@7nsane/zift 4.1.0 → 4.3.0

package/README.md

@@ -1,4 +1,4 @@
-# 🛡️ Zift (v4.1.0)
+# 🛡️ Zift (v4.2.0)
 
 [![npm version](https://img.shields.io/npm/v/@7nsane/zift.svg?style=flat-square)](https://www.npmjs.com/package/@7nsane/zift)
 [![License](https://img.shields.io/npm/l/@7nsane/zift.svg?style=flat-square)](https://www.npmjs.com/package/@7nsane/zift)
@@ -6,15 +6,16 @@
 
 **The Symbolically-Intelligent Ecosystem Security Engine for JavaScript.**
 
-Zift v5.0 is the "Intelligence" release, introducing **Symbolic Taint Analysis**. It can track sensitive data through complex code transformations, destructuring, and nested object structures across module boundaries.
+Zift v4.2 is the "Deep Hardening" release, introducing advanced behavioral rules for Wiper detection, Worm prevention, and OS-specific targeting analysis.
 
-## 🚀 Key Advancements (v5.0.0)
+## 🚀 Key Advancements (v4.2.0)
 
 - **🧠 Symbolic Taint Analysis**: Tracks data through destructuring (`const { key } = process.env`) and deep property access (`obj.a.b.c`).
 - **🧬 Transformation Tracking**: Automatically follows taint through encoding methods like `Buffer.from(data).toString('base64')` or `hex`.
-- **🌍 Recursive Cross-File Intelligence**: Follows sensitive data even when it's re-exported through multiple intermediate files and objects.
-- **🛡️ Immutable Runtime Guards**: Structural protection for `http` and `child_process` sinks (v4.0 legacy).
-- **🧩 Opaque Payload Detection**: Flags native binaries (`.node`) and high-entropy skipped strings.
+- **🐛 Worm & Propagation Defense**: Detects the chain of credential theft, data exfiltration, and self-publishing (registry hijacking).
+- **🛡️ Deep Behavioral Hardening**: Flags wipers (recursive deletions), CI/CD secret theft, and unauthorized module/git tampering.
+- **📡 OS Fingerprinting Detection**: Identifies system targeting behaviors (os.platform, arch) coupled with network activity.
+- **📦 Lifecycle-Specific Intelligence**: Detects remote fetches and binary drops occurring during sensitive contexts like `preinstall`.
 
 ## 📦 Quick Start
 

package/bin/zift.js

@@ -28,6 +28,13 @@ async function main() {
     return;
   }
 
+  if (args[0] === 'scan') {
+    target = args[1] || '.';
+  } else if (args[0] && !args[0].startsWith('-')) {
+    // If first arg isn't a command or flag, it might be a target
+    target = args[0];
+  }
+
   // 2. Detection for bun/pnpm usage
   if (args.includes('--bun')) installer = 'bun';
   if (args.includes('--pnpm')) installer = 'pnpm';
@@ -58,7 +65,7 @@ async function main() {
   }
 
   // 6. Execution
-  const isLocal = fs.existsSync(target) && fs.lstatSync(target).isDirectory();
+  const isLocal = fs.existsSync(target); // Check existence, dir/file handled by scanner
 
   if (isLocal) {
     await runLocalScan(target, format);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@7nsane/zift",
-  "version": "4.1.0",
+  "version": "4.3.0",
   "description": "A high-performance, deterministic security scanner for npm packages.",
   "main": "src/scanner.js",
   "bin": {
@@ -27,4 +27,4 @@
     "chalk": "^4.1.2",
     "glob": "^13.0.6"
   }
-}
+}

