- Umhlaseli uphazamise i-akhawunti ye-npm yomnakekeli oyinhloko we-Axios futhi wakhipha izinguqulo 1.14.1 kanye no-0.30.4 nge-phantom dependency, i-plain-crypto-js, eyasebenzisa i-cross-platform RAT ngesikhathi sokufakwa.
- I-malware ixhumane neseva ye-C2 (sfrclak[.]com) futhi yalanda imithwalo ethile yokukhokha ye-Windows, i-macOS, ne-Linux, yenza ukuhlola uhlelo, igcina ama-beacon avamile, futhi kwezinye izimo, yasungula ukuqhubeka.
- Lokhu kuhlasela, okushiwo yi-Google nabanye abacwaningi, kubangelwa umlingisi waseNyakatho Korea i-UNC1069, kwahlanganisa isikhathi sokuvezwa cishe amahora amathathu nomkhankaso wobunjiniyela bezenhlalo oyinkimbinkimbi ngokumelene nomgcini ukuze kwebiwe iziqinisekiso zabo.
- Izinhlangano ezikwazile ukufaka izinguqulo ezithintekile kumele zizibophezele ekuthatheni isinyathelo, zifune izinto zobuciko ze-RAT, zijikeleze iziqinisekiso, zifake izinguqulo ezivikelekile ze-Axios, futhi ziqinise uchungechunge lwazo lokuhlinzeka, i-CI/CD, kanye nezilawuli zokuphathwa kokuxhomekeka.
Umphakathi wokuthuthukiswa kweJavaScript usanda kubhekana nenye yalezo zinto ezesabekayo ezikwenza ucabange kabusha ukuthi uthemba kangakanani ukuthembela kwakho, njengoba kuboniswe yizinkinga zobuthakathaka belabhulali . I-Axios, enye yelabhulali ye-HTTP esetshenziswa kakhulu kuhlelo lwe-ecosystem, yasetshenziswa ngo-npm ukusabalalisa i-remote access trojan (RAT) ngezinguqulo ezibonakala zisemthethweni. Lesi sigameko sathatha amahora ambalwa kuphela, kodwa sikubeke kwacaca ukuthi uchungechunge lokuhlinzekwa kwesofthiwe lulenga ngentambo encane kakhulu kunalokho abaningi ababekucabanga.
Inkinga enkulu akukhona nje ukuthi abahlaseli bakwazile ukungena ngenkani kwiphakheji elandiwe amashumi noma amakhulu ezigidi zezikhathi ngesonto. Inkinga yangempela ukuthi bakwenze ngokuntshontsha i-akhawunti ye-npm yomnakekeli oyinhloko, beshicilela izinguqulo "ezisemthethweni" ezazibonakala zijwayelekile futhi zingathinti ngisho nomugqa owodwa wekhodi yomthombo ye-Axios . Konke ukuziphatha okunonya kwakuncike ekuthembekeni kwe-phantom okwenzelwe ngqo ukuhlaselwa.
Ukuzibophezela kuka-Axios ku-npm kwenzeka kanjani
Ukuze siqonde ubukhulu besigameko, sidinga ukuqala ngendawo yokungena. Umhlaseli ukwazile ukulawula i-akhawunti ye-npm ka-“jasonsaayman,” umgcini oyinhloko we-Axios, futhi washintsha ikheli le-imeyili elihambisanayo laba yilelo elalingaphansi kolawulo lwakhe , elibanjwe ku-Proton Mail. Kusukela ngaleso sikhathi kuqhubeke, babenenkululeko yokushicilela izinguqulo ezintsha zephakheji njengokungathi bangumgcini.
Esebenzisa lezo ziqinisekiso, walayisha izinguqulo ezimbili ezinonya ze-Axios: 1.14.1 kanye ne-0.30.4 , ezihlanganisa amagatsha amabili amakhulu ephrojekthi. Ukulayisha kwenziwe ngemizuzu engama-39 kuphela futhi, ngokusho kokuhlaziywa kwe-StepSecurity, kwenziwa ngqo kusuka ku-npm kusetshenziswa ithokheni yakudala ehlala isikhathi eside, edlula ngokuphelele ipayipi elivamile le-CI/CD elisekelwe ku-GitHub Actions.
