@dimzxzzx07/file-watcher 1.0.0

package/dist/detectors/PatternMatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PatternMatcher.d.ts","sourceRoot":"","sources":["../../src/detectors/PatternMatcher.ts"],"names":[],"mappings":"AAEA,qBAAa,cAAc;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwB;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwB;;IAanD,OAAO,CAAC,kBAAkB;IA+D1B,OAAO,CAAC,oBAAoB;IA+B5B,OAAO,CAAC,oBAAoB;IAoErB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAcrD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAcvD,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC;IAoBtD,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG;QACvC,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACrE,KAAK,EAAE,MAAM,CAAC;KACjB;IAkDD,OAAO,CAAC,WAAW;IAWnB,OAAO,CAAC,SAAS;IAaV,WAAW,IAAI,MAAM,EAAE;IAIvB,aAAa,IAAI,MAAM,EAAE;IAIzB,aAAa,IAAI,MAAM,EAAE;CAGnC"}

package/dist/detectors/PatternMatcher.js

@@ -0,0 +1,283 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PatternMatcher = void 0;
+const Logger_1 = require("../utils/Logger");
+class PatternMatcher {
+    logger;
+    patterns;
+    signatures;
+    heuristics;
+    constructor() {
+        this.logger = Logger_1.Logger.getInstance();
+        this.patterns = new Map();
+        this.signatures = new Map();
+        this.heuristics = new Map();
+        this.initializePatterns();
+        this.initializeSignatures();
+        this.initializeHeuristics();
+    }
+    initializePatterns() {
+        this.patterns.set('injection', [
+            /eval\s*\(\s*['"`][^)]*['"`]\s*\)/gi,
+            /Function\s*\(\s*['"`][^)]*['"`]\s*\)/gi,
+            /setTimeout\s*\(\s*['"`][^)]*['"`]\s*\)/gi,
+            /setInterval\s*\(\s*['"`][^)]*['"`]\s*\)/gi,
+            /new\s+Function\s*\(\s*['"`][^)]*['"`]\s*\)/gi,
+            /require\s*\(\s*['"`](?:fs|child_process|vm|cluster)['"`]\s*\)/gi,
+            /process\.(?:binding|dlopen|kill)\s*\(/gi,
+            /child_process\.(?:exec|spawn|fork)\s*\(/gi,
+            /vm\.(?:runIn|create)\s*\(/gi
+        ]);
+        this.patterns.set('obfuscation', [
+            /String\.fromCharCode\s*\([^)]+\)/gi,
+            /unescape\s*\([^)]+\)/gi,
+            /escape\s*\([^)]+\)/gi,
+            /decodeURI(?:Component)?\s*\([^)]+\)/gi,
+            /atob\s*\([^)]+\)/gi,
+            /btoa\s*\([^)]+\)/gi,
+            /Buffer\.from\s*\([^)]+\)/gi,
+            /new\s+Buffer\s*\([^)]+\)/gi,
+            /\[[A-Za-z0-9+/]{50,}\]/g,
+            /\\x[0-9a-f]{2,50}/gi
+        ]);
+        this.patterns.set('backdoor', [
+            /net\.(?:createServer|connect)\s*\(/gi,
+            /http\.(?:createServer|request)\s*\(/gi,
+            /tls\.(?:createServer|connect)\s*\(/gi,
+            /dgram\.createSocket\s*\(/gi,
+            /WebSocket\s*\(/gi,
+            /Socket\.(?:connect|bind|listen)\s*\(/gi,
+            /server\.listen\s*\(\s*(?:[0-9]+|['"`][^)]*['"`])\s*\)/gi
+        ]);
+        this.patterns.set('malware', [
+            /crypto\.(?:miner|monero)/gi,
+            /xmr\./gi,
+            /coinhive/gi,
+            /Crypt(?:o)?Night/gi,
+            /webchain/gi,
+            /miner\./gi
+        ]);
+        this.patterns.set('anti-debug', [
+            /debugger;/g,
+            /--inspect/g,
+            /--debug/g,
+            /process\.(?:_getActiveRequests|_getActiveHandles)/g,
+            /Error\.captureStackTrace/g,
+            /process\.binding\(['"`]debug['"`]\)/g
+        ]);
+        this.patterns.set('self-modify', [
+            /fs\.(?:writeFile|unlink|rename)Sync?\s*\(\s*__filename/gi,
+            /fs\.(?:writeFile|unlink|rename)Sync?\s*\(\s*module\.filename/gi,
+            /process\.argv\s*\[\s*1\s*\]/gi,
+            /module\.exports\s*=\s*\{/gi,
+            /exports\.[a-zA-Z_]+\s*=/gi
+        ]);
+    }
+    initializeSignatures() {
+        this.signatures.set('malware', [
+            '4d5a90',
