@daemonitor/plugins 1.1.41 → 1.1.43

package/dist/plugins/monitoring/AdsensePlugin.js

@@ -32,8 +32,8 @@ export function reportStart(today) {
 }
 export function reportUrl(account, start, end, bySite = false) {
     const q = new URLSearchParams({ dateRange: "CUSTOM", reportingTimeZone: "ACCOUNT_TIME_ZONE", dimensions: "DATE" });
-    // DOMAIN_NAME, not OWNED_SITE_DOMAIN_NAME: the owned-site rows nest (archpaper.com
-    // contains www.archpaper.com and jobs.archpaper.com), so they double count.
+    // DOMAIN_NAME, not OWNED_SITE_DOMAIN_NAME: the owned-site rows nest (example.com
+    // contains www.example.com and jobs.example.com), so they double count.
     if (bySite)
         q.append("dimensions", "DOMAIN_NAME");
     for (const [k, v] of [["startDate", start], ["endDate", end]]) {
@@ -183,7 +183,7 @@ export function createAdsensePlugin() {
         }
         catch { /* totals only */ }
         return {
-            // The account's own name ("The Architect's Newspaper") labels the service.
+            // The account's own name labels the service.
             // It overrides the plugin's instance name, which only says "AdSense".
             ...(account.displayName ? { name: account.displayName } : {}),
             accountId: account.name,

package/dist/plugins/monitoring/Ga4Plugin.js

@@ -102,7 +102,7 @@ export function pagesRequest(startDate, exclude = []) {
 const bareHost = (h) => h.trim().toLowerCase().replace(/^www\./, "");
 /**
  * A pages report -> the most viewed pages per host. `/a` and `/a/` add up, and a
- * site name most titles end in (" | The Architect's Newspaper") comes off.
+ * site name most titles end in (" | Example Site") comes off.
  */
 export function parsePages(report) {
     const rows = (report?.rows || []).map((r) => ({

