@shomra/agent 0.3.17 → 0.3.18

package/src/detect/signals/packages.mjs

@@ -0,0 +1,45 @@
+export const INSTALL_LURE = [
+  { name: 'Instructs downloading an executable/archive to run', re: /\b(download|install|fetch|grab|extract)\b[^\n]{0,180}\.(zip|exe|dmg|pkg|msi|bin|appimage|jar|scr|apk|deb|rpm|tar\.gz|tgz)\b/i, severity: 'MEDIUM' },
+  { name: 'Password-protected archive (evades AV / scanners)', re: /\b(extract|unzip|decompress|archive|zip|password)\b[^\n]{0,50}\b(pass(word|phrase)?|pwd)\s*[:=]\s*\S/i, severity: 'HIGH' },
+  { name: 'Coercion: claims a helper is required before the task works', re: /\b(required to (function|work|deploy|run)|will not (work|function|run)( correctly| properly)?( without)?|does not work without|otherwise it is impossible|cannot [a-z ]{0,24} without (installing|running)|must (be )?(install(ed)?|run) (this |the )?)/i, severity: 'MEDIUM' },
+  { name: 'Coercion: re-run / retry until it succeeds', re: /\b(re-?run (if needed|until|the command)|run (it |the command )?again|try again after)/i, severity: 'LOW' },
+];
+
+export const MALICIOUS_PACKAGE_SEED = new Set([
+  'event-stream', 'eslint-scope-malware', 'electron-native-notify', 'rc-malware',
+  'crossenv', 'mongose', 'expresss',
+]);
+
+export const POPULAR_PACKAGES = [
+  'express', 'react', 'lodash', 'axios', 'chalk', 'commander',
+  'mongoose', 'cross-env', 'dotenv', 'request', 'puppeteer', 'playwright',
+];
+
+export function editDistance(a, b) {
+  const m = a.length, n = b.length;
+  const dp = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(0));
+  for (let i = 0; i <= m; i++) dp[i][0] = i;
+  for (let j = 0; j <= n; j++) dp[0][j] = j;
+  for (let i = 1; i <= m; i++)
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      dp[i][j] = Math.min(dp[i - 1][j] + 1, dp[i][j - 1] + 1, dp[i - 1][j - 1] + cost);
+    }
+  return dp[m][n];
+}
+
+export function packageFromCommand(command, args) {
+  const tokens = [command, ...(args ?? [])].filter(Boolean).map(String);
+  if (!tokens.length) return null;
+  const runners = new Set(['npx', 'npm', 'pnpm', 'yarn', 'bunx', 'bun']);
+  const skips = new Set(['exec', 'dlx', 'run', 'install', 'add', 'create', '-y', '--yes']);
+  const start = runners.has(tokens[0].split('/').pop() ?? tokens[0]) ? 1 : -1;
+  if (start === -1) return null;
+  for (let i = start; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t.startsWith('-') || skips.has(t)) continue;
+    const name = t.startsWith('@') ? t.split('/').slice(0, 2).join('/') : t.split('@')[0];
+    return name.replace(/@[\d^~].*$/, '');
+  }
+  return null;
+}