+            '7f454c46',
+            'cafebabe',
+            '1f8b08',
+            '504b0304',
+            '25504446',
+            'd0cf11e0',
+            '38425053'
+        ]);
+        this.signatures.set('injection', [
+            'eval(atob(',
+            'new Function(atob(',
+            'process.binding',
+            'Reflect.construct',
+            'Object.defineProperty',
+            '__defineGetter__',
+            '__defineSetter__'
+        ]);
+        this.signatures.set('backdoor', [
+            'reverse shell',
+            'bind shell',
+            'backconnect',
+            'command injection',
+            'remote access'
+        ]);
+    }
+    initializeHeuristics() {
+        this.heuristics.set('suspicious_structure', (content) => {
+            let score = 0;
+            const tryCount = (content.match(/try\s*{/g) || []).length;
+            const catchCount = (content.match(/catch\s*\(/g) || []).length;
+            if (tryCount > catchCount)
+                score += 10;
+            const concatCount = (content.match(/\+/g) || []).length;
+            if (concatCount > 100)
+                score += 20;
+            const functionCount = (content.match(/function\s*\(/g) || []).length;
+            if (functionCount > 20)
+                score += 15;
+            return score > 30;
+        });
+        this.heuristics.set('weird_variables', (content) => {
+            const varPattern = /(?:var|let|const)\s+([a-zA-Z_$][0-9a-zA-Z_$]*)/g;
+            const matches = content.match(varPattern) || [];
+            let weirdCount = 0;
+            for (const match of matches) {
+                const varName = match.split(/\s+/)[1];
+                if (varName && (varName.length > 30 ||
+                    /^_+$/.test(varName) ||
+                    /^[0-9]+$/.test(varName) ||
+                    varName.includes('_0x'))) {
+                    weirdCount++;
+                }
+            }
+            return weirdCount > 5;
+        });
+        this.heuristics.set('suspicious_strings', (content) => {
+            const suspiciousStrings = [
+                'eval', 'Function', 'constructor', 'prototype',
+                '__proto__', 'defineProperty', 'getOwnProperty',
+                'caller', 'callee', 'arguments', 'apply', 'bind',
+                'toString', 'valueOf', 'hasOwnProperty',
+                'isPrototypeOf', 'propertyIsEnumerable',
+                'toLocaleString', 'watch', 'unwatch'
+            ];
+            let suspiciousCount = 0;
+            for (const str of suspiciousStrings) {
+                const regex = new RegExp(`['"\`]${str}['"\`]`, 'g');
+                const matches = content.match(regex) || [];
+                suspiciousCount += matches.length;
+            }
+            return suspiciousCount > 10;
+        });
+        this.heuristics.set('encoded_content', (content) => {
+            const base64Matches = content.match(/[A-Za-z0-9+/]{100,}={0,2}/g) || [];
+            const hexMatches = content.match(/[0-9a-fA-F]{100,}/g) || [];
+            const unicodeMatches = content.match(/\\u[0-9a-fA-F]{4}/g) || [];
+            return base64Matches.length > 0 ||
+                hexMatches.length > 0 ||
+                unicodeMatches.length > 20;
+        });
+    }
+    matchPatterns(content, type) {
+        const patterns = this.patterns.get(type);
+        if (!patterns)
+            return false;
+        for (const pattern of patterns) {
+            if (pattern.test(content)) {
+                this.logger.debug(`Pattern matched: ${type}`, { pattern: pattern.source });
+                return true;
+            }
+        }
+        return false;
+    }
+    matchSignatures(content, type) {
+        const signatures = this.signatures.get(type);
+        if (!signatures)
+            return false;
+        for (const signature of signatures) {
+            if (content.includes(signature)) {