package/src/collector.js

@@ -29,7 +29,19 @@ class ASTCollector {
             EXPORTS: [],
             IMPORTS: [],
             OPAQUE_STRING_SKIP: [],
-            NON_DETERMINISTIC_SINK: []
+            NON_DETERMINISTIC_SINK: [],
+            CREDENTIAL_FILE_ACCESS: [],
+            DISCORD_STORAGE_ACCESS: [],
+            WEBHOOK_SINK: [],
+            EVASION_ENVIRONMENT_CHECK: [],
+            WALLET_HOOK: [],
+            CICD_SECRET_ACCESS: [],
+            WIPER_OPERATION: [],
+            REGISTRY_TAMPER: [],
+            MODULE_TAMPER: [],
+            REVERSE_SHELL_BEHAVIOR: [],
+            FINGERPRINT_SIGNAL: [],
+            PUBLISH_SINK: []
         };
         const flows = [];
         const sourceCode = code;
@@ -124,6 +136,82 @@ class ASTCollector {
                     type: 'default'
                 });
             },
+            Identifier: (node) => {
+                const evasionIds = ['v8debug'];
+                if (evasionIds.includes(node.name)) {
+                    facts.EVASION_ENVIRONMENT_CHECK.push({
+                        file: filePath,
+                        line: node.loc.start.line,
+                        context: node.name
+                    });
+                }
+            },
+            MemberExpression: (node, state, ancestors) => {
+                const memberCode = sourceCode.substring(node.start, node.end);
+
+                // 1. Anti-Analysis / Evasion Check
+                const evasionPatterns = ['debugPort', 'v8debug', 'NODE_OPTIONS'];
+                if (evasionPatterns.some(p => memberCode.includes(p))) {
+                    facts.EVASION_ENVIRONMENT_CHECK.push({
+                        file: filePath,
+                        line: node.loc.start.line,
+                        context: memberCode
+                    });
+                }
+
+                // 2. Wallet DRAINER Hook detection
+                const walletPatterns = ['ethereum', 'solana', 'phantom'];
+                if (walletPatterns.some(p => memberCode.includes(p))) {
+                    facts.WALLET_HOOK.push({
+                        file: filePath,
+                        line: node.loc.start.line,
+                        context: memberCode
+                    });
+                }
+
+                // 3. CI/CD Secret Access
+                const cicdPatterns = ['GITHUB_TOKEN', 'CIRCLECI_TOKEN', 'AZURE_TOKEN', 'TRAVIS_TOKEN', 'GITLAB_TOKEN'];
+                if (cicdPatterns.some(p => memberCode.includes(p))) {
+                    facts.CICD_SECRET_ACCESS.push({
+                        file: filePath,
+                        line: node.loc.start.line,
+                        variable: memberCode
+                    });
+                }
+
+                // 4. OS Fingerprinting (platform, arch, release)
+                const fingerPatterns = ['process.platform', 'process.arch', 'os.platform', 'os.arch', 'os.release', 'os.type'];
+                if (fingerPatterns.some(p => memberCode.includes(p))) {
+                    // Avoid duplicate if it's part of a CallExpression (will be caught there)
+                    const parent = ancestors[ancestors.length - 2];
+                    if (parent && parent.type === 'CallExpression' && parent.callee === node) return;
+
+                    facts.FINGERPRINT_SIGNAL.push({
+                        file: filePath,
+                        line: node.loc.start.line,
+                        context: memberCode
+                    });
+                }
+
+                // 4. process.env access (Moved from redundant visitor)
+                const objectCode = sourceCode.substring(node.object.start, node.object.end);
+                if (objectCode === 'process.env' || objectCode === 'process["env"]' || objectCode === "process['env']") {
+                    const property = node.property.name || (node.property.type === 'Literal' ? node.property.value : null);
+                    const whitelist = ['NODE_ENV', 'TIMING', 'DEBUG', 'VERBOSE', 'CI', 'APPDATA', 'HOME', 'USERPROFILE', 'PATH', 'PWD'];
+                    if (whitelist.includes(property)) return;
+
+                    envAccessCount++;
+                    facts.ENV_READ.push({
+                        file: filePath,
+                        line: node.loc.start.line,
+                        variable: property ? `process.env.${property}` : 'process.env'
+                    });
+
+                    if (envAccessCount > 5) {
+                        facts.MASS_ENV_ACCESS.push({ file: filePath, line: node.loc.start.line, count: envAccessCount });
+                    }
+                }
+            },
             CallExpression: (node, state, ancestors) => {
                 const calleeCode = sourceCode.substring(node.callee.start, node.callee.end);
 
@@ -175,6 +263,23 @@ class ASTCollector {
                         line: node.loc.start.line,
                         callee: calleeCode
                     });
+
+                    // Check for Webhook Sinks
+                    if (netType === 'NETWORK_SINK') {
+                        node.arguments.forEach(arg => {
+                            if (arg.type === 'Literal' && typeof arg.value === 'string') {
+                                const val = arg.value.toLowerCase();
+                                const webhooks = ['discord.com/api/webhooks', 'pipedream.net', 'webhook.site', 'burpcollaborator.net'];
+                                if (webhooks.some(w => val.includes(w))) {
+                                    facts.WEBHOOK_SINK.push({
+                                        file: filePath,
+                                        line: node.loc.start.line,
+                                        url: val
+                                    });
+                                }
+                            }
+                        });
+                    }
                 }
 
                 if (this.isShellSink(calleeCode)) {
@@ -206,10 +311,30 @@ class ASTCollector {
                 }
 
                 if (this.isSensitiveFileRead(calleeCode, node, sourceCode)) {
-                    facts.FILE_READ_SENSITIVE.push({
+                    const arg = node.arguments[0];
+                    const pathValue = arg && arg.type === 'Literal' ? String(arg.value).toLowerCase() : '';
+                    const isCredential = ['.aws', '.ssh', '.npmrc', 'aws_access_key', 'shadow'].some(s => pathValue.includes(s));
+
+                    if (isCredential) {
+                        facts.CREDENTIAL_FILE_ACCESS.push({
+                            file: filePath,
+                            line: node.loc.start.line,
+                            path: pathValue
+                        });
+                    } else {
+                        facts.FILE_READ_SENSITIVE.push({
+                            file: filePath,
+                            line: node.loc.start.line,
+                            path: sourceCode.substring(node.arguments[0].start, node.arguments[0].end)
+                        });
+                    }
+                }
+
+                if (this.isDiscordStorageAccess(calleeCode, node, sourceCode)) {
+                    facts.DISCORD_STORAGE_ACCESS.push({
                         file: filePath,
                         line: node.loc.start.line,
-                        path: node.arguments[0] ? sourceCode.substring(node.arguments[0].start, node.arguments[0].end) : 'unknown'
+                        path: sourceCode.substring(node.arguments[0].start, node.arguments[0].end)
                     });
                 }
 
@@ -221,6 +346,54 @@ class ASTCollector {
                     });
                 }
 