package/src/detect/signals/propagation.mjs

@@ -0,0 +1,86 @@
+import { isDocumentationLine } from './prose-context.mjs';
+
+export const AGENT_ROOT_RE =
+  /(^|\/)\.(claude|claude-plugin|cursor|continue|codeium|windsurf|aider|cline|roo|zed|codex|gemini|goose|kilocode|trae|junie|amazonq|mem0|letta|memgpt|opencode|crush|augment|kiro|qoder|factory|devin|antigravity|qwen|openhands|specstory|copilot)(\/)|(^|\/)\.github\/(agents|instructions|prompts|chatmodes)(\/)/i;
+
+export const isAgentAdjacentPath = (p) => AGENT_ROOT_RE.test(String(p ?? '').replace(/\\/g, '/'));
+
+const ARTIFACT_BASENAME_RE =
+  /(?:\b(?:SKILL\.md|AGENTS?\.md|CLAUDE\.md|GEMINI\.md|settings(?:\.local)?\.json|claude_desktop_config\.json|mcp[_-]?settings\.json|[\w-]{1,64}\.mdc)|\.cursorrules|\.windsurfrules)\b/i;
+
+const PROP_WRITE_VERB_RE =
+  /\b(write|writes|writing|create|creates|creating|recreate|recreates|restore|restores|reinstall|reinstalls|add|adds|adding|append|appends|appending|install|installs|installing|copy|copies|copying|save|saves|saving|drop|drops|place|places|generate|generates|scaffold|scaffolds|overwrite|overwrites|patch|patches|update|updates|cp|mv|tee|mkdir)\b|(?:^|[\s"'`])>>?\s*['"`]?[\w./~$-]/i;
+
+const PROP_IMPERATIVE_RE =
+  /(?:^|\n)\s*(?:[-*+]\s+|\d+[.)]\s+|\$\s+)?(?:then\s+|first\s+|now\s+|also\s+|to\s+\w+,\s*)?(write|create|recreate|restore|reinstall|add|append|install|copy|save|place|generate|scaffold|overwrite|patch|drop|echo|cat|cp|mv|tee|mkdir|printf)\b/i;
+
+const PROP_SHELL_WRITE_RE = /(?:^|[\s"'`])>>?\s*['"`]?[~.$/\w-]|\b(?:tee|cp|mv|install)\s+[-\w./~$]+\s+[-\w./~$]|\bmkdir\s+-p\b/;
+
+const PROP_FETCH_RE = /\b(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod|fetch|http\.get|requests\.get|urllib)\b|\bhttps?:\/\//i;
+
+const PROP_CONCEAL_RE =
+  /\b(do not (?:mention|tell|report|log|show|disclose|reveal)|don'?t (?:mention|tell|report|log|show)|without (?:telling|informing|notifying|mentioning)|silently|quietly|no need to (?:mention|report|tell)|hide (?:this|it)|keep (?:this|it) (?:secret|hidden|between)|remove this (?:line|section|note) (?:after|once)|delete this (?:file|note) (?:after|once))\b/i;
+
+const PROP_BREADTH_RE =
+  /\b(?:every (?:project|repo(?:sitory)?|workspace|machine|checkout)|each (?:project|repo(?:sitory)?|workspace)|all (?:projects|repos(?:itories)?|workspaces)|globally|system[- ]wide)\b|~\/\.[a-z]|\$HOME\/\.[a-z]/i;
+
+const PROP_RESTORE_RE =
+  /\b(restore|recreate|re-?add|re-?install|put (?:this|it) back|if (?:this|it) (?:is |has been )?(?:deleted|removed|missing)|should (?:this|it) (?:be )?(?:deleted|removed)|ensure (?:this|it) (?:still )?exists)\b/i;
+
+const PROP_PATH_RE = /(?:^|[\s'"`(=|;&:])((?:~\/|\.{0,2}\/)?(?:[\w.@$-]+\/)+[\w.@$-]+(?:\.\w+)?)/g;
+
+const trimPropTarget = (t) => String(t).replace(/[.,;:!?)\]}'"`]{1,8}$/, '');
+
+function propPathIn(line) {
+  PROP_PATH_RE.lastIndex = 0;
+  for (const m of line.matchAll(PROP_PATH_RE)) {
+    const p = trimPropTarget(m[1] ?? '');
+    if (p && isAgentAdjacentPath(p) && /\.[a-z0-9]{1,8}$/i.test(p)) return p;
+  }
+  return null;
+}
+
+export function localPropagation(content, { path = '', kind } = {}) {
+  const body = String(content ?? '');
+  if (!body.trim()) return [];
+  const selfPath = String(path ?? '').replace(/\\/g, '/');
+  const autoRun = kind === 'hook';
+  const out = [];
+  const lines = body.split(/\r?\n/).slice(0, 4000);
+
+  for (let i = 0; i < lines.length && out.length < 12; i++) {
+    const line = lines[i];
+    if (line.length > 2000) continue;
+    const m = ARTIFACT_BASENAME_RE.exec(line);
+    const agentPath = propPathIn(line);
+    if (!m && !agentPath) continue;
+    if (!PROP_WRITE_VERB_RE.test(line)) continue;
+    if (!PROP_IMPERATIVE_RE.test(line) && !PROP_SHELL_WRITE_RE.test(line) && isDocumentationLine(line)) continue;
+
+    const target = trimPropTarget(agentPath ?? m[0]);
+    const t = target.replace(/^[.~]?\//, '');
+    const self = !!selfPath && (selfPath.endsWith(t) || t.endsWith(selfPath));
+
+    const amplifiers = [];
+    if (autoRun) amplifiers.push('auto-run');
+    if (PROP_FETCH_RE.test(line)) amplifiers.push('remote-content');
+    if (PROP_CONCEAL_RE.test(line) || PROP_CONCEAL_RE.test(lines.slice(Math.max(0, i - 1), i + 2).join(' '))) amplifiers.push('concealment');
+    if (PROP_BREADTH_RE.test(line) || (self && PROP_RESTORE_RE.test(line))) amplifiers.push('breadth');
+
+    const severity = amplifiers.includes('concealment') || amplifiers.length >= 2 ? 'CRITICAL' : amplifiers.length === 1 ? 'HIGH' : 'MEDIUM';
+    out.push({
+      severity,
+      target,
+      amplifiers,
+      line: i + 1,
+      title: self
+        ? `Artifact restores itself (${target})`
+        : `Artifact writes another agent artifact (${target})`,
+      remediationText: self
+        ? 'Removing the file is not enough - the instruction to restore it travels with it. Check every location it names for a copy.'
+        : `Confirm that writing ${target} is this artifact's stated purpose, and pin what it emits to a reviewed template rather than to content decided at run time.`,
+    });
+  }
+  const RANK = { MEDIUM: 1, HIGH: 2, CRITICAL: 3 };
+  return out.sort((a, b) => RANK[b.severity] - RANK[a.severity]);
+}