Emahoreni ayishumi nesishiyagalombili ngaphambi kokuhlasela kokugcina, umlingisi wayeseshicilele inguqulo "ehlanzekile" ehlobene nokuthembela okunonya ku-npm registry . Lesi sinyathelo sokuqala sasebenza ekukhiqizeni umlando nokuvimbela ukuhlolwa okuzenzakalelayo ukuthi kungenzeki lapho kuvela iphakheji entsha ngokuphelele ngesikhathi sokuhlasela.
Okumangalisayo ukuthi abahlaseli abazange bashintshe ikhodi yomthombo ye-Axios noma benze noma yiziphi izinguquko ezibonakalayo endaweni yokugcina ye-GitHub . Eqinisweni, izinguqulo 1.14.1 kanye no-0.30.4 zazingenazo izivumelwano noma amathegi ahambisanayo ku-GitHub; zazikhona kuphela ngo-npm. Umehluko oyinhloko wawusefayeleni lokuxhomekeka kwephakheji, elanyatheliswa kurejista.
I-Axios, ngaphansi kwezimo ezijwayelekile, imemezela kuphela ukuncika okuthathu: ukuqondisa kabusha, i-form-data, kanye ne-proxy-from-env . Kodwa-ke, ezinguqulweni ezithintekile, kwavela ukuncika kwesine, okwakungekho ngaphambilini kuphrojekthi: i-plain-crypto-js, inguqulo 4.2.1. Lo mtapo wolwazi we-phantom awuzange usetshenziswe ndawo ku-codebase ye-Axios, kodwa wawufaka iskripthi sangemuva kokufaka esasisebenza ngokuzenzakalelayo lapho kufakwa iphakheji nge-npm, i-pnpm, noma amathuluzi afanayo.
i-plain-crypto-js: ukuxhomekeka kwe-phantom okusetshenziswa yi-RAT
Isihluthulelo sokuhlasela sasikulokho kuncika okwengeziwe. i-plain-crypto-js yanyatheliswa ngo-npm ngumsebenzisi ogama lakhe lingu-“nrwise”, naye enekheli le-imeyili le-Proton Mail, futhi inhloso yayo kuphela kwakuwukusebenzisa iskripthi sangemuva kokufakwa esifihliwe ku-Node.js (setup.js) . Leso skripthi sasebenza njenge-dropper, okungukuthi, njengesifaki sokuqala sesigaba sesibili se-malware.
Lapho kufakwa i-Axios kwenye yezinguqulo zayo ezinobuthi, umjikelezo wokuphila we-npm post-install uqalise ngokuzenzakalelayo ikhodi ye-plain-crypto-js ngaphandle kwesenzo esikhethekile esidingekayo kunjiniyela . I-dropper ixhunywe kuseva yomyalo nokulawula (C2) esebenzayo kusizinda se-sfrclakcom, ilalele ku-port 8000, futhi ilande umthwalo okhokhelwayo othize ohlelweni lokusebenza lomshini othintekile; lokhu kuziphatha kungabonakala ngokuhlaziywa kwethrafikhi yenethiwekhi.
Abacwaningi e-StepSecurity nakwamanye amaqembu okuhlaziya bachaza ukuziphatha okucophelela kakhulu. Ngemva kokwenza umthwalo okhokhelwayo ononya, i-dropper isuse iminonjana yayo: isuse iskripthi se-postinstall, yashintsha ifayela le-package.json ngenguqulo "ehlanzekile", futhi yashiya ifayela le-node_modules, lapho liqala ukubonwa, elibonakala lingenangozi . Ngale ndlela, ukuhlolwa ngesandla okulandelayo akuzange kuthole ikhodi enonya ngqo ngaphakathi kwe-Axios.
Ukuze kutholakale ukukhohlisa, okuwukuphela kwenkomba ethembekile yayikumafayela okukhiya (i-package-lock.json, i-pnpm-lock.yaml, i-yarn.lock) kanye nokuba khona kwezinguqulo ezithile: i-axios 1.14.1 noma i-0.30.4 kanye ne-plain-crypto-js 4.2.1, ngaphezu kwezinguqulo ezimbili zaleyo phakheji enezinombolo eziphakathi (4.2.0, 4.2.2) ezixhunywe kwezinye izihlaziyi. I-Socket, ngakolunye uhlangothi, kamuva yathola ukuthi i-malware efanayo nayo yasatshalaliswa ngamaphakheji @shadanai/openclaw (izinguqulo ezahlukahlukene 2026.3.xx) kanye ne-@qqbrowser/openclaw-qbot (0.0.130), kanye namasu okuphepha njenge-honeypots nawo angasiza ekutholeni imikhankaso efanayo.