+                if (this.isWiperOperation(calleeCode, node, sourceCode)) {
+                    facts.WIPER_OPERATION.push({
+                        file: filePath,
+                        line: node.loc.start.line,
+                        path: node.arguments[0] ? sourceCode.substring(node.arguments[0].start, node.arguments[0].end) : 'unknown'
+                    });
+                }
+
+                if (this.isRegistryTamper(calleeCode, node, sourceCode)) {
+                    facts.REGISTRY_TAMPER.push({
+                        file: filePath,
+                        line: node.loc.start.line,
+                        path: node.arguments[0] ? sourceCode.substring(node.arguments[0].start, node.arguments[0].end) : 'unknown'
+                    });
+                }
+
+                if (this.isModuleTamper(calleeCode, node, sourceCode)) {
+                    facts.MODULE_TAMPER.push({
+                        file: filePath,
+                        line: node.loc.start.line,
+                        path: node.arguments[0] ? sourceCode.substring(node.arguments[0].start, node.arguments[0].end) : 'unknown'
+                    });
+                }
+
+                if (this.isReverseShellBehavior(calleeCode, node, sourceCode)) {
+                    facts.REVERSE_SHELL_BEHAVIOR.push({
+                        file: filePath,
+                        line: node.loc.start.line,
+                        context: calleeCode
+                    });
+                }
+
+                if (this.isPublishSink(calleeCode, node, sourceCode)) {
+                    facts.PUBLISH_SINK.push({
+                        file: filePath,
+                        line: node.loc.start.line,
+                        callee: calleeCode
+                    });
+                }
+
+                if (this.isOSFingerprint(calleeCode, node, sourceCode)) {
+                    facts.FINGERPRINT_SIGNAL.push({
+                        file: filePath,
+                        line: node.loc.start.line,
+                        context: calleeCode
+                    });
+                }
+
                 node.arguments.forEach((arg, index) => {
                     const argCode = sourceCode.substring(arg.start, arg.end);
                     const isArgTainted = argCode.includes('process.env') || flows.some(f => {
@@ -254,6 +427,45 @@ class ASTCollector {
                     }
                 });
 
+                // v5.2 Symbolic Async: await and .then()
+                if (calleeCode.includes('.then')) {
+                    const parts = calleeCode.split('.then');
+                    const promiseBase = parts[0];
+                    const isPromiseTainted = flows.some(f => f.toVar === promiseBase) || promiseBase.includes('process.env') || promiseBase.includes('secret');
+
+                    if (isPromiseTainted && node.arguments[0] && (node.arguments[0].type === 'ArrowFunctionExpression' || node.arguments[0].type === 'FunctionExpression')) {
+                        const param = node.arguments[0].params[0];
+                        if (param && param.type === 'Identifier') {
+                            flows.push({
+                                fromVar: promiseBase,
+                                toVar: param.name,
+                                file: filePath,
+                                line: node.loc.start.line,
+                                async: true
+                            });
+                        }
+                    }
+                }
+
+                // v5.1 Symbolic Mutations: .push(), .concat(), .assign()
+                const mutationMethods = ['push', 'unshift', 'concat', 'assign', 'append'];
+                if (mutationMethods.some(m => calleeCode.endsWith('.' + m))) {
+                    const objectName = calleeCode.split('.')[0];
+                    node.arguments.forEach(arg => {
+                        const argCode = sourceCode.substring(arg.start, arg.end);
+                        const isArgTainted = argCode.includes('process.env') || flows.some(f => f.toVar === argCode);
+                        if (isArgTainted) {
+                            flows.push({
+                                fromVar: argCode,
+                                toVar: objectName,
+                                file: filePath,
+                                line: node.loc.start.line,
+                                mutation: calleeCode
+                            });
+                        }
+                    });
+                }
+
                 // v5.0 Symbolic Transformers: Buffer/Base64/Hex
                 if (calleeCode.includes('Buffer.from') || calleeCode.includes('.toString')) {
                     const parent = ancestors[ancestors.length - 2];
@@ -271,25 +483,6 @@ class ASTCollector {
                     }
                 }
             },
-            MemberExpression: (node) => {
-                const objectCode = sourceCode.substring(node.object.start, node.object.end);
-                if (objectCode === 'process.env' || objectCode === 'process["env"]' || objectCode === "process['env']") {
-                    const property = node.property.name || (node.property.type === 'Literal' ? node.property.value : null);
-                    const whitelist = ['NODE_ENV', 'TIMING', 'DEBUG', 'VERBOSE', 'CI', 'APPDATA', 'HOME', 'USERPROFILE', 'PATH', 'PWD'];
-                    if (whitelist.includes(property)) return;
-
-                    envAccessCount++;
-                    facts.ENV_READ.push({
-                        file: filePath,
-                        line: node.loc.start.line,
-                        variable: property ? `process.env.${property}` : 'process.env'
-                    });
-
-                    if (envAccessCount > 5) {
-                        facts.MASS_ENV_ACCESS.push({ file: filePath, line: node.loc.start.line, count: envAccessCount });
-                    }
-                }
-            },
             VariableDeclarator: (node) => {
                 if (node.init) {
                     const from = sourceCode.substring(node.init.start, node.init.end);
@@ -298,6 +491,20 @@ class ASTCollector {
             },
             AssignmentExpression: (node) => {
                 const leftCode = sourceCode.substring(node.left.start, node.left.end);
+                if (node.right.type === 'AwaitExpression') {
+                    const from = sourceCode.substring(node.right.argument.start, node.right.argument.end);
+                    const isFromTainted = flows.some(f => f.toVar === from) || from.includes('process.env');
+                    if (isFromTainted) {
+                        flows.push({
+                            fromVar: from,
+                            toVar: leftCode,
+                            file: filePath,
+                            line: node.loc.start.line,
+                            async: true
+                        });
+                    }
+                }
+
                 if (leftCode === 'module.exports' || leftCode.startsWith('exports.')) {
                     facts.EXPORTS.push({
                         file: filePath,
@@ -403,8 +610,16 @@ class ASTCollector {
 