package/src/detect/signals/prose-context.mjs

@@ -0,0 +1,82 @@
+import { egressHost } from './egress.mjs';
+import { IMPERATIVE } from './memory.mjs';
+
+const DESCRIPTIVE_MARKERS =
+  /\b(detect|scan|flag|block|catch|prevent|guard|protect|harden|audit|benchmark|catalog|scenario|corpus|coverage|example|vector|signal|rule|technique|posture|detection|test\s*case|red[- ]?team|-style|grounded in|fixed|now green|was|were|had|used to|previously|postmortem|regression|changelog|root[- ]?cause|repro|note|see|describes?|documents?|refers?|treat(s|ed|ing)?|counts?|reads?)\w*/i;
+
+export function isDescriptiveLine(line) {
+  return DESCRIPTIVE_MARKERS.test(line) && !IMPERATIVE.test(line);
+}
+
+const RESEARCH_CITATION_RE =
+  /\b(?:in\s+their\s+(?:\d{4}\s+)?paper|et\s+al\.|we\s+(?:analys|analyz|studi|examin|evaluat|benchmark|review|investigat)\w*|(?:this|the)\s+(?:paper|study|report|article|post|research|survey|technique|attack|jailbreak)\b|according\s+to\s+(?:researchers|the\s+authors)|characteriz\w+\s+(?:and\s+)?evaluat\w+|published\s+(?:in|by)\b|\barxiv\b|\bCVE-\d{4}-|\bis\s+a\s+(?:critical\s+|active\s+|growing\s+)?(?:research|study)\s+(?:area|topic|field)|\b(?:the\s+)?ethics\s+of\b)/i;
+
+const ATTACK_NAMING_RE = /(?:[Tt]his|[Tt]he)\s+(?:[A-Z][\w.-]{1,24}\s+){1,3}(?:attack|jailbreak|technique|exploit|payload)\b/;
+
+const ATTACK_CHARACTERISATION_RE =
+  /\bis\s+a\s+(?:well[-\s]documented|well[-\s]known|widely[-\s]known|classic|common|known|documented)\s+(?:attack|technique|jailbreak|pattern|exploit|vector)\b/i;
+
+const CITATION_HANDOFF_RE = /[:;\u2014\u2013]\s*$/;
+
+const CITATION_FRAMES = [RESEARCH_CITATION_RE, ATTACK_NAMING_RE, ATTACK_CHARACTERISATION_RE];
+
+export function citationGoverns(segment, offset) {
+  const text = String(segment ?? '');
+
+  for (const re of CITATION_FRAMES) {
+    const cit = text.match(re);
+    if (!cit) continue;
+    if (offset == null) return true;
+    const citEnd = (cit.index ?? 0) + cit[0].length;
+    if (citEnd > offset) continue;
+    if (!CITATION_HANDOFF_RE.test(text.slice(citEnd, offset))) return true;
+  }
+  return false;
+}
+
+const ELLIPSIS_RE = /…|\.\.\./;
+
+const REGEX_PATTERN_RE = /\\[sdwbSDWB]|\\\+|\\\*|\\\(|\\\||\(\?:|\.\*|\.\+/;
+
+const CREDENTIAL_PATH_RE =
+  /~\/\.(ssh|aws|kube|gnupg|docker|npmrc?)\b|\bid_(rsa|ed25519|dsa)\b|\.pem\b|\bcredentials\b\s*(file)?|\bAWS_SECRET|\bANTHROPIC_API_KEY\b|\bOPENAI_API_KEY\b/i;
+
+const EXECUTABLE_FETCH_RE =
+  /\b(?:curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n]{0,200}?(?:https?:\/\/|\bwww\.|\b\d{1,3}(?:\.\d{1,3}){3}\b)[^\n]{0,200}?\|\s*(?:sudo\s+)?(?:(?:ba|z|k|da)?sh|python\d?|perl|ruby|node)\b/i;
+
+function carriesHardEvidence(line) {
+  return CREDENTIAL_PATH_RE.test(line) || EXECUTABLE_FETCH_RE.test(line) || !!egressHost(line);
+}
+
+export function isDocumentationLine(line) {
+  if (!line) return false;
+  if (carriesHardEvidence(line)) return false;
+  if (ELLIPSIS_RE.test(line) || REGEX_PATTERN_RE.test(line)) return true;
+  return isDescriptiveLine(line);
+}
+
+const PROHIBITION_MARKER_RE =
+  /\b(?:never|do not|don'?t|cannot|can'?t|must not|mustn'?t|should not|shouldn'?t|avoid|avoids|avoiding|refuse to|refrain from|forbidden|prohibited|disallow\w*|instead of|rather than|beware of)\b[^.:;\n]{0,60}$/i;
+
+const DOUBLE_NEGATIVE_RE = /\b(?:hesitate|worry|be afraid|forget|fail|neglect|shy away)\b/i;
+
+const COORDINATE_TAIL_RE = /(?:\b(?:and|or|but|then|also)\b|[,;])\s*$/i;
+
+export function prohibitsAt(line, offset) {
+  if (!line) return false;
+  const at = offset == null || offset < 0 ? line.length : Math.min(offset, line.length);
+  const before = line.slice(Math.max(0, at - 90), at);
+  if (!PROHIBITION_MARKER_RE.test(before)) return false;
+  if (COORDINATE_TAIL_RE.test(before)) return false;
+  return !DOUBLE_NEGATIVE_RE.test(before);
+}
+
+const RISK_CELL_RE = /\b(?:critical|high|medium|low|severity|risk|danger\w*|forbidden|blocked|denied|prohibited|never|do not|example|attack|threat|mitigation|why|impact)\b/i;
+
+export function isRiskTableRow(line) {
+  const t = String(line ?? '').trim();
+  if (!t.startsWith('|') || !t.endsWith('|')) return false;
+  const cells = t.slice(1, -1).split('|');
+  if (cells.length < 3) return false;
+  return cells.some((c) => RISK_CELL_RE.test(c));
+}