+                this.logger.debug(`Signature matched: ${type}`, { signature });
+                return true;
+            }
+        }
+        return false;
+    }
+    applyHeuristics(content) {
+        const results = new Map();
+        for (const [name, heuristic] of this.heuristics) {
+            try {
+                const result = heuristic(content);
+                results.set(name, result);
+                if (result) {
+                    this.logger.debug(`Heuristic triggered: ${name}`);
+                }
+            }
+            catch (error) {
+                this.logger.error(`Heuristic failed: ${name}`, { error });
+                results.set(name, false);
+            }
+        }
+        return results;
+    }
+    comprehensiveScan(content) {
+        const findings = [];
+        let totalScore = 0;
+        for (const [type, patterns] of this.patterns) {
+            for (const pattern of patterns) {
+                const matches = content.match(new RegExp(pattern.source, 'g')) || [];
+                if (matches.length > 0) {
+                    findings.push({
+                        type,
+                        pattern: pattern.source,
+                        severity: this.getSeverity(type, matches.length)
+                    });
+                    totalScore += matches.length * this.getWeight(type);
+                }
+            }
+        }
+        for (const [type, signatures] of this.signatures) {
+            for (const signature of signatures) {
+                if (content.includes(signature)) {
+                    findings.push({
+                        type,
+                        pattern: signature,
+                        severity: 'high'
+                    });
+                    totalScore += 20;
+                }
+            }
+        }
+        const heuristicResults = this.applyHeuristics(content);
+        for (const [name, result] of heuristicResults) {
+            if (result) {
+                findings.push({
+                    type: 'heuristic',
+                    pattern: name,
+                    severity: 'medium'
+                });
+                totalScore += 10;
+            }
+        }
+        return {
+            matched: findings.length > 0,
+            findings,
+            score: totalScore
+        };
+    }
+    getSeverity(type, count) {
+        if (type === 'malware' || type === 'backdoor')
+            return 'critical';
+        if (type === 'injection')
+            return 'high';
+        if (type === 'anti-debug' || type === 'self-modify')
+            return 'high';
+        if (type === 'obfuscation')
+            return 'medium';
+        if (count > 10)
+            return 'high';
+        if (count > 5)
+            return 'medium';
+        return 'low';
+    }
+    getWeight(type) {
+        const weights = {
+            'malware': 10,
+            'backdoor': 10,
+            'injection': 8,
+            'anti-debug': 6,
+            'self-modify': 6,
+            'obfuscation': 4
+        };
+        return weights[type] || 1;
+    }
+    getPatterns() {
+        return Array.from(this.patterns.keys());
+    }
+    getSignatures() {
+        return Array.from(this.signatures.keys());
+    }
+    getHeuristics() {
+        return Array.from(this.heuristics.keys());
+    }
+}
+exports.PatternMatcher = PatternMatcher;
+//# sourceMappingURL=PatternMatcher.js.map

