| theme-hackermode | [10.0.1, 10.0.1] | – |
| @espace-client-axafr/page-user-profile | [1.0.0, 1.0.0] | – |
| pnpm_prune_lockfile_v8 | [10.0.1, 10.0.1] | – |
| @espace-client-axafr/popin-arkea | [1.0.0, 1.0.0] | – |
| tailwind-nbr-icon | [1.0.3, 1.0.3] | – |
| pumpdotfun-sdk-v3.0 | [3.0.0, 3.1.2] | – |
| @espace-client-axafr/icc-mon-auto | [1.0.0, 1.0.0] | – |
| example-third-party-queries-caching | [10.0.1, 10.0.1] | – |
| @espace-client-axafr/standard-card | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/demat-contract | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/banniere-alerte-client | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/rib-v2 | [1.0.0, 1.0.0] | – |
| string-mapper | [1.3.8, 1.3.9] | – |
| @espace-client-axafr/pages-editoriales | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/juridica | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/user-profile | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/chat-genesys-auth | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/formulaire-contact-unifie | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/kyc-widget | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/vsup | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/completer-arret-travail | [1.0.0, 1.0.0] | – |
| internal-vscode-extension | [10.0.1, 10.0.1] | – |
| @espace-client-axafr/remboursements | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/contract-selection | [1.0.0, 1.0.0] | – |
| filigron-icon | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/section-derniers-documents | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/fetch-helper | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/block-advisor | [1.0.0, 1.0.0] | – |
| example-infinite-scroll | [10.0.1, 10.0.2] | – |
| @espace-client-axafr/advisor-list | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/resiliation-3-clics | [1.0.0, 1.0.0] | – |
| @realstate.com.au/webview | [7.7.7, 7.7.7] | – |
| @espace-client-axafr/performance-indicator | [1.0.0, 1.0.0] | – |
| example-backend | [1.0.0, 99.1.3] | – |
| @espace-client-axafr/global-popin | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/paiement-cotisation | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/arret-travail | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/user-profile-acceptance | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/social-security-input | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/redirection-angel | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/savings-types | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/round-button | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/confirmation-screen | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/skeleton | [1.0.0, 1.0.0] | – |
| @axaclient-socle-front/redux-helpers | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/dashboard-standard-card | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/document-menu | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/page-debranchement-agipi | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/file-upload-block | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/dashboard-detail-card | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/rib | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/certificate-auto | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/savings-card | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/greeting-message | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/page-details-contrat | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/advisor-details | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/reimbursements-info | [1.0.0, 1.0.0] | – |
| relay-twilio | [7.7.7, 7.7.7] | – |
| @espace-client-axafr/healthcare-upload | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/new-rib | [1.0.0, 1.0.0] | – |
| @furious_whale/flyline | [0.0.9, 1.1.0] | – |
| @espace-client-axafr/eretrait | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/popin-footer | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/savings-summary-card | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/declaration-sinistre-auto | [1.0.0, 1.0.0] | – |
| @espace-client-axafr/api-mapping | [1.0.0, 1.0.0] | – |
参考链接
https://www.oscs1024.com/hd/MPS-t65p-h7sz
安全处理建议
- 排查是否安装了受影响的包：
使用墨菲安全软件供应链安全平台等工具快速检测是否引入受影响的包。 - 立即移除受影响包：
若已安装列表中的恶意包，立即执行 npm uninstall <包名>，并删除node_modules和package-lock.json后重新安装依赖。 - 全面检查系统安全：
运行杀毒软件扫描，检查是否有异常进程、网络连接（重点关注境外 IP 通信），排查环境变量、配置文件是否被窃取（如数据库密码、API 密钥等），必要时重置敏感凭证。 - 加强依赖管理规范：
- 仅从官方 NPM 源安装组件，避免使用第三方镜像或未知来源的包。
- 使用npm audit、yarn audit定期检查依赖漏洞。
- 限制package.json中依赖的版本范围（如避免*或latest），优先选择下载量高、社区活跃的成熟组件。
- 集成墨菲安全软件供应链安全平台等工具自动监控风险。
一键自动排查全公司此类风险
墨菲安全为您免费提供一键排查全公司开源组件漏洞&投毒风险服务，可一键接入扫描全公司的代码仓库、容器镜像仓库、主机、制品仓库等。
试用地址：https://www.murphysec.com/adv?code=CY7N
提交漏洞情报：https://www.murphysec.com/bounty
关于本次投毒的分析
- 包名：@axaclient-socle-front/redux-helpers@1.0.0
攻击目标：AXA法国客户相关前端项目
理由：受影响包多含@espace-client-axafr作用域，指向AXA法国客户项目，窃取主机信息可能针对其开发/部署环境。