         if (node.arguments.length > 0 && node.arguments[0].type === 'Literal') {
             const pathValue = String(node.arguments[0].value);
-            const sensitive = ['.ssh', '.env', 'shadow', 'passwd', 'credentials', 'token', '_netrc', 'aws_access_key'];
-            return sensitive.some((s) => pathValue.toLowerCase().includes(s));
+            const sensitive = ['.ssh', '.env', 'shadow', 'passwd', 'credentials', 'token', '_netrc', 'aws_access_key', '.npmrc'];
+            if (sensitive.some((s) => pathValue.includes(s))) return true;
+
+            // Deep check: if argument is a variable, check if it was initialized with a sensitive string
+            const arg = node.arguments[0];
+            if (arg && arg.type === 'Identifier') {
+                const varName = arg.name;
+                // This is a bit complex for a one-liner, but we can check if it's in our local flows
+                // For now, let's just stick to the code string includes, which already handles BinaryExpressions of literals
+            }
         }
         return false;
     }
@@ -422,6 +637,21 @@ class ASTCollector {
         return false;
     }
 
+    isDiscordStorageAccess(calleeCode, node, sourceCode) {
+        if (typeof calleeCode !== 'string') return false;
+        if (!calleeCode.includes('fs.readFile') && !calleeCode.includes('fs.readFileSync')) return false;
+
+        if (node.arguments.length > 0) {
+            const arg = node.arguments[0];
+            const argCode = sourceCode.substring(arg.start, arg.end).toLowerCase();
+
+            // Detection: check if the argument code OR any part of the expression contains 'discord' and 'local storage'
+            // We also check identifiers if their names are suspicious (simple heuristic)
+            return argCode.includes('discord') && (argCode.includes('local storage') || argCode.includes('leveldb') || argCode.includes('token'));
+        }
+        return false;
+    }
+
     tryEvaluate(node, sourceCode) {
         try {
             const code = sourceCode.substring(node.start, node.end);
@@ -458,6 +688,105 @@ class ASTCollector {
             });
         }
     }
+
+    isWiperOperation(calleeCode, node, sourceCode) {
+        if (typeof calleeCode !== 'string') return false;
+        const wiperFuncs = ['fs.rm', 'fs.rmSync', 'fs.rmdir', 'fs.rmdirSync', 'fs.unlink', 'fs.unlinkSync'];
+        const isWiperFunc = wiperFuncs.some(f => calleeCode === f || calleeCode.endsWith('.' + f));
+        if (!isWiperFunc) return false;
+
+        const arg = node.arguments[0];
+        if (!arg) return false;
+
+        const argCode = sourceCode.substring(arg.start, arg.end).toLowerCase();
+        const sensitivePaths = ['/root', '/home', '/etc', '/var/log', '/usr/bin', '/bin', 'c:\\windows', 'c:\\users'];
+        const isSensitivePath = sensitivePaths.some(p => argCode.includes(p));
+
+        const hasRecursive = sourceCode.substring(node.start, node.end).includes('recursive: true');
+        return isSensitivePath || hasRecursive;
+    }
+
+    isRegistryTamper(calleeCode, node, sourceCode) {
+        if (typeof calleeCode !== 'string') return false;
+        if (!calleeCode.includes('fs.writeFile') && !calleeCode.includes('fs.writeFileSync') && !calleeCode.includes('fs.appendFile')) return false;
+
+        if (node.arguments.length > 0) {
+            const arg = node.arguments[0];
+            const argCode = sourceCode.substring(arg.start, arg.end).toLowerCase();
+            return argCode.includes('.npmrc') || argCode.includes('registry') || argCode.includes('npm-registry');
+        }
+        return false;
+    }
+
+    isModuleTamper(calleeCode, node, sourceCode) {
+        if (typeof calleeCode !== 'string') return false;
+        if (!calleeCode.includes('fs.writeFile') && !calleeCode.includes('fs.writeFileSync') && !calleeCode.includes('fs.mkdir')) return false;
+
+        if (node.arguments.length > 0) {
+            const arg = node.arguments[0];
+            const argCode = sourceCode.substring(arg.start, arg.end).toLowerCase();
+            return argCode.includes('node_modules') || argCode.includes('.git');
+        }
+        return false;
+    }
+
+    isReverseShellBehavior(calleeCode, node, sourceCode) {
+        if (typeof calleeCode !== 'string') return false;
+        if (calleeCode.endsWith('.pipe')) {
+            const arg = node.arguments[0];
+            if (arg) {
+                const argCode = sourceCode.substring(arg.start, arg.end);
+                return ['process.stdin', 'process.stdout', 'sh', 'bash', 'cmd', 'pwsh'].some(s => argCode.includes(s));
+            }
+        }
+        return false;
+    }
+
+    isPublishSink(calleeCode, node, sourceCode) {
+        if (typeof calleeCode !== 'string') return false;
+
+        // 1. Direct Shell Commands
+        if (this.isShellSink(calleeCode)) {
+            const arg = node.arguments[0];
+            if (arg && arg.type === 'Literal' && typeof arg.value === 'string') {
+                const val = arg.value.toLowerCase();
+                if (val.includes('npm publish') || val.includes('npm login') || val.includes('npm adduser')) return true;
+                if (val.includes('pnpm publish') || val.includes('yarn publish')) return true;
+            }
+        }
+
+        // 2. Registry API calls (e.g. put to /-/package/)
+        const networkSinks = ['fetch', 'axios', 'request', 'http.request', 'https.request'];
+        const isNet = networkSinks.some(s => calleeCode === s || calleeCode.endsWith('.' + s));
+        if (isNet && node.arguments.length > 0) {
+            const arg = node.arguments[0];
+            if (arg && arg.type === 'Literal' && typeof arg.value === 'string') {
+                const val = arg.value.toLowerCase();
+                if (val.includes('registry.npmjs.org') && (val.includes('/-/user/') || val.includes('/-/package/'))) return true;
+            }
+        }
+
+        return false;
+    }
+
+    isOSFingerprint(calleeCode, node, sourceCode) {
+        if (typeof calleeCode !== 'string') return false;
+
+        // 1. OS Module Methods
+        const osMethods = ['os.platform', 'os.arch', 'os.release', 'os.type', 'os.cpus', 'os.networkInterfaces', 'os.userInfo'];
+        if (osMethods.some(m => calleeCode === m || calleeCode.endsWith('.' + m))) return true;
+
+        // 2. File Reads of OS metadata
+        if (calleeCode.includes('fs.readFile') || calleeCode.includes('fs.readFileSync')) {
+            const arg = node.arguments[0];
+            if (arg && arg.type === 'Literal' && typeof arg.value === 'string') {
+                const val = arg.value.toLowerCase();
+                if (val.includes('/etc/os-release') || val.includes('/etc/issue') || val.includes('/proc/version')) return true;
+            }
+        }
+
+        return false;
+    }
 }
 