package/dist/detectors/PatternMatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PatternMatcher.js","sourceRoot":"","sources":["../../src/detectors/PatternMatcher.ts"],"names":[],"mappings":";;;AAAA,4CAAyC;AAEzC,MAAa,cAAc;IACN,MAAM,CAAS;IACf,QAAQ,CAAwB;IAChC,UAAU,CAAwB;IAClC,UAAU,CAAwB;IAEnD;QACI,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,EAAE,CAAC;QAE5B,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAChC,CAAC;IAEO,kBAAkB;QACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE;YAC3B,oCAAoC;YACpC,wCAAwC;YACxC,0CAA0C;YAC1C,2CAA2C;YAC3C,8CAA8C;YAC9C,iEAAiE;YACjE,yCAAyC;YACzC,2CAA2C;YAC3C,6BAA6B;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE;YAC7B,oCAAoC;YACpC,wBAAwB;YACxB,sBAAsB;YACtB,uCAAuC;YACvC,oBAAoB;YACpB,oBAAoB;YACpB,4BAA4B;YAC5B,4BAA4B;YAC5B,yBAAyB;YACzB,qBAAqB;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE;YAC1B,sCAAsC;YACtC,uCAAuC;YACvC,sCAAsC;YACtC,4BAA4B;YAC5B,kBAAkB;YAClB,wCAAwC;YACxC,yDAAyD;SAC5D,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;YACzB,4BAA4B;YAC5B,SAAS;YACT,YAAY;YACZ,oBAAoB;YACpB,YAAY;YACZ,WAAW;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE;YAC5B,YAAY;YACZ,YAAY;YACZ,UAAU;YACV,oDAAoD;YACpD,2BAA2B;YAC3B,sCAAsC;SACzC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE;YAC7B,0DAA0D;YAC1D,gEAAgE;YAChE,+BAA+B;YAC/B,4BAA4B;YAC5B,2BAA2B;SAC9B,CAAC,CAAC;IACP,CAAC;IAEO,oBAAoB;QACxB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE;YAC3B,QAAQ;YACR,UAAU;YACV,UAAU;YACV,QAAQ;YACR,UAAU;YACV,UAAU;YACV,UAAU;YACV,UAAU;SACb,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE;YAC7B,YAAY;YACZ,oBAAoB;YACpB,iBAAiB;YACjB,mBAAmB;YACnB,uBAAuB;YACvB,kBAAkB;YAClB,kBAAkB;SACrB,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE;YAC5B,eAAe;YACf,YAAY;YACZ,aAAa;YACb,mBAAmB;YACnB,eAAe;SAClB,CAAC,CAAC;IACP,CAAC;IAEO,oBAAoB;QACxB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC,OAAe,EAAE,EAAE;YAC5D,IAAI,KAAK,GAAG,CAAC,CAAC;YAEd,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAC1D,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAC/D,IAAI,QAAQ,GAAG,UAAU;gBAAE,KAAK,IAAI,EAAE,CAAC;YAEvC,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACxD,IAAI,WAAW,GAAG,GAAG;gBAAE,KAAK,IAAI,EAAE,CAAC;YAEnC,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACrE,IAAI,aAAa,GAAG,EAAE;gBAAE,KAAK,IAAI,EAAE,CAAC;YAEpC,OAAO,KAAK,GAAG,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,OAAe,EAAE,EAAE;YACvD,MAAM,UAAU,GAAG,iDAAiD,CAAC;YACrE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAEhD,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtC,IAAI,OAAO,IAAI,CACX,OAAO,CAAC,MAAM,GAAG,EAAE;oBACnB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;oBACpB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;oBACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC1B,EAAE,CAAC;oBACA,UAAU,EAAE,CAAC;gBACjB,CAAC;YACL,CAAC;YAED,OAAO,UAAU,GAAG,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,OAAe,EAAE,EAAE;YAC1D,MAAM,iBAAiB,GAAG;gBACtB,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW;gBAC9C,WAAW,EAAE,gBAAgB,EAAE,gBAAgB;gBAC/C,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM;gBAChD,UAAU,EAAE,SAAS,EAAE,gBAAgB;gBACvC,eAAe,EAAE,sBAAsB;gBACvC,gBAAgB,EAAE,OAAO,EAAE,SAAS;aACvC,CAAC;YAEF,IAAI,eAAe,GAAG,CAAC,CAAC;YACxB,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,SAAS,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACpD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC3C,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;YACtC,CAAC;YAED,OAAO,eAAe,GAAG,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,OAAe,EAAE,EAAE;YACvD,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,IAAI,EAAE,CAAC;YACxE,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;YAEjE,OAAO,aAAa,CAAC,MAAM,GAAG,CAAC;gBACxB,UAAU,CAAC,MAAM,GAAG,CAAC;gBACrB,cAAc,CAAC,MAAM,GAAG,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,aAAa,CAAC,OAAe,EAAE,IAAY;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE5B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAEM,eAAe,CAAC,OAAe,EAAE,IAAY;QAChD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAE9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC/D,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAEM,eAAe,CAAC,OAAe;QAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;QAE3C,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAE1B,IAAI,MAAM,EAAE,CAAC;oBACT,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