I-RAT yesikhulumi esibanzi: I-Windows, i-macOS ne-Linux kugqanyisiwe
Uma isiqediwe, iskripthi se-setup.js sisebenze njenge-orchestrator ekwazi ukubona uhlelo lokusebenza nokulandela indlela yokuhlasela ethile yeplatifomu . Umkhankaso wawulungiselelwe kusengaphambili ngokucacile: ngokusho kwe-StepSecurity, abahlaseli babenemithwalo emithathu ehlukene yokukhokha ehlanganiswe kusengaphambili, eyodwa yesistimu ngayinye.
Kumasistimu e-macOS, inqubo yokufakwa ngemuva kwethula i-AppleScript elande i-Trojanized binary kusuka kuseva ye-sfrclakcom:8000 . Le binary igcinwe endleleni ye-/Library/Caches/com.apple.act.mond, izimvume zayo zalungiswa ukuze ikwazi ukusebenza, futhi ekugcineni, yaqalwa ngemuva kusetshenziswa i-/bin/zsh. Lapho i-RAT isisebenza, i-AppleScript ngokwayo yasuswa ukuze kube nzima kakhulu ukuhlaziya kwe-forensic.
Kumakhompyutha e-Windows, i-malware ithole i-PowerShell binary yesistimu, yayikopisha ku-%PROGRAMDATA%\wt.exe ukuze iyifihle njenge-Windows terminal, futhi yakhiqiza i-VBScript yesikhashana . Le VBScript yabe isixhumana neseva ye-C2 ukuze ilande iskripthi esengeziwe se-PowerShell RAT, yasisebenzisa, yabe isisusa ifayela elilandiwe. Ngaphezu kwalokho, i-Windows variant yadala ifayela le-%PROGRAMDATA%\system.bat elinesimiso sokulanda esivumela i-malware ukuthi izibuyisele yona ekungeneni ngakunye futhi yengeze ukhiye wokwenza kurejista ye-Windows ukuqinisekisa ukuqhubeka.
Ku-Linux nakwezinye izinhlelo ezifana ne-Unix ngaphandle kwe-macOS, i-dropper isebenzise i-execSync ye-Node.js ukuqalisa umyalo we-shell olande iskripthi se-Python kusuka ku-sfrclakcom, yasilondoloza njenge-/tmp/ld.py, futhi yasisebenzisa nge-nohup ukuze siqhubeke sisebenza ngemuva . Ngokungafani ne-Windows, lolu hlobo aluzange lubonise indlela eqinile yokuphikelela, okuphakamisa indlela esheshayo yokuphuma kwedatha noma ukuthunyelwa ngezikhathi ezithile kokuphikelela ngemiyalo elandelayo.
I-SafeDep kanye ne-Elastic Security Labs bahlaziye imithwalo yokukhokha yezinga lesibili futhi baphetha ngokuthi ama-RAT e-macOS (C++ Mach-O binary) kanye ne-Linux (Python script) abelane ngesethi yomyalo efanayo, iphrothokholi ye-C2, ifomethi yomlayezo, kanye nokuziphatha kokusebenza . Lolu hlobo lokuhlaziya luvame ukuncika kumasevisi okuskena njenge -VirusTotal , alula ukuhlangana kwamasampula nama-IOC.
Kuzo zonke izimo, i-host ngayinye ethintekile yenze ukuhlola kwesistimu ngokushesha: iziqondiso zomsebenzisi, izimpande zedrayivu, izinqubo ezisebenzayo, kanye neminye imethadatha . Lolu lwazi luthunyelwe kuseva yomyalo nokulawula, futhi i-ejenti igcine iluphu ye-beacon yemizuzwana engaba ngu-60, ilinde imiyalelo emisha, okuhlanganisa ukwenziwa kwezikripthi ezengeziwe noma ukufakwa kwama-binary kwimemori.