package/dist/plugins/monitoring/LogWatchPlugin.js

@@ -28,7 +28,7 @@ function parseLine(line) {
     const ips = tokens.filter((t) => IP_TOKEN.test(t));
     const ip = ips.length ? ips[ips.length - 1] : (tokens[0] || "");
     // A host in the leading field is what lets a SHARED access log (one file for
-    // every vhost, as on the misc box) still say WHICH site was hit. A plain
+    // every vhost) still say WHICH site was hit. A plain
     // combined line leads with the client IP instead, so only a non-IP first
     // token counts. When $host is itself an IP — a request made straight to the
     // origin address — there is no site name to report and "" is correct.
@@ -42,13 +42,6 @@ const BASE64_BLOB = /[A-Za-z0-9+/]{40,}={0,2}/;
 const UPLOADS_PHP = /\/wp-content\/uploads\/.*\.php$/i;
 const PLUGIN_PHP = /\/wp-content\/(?:plugins|mu-plugins)\/.*\.php$/i;
 const BATCH_PATH = /^\/wp-json\/batch\/v1|rest_route=\/?batch\/v1/i;
-// The omnisend-integration mu-plugin's wp_send_json_error "Security check
-// failed" logs as 79 bytes direct from Cloudflare and 90 through cloudflared
-// (since 2026-10-28); success logs as 77 and 88. Matching on size is the only
-// signal the access log carries, so a change to that message, to nginx's gzip
-// settings or to the proxy in front silences this rule.
-const SUBSCRIBE_FAIL_BYTES = new Set([79, 90]);
-const SUBSCRIBE_REFERER = /\/subscribe\/?(?:[?#]|$)/;
 // wp-admin paths that answer 2xx to anonymous callers, so a 2xx on them proves
 // nothing about being logged in. Everything else under /wp-admin/ redirects a
 // logged-out visitor to the login form.
@@ -93,7 +86,7 @@ async function readNew(source, st) {
     st.remainder = lines.pop() ?? ""; // last element is a partial line (no newline)
     return lines;
 }
-export function analyze(lines, cfg, windowSec, st) {
+export function analyze(lines, cfg, windowSec, st, rules = []) {
     const burstThreshold = cfg.xmlrpcBurstThreshold ?? 20;
     const batchIps = new Map(); // ip → count of batch/v1 → 207
     // key (ip, or path for webshells) → the vhosts it was seen against. Only
@@ -123,7 +116,7 @@ export function analyze(lines, cfg, windowSec, st) {
     const adminOkIps = new Set(); // ip that then loaded an authed wp-admin page (2xx)
     const xmlrpcByIp = new Map(); // ip → POST xmlrpc count
     const webshell = new Map(); // pathNoQuery → sample
-    const subscribeFail = new Map(); // ip → "Security check failed" replies
+    const compiled = rules.map((rule) => ({ rule, referer: rule.referer ? new RegExp(rule.referer) : null, hits: new Map() }));
     let total = 0;
     for (const line of lines) {
         const e = parseLine(line);
@@ -174,8 +167,18 @@ export function analyze(lines, cfg, windowSec, st) {
         // every WP site is probed constantly for my.php / academy.php / etc., and
         // those hits 404 (not there) or 403 (WAF-blocked). Alerting on the probes
         // is pure noise; alert only when the shell actually RAN.
-        if (e.method === "POST" && pathNoQuery === "/wp-admin/admin-ajax.php" && SUBSCRIBE_FAIL_BYTES.has(e.bytes) && SUBSCRIBE_REFERER.test(e.referer)) {
-            subscribeFail.set(e.ip, (subscribeFail.get(e.ip) || 0) + 1);
+        for (const { rule, referer, hits } of compiled) {
+            if (rule.method && rule.method !== e.method)
+                continue;
+            if (rule.path && rule.path !== pathNoQuery)
+                continue;
+            if (rule.status && !rule.status.includes(e.status))
+                continue;
+            if (rule.bytes && !rule.bytes.includes(e.bytes))
+                continue;
+            if (referer && !referer.test(e.referer))
+                continue;
+            hits.set(e.ip, (hits.get(e.ip) || 0) + 1);
             noteHost(e.ip, e.host);
         }
         const executed = e.status >= 200 && e.status < 300;
@@ -193,7 +196,7 @@ export function analyze(lines, cfg, windowSec, st) {
     // batch/v1 finding so it leads.
     // Only call it a takeover when the login status is trustworthy for this site
     // AND the IP went on to load an admin screen successfully. Either half alone
-    // produced a false "account takeover" page on archpaper.com, 2026-08-23.
+    // would page a false "account takeover".
     const authed = (ip) => !st?.hideLogin && loginOkIps.has(ip) && adminOkIps.has(ip);
     for (const [ip, count] of batchIps) {
         if (authed(ip)) {
@@ -230,13 +233,16 @@ export function analyze(lines, cfg, windowSec, st) {
             });
         }
     }
-    for (const [ip, count] of subscribeFail) {
-        findings.push({
-            rule: "subscribe-nonce-fail", key: `subscribe-nonce:${ip}`, severity: "warning", ip,
-            path: "/wp-admin/admin-ajax.php",
-            title: "Subscribe form rejected a visitor",
-            detail: `${ip}: "Security check failed" on /subscribe/ (${count}×)${onSites(ip)}, a real signup was turned away`,
-        });
+    for (const { rule, hits } of compiled) {
+        for (const [ip, count] of hits) {
+            const title = rule.title || rule.name;
+            findings.push({
+                rule: rule.name, key: `rule:${rule.name}:${ip}`, severity: rule.severity || "warning", ip,
+                path: rule.path,
+                title,
+                detail: `${ip}: ${title} (${count}×)${onSites(ip)}`,
+            });
+        }
     }
     const counts = {
         total,
@@ -245,7 +251,7 @@ export function analyze(lines, cfg, windowSec, st) {
         batchBlocked,
         xmlrpcPosts: [...xmlrpcByIp.values()].reduce((a, b) => a + b, 0),
         webshellHits: [...webshell.values()].reduce((a, b) => a + b.count, 0),
-        subscribeFail: [...subscribeFail.values()].reduce((a, b) => a + b, 0),
+        ruleHits: compiled.reduce((n, { hits }) => n + [...hits.values()].reduce((a, b) => a + b, 0), 0),
         loginSuccess: st?.hideLogin ? 0 : [...loginOkIps].filter((ip) => adminOkIps.has(ip)).length,
         loginRedirectsAlways: !!st?.hideLogin,
     };
@@ -262,7 +268,7 @@ export function createLogWatchPlugin() {
         if (Array.isArray(cfg.sources) && cfg.sources.length)
             return cfg.sources;
         if (cfg.path)
-            return [{ name: cfg.name, path: cfg.path, fromStart: cfg.fromStart }];
+            return [{ name: cfg.name, path: cfg.path, fromStart: cfg.fromStart, rules: cfg.rules }];
         return [];
     };
     const refreshFn = async (plugin) => {
@@ -280,7 +286,7 @@ export function createLogWatchPlugin() {
             }
             try {
                 const lines = await readNew(source, st);
-                const { findings, counts } = analyze(lines, cfg, windowSec, st);
+                const { findings, counts } = analyze(lines, cfg, windowSec, st, source.rules);
                 await plugin.send({ name: label, source: label, path: source.path, window: windowSec, counts, findings }, uid);
             }
             catch (e) {
@@ -298,6 +304,6 @@ export function createLogWatchPlugin() {
         refreshTimer = null;
         states.clear();
     };
-    return createMonitoringPlugin("logwatch", "logwatch", "Access-log security watcher (WP2Shell / webshell / xmlrpc / subscribe form)", async () => { }, monitorFn, refreshFn, teardownFn);
+    return createMonitoringPlugin("logwatch", "logwatch", "Access-log security watcher (WP2Shell / webshell / xmlrpc / custom rules)", async () => { }, monitorFn, refreshFn, teardownFn);
 }
 export default createLogWatchPlugin;