;gBACtD,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1D,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7B,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAEM,iBAAiB,CAAC,OAAe;QAKpC,MAAM,QAAQ,GAA+D,EAAE,CAAC;QAChF,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,QAAQ,CAAC,IAAI,CAAC;wBACV,IAAI;wBACJ,OAAO,EAAE,OAAO,CAAC,MAAM;wBACvB,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;qBACnD,CAAC,CAAC;oBACH,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACxD,CAAC;YACL,CAAC;QACL,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9B,QAAQ,CAAC,IAAI,CAAC;wBACV,IAAI;wBACJ,OAAO,EAAE,SAAS;wBAClB,QAAQ,EAAE,MAAM;qBACnB,CAAC,CAAC;oBACH,UAAU,IAAI,EAAE,CAAC;gBACrB,CAAC;YACL,CAAC;QACL,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;YAC5C,IAAI,MAAM,EAAE,CAAC;gBACT,QAAQ,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,QAAQ;iBACrB,CAAC,CAAC;gBACH,UAAU,IAAI,EAAE,CAAC;YACrB,CAAC;QACL,CAAC;QAED,OAAO;YACH,OAAO,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC5B,QAAQ;YACR,KAAK,EAAE,UAAU;SACpB,CAAC;IACN,CAAC;IAEO,WAAW,CAAC,IAAY,EAAE,KAAa;QAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC;QACjE,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,MAAM,CAAC;QACxC,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,aAAa;YAAE,OAAO,MAAM,CAAC;QACnE,IAAI,IAAI,KAAK,aAAa;YAAE,OAAO,QAAQ,CAAC;QAE5C,IAAI,KAAK,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC/B,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,SAAS,CAAC,IAAY;QAC1B,MAAM,OAAO,GAA2B;YACpC,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,CAAC;YACf,aAAa,EAAE,CAAC;YAChB,aAAa,EAAE,CAAC;SACnB,CAAC;QAEF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAEM,WAAW;QACd,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEM,aAAa;QAChB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAEM,aAAa;QAChB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;CACJ;AA5TD,wCA4TC","sourcesContent":["import { Logger } from '../utils/Logger';\n\nexport class PatternMatcher {\n    private readonly logger: Logger;\n    private readonly patterns: Map<string, RegExp[]>;\n    private readonly signatures: Map<string, string[]>;\n    private readonly heuristics: Map<string, Function>;\n\n    constructor() {\n        this.logger = Logger.getInstance();\n        this.patterns = new Map();\n        this.signatures = new Map();\n        this.heuristics = new Map();\n        \n        this.initializePatterns();\n        this.initializeSignatures();\n        this.initializeHeuristics();\n    }\n\n    private initializePatterns(): void {\n        this.patterns.set('injection', [\n            /eval\\s*\\(\\s*['\"`][^)]*['\"`]\\s*\\)/gi,\n            /Function\\s*\\(\\s*['\"`][^)]*['\"`]\\s*\\)/gi,\n            /setTimeout\\s*\\(\\s*['\"`][^)]*['\"`]\\s*\\)/gi,\n            /setInterval\\s*\\(\\s*['\"`][^)]*['\"`]\\s*\\)/gi,\n            /new\\s+Function\\s*\\(\\s*['\"`][^)]*['\"`]\\s*\\)/gi,\n            /require\\s*\\(\\s*['\"`](?:fs|child_process|vm|cluster)['\"`]\\s*\\)/gi,\n            /process\\.(?:binding|dlopen|kill)\\s*\\(/gi,\n            /child_process\\.(?:exec|spawn|fork)\\s*\\(/gi,\n            /vm\\.(?:runIn|create)\\s*\\(/gi\n        ]);\n\n        this.patterns.set('obfuscation', [\n            /String\\.fromCharCode\\s*\\([^)]+\\)/gi,\n            /unescape\\s*\\([^)]+\\)/gi,\n            /escape\\s*\\([^)]+\\)/gi,\n            /decodeURI(?:Component)?\\s*\\([^)]+\\)/gi,\n            /atob\\s*\\([^)]+\\)/gi,\n            /btoa\\s*\\([^)]+\\)/gi,\n            /Buffer\\.from\\s*\\([^)]+\\)/gi,\n            /new\\s+Buffer\\s*\\([^)]+\\)/gi,\n            /\\[[A-Za-z0-9+/]{50,}\\]/g,\n            /\\\\x[0-9a-f]{2,50}/gi\n        ]);\n\n        this.patterns.set('backdoor', [\n            /net\\.(?:createServer|connect)\\s*\\(/gi,\n            /http\\.(?:createServer|request)\\s*\\(/gi,\n            /tls\\.