Ifasitela lokuziveza, izinhloso, kanye nokunikezwa kweNorth Korea
Izinguqulo ezinonya ze-Axios zazitholakala ngo-npm cishe amahora amathathu, ngesikhathi esikhethwe ngokucophelela. Amaphakheji abekwe engcupheni ashicilelwe ngaphambi nje kwamabili ngeSonto (isikhathi esandise isikhathi sokusabela sabavikeli), futhi lesi sigameko savinjelwa ngoMsombuluko ekuseni , ngemuva kokuba izinkampani zokuphepha zixwayise iziphathimandla ngokuziphatha okungajwayelekile.
Phakathi naleso sikhathi esifushane, i-Huntress ithole okungenani izinhlelo ezingu-135 ezixhuma kuseva yomhlaseli . Njengoba i-Axios iqopha ukulandwa okungaphezu kwezigidi ezingu-80-100 ngesonto (ngokusho kwemithombo ehlukahlukene, ngisho nangaphezulu kwezigidi ezingu-300 kwezinye izikhathi), lelo nani cishe limelela ingxenye encane nje yeqhwa, elikhawulelwe ezinhlelweni ezifika ekunakweni kwezinkampani zokuhlaziya ezenze idatha yazo yaba sobala.
I-Google, ngethimba layo le-Treat Intelligence, ihlonze lokhu kuhlasela njengomdlali we-North Korea osolwayo obizwa nge-UNC1069 . Ama-Elastic Security Labs aqinise lo mbono ngokuthola ukufana okuqinile phakathi kwe-RAT etholakala ku-macOS kanye ne-WAVESHAPER, umnyango wangemuva we-C++ otholwe nguMandiant futhi oxhumene neqembu elifanayo lezinsongo.
Abahlaziyi be-Google bagcizelele ukuthi amaqembu axhumene neNyakatho Korea abelokhu egxile ekuhlaselweni kwe-supply chain kanye nemisebenzi yokwebiwa kwe-cryptocurrency iminyaka eminingi . Iphethini iyahambisana: ingqalasizinda yentuthuko ibeka engcupheni, imitapo yolwazi esetshenziswa kabanzi, noma isofthiwe ethembekile ukuze iqhubekele eceleni iye ezinhlosweni eziphatha izimpahla ezinenani eliphezulu, okhiye abazimele, noma iziqinisekiso.
Imibiko eminingana iphinde yaqokomisa ukuthi ukulawulwa nokwakhiwa kokuhlaselwa kusikisela ithimba elihlelekile kahle : ukuqaliswa okuthathu okufanayo kwe-RAT efanayo (i-PowerShell, i-C++, ne-Python), iphrothokholi ye-C2 ehambisanayo, ukuziphatha okufanayo kuzo zonke izinhlobo, kanye nesu elicacile lokuzihlanza ukuze kugwenywe ukushiya iminonjana. I-Elastic igcizelele ukuthi lokhu kuvumelana kukhomba kunjiniyela oyedwa noma iqembu elisebenza kusukela kudokhumenti yokuklama eyabiwe, kude nokusungula izinto ezintsha.
Ngaphandle kwezici zobuchwepheshe kuphela, elinye lamaphuzu aphazamisa kakhulu kuleli cala ukuthi i-akhawunti yomgcini oyinhloko ye-npm yantshontshwa kanjani. Umphathi we-Axios ngokwakhe kamuva wachaza ukuthi wayene-dual-factor authentication evuliwe cishe kuzo zonke izinsizakalo zakhe , kodwa wagcina enikeze ukufinyelela ngaphandle kokuqaphela.
Ngokusho kokuhlaziywa kokuhlolwa kwesidumbu okwabiwe yithimba, abahlaseli baqalise umsebenzi wobunjiniyela bezenhlalo oyinkimbinkimbi kakhulu, osekelwa amathuluzi asebenzisa i-AI, ukuze bathole ukwethenjwa kwabo . Bazenza umsunguli wenkampani, bekopisha ubunikazi bayo obubonakalayo, isithombe, ngisho nophawu lwenkampani. Bakha isikhala sangempela se-Slack ngelogo yenkampani, iziteshi ezinezikhala okuthiwa zivumelaniswe ne-LinkedIn, ngisho namaphrofayili mbumbulu abasebenzi kanye nabanye abanakekeli besofthiwe abavulekile.