package/src/detect/signals/scan.mjs

@@ -0,0 +1,91 @@
+import { RISKY_CONFIG_MARKERS, riskyConfigHit } from './config-markers.mjs';
+import { detectCredentialHarvest } from './credential-harvest.mjs';
+import { egressHost } from './egress.mjs';
+import { detectExecutionHijack } from './execution-hijack.mjs';
+import { BUILD_ARTIFACT, INJECTION_PHRASES, INJECTION_REGEXES, INVISIBLE_CHARS_RE, PRECEDING_NEGATION, describesRatherThanInstructs } from './injection.mjs';
+import { lineAt, locate } from './lines.mjs';
+import { codeMask, deobfuscate } from './masking.mjs';
+import { PII_PATTERNS, RESERVED_IPV4, SECRET_PATTERNS, VERSION_CONTEXT, isPlaceholderSecret, luhnValid } from './secrets.mjs';
+import { SEV_RANK } from './severity.mjs';
+import { DANGEROUS_SHELL, matchesShellSignal } from './shell.mjs';
+import { scanStagedFetchExec } from './staged-fetch.mjs';
+
+export function localScan(text, opts = {}) {
+  const findings = [];
+  const t = text || '';
+  const cats = opts.categories ?? ['shell', 'injection', 'secret', 'config', 'egress'];
+  const mask = codeMask(t);
+
+  if (cats.includes('shell')) {
+    const aug = deobfuscate(t);
+    if (aug.decodedPayload) findings.push({ label: 'Encoded shell / RCE payload (base64, hex, percent or char-code)', severity: 'CRITICAL', category: 'shell' });
+    for (const sig of DANGEROUS_SHELL) if (matchesShellSignal(sig, aug.text)) findings.push({ label: sig.name, severity: sig.severity, category: 'shell', ...locate(t, sig.re, mask) });
+    for (const sig of scanStagedFetchExec(aug.text)) findings.push({ label: sig.name, severity: sig.severity, category: 'shell', ...locate(t, sig.re, mask) });
+    for (const h of detectExecutionHijack(aug.text))
+      findings.push({ label: `Installs an execution hook that governs ${h.governs} (${h.key})`, severity: h.severity, category: 'shell' });
+    for (const c of detectCredentialHarvest(aug.text))
+      findings.push({ label: `${c.label} - credential harvest`, severity: c.severity, category: 'shell' });
+  }
+  if (cats.includes('injection')) {
+    const low = t.toLowerCase();
+
+    for (const p of INJECTION_PHRASES) {
+      const at = low.indexOf(p);
+      if (at < 0) continue;
+      if (PRECEDING_NEGATION.test(t.slice(Math.max(0, at - 20), at))) continue;
+      findings.push({ label: `Injected instruction: "${p}"`, severity: 'HIGH', category: 'injection', ...locate(t, p, mask) });
+      break;
+    }
+    for (const { label, re, moodGuarded } of INJECTION_REGEXES) {
+      const m = t.match(re);
+      if (!m) continue;
+      const at = m.index ?? 0;
+      if (PRECEDING_NEGATION.test(t.slice(Math.max(0, at - 20), at))) continue;
+      if (label === 'Bulk destructive command' && BUILD_ARTIFACT.test(m[0])) continue;
+      if (moodGuarded && describesRatherThanInstructs(t, at)) continue;
+      findings.push({ label, severity: 'HIGH', category: 'injection', ...locate(t, re, mask) });
+    }
+    if (INVISIBLE_CHARS_RE.test(t)) findings.push({ label: 'Invisible / zero-width characters', severity: 'MEDIUM', category: 'injection', ...locate(t, INVISIBLE_CHARS_RE, mask) });
+  }
+  if (cats.includes('secret')) {
+    for (const { name, re } of SECRET_PATTERNS) { const m = t.match(re); if (m && !isPlaceholderSecret(m[0])) findings.push({ label: `Live credential: ${name}`, severity: 'CRITICAL', category: 'secret', ...locate(t, re, mask) }); }
+  }
+  if (cats.includes('pii')) {
+    for (const { name, re } of PII_PATTERNS) {
+      const m = t.match(re);
+      if (!m) continue;
+      if (name === 'Credit card number' && !luhnValid(m[0])) continue;
+
+      if (name === 'IPv4 address') {
+        if (RESERVED_IPV4.test(m[0])) continue;
+        if (VERSION_CONTEXT.test(t.slice(Math.max(0, (m.index ?? 0) - 12), m.index ?? 0))) continue;
+      }
+
+      if (name === 'Phone number' && /^\d+$/.test(m[0])) continue;
+      findings.push({ label: `Personal data: ${name}`, severity: 'MEDIUM', category: 'pii', ...locate(t, re, mask) });
+    }
+  }
+  if (cats.includes('config')) {
+
+    for (const m of RISKY_CONFIG_MARKERS) {
+      const hit = riskyConfigHit(t, m);
+      if (hit) {
+        findings.push({ label: `Risky setting: "${m}"`, severity: 'MEDIUM', category: 'config', line: lineAt(t, hit.start), codeContext: mask[hit.start] === 1 });
+        break;
+      }
+    }
+  }
+  if (cats.includes('egress')) {
+    const h = egressHost(t);
+    if (h) findings.push({ label: `Exfiltration sink host: ${h}`, severity: 'HIGH', category: 'egress', ...locate(t, h, mask) });
+  }
+
+  let worstRank = 0, top = null;
+  for (const f of findings) if (SEV_RANK[f.severity] > worstRank) { worstRank = SEV_RANK[f.severity]; top = f; }
+  const verdict = worstRank >= SEV_RANK.CRITICAL ? 'BLOCK' : worstRank >= SEV_RANK.HIGH ? 'FLAG' : 'ALLOW';
+  return { verdict, top, findings };
+}
+
+export function downrankCodeContext(findings) {
+  return (findings || []).map((f) => (f.codeContext ? { ...f, severity: 'LOW', downranked: true } : f));
+}