(?:createServer|connect)\\s*\\(/gi,\n            /dgram\\.createSocket\\s*\\(/gi,\n            /WebSocket\\s*\\(/gi,\n            /Socket\\.(?:connect|bind|listen)\\s*\\(/gi,\n            /server\\.listen\\s*\\(\\s*(?:[0-9]+|['\"`][^)]*['\"`])\\s*\\)/gi\n        ]);\n\n        this.patterns.set('malware', [\n            /crypto\\.(?:miner|monero)/gi,\n            /xmr\\./gi,\n            /coinhive/gi,\n            /Crypt(?:o)?Night/gi,\n            /webchain/gi,\n            /miner\\./gi\n        ]);\n\n        this.patterns.set('anti-debug', [\n            /debugger;/g,\n            /--inspect/g,\n            /--debug/g,\n            /process\\.(?:_getActiveRequests|_getActiveHandles)/g,\n            /Error\\.captureStackTrace/g,\n            /process\\.binding\\(['\"`]debug['\"`]\\)/g\n        ]);\n\n        this.patterns.set('self-modify', [\n            /fs\\.(?:writeFile|unlink|rename)Sync?\\s*\\(\\s*__filename/gi,\n            /fs\\.(?:writeFile|unlink|rename)Sync?\\s*\\(\\s*module\\.filename/gi,\n            /process\\.argv\\s*\\[\\s*1\\s*\\]/gi,\n            /module\\.exports\\s*=\\s*\\{/gi,\n            /exports\\.[a-zA-Z_]+\\s*=/gi\n        ]);\n    }\n\n    private initializeSignatures(): void {\n        this.signatures.set('malware', [\n            '4d5a90',\n            '7f454c46',\n            'cafebabe',\n            '1f8b08',\n            '504b0304',\n            '25504446',\n            'd0cf11e0',\n            '38425053'\n        ]);\n\n        this.signatures.set('injection', [\n            'eval(atob(',\n            'new Function(atob(',\n            'process.binding',\n            'Reflect.construct',\n            'Object.defineProperty',\n            '__defineGetter__',\n            '__defineSetter__'\n        ]);\n\n        this.signatures.set('backdoor', [\n            'reverse shell',\n            'bind shell',\n            'backconnect',\n            'command injection',\n            'remote access'\n        ]);\n    }\n\n    private initializeHeuristics(): void {\n        this.heuristics.set('suspicious_structure', (content: string) => {\n            let score = 0;\n            \n            const tryCount = (content.match(/try\\s*{/g) || []).length;\n            const catchCount = (content.match(/catch\\s*\\(/g) || []).length;\n            if (tryCount > catchCount) score += 10;\n            \n            const concatCount = (content.match(/\\+/g) || []).length;\n            if (concatCount > 100) score += 20;\n            \n            const functionCount = (content.match(/function\\s*\\(/g) || []).length;\n            if (functionCount > 20) score += 15;\n            \n            return score > 30;\n        });\n\n        this.heuristics.set('weird_variables', (content: string) => {\n            const varPattern = /(?:var|let|const)\\s+([a-zA-Z_$][0-9a-zA-Z_$]*)/g;\n            const matches = content.match(varPattern) || [];\n            \n            let weirdCount = 0;\n            for (const match of matches) {\n                const varName = match.split(/\\s+/)[1];\n                if (varName && (\n                    varName.length > 30 ||\n                    /^_+$/.test(varName) ||\n                    /^[0-9]+$/.test(varName) ||\n                    varName.includes('_0x')\n                )) {\n                    weirdCount++;\n                }\n            }\n            \n            return weirdCount > 5;\n        });\n\n        this.heuristics.set('suspicious_strings', (content: string) => {\n            const suspiciousStrings = [\n                'eval', 'Function', 'constructor', 'prototype',\n                '__proto__', 'defineProperty', 'getOwnProperty',\n                'caller', 'callee', 'arguments', 'apply', 'bind',\n                'toString', 'valueOf', 'hasOwnProperty',\n                'isPrototypeOf', 'propertyIsEnumerable',\n                'toLocaleString', 'watch', 'unwatch'\n            ];\n            \n            let suspiciousCount = 0;\n            