Ngaphakathi kwaleso simo, bahlele umhlangano nge-Microsoft Teams lapho iqembu eliphelele lochwepheshe libonakala lihlanganyela khona . Phakathi nomhlangano, balingisa inkinga yobuchwepheshe futhi babonisa ukuthi ingxenye ethile yesistimu yabo isiphelelwe yisikhathi. Uchwepheshe wokulungisa, ecabanga ukuthi kwakuyimfuneko esemthethweni ehlobene nethuluzi le-videoconferencing uqobo, walanda futhi wafaka ifayela eliphakanyisiwe.
Eqinisweni, lelo fayela kwakuyi -Trojan yokufinyelela kude eyavumela abahlaseli ukuthi bashintshele kuziqinisekiso zesisulu futhi ekugcineni balawule i-akhawunti ye-npm esetshenziselwa ukushicilela i-Axios . Yonke inqubo yayihlelwe kahle kakhulu, inemininingwane eminingi ekholekayo, kangangokuthi isisulu sayichaza ngokuthi "ihlanganiswe kahle, inobungcweti, futhi iyakholisa ngokuphelele."
Lesi sici sobuntu salesi sigameko senza kucace ukuthi ngisho nezinyathelo zobuchwepheshe ezifana ne-2FA azanele uma ubunjiniyela bezenhlalo obusezingeni eliphezulu buhlanganiswa nokulingiswa okubonakalayo, ama-deepfake, noma ukwenziwa kwezinhlangano ngendlela eningiliziwe . Isixhumanisi esibuthakathaka kakhulu, futhi, ukusebenzisana kwabantu.
Umthelela ezinhlanganweni nakubathuthukisi abasebenzisa i-Axios
Ngokombono ongokoqobo, inkinga enkulu ukuthola ukuthi ubani ngempela othintekile. Noma iyiphi inhlangano efake i- [email protected] noma i-[email protected] ngesikhathi sefasitela lapho zazitholakala khona kufanele icabange ukuthi umshini noma ipayipi elenze ukufakwa lingase libe sengozini.
Izincomo ezivela ezinkampanini ezifana ne-StepSecurity, i-Aikido, i-Huntress, kanye ne-Elastic azinakuphikwa. Uma kukhona okusolisayo, indlela yokuqapha iyadingeka, hhayi nje "ukususa nokufaka kabusha ama-node_modules ." Inkambo ehlakaniphile yokwenza iwukwakha kabusha imishini noma izindawo ezithintekile ezithombeni ezithembekile bese ubuyekeza ngokucophelela amalogi e-CI/CD ukuze uthole ukuthi yimiphi imisebenzi noma amapayipi okungenzeka ukuthi enze izinguqulo ezithintekile.
Ngaphezu kwalokho, kubalulekile ukushintshanisa zonke iziqinisekiso nezimfihlo okungenzeka ukuthi i-RAT izifinyelele kulezo node : amathokheni e-npm, okhiye bomhlinzeki wefu, izimfihlo zamapayipi, iziqinisekiso zedathabheyisi, okhiye be-SSH, njll. Ukushiya lezi ziqinisekiso zijikeleza ngemva kokuhlasela okunjalo kushiya umnyango uvulekele ukunyakaza okuthule eceleni.
Ezingeni lobuchwepheshe, amaqembu kufanele abukeze amafayela awo okukhiya (package-lock.json, pnpm-lock.yaml, yarn.lock) ukuze athole izinkomba ezinguqulweni ze-Axios kanye ne-plain-crypto-js eziphazamisekile . Uma lezi zinto zitholakala, isinyathelo esilandelayo ukuhlola izinhlelo ezithintekile ukuthola izinto ezingaba khona ze-RAT: /Library/Caches/com.apple.act.mond ku-macOS, %PROGRAMDATA%\wt.exe kanye ne-%PROGRAMDATA%\system.bat ku-Windows, noma /tmp/ld.py ku-Linux.
Ngesikhathi esifanayo, kunconywa ukusetha ngokusobala izinguqulo ezivikelekile ze-Axios, njenge-1.14.0 kanye ne-0.30.3, bese usebenzisa ama-override noma izixazululo ukuvimbela ukuncika okuguqukayo ekuxazululeni izinguqulo ezingafunwa . Ukuvimba ithrafikhi ephumayo eya kusizinda se-sfrclakcom nakho kuyindlela enengqondo yokuvimbela, okungenani ngenkathi kuhlaziywa ububanzi obugcwele bokuhlaselwa.
