这是恶意代码的证据吗？

Question

我正在使用 create-react-app 开发 React 应用程序，最近我在 VS Code 终端中看到了一些对我来说有点可疑的错误。看起来一个名为“express”的库正试图找到一个win.ini文件和一些与/etc/passwd.

为什么它需要看那些？

我在 NPM 上查找了“express”，它看起来像一个轻量级的 Web 服务器。那是 create-react-app 用作开发服务器的吗？

URIError: Failed to decode param '/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/windows/win.ini'
    at decodeURIComponent (<anonymous>)
    at decode_param (C:\path\to\my\project\node_modules\express\lib\router\layer.js:172:12)
    at Layer.match (C:\path\to\my\project\node_modules\express\lib\router\layer.js:123:27)
    at matchLayer (C:\path\to\my\project\node_modules\express\lib\router\index.js:574:18)
    at next (C:\path\to\my\project\node_modules\express\lib\router\index.js:220:15)
    at expressInit (C:\path\to\my\project\node_modules\express\lib\middleware\init.js:40:5)
    at Layer.handle [as handle_request] (C:\path\to\my\project\node_modules\express\lib\router\layer.js:95:5)
    at trim_prefix (C:\path\to\my\project\node_modules\express\lib\router\index.js:317:13)
    at C:\path\to\my\project\node_modules\express\lib\router\index.js:284:7
    at Function.process_params (C:\path\to\my\project\node_modules\express\lib\router\index.js:335:12)
    at next (C:\path\to\my\project\node_modules\express\lib\router\index.js:275:10)
    at query (C:\path\to\my\project\node_modules\express\lib\middleware\query.js:45:5)
    at Layer.handle [as handle_request] (C:\path\to\my\project\node_modules\express\lib\router\layer.js:95:5)
    at trim_prefix (C:\path\to\my\project\node_modules\express\lib\router\index.js:317:13)
    at C:\path\to\my\project\node_modules\express\lib\router\index.js:284:7
    at Function.process_params (C:\path\to\my\project\node_modules\express\lib\router\index.js:335:12)
URIError: Failed to decode param '/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/winnt/win.ini'
    at decodeURIComponent (<anonymous>)
    at decode_param (C:\path\to\my\project\node_modules\express\lib\router\layer.js:172:12)
    at Layer.match (C:\path\to\my\project\node_modules\express\lib\router\layer.js:123:27)
    at matchLayer (C:\path\to\my\project\node_modules\express\lib\router\index.js:574:18)
    at next (C:\path\to\my\project\node_modules\express\lib\router\index.js:220:15)
    at expressInit (C:\path\to\my\project\node_modules\express\lib\middleware\init.js:40:5)
    at Layer.handle [as handle_request] (C:\path\to\my\project\node_modules\express\lib\router\layer.js:95:5)
    at trim_prefix (C:\path\to\my\project\node_modules\express\lib\router\index.js:317:13)
    at C:\path\to\my\project\node_modules\express\lib\router\index.js:284:7
    at Function.process_params (C:\path\to\my\project\node_modules\express\lib\router\index.js:335:12)
    at next (C:\path\to\my\project\node_modules\express\lib\router\index.js:275:10)
    at query (C:\path\to\my\project\node_modules\express\lib\middleware\query.js:45:5)
    at Layer.handle [as handle_request] (C:\path\to\my\project\node_modules\express\lib\router\layer.js:95:5)
    at trim_prefix (C:\path\to\my\project\node_modules\express\lib\router\index.js:317:13)
    at C:\path\to\my\project\node_modules\express\lib\router\index.js:284:7
    at Function.process_params (C:\path\to\my\project\node_modules\express\lib\router\index.js:335:12)
URIError: Failed to decode param '/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/windows/win.ini'
    at decodeURIComponent (<anonymous>)
    at decode_param (C:\path\to\my\project\node_modules\express\lib\router\layer.js:172:12)
    at Layer.match (C:\path\to\my\project\node_modules\express\lib\router\layer.js:123:27)
    at matchLayer (C:\path\to\my\project\node_modules\express\lib\router\index.js:574:18)
    at next (C:\path\to\my\project\node_modules\express\lib\router\index.js:220:15)
    at expressInit (C:\path\to\my\project\node_modules\express\lib\middleware\init.js:40:5)
    at Layer.handle [as handle_request] (C:\path\to\my\project\node_modules\express\lib\router\layer.js:95:5)