package/src/detect/signals/secrets.mjs

@@ -0,0 +1,85 @@
+export const SECRET_PATTERNS = [
+
+  { name: 'Stripe live key', re: /\bsk_live_[0-9a-zA-Z]{16,}/ },
+  { name: 'OpenAI key', re: /\bsk-[A-Za-z0-9]{20,}/ },
+  { name: 'AWS access key id', re: /\bAKIA[0-9A-Z]{16}/ },
+  { name: 'GitHub token', re: /ghp_[0-9A-Za-z]{20,}/ },
+
+  { name: 'Anthropic API key', re: /\bsk-ant-[A-Za-z0-9_-]{20,}/ },
+  { name: 'OpenAI project key', re: /\bsk-proj-[A-Za-z0-9_-]{20,}/ },
+  { name: 'Google API key', re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+  { name: 'Hugging Face token', re: /\bhf_[A-Za-z0-9]{30,}/ },
+  { name: 'GitLab PAT', re: /\bglpat-[A-Za-z0-9_-]{20,}/ },
+  { name: 'npm token', re: /\bnpm_[A-Za-z0-9]{30,}/ },
+  { name: 'Slack token', re: /xox[baprs]-[0-9A-Za-z-]{10,}/ },
+
+  { name: 'AWS secret access key (keyed)', re: /\bAWS_SECRET_ACCESS_KEY\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}\b/ },
+
+  {
+    name: 'Database URL with password',
+    re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/(?!(?:user|username|admin|root|myuser|dbuser):(?:pass|password|passwd|secret|changeme|mypassword|yourpassword|xxx+|123456)@)[^\s:@/]+:[^\s:@/]{4,}@/i,
+  },
+  { name: 'Generic bearer', re: /bearer\s+[A-Za-z0-9._-]{20,}/i },
+  { name: 'Private key block', re: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/ },
+
+  { name: 'Groq API key', re: /\bgsk_[A-Za-z0-9]{40,}/ },
+  { name: 'Replicate API token', re: /\br8_[A-Za-z0-9]{30,}/ },
+  { name: 'Perplexity API key', re: /\bpplx-[A-Za-z0-9]{32,}/ },
+  { name: 'Fireworks API key', re: /\bfw_[A-Za-z0-9]{20,}/ },
+  { name: 'xAI API key', re: /\bxai-[A-Za-z0-9]{40,}/ },
+  { name: 'LangSmith API key', re: /\blsv2_(?:pt|sk)_[A-Za-z0-9]{24,}_[A-Za-z0-9]{8,}/ },
+  { name: 'Pinecone API key', re: /\bpcsk_[A-Za-z0-9_]{30,}/ },
+  { name: 'OpenRouter API key', re: /\bsk-or-v1-[A-Za-z0-9]{32,}/ },
+  { name: 'DigitalOcean token', re: /\bdop_v1_[a-f0-9]{60,}/ },
+  { name: 'Shopify access token', re: /\bshp(?:at|ca|pa|ss)_[a-fA-F0-9]{30,}/ },
+  { name: 'GitHub fine-grained PAT', re: /\bgithub_pat_[A-Za-z0-9_]{60,}/ },
+  { name: 'GitHub OAuth / refresh / server token', re: /\bgh[osur]_[A-Za-z0-9]{20,}/ },
+  { name: 'SendGrid API key', re: /\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{40,}/ },
+  { name: 'Slack incoming webhook', re: /\bhooks\.slack\.com\/services\/T[A-Z0-9]{6,}\/B[A-Z0-9]{6,}\/[A-Za-z0-9]{20,}/ },
+  { name: 'Discord webhook', re: /\bdiscord(?:app)?\.com\/api\/webhooks\/\d{17,}\/[A-Za-z0-9_-]{40,}/ },
+  { name: 'Telegram bot token', re: /\b\d{8,12}:AA[A-Za-z0-9_-]{30,}/ },
+  { name: 'Sentry DSN with secret', re: /\bhttps:\/\/[a-f0-9]{32}(?::[a-f0-9]{32})?@[\w.-]*(?:sentry\.io|ingest\.[\w.-]+)\/\d+/ },
+  { name: 'Azure storage account key', re: /\bAccountKey\s*=\s*[A-Za-z0-9+/]{60,}={0,2}/ },
+  { name: 'JSON web token', re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{20,}/ },
+  { name: 'Registry auth blob (docker config)', re: /"auth"\s*:\s*"[A-Za-z0-9+/]{24,}={0,2}"/ },
+  {
+    name: 'Provider API key (named env var)',
+    re: /\b(?:AZURE_OPENAI_API_KEY|MISTRAL_API_KEY|COHERE_API_KEY|CO_API_KEY|TOGETHER_API_KEY|DEEPSEEK_API_KEY|DD_API_KEY|DATADOG_API_KEY|TWILIO_AUTH_TOKEN|VERCEL_TOKEN|CLOUDFLARE_API_TOKEN|WEAVIATE_API_KEY|VOYAGE_API_KEY|NVIDIA_API_KEY|CEREBRAS_API_KEY|SAMBANOVA_API_KEY)\s*[=:]\s*["']?[A-Za-z0-9_-]{24,}\b/,
+  },
+];
+
+export const PII_PATTERNS = [
+  { name: 'Email address', re: /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,255}\.[A-Za-z]{2,24}/ },
+  { name: 'US SSN', re: /\b\d{3}-\d{2}-\d{4}\b/ },
+  { name: 'Credit card number', re: /\b(?:\d[ -]?){13,16}\b/ },
+  { name: 'Phone number', re: /\b(?:\+?1[ .-]?)?\(?\d{3}\)?[ .-]?\d{3}[ .-]?\d{4}\b/ },
+  { name: 'IPv4 address', re: /\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/ },
+];
+
+export const RESERVED_IPV4 = /^(0\.|255\.255\.255\.255|127\.|10\.|192\.168\.|169\.254\.|172\.(1[6-9]|2\d|3[01])\.|192\.0\.2\.|198\.51\.100\.|203\.0\.113\.|8\.8\.(8\.8|4\.4)|1\.1\.1\.1|1\.0\.0\.1|224\.)/;
+
+export const VERSION_CONTEXT = /\b(v|ver|version|release|rev|build|semver|tag)\.?\s*$/i;
+
+export function luhnValid(value) {
+  const digits = String(value).replace(/[^\d]/g, '');
+  if (digits.length < 13 || digits.length > 19) return false;
+  let sum = 0, alt = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let d = parseInt(digits[i], 10);
+    if (alt) { d *= 2; if (d > 9) d -= 9; }
+    sum += d;
+    alt = !alt;
+  }
+  return sum % 10 === 0;
+}
+
+export function isPlaceholderSecret(v) {
+  const s = String(v);
+  const low = s.toLowerCase();
+  if (/(example|sample|placeholder|dummy|redacted|changeme|test[_-]?(key|token|secret)|your[-_]?(key|token|secret|api))/.test(low)) return true;
+  if (/(x{6,}|\.{3,}|<[^>]{2,}>|\*{4,}|•{3,})/.test(low)) return true;
+  const tail = s.replace(/^\w{1,10}[-_]/, '');
+  if (/^(.)\1{7,}/.test(tail)) return true;
+  if (/^(0123|1234|abcd|abcdef|deadbeef)/i.test(tail)) return true;
+  return false;
+}