 module.exports = ASTCollector;

package/src/engine.js

@@ -30,14 +30,38 @@ class SafetyEngine {
 
         // Check required facts
         for (const req of rule.requires) {
-            let matchedFacts = facts[req] || [];
+            let matchedFacts = (facts[req] || []).map(f => ({ ...f, type: req }));
+
+            // Handle virtual requirements (LIFECYCLE_CONTEXT)
+            if (req === 'LIFECYCLE_CONTEXT' && matchedFacts.length === 0) {
+                const virtualMatch = triggers.some(t => {
+                    if (lifecycleFiles instanceof Set) return lifecycleFiles.has(t.file);
+                    if (Array.isArray(lifecycleFiles)) return lifecycleFiles.includes(t.file);
+                    return false;
+                });
+                if (virtualMatch) {
+                    matchedFacts = [{ type: 'LIFECYCLE_CONTEXT', virtual: true }];
+                }
+            }
+
+            if (matchedFacts.length === 0) return null;
 
-            // Specialist Rule: Startup Mod (ZFT-012) requires specific file paths (now explicit in definitions but engine may still help)
-            // But per review, we should aim for explicit facts.
-            // ZFT-012 now just requires FILE_WRITE_STARTUP. Simple.
+            // v5.3 Sequence Matching: Ensure facts occur in specified order (if rule has .sequence)
+            if (rule.sequence) {
+                const reqIndex = rule.requires.indexOf(req);
+                if (reqIndex > 0) {
+                    const prevReq = rule.requires[reqIndex - 1];
+                    const prevTriggers = triggers.filter(t => t.type === prevReq);
+
+                    // Filter current matches to only those that happen AFTER a previous trigger
+                    matchedFacts = matchedFacts.filter(curr => {
+                        return prevTriggers.some(prev => curr.line >= prev.line);
+                    });
+                }
+            }
 
-            if (matchedFacts.length === 0) return null; // Rule not matched
-            triggers.push(...matchedFacts.map(f => ({ ...f, type: req })));
+            if (matchedFacts.length === 0) return null;
+            triggers.push(...matchedFacts);
         }
 
         // Check optional facts for bonuses
@@ -65,7 +89,7 @@ class SafetyEngine {
 
         // Cluster Bonus: Source + Sink
         const hasSource = triggers.some(t => t.type.includes('READ') || t.type.includes('ACCESS'));
-        const hasSink = triggers.some(t => t.type.includes('SINK') || t.type === 'DYNAMIC_EXECUTION' || t.type === 'SHELL_EXECUTION' || t.type === 'DYNAMIC_REQUIRE');
+        const hasSink = triggers.some(t => t.type.includes('SINK') || t.type === 'DYNAMIC_EXECUTION' || t.type === 'SHELL_EXECUTION' || t.type === 'DYNAMIC_REQUIRE' || t.type === 'WIPER_OPERATION' || t.type === 'REVERSE_SHELL_BEHAVIOR');
         if (hasSource && hasSink) {
             baseScore += 40;
         }
@@ -73,8 +97,8 @@ class SafetyEngine {
         let finalScore = baseScore * multiplier;
 