    at trim_prefix (C:\path\to\my\project\node_modules\express\lib\router\index.js:317:13)
    at C:\path\to\my\project\node_modules\express\lib\router\index.js:284:7
    at Function.process_params (C:\path\to\my\project\node_modules\express\lib\router\index.js:335:12)
    at next (C:\path\to\my\project\node_modules\express\lib\router\index.js:275:10)
    at query (C:\path\to\my\project\node_modules\express\lib\middleware\query.js:45:5)
    at Layer.handle [as handle_request] (C:\path\to\my\project\node_modules\express\lib\router\layer.js:95:5)
    at trim_prefix (C:\path\to\my\project\node_modules\express\lib\router\index.js:317:13)
    at C:\path\to\my\project\node_modules\express\lib\router\index.js:284:7
    at Function.process_params (C:\path\to\my\project\node_modules\express\lib\router\index.js:335:12)
URIError: Failed to decode param '/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/winnt/win.ini'
    at decodeURIComponent (<anonymous>)
    at decode_param (C:\path\to\my\project\node_modules\express\lib\router\layer.js:172:12)
    at Layer.match (C:\path\to\my\project\node_modules\express\lib\router\layer.js:123:27)
    at matchLayer (C:\path\to\my\project\node_modules\express\lib\router\index.js:574:18)
    at next (C:\path\to\my\project\node_modules\express\lib\router\index.js:220:15)
    at expressInit (C:\path\to\my\project\node_modules\express\lib\middleware\init.js:40:5)
    at Layer.handle [as handle_request] (C:\path\to\my\project\node_modules\express\lib\router\layer.js:95:5)
    at trim_prefix (C:\path\to\my\project\node_modules\express\lib\router\index.js:317:13)
    at C:\path\to\my\project\node_modules\express\lib\router\index.js:284:7
    at Function.process_params (C:\path\to\my\project\node_modules\express\lib\router\index.js:335:12)
    at next (C:\path\to\my\project\node_modules\express\lib\router\index.js:275:10)
    at query (C:\path\to\my\project\node_modules\express\lib\middleware\query.js:45:5)
    at Layer.handle [as handle_request] (C:\path\to\my\project\node_modules\express\lib\router\layer.js:95:5)
    at trim_prefix (C:\path\to\my\project\node_modules\express\lib\router\index.js:317:13)
    at C:\path\to\my\project\node_modules\express\lib\router\index.js:284:7
    at Function.process_params (C:\path\to\my\project\node_modules\express\lib\router\index.js:335:12)
URIError: Failed to decode param '/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/etc/passwd'
    at decodeURIComponent (<anonymous>)
    at decode_param (C:\path\to\my\project\node_modules\express\lib\router\layer.js:172:12)
    at Layer.match (C:\path\to\my\project\node_modules\express\lib\router\layer.js:123:27)
    at matchLayer (C:\path\to\my\project\node_modules\express\lib\router\index.js:574:18)
    at next (C:\path\to\my\project\node_modules\express\lib\router\index.js:220:15)
    at expressInit (C:\path\to\my\project\node_modules\express\lib\middleware\init.js:40:5)
    at Layer.handle [as handle_request] (C:\path\to\my\project\node_modules\express\lib\router\layer.js:95:5)
    at trim_prefix (C:\path\to\my\project\node_modules\express\lib\router\index.js:317:13)
    at C:\path\to\my\project\node_modules\express\lib\router\index.js:284:7
    at Function.process_params (C:\path\to\my\project\node_modules\express\lib\router\index.js:335:12)
    at next (C:\path\to\my\project\node_modules\express\lib\router\index.js:275:10)
    at query (C:\path\to\my\project\node_modules\express\lib\middleware\query.js:45:5)
    at Layer.handle [as handle_request] (C:\path\to\my\project\node_modules\express\lib\router\layer.js:95:5)
    at trim_prefix (C:\path\to\my\project\node_modules\express\lib\router\index.js:317:13)
    at C:\path\to\my\project\node_modules\express\lib\router\index.js:284:7
    at Function.process_params (C:\path\to\my\project\node_modules\express\lib\router\index.js:335:12)

Answer 1

win.ini 仅存储用于登录的用户设置，而 /etc/passwd 包含 UNIX 系统上的用户列表。这两个文件都不包含密码，甚至不包含密码哈希值。

如果这是恶意的，我怀疑 Express 被用来回发给攻击者服务器以向他们提供信息。