package/dist/plugins/monitoring/WordpressPlugin.js

@@ -4,7 +4,7 @@ import { readdir } from "node:fs/promises";
 import * as path from "node:path";
 import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
 // WordPress security-posture plugin. Runs on the WP host (where the daemonitor
-// client already runs) and polls the state that the Archpaper intrusions moved
+// client already runs) and polls the state that WordPress intrusions tend to move
 // through: admin accounts, page statuses, must-use plugins, and the web user's
 // crontab. It emits raw observations only — severity and the new-admin /
 // admin-demotion DIFFS are decided server-side in the ingest handler
@@ -16,11 +16,11 @@ import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
 // is best-effort and isolated: one failing (e.g. crontab needs root) degrades
 // that one field to null, it never kills the poll.
 const pexec = promisify(execFile);
-// Service-account naming patterns seen in the Archpaper intrusions. Any admin
+// Service-account naming patterns common in WordPress intrusions. Any admin
 // whose login/email contains one of these (case-insensitive substring) is
 // flagged for escalation even before the new-admin diff fires.
 const DEFAULT_SERVICE_PATTERNS = [
-    "wpsvc", "wpengine", "bot", "svc", "researchlabs", "wordpress-svc",
+    "wpsvc", "wpengine", "bot", "svc", "wordpress-svc",
 ];
 const DEFAULT_CRITICAL_PAGES = ["login", "home", "index", "front-page"];
 function slug(s) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daemonitor/plugins",
-  "version": "1.1.41",
+  "version": "1.1.43",
   "description": "daemonitor plugins",
   "types": "types/index.d.ts",
   "main": "dist/index.js",