Izifundo zokuphepha ze-software supply chain
Isigameko se-Axios akusona isenzakalo esiyingqayizivele, kodwa esinye isixhumanisi ochungechungeni lokuhlaselwa kwe-supply chain okuhlanganisa amacala afana ne-SolarWinds, i-Kaseya, i-3CX, i-Polyfill.io, kanye nobuthakathaka obusetshenziswa ku-Log4j. Umqondo oyinhloko uhlala ufana: ukuyekethisa ingxenye esetshenziswa kabanzi, ethembekile ukuze kwandiswe ukufinyelela , kunokuzama ukuhlasela umshini ngomshini.
Esinye sezifundo eziphindaphindwa kakhulu ezivela kochwepheshe ukuthi ukwethembana akukwazi ukuthembela kuphela ekuthandweni komtapo wolwazi noma idumela lomnakekeli . Uma isiteshi sokukhulula (i-akhawunti ye-npm, ipayipi le-CI/CD, ingqalasizinda yokwakha) sisengozini, konke okukhishwe ngaso kuzuza leyo ngozi. Ukubuyekezwa kwekhodi ngesandla nakho akwanele uma i-malware ifihla ekuxhomekeni okuguqukayo futhi izisusa ngemva kokusetshenziswa.
Kuye kwaqokonyiswa nokuthi "isivinini esizenzakalelayo" sezibuyekezo zokuncika siza nezindleko maqondana nobuso bokuhlasela . Ukwamukela njalo inguqulo yakamuva ngokuzenzakalelayo kulula kakhulu, kodwa kuvula ithuba lokuthi isibuyekezo esinonya sisabalale ngemizuzu embalwa. Ezinye izinhlangano sezivele zicabangela izinqubomgomo ezifana nokudinga ukuthi inguqulo entsha ibe se-ecosystem isikhathi esithile ngaphambi kokwamukelwa, noma ukudinga izinguquko kumaphakheji abalulekile ukuze kubuyekezwe ngesandla okwengeziwe.
Ngokuphathelene nengqalasizinda yentuthuko, izindawo ze-CI/CD kumele ziphathwe njengezimpahla ezibucayi kakhulu . Noma iyiphi i-RAT eyenziwa ngesikhathi sokufakwa kokuxhomekeka cishe izofuna izimfihlo zamapayipi kanye nokufinyelela kwezinye izindawo. Ukuhlukanisa la ma-node, ukuwaqapha eduze, nokushintshanisa izimfihlo zawo ngezikhathi ezithile akuseyona isincomo "esifanele" kodwa kuyisidingo.
Okokugcina, ukuthola lezi zinhlobo zokuhlaselwa kudinga ukuhlanganisa ulwazi oluvela emithonjeni eminingi: izinguqulo ezifakiwe, amafayela okukhiya, izinkomba zesistimu yokusebenza zokuyekethisa, kanye ne-telemetry yenethiwekhi . Amathuluzi akhiqiza futhi aphathe i-Software Bill of Materials (SBOMs) asiza ukulandelela ngokushesha ukuthi yimaphi amaphrojekthi asebenzisa amaphakheji, okuyinto ebalulekile lapho kuqalwa izexwayiso ezinkulu njengale.
Lesi siqephu sonke ne-Axios sibonisa izinga lapho uhlelo lokuncika, noma ngabe lubonakala luvuthiwe futhi luqinisiwe, lusathembele kakhulu ekwethembeni nasekuqapheni njalo. Umtapo wolwazi obonakala ungenangozi, ogcinwa ngumuntu oyedwa owela esisulu sokuhlaselwa kobunjiniyela bezenhlalo okwenziwe kahle, ungaba, emahoreni ambalwa, umjelo womhlaba wonke wokusebenzisa ama-RAT ahlukene ngokumelene nezinkampani, abasebenza ngokuzimela, nezinhlangano zabo bonke ubukhulu . Ukuqinisa izilawuli ezizungeze ama-akhawunti okushicilela, amapayipi, kanye nokuncika okubalulekile akuseyona indlela engcono kakhulu yokuzikhethela, kodwa kuyimfuneko yokuthuthuka okuqhubekayo endaweni lapho abahlaseli beba nesineke, benamasu, futhi behlonyiswe ngamathuluzi angcono.