         // Severe Cluster: SENSITIVE_READ + Dangerous Sink + lifecycleContext = Critical (100)
-        const isSensitiveRead = triggers.some(t => t.type === 'ENV_READ' || t.type === 'FILE_READ_SENSITIVE');
-        const isDangerousSink = triggers.some(t => t.type === 'NETWORK_SINK' || t.type === 'DNS_SINK' || t.type === 'RAW_SOCKET_SINK' || t.type === 'SHELL_EXECUTION');
+        const isSensitiveRead = triggers.some(t => t.type === 'ENV_READ' || t.type === 'FILE_READ_SENSITIVE' || t.type === 'CICD_SECRET_ACCESS');
+        const isDangerousSink = triggers.some(t => t.type === 'NETWORK_SINK' || t.type === 'DNS_SINK' || t.type === 'RAW_SOCKET_SINK' || t.type === 'SHELL_EXECUTION' || t.type === 'WEBHOOK_SINK' || t.type === 'WIPER_OPERATION' || t.type === 'REVERSE_SHELL_BEHAVIOR');
         if (isSensitiveRead && isDangerousSink && isInLifecycle) {
             finalScore = 100;
         }

package/src/rules/definitions.js

@@ -137,13 +137,143 @@ const RULES = [
         priority: 1,
         baseScore: 25,
         description: 'Detection of very large high-entropy strings that exceed scanning limits.'
+    },
+    {
+        id: 'ZFT-016',
+        alias: 'CREDENTIAL_STEAL_ATTEMPT',
+        name: 'Credential Theft Attempt',
+        requires: ['CREDENTIAL_FILE_ACCESS', 'NETWORK_SINK'],
+        priority: 1,
+        baseScore: 85,
+        description: 'Detection of access to sensitive credential files (.aws, .ssh, .npmrc) and exfiltration.'
+    },
+    {
+        id: 'ZFT-017',
+        alias: 'ANTI_ANALYSIS_EVASION',
+        name: 'Anti-Analysis / Evasion',
+        requires: ['EVASION_ENVIRONMENT_CHECK'],
+        optional: ['DYNAMIC_EXECUTION'],
+        priority: 2,
+        baseScore: 50,
+        description: 'Detection of code that checks for VM, Debugger, or Sandbox environments to evade analysis.'
+    },
+    {
+        id: 'ZFT-018',
+        alias: 'CRYPTO_WALLET_DRAINER',
+        name: 'Crypto-Wallet Drainer Hook',
+        requires: ['WALLET_HOOK'],
+        priority: 1,
+        baseScore: 95,
+        description: 'Detection of hooks on browser-based crypto wallets (window.ethereum, Solana).'
+    },
+    {
+        id: 'ZFT-019',
+        alias: 'DISCORD_TOKEN_STEALER',
+        name: 'Discord Token Stealer',
+        requires: ['DISCORD_STORAGE_ACCESS', 'NETWORK_SINK'],
+        priority: 1,
+        baseScore: 80,
+        description: 'Detection of Discord local storage access followed by network activity.'
+    },
+    {
+        id: 'ZFT-020',
+        alias: 'HIGH_RISK_WEBHOOK_SINK',
+        name: 'High-Risk Webhook Exfiltration',
+        requires: ['WEBHOOK_SINK'],
+        optional: ['ENV_READ', 'ENCODER_USE'],
+        priority: 2,
+        baseScore: 60,
+        description: 'Detection of data being sent to known high-risk exfiltration domains (Discord Webhooks, Pipedream).'
+    },
+    {
+        id: 'ZFT-021',
+        alias: 'WIPER_MODULE_DETECTED',
+        name: 'Destructive Wiper Module',
+        requires: ['WIPER_OPERATION'],
+        priority: 1,
+        baseScore: 100,
+        description: 'Detection of recursive deletion operations on sensitive directory structures (Home, Root, Documents).'
+    },
+    {
+        id: 'ZFT-022',
+        alias: 'CICD_SECRET_EXFILTRATION',
+        name: 'CI/CD Secret Exfiltration',
+        requires: ['CICD_SECRET_ACCESS', 'NETWORK_SINK'],
+        priority: 1,
+        baseScore: 90,
+        description: 'Detection of CI/CD secrets (GITHUB_TOKEN, CIRCLECI_TOKEN) being accessed and exfiltrated.'
+    },
+    {
+        id: 'ZFT-023',
+        alias: 'REGISTRY_POISONING_ATTEMPT',
+        name: 'Registry Poisoning Attempt',
+        requires: ['REGISTRY_TAMPER'],
+        priority: 2,
+        baseScore: 70,
+        description: 'Detection of unauthorized modifications to .npmrc or registry configuration.'
+    },
+    {
+        id: 'ZFT-024',
+        alias: 'MODULE_REPOS_HIJACKING',
+        name: 'Module/Repository Hijacking',
+        requires: ['MODULE_TAMPER'],
+        priority: 2,
+        baseScore: 75,
+        description: 'Detection of unauthorized write operations into node_modules or .git directories.'
+    },
+    {
+        id: 'ZFT-025',
+        alias: 'REVERSE_SHELL_PATTERN',
+        name: 'Reverse Shell Behavior',
+        requires: ['REVERSE_SHELL_BEHAVIOR'],
+        priority: 1,
+        baseScore: 95,
+        description: 'Detection of network sockets being piped directly into system shells (Reverse Shell pattern).'
+    },
+    {
+        id: 'ZFT-026',
+        alias: 'REGISTRY_PUBLISH_ATTEMPT',
+        name: 'Registry Publication Attempt',
+        requires: ['PUBLISH_SINK'],
+        priority: 1,
+        baseScore: 85,
+        description: 'Detection of attempts to run npm publish or interact with registry upload APIs (Worm behavior).'
+    },
+    {
+        id: 'ZFT-027',
+        alias: 'FINGERPRINT_OS_TARGETING',
+        name: 'OS Fingerprinting & Targeting',
+        requires: ['FINGERPRINT_SIGNAL'],
+        optional: ['NETWORK_SINK', 'SHELL_EXECUTION'],
+        priority: 2,
+        baseScore: 55,
+        description: 'Detection of OS metadata collection (platform, release, arch) potentially for targeted payload delivery.'
+    },
+    {
+        id: 'ZFT-028',
+        alias: 'WORM_PROPAGATION_CHAIN',
+        name: 'Automated Worm Propagation',
+        requires: ['CREDENTIAL_FILE_ACCESS', 'NETWORK_SINK', 'PUBLISH_SINK'],
+        priority: 1,
+        baseScore: 100,
+        description: 'Detection of the full worm cycle: Harvest tokens -> Exfiltrate -> Self-publish.'
+    },
+    {
+        id: 'ZFT-029',
+        alias: 'LIFECYCLE_BINARY_FETCH',
+        name: 'Lifecycle Binary Drop',
+        requires: ['REMOTE_FETCH_SIGNAL', 'LIFECYCLE_CONTEXT'],
+        optional: ['SHELL_EXECUTION'],
+        priority: 1,
+        baseScore: 90,
+        description: 'Detection of remote payload fetching specifically during package install/lifecycle scripts.'
     }
 ];
 