for (const str of suspiciousStrings) {\n                const regex = new RegExp(`['\"\\`]${str}['\"\\`]`, 'g');\n                const matches = content.match(regex) || [];\n                suspiciousCount += matches.length;\n            }\n            \n            return suspiciousCount > 10;\n        });\n\n        this.heuristics.set('encoded_content', (content: string) => {\n            const base64Matches = content.match(/[A-Za-z0-9+/]{100,}={0,2}/g) || [];\n            const hexMatches = content.match(/[0-9a-fA-F]{100,}/g) || [];\n            const unicodeMatches = content.match(/\\\\u[0-9a-fA-F]{4}/g) || [];\n            \n            return base64Matches.length > 0 || \n                   hexMatches.length > 0 || \n                   unicodeMatches.length > 20;\n        });\n    }\n\n    public matchPatterns(content: string, type: string): boolean {\n        const patterns = this.patterns.get(type);\n        if (!patterns) return false;\n\n        for (const pattern of patterns) {\n            if (pattern.test(content)) {\n                this.logger.debug(`Pattern matched: ${type}`, { pattern: pattern.source });\n                return true;\n            }\n        }\n\n        return false;\n    }\n\n    public matchSignatures(content: string, type: string): boolean {\n        const signatures = this.signatures.get(type);\n        if (!signatures) return false;\n\n        for (const signature of signatures) {\n            if (content.includes(signature)) {\n                this.logger.debug(`Signature matched: ${type}`, { signature });\n                return true;\n            }\n        }\n\n        return false;\n    }\n\n    public applyHeuristics(content: string): Map<string, boolean> {\n        const results = new Map<string, boolean>();\n\n        for (const [name, heuristic] of this.heuristics) {\n            try {\n                const result = heuristic(content);\n                results.set(name, result);\n                \n                if (result) {\n                    this.logger.debug(`Heuristic triggered: ${name}`);\n                }\n            } catch (error) {\n                this.logger.error(`Heuristic failed: ${name}`, { error });\n                results.set(name, false);\n            }\n        }\n\n        return results;\n    }\n\n    public comprehensiveScan(content: string): {\n        matched: boolean;\n        findings: Array<{ type: string; pattern: string; severity: string }>;\n        score: number;\n    } {\n        const findings: Array<{ type: string; pattern: string; severity: string }> = [];\n        let totalScore = 0;\n\n        for (const [type, patterns] of this.patterns) {\n            for (const pattern of patterns) {\n                const matches = content.match(new RegExp(pattern.source, 'g')) || [];\n                if (matches.length > 0) {\n                    findings.push({\n                        type,\n                        pattern: pattern.source,\n                        severity: this.getSeverity(type, matches.length)\n                    });\n                    totalScore += matches.length * this.getWeight(type);\n                }\n            }\n        }\n\n        for (const [type, signatures] of this.signatures) {\n            for (const signature of signatures) {\n                if (content.includes(signature)) {\n                    findings.push({\n                        type,\n                        pattern: signature,\n                        severity: 'high'\n                    });\n                    totalScore += 20;\n                }\n            }\n        }\n\n        const heuristicResults = this.applyHeuristics(content);\n        for (const [name, result] of heuristicResults) {\n            if (result) {\n                findings.push({\n                    type: 'heuristic',\n                    pattern: name,\n                    severity: 