package/src/detect/signals/sensitive.mjs

@@ -0,0 +1,9 @@
+export const SENSITIVE_READ = [
+  'secret', 'credential', 'password', 'token', 'api_key', 'apikey', 'private_key',
+  'ssh', 'aws', 'env', 'environment', 'keychain', 'vault', 'read_file', 'readfile', 'cat ',
+];
+
+export const NETWORK_VERBS = [
+  'http_request', 'http', 'fetch', 'request', 'curl', 'webhook', 'post', 'send',
+  'upload', 'publish', 'email', 'sendmail', 'smtp',
+];

package/src/detect/signals/severity.mjs

@@ -0,0 +1,10 @@
+export const SEV_RANK = { INFO: 1, LOW: 2, MEDIUM: 3, HIGH: 4, CRITICAL: 5 };
+
+export function grade(findings) {
+  const WEIGHT = { INFO: 2, LOW: 8, MEDIUM: 20, HIGH: 40, CRITICAL: 70 };
+  let worstRank = 0;
+  for (const f of findings) if (SEV_RANK[f.severity] > worstRank) worstRank = SEV_RANK[f.severity];
+  const verdict = worstRank >= SEV_RANK.CRITICAL ? 'BLOCK' : worstRank >= SEV_RANK.HIGH ? 'FLAG' : 'ALLOW';
+  const riskScore = Math.min(100, findings.reduce((s, f) => s + (WEIGHT[f.severity] ?? 0), 0));
+  return { verdict, riskScore };
+}