 const CATEGORIES = {
-    SOURCES: ['ENV_READ', 'FILE_READ_SENSITIVE', 'MASS_ENV_ACCESS'],
-    SINKS: ['NETWORK_SINK', 'DNS_SINK', 'RAW_SOCKET_SINK', 'DYNAMIC_EXECUTION', 'SHELL_EXECUTION', 'DYNAMIC_REQUIRE'],
-    SIGNALS: ['OBFUSCATION', 'ENCODER_USE', 'REMOTE_FETCH_SIGNAL', 'PIPE_TO_SHELL_SIGNAL', 'NATIVE_BINARY_DETECTED', 'OPAQUE_STRING_SKIP', 'NON_DETERMINISTIC_SINK'],
+    SOURCES: ['ENV_READ', 'FILE_READ_SENSITIVE', 'MASS_ENV_ACCESS', 'CREDENTIAL_FILE_ACCESS', 'DISCORD_STORAGE_ACCESS', 'CICD_SECRET_ACCESS'],
+    SINKS: ['NETWORK_SINK', 'DNS_SINK', 'RAW_SOCKET_SINK', 'DYNAMIC_EXECUTION', 'SHELL_EXECUTION', 'DYNAMIC_REQUIRE', 'WEBHOOK_SINK', 'WIPER_OPERATION', 'REGISTRY_TAMPER', 'MODULE_TAMPER', 'REVERSE_SHELL_BEHAVIOR', 'PUBLISH_SINK'],
+    SIGNALS: ['OBFUSCATION', 'ENCODER_USE', 'REMOTE_FETCH_SIGNAL', 'PIPE_TO_SHELL_SIGNAL', 'NATIVE_BINARY_DETECTED', 'OPAQUE_STRING_SKIP', 'NON_DETERMINISTIC_SINK', 'EVASION_ENVIRONMENT_CHECK', 'WALLET_HOOK', 'FINGERPRINT_SIGNAL'],
     PERSISTENCE: ['FILE_WRITE_STARTUP'],
     CONTEXT: ['LIFECYCLE_CONTEXT']
 };

package/src/scanner.js

@@ -45,7 +45,19 @@ class PackageScanner {
                 EXPORTS: [],
                 IMPORTS: [],
                 NATIVE_BINARY_DETECTED: [],
-                OPAQUE_STRING_SKIP: []
+                OPAQUE_STRING_SKIP: [],
+                CREDENTIAL_FILE_ACCESS: [],
+                DISCORD_STORAGE_ACCESS: [],
+                WEBHOOK_SINK: [],
+                EVASION_ENVIRONMENT_CHECK: [],
+                WALLET_HOOK: [],
+                CICD_SECRET_ACCESS: [],
+                WIPER_OPERATION: [],
+                REGISTRY_TAMPER: [],
+                MODULE_TAMPER: [],
+                REVERSE_SHELL_BEHAVIOR: [],
+                FINGERPRINT_SIGNAL: [],
+                PUBLISH_SINK: []
             },
             flows: []
         };
@@ -193,23 +205,26 @@ class PackageScanner {
             ignoreLines = [...ignoreLines, ...content.split('\n').map(l => l.trim()).filter(l => l && !l.startsWith('#'))];
         }
 