'medium'\n                });\n                totalScore += 10;\n            }\n        }\n\n        return {\n            matched: findings.length > 0,\n            findings,\n            score: totalScore\n        };\n    }\n\n    private getSeverity(type: string, count: number): string {\n        if (type === 'malware' || type === 'backdoor') return 'critical';\n        if (type === 'injection') return 'high';\n        if (type === 'anti-debug' || type === 'self-modify') return 'high';\n        if (type === 'obfuscation') return 'medium';\n        \n        if (count > 10) return 'high';\n        if (count > 5) return 'medium';\n        return 'low';\n    }\n\n    private getWeight(type: string): number {\n        const weights: Record<string, number> = {\n            'malware': 10,\n            'backdoor': 10,\n            'injection': 8,\n            'anti-debug': 6,\n            'self-modify': 6,\n            'obfuscation': 4\n        };\n        \n        return weights[type] || 1;\n    }\n\n    public getPatterns(): string[] {\n        return Array.from(this.patterns.keys());\n    }\n\n    public getSignatures(): string[] {\n        return Array.from(this.signatures.keys());\n    }\n\n    public getHeuristics(): string[] {\n        return Array.from(this.heuristics.keys());\n    }\n}"]}

package/dist/guards/FileGuard.d.ts

@@ -0,0 +1,35 @@
+export declare class FileGuard {
+    private static instance;
+    private readonly logger;
+    private readonly fileLocks;
+    private readonly filePermissions;
+    private readonly watchedFiles;
+    private readonly quarantineDir;
+    private isActive;
+    private constructor();
+    static getInstance(): FileGuard;
+    private initializeQuarantine;
+    private startFileMonitoring;
+    protectFile(filePath: string): Promise<boolean>;
+    lockFile(filePath: string): Promise<boolean>;
+    unlockFile(filePath: string): Promise<boolean>;
+    quarantineFile(filePath: string, reason: string): Promise<string>;
+    restoreFromQuarantine(quarantinePath: string): Promise<boolean>;
+    verifyFileIntegrity(filePath: string): Promise<boolean>;
+    createBackup(filePath: string): Promise<string>;
+    restoreFromBackup(backupPath: string, targetPath: string): Promise<boolean>;
+    monitorFile(filePath: string): Promise<void>;
+    private handleFileChange;
+    private handleFileDelete;
+    private checkFileIntegrity;
+    private fileExists;
+    private calculateFileHash;
+    private getStoredHash;
+    private findBackups;
+    getLockedFiles(): string[];
+    getWatchedFiles(): string[];
+    getQuarantinedFiles(): Promise<string[]>;
+    deactivate(): void;
+    getStatus(): any;
+}
+//# sourceMappingURL=FileGuard.d.ts.map

package/dist/guards/FileGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FileGuard.d.ts","sourceRoot":"","sources":["../../src/guards/FileGuard.ts"],"names":[],"mappings":"AAKA,qBAAa,SAAS;IAClB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgD;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;IACtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAiB;IAEjC,OAAO;WAWO,WAAW,IAAI,SAAS;YAOxB,oBAAoB;IAQlC,OAAO,CAAC,mBAAmB;IAMd,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA6B/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAqB5C,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsB9C,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA8BjE,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB/D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoCvD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB/C,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsB3E,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAoB3C,gBAAgB;YAgBhB,gBAAgB;YAUhB,kBAAkB;YAYlB,UAAU;YASV,iBAAiB;YAOjB,aAAa;YASb,WAAW;IAiBlB,cAAc,IAAI,MAAM,EAAE;IAM1B,eAAe,IAAI,MAAM,EAAE;IAIrB,mBAAmB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAS9C,UAAU,IAAI,IAAI;IAiBlB,SAAS,IAAI,GAAG;CAQ1B"}