package/src/detect/signals/shell.mjs

@@ -0,0 +1,96 @@
+import { lineTextAt } from './lines.mjs';
+
+const EPHEMERAL_RM_TARGET_RE =
+  /^(\.\/)?(node_modules|dist|build|out|coverage|target|\.next|\.nuxt|\.turbo|\.svelte-kit|\.cache|\.parcel-cache|__pycache__|\.pytest_cache|\.mypy_cache|\.ruff_cache|\.tox|venv|\.venv|\.eggs|[\w.-]+\.egg-info)\/?\*?$/i;
+
+function rmTargetsRealData(line) {
+  const m = /\brm\s+((?:-[a-zA-Z]+\s+)+)(.*)$/.exec(line);
+  if (!m) return true;
+  const targets = m[2]
+    .split(/&&|\|\||[;|>&]/)[0]
+    .split(/\s+/)
+    .filter((t) => t && !t.startsWith('-'));
+  if (!targets.length) return true;
+  return !targets.every((t) => EPHEMERAL_RM_TARGET_RE.test(t.replace(/^["']|["']$/g, '')));
+}
+
+export function matchesShellSignal(sig, text) {
+  if (!sig.refine) return sig.re.test(text);
+  const g = new RegExp(sig.re.source, sig.re.flags.includes('g') ? sig.re.flags : sig.re.flags + 'g');
+  for (const m of text.matchAll(g)) {
+    if (m.index == null) continue;
+    if (sig.refine(lineTextAt(text, m.index))) return true;
+  }
+  return false;
+}
+
+const SENSITIVE_PATH = String.raw`~/\.(?:ssh|aws|kube|gnupg|docker|config/gcloud)|/root/|/etc/(?:shadow|passwd|ssh)|id_[rd]sa|\.pem(?![.\w])|\.env(?![.\w])|credentials|\.npmrc|\.git-credentials|\bsecrets?\b|authorized_keys|\$HOME\b|/home(?:/[\w.-]+)?/?(?=[\s'"]|$)`;
+
+export const DANGEROUS_SHELL = [
+  { name: 'Pipe-to-shell installer (curl … | sh)', re: /\b(curl|wget)\b[^\n|]{0,200}\|\s*(sudo\s+)?(ba|z|k)?sh\b/i, severity: 'CRITICAL' },
+  { name: 'PowerShell download-and-run (iwr/curl … | iex)', re: /\b(iwr|curl|wget|invoke-webrequest|invoke-restmethod|irm)\b[^\n|]{0,200}\|\s*(iex|invoke-expression)\b/i, severity: 'CRITICAL' },
+  { name: 'Invoke-Expression of downloaded content', re: /\b(iex|invoke-expression)\b[^\n]{0,120}(downloadstring|net\.webclient|\(\s*(iwr|irm|invoke-)|\$\()/i, severity: 'CRITICAL' },
+  { name: 'Reverse shell via /dev/tcp', re: /\/dev\/(tcp|udp)\//i, severity: 'CRITICAL' },
+  { name: 'Base64 blob piped to a shell', re: /base64\s+(--?d(ecode)?)?\b[^\n|]{0,200}\|\s*(ba|z)?sh\b/i, severity: 'CRITICAL' },
+  { name: 'curl/wget posts data to the network (exfiltration)', re: /\b(curl|wget|http|https|invoke-restmethod|irm)\b[^\n]{0,220}(--data(-raw|-binary|-urlencode)?|--form\b|--upload-file\b|(^|\s)-d\s|(^|\s)-F\s|(^|\s)-T\s|-Method\s+Post)/i, severity: 'HIGH' },
+  { name: 'Command output piped into a network call', re: /\b(curl|wget|invoke-restmethod|invoke-webrequest|irm|iwr)\b[^\n]{0,220}(\$\(|`[^`\n]+`|<\()/i, severity: 'HIGH' },