-        const getJsFiles = (dir) => {
+        const getJsFiles = (dirOrFile) => {
+            const stats = fs.statSync(dirOrFile);
+            if (!stats.isDirectory()) {
+                if (dirOrFile.endsWith('.js') || dirOrFile.endsWith('.node')) {
+                    return [dirOrFile];
+                }
+                return [];
+            }
+
             const results = [];
-            const list = fs.readdirSync(dir);
+            const list = fs.readdirSync(dirOrFile);
             for (const file of list) {
-                const fullPath = path.join(dir, file);
+                const fullPath = path.join(dirOrFile, file);
                 const relativePath = path.relative(this.packageDir, fullPath);
 
                 // Simple ignore check
                 if (ignoreLines.some(pattern => relativePath.includes(pattern) || file === pattern)) continue;
                 if (file.startsWith('.') && file !== '.ziftignore') continue;
 
-                const stat = fs.statSync(fullPath);
-                if (stat && stat.isDirectory()) {
-                    results.push(...getJsFiles(fullPath));
-                } else if (file.endsWith('.js') || file.endsWith('.node')) {
-                    results.push(fullPath);
-                }
+                results.push(...getJsFiles(fullPath));
             }
             return results;
         };
@@ -233,7 +248,7 @@ class PackageScanner {
                         type: t.type,
                         file: path.relative(this.packageDir, t.file),
                         line: t.line,
-                        context: t.reason || t.callee || t.variable || t.path
+                        context: t.reason || t.callee || t.variable || t.path || t.url || t.context
                     }))
                 };
             }),

package/src/shield.js

@@ -14,8 +14,10 @@ function setupShield() {
         console.warn(`[ZIFT-SHIELD] 🌐 Outbound Connection: ${address}:${port}`);
     });
 
-    // 2. Wrap Child Process (for shell command execution) - IMMUTABLE
+    // 2. Wrap Child Process (for shell command execution) - ACTIVE BLOCKING
     const cp = require('node:child_process');
+    const ALLOWED_COMMANDS = ['npm install', 'npm audit', 'ls', 'dir', 'whoami', 'node -v'];
+
     ['exec', 'spawn', 'execSync', 'spawnSync'].forEach(method => {
         const original = cp[method];
         if (!original) return;
@@ -23,10 +25,18 @@ function setupShield() {
         const wrapper = function (...args) {
             const command = args[0];
             const cmdStr = typeof command === 'string' ? command : (Array.isArray(args[1]) ? args[1].join(' ') : String(command));
-            console.warn(`[ZIFT-SHIELD] 🐚 Shell Execution: ${cmdStr}`);
 
-            if (cmdStr.includes('curl') || cmdStr.includes('wget') || cmdStr.includes('| sh') || cmdStr.includes('| bash')) {
-                console.error(`[ZIFT-SHIELD] ⚠️  CRITICAL: Potential Remote Dropper detected in shell execution!`);
+            // Security Logic
+            const isCritical = cmdStr.includes('curl') || cmdStr.includes('wget') || cmdStr.includes('| sh') || cmdStr.includes('| bash') || cmdStr.includes('rm -rf /');
+            const isBlocked = !ALLOWED_COMMANDS.some(allowed => cmdStr.startsWith(allowed)) || isCritical;
+
+            if (isBlocked) {
+                console.error(`[ZIFT-SHIELD] ❌ BLOCKED: Unauthorized or dangerous shell execution: "${cmdStr}"`);
+                if (process.env.ZIFT_ENFORCE === 'true') {
+                    throw new Error(`[ZIFT-SHIELD] Access Denied: Shell command "${cmdStr}" is not in the allow-list.`);
+                }
+            } else {
+                console.warn(`[ZIFT-SHIELD] 🐚 Shell Execution (Allowed): ${cmdStr}`);
             }
 
             return original.apply(this, args);
@@ -39,6 +49,42 @@ function setupShield() {
         }
     });
 
+    // 2.5 Filesystem Protection
+    const fs = require('node:fs');
+    const PROTECTED_FILES = ['.env', '.npmrc', 'shadow', 'id_rsa', 'id_ed25519'];
+
+    const fsMethods = ['readFile', 'readFileSync', 'promises.readFile', 'createReadStream'];
+    fsMethods.forEach(methodPath => {
+        let parent = fs;
+        let method = methodPath;
+        if (methodPath.startsWith('promises.')) {
+            parent = fs.promises;
+            method = 'readFile';
+        }
+
+        const original = parent[method];
+        if (!original) return;
+
+        const wrapper = function (...args) {
+            const pathArg = args[0];
+            const pathStr = typeof pathArg === 'string' ? pathArg : (pathArg instanceof Buffer ? pathArg.toString() : String(pathArg));
+
+            if (PROTECTED_FILES.some(f => pathStr.includes(f))) {
+                console.error(`[ZIFT-SHIELD] ❌ BLOCKED: Access to protected file: "${pathStr}"`);
+                if (process.env.ZIFT_ENFORCE === 'true') {
+                    throw new Error(`[ZIFT-SHIELD] Access Denied: Protected file "${pathStr}" cannot be read.`);
+                }
+            }
+            return original.apply(this, args);
+        };
+
+        try {
+            Object.defineProperty(parent, method, { value: wrapper, writable: false, configurable: false });
+        } catch (e) {
+            parent[method] = wrapper;
+        }
+    });
+
     // 3. Monitor HTTP/HTTPS - IMMUTABLE
     const http = require('node:http');
     const https = require('node:https');