+  { name: 'Fetches from a raw IP address', re: /\b(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n]{0,220}https?:\/\/\d{1,3}(\.\d{1,3}){3}/i, severity: 'HIGH' },
+  { name: 'Writes to shell profile / SSH keys / crontab', re: /(\.bashrc|\.zshrc|\.bash_profile|\.profile|authorized_keys|id_rsa\b|\bcrontab\b)/i, severity: 'HIGH' },
+
+  {
+    name: 'World-writable permissions on the filesystem root (chmod -R 777 /)',
+    re: /\bchmod\b(?=[^\n;|&]*(?:-[a-zA-Z]*R|--recursive))(?=[^\n;|&]*(?:\b0?[0-7][0-7][2367]\b|a\+rwx|a=rwx|o\+w|ugo\+rwx))(?=[^\n;|&]*\s\/(?:\s|\*|$))/i,
+    severity: 'CRITICAL',
+  },
+  {
+    name: 'World-writable permissions on a credential or system path (chmod 777)',
+    re: /\bchmod\b(?=[^\n;|&]*(?:\b0?[0-7][0-7][2367]\b|a\+rwx|a=rwx|o\+w|ugo\+rwx))(?=[^\n;|&]*(?:~(?:\s|$|\/\.)|\$HOME\b|\/etc\b|\/root\b|\/usr\b|\/var\b|\/boot\b|\.ssh\b|id_rsa\b|authorized_keys\b|\.aws\b|\.gnupg\b|\.kube\b))/i,
+    severity: 'HIGH',
+  },
+  { name: 'Recursive force delete (rm -rf)', re: /\brm\s+-[a-z]*r[a-z]*f|\brm\s+-[a-z]*f[a-z]*r/i, severity: 'HIGH', refine: rmTargetsRealData },
+
+  { name: 'Inline eval / exec of a string', re: /(?<![-.\w$>:`"'])(eval|exec)\s*[("`']/i, severity: 'HIGH' },
+  { name: 'Pipes an env dump to the network', re: /\b(env|printenv|set)\b[^\n|]{0,80}\|[^\n]{0,80}(curl|wget|nc\b|http)/i, severity: 'HIGH' },
+  { name: 'Disables TLS / cert verification', re: /(NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*0|GIT_SSL_NO_VERIFY|--no-check-certificate|--insecure\b|verify\s*=\s*False)/i, severity: 'MEDIUM' },
+  { name: 'python -c one-liner', re: /python[0-9.]*\s+-c\b/i, severity: 'MEDIUM' },
+  { name: 'node -e one-liner', re: /\bnode\s+-e\b/i, severity: 'MEDIUM' },
+  { name: 'Netcat / socket exfil', re: /\bnc\s+-[a-z]*\b|\bncat\b/i, severity: 'MEDIUM' },
+
+  { name: 'Clears recorded shell history (anti-forensics)', re: /\bhistory\s+-c\b|\brm\b[^\n]{0,30}\.(bash|zsh|sh)_history\b|>\s*\S{0,30}\.(bash|zsh|sh)_history\b/i, severity: 'MEDIUM' },
+  { name: 'Suppresses shell-history recording (anti-forensics)', re: /\bln\s+-s\S*\s+\/dev\/null\s+\S{0,40}\.(bash_|zsh_|sh_)?history\b|\bHISTFILE=\/dev\/null\b|\bunset\s+HISTFILE\b|\bexport\s+HIST(SIZE|FILESIZE)=0\b|\bset\s+\+o\s+history\b/i, severity: 'MEDIUM' },
+  { name: 'Truncates a security / audit log (anti-forensics)', re: />\s*(\/var\/log\/(audit|secure|auth\.log|wtmp|btmp|lastlog|syslog|messages)|\/var\/(run|log)\/(wtmp|btmp|utmp))\b/i, severity: 'HIGH' },
+  { name: 'Vacuums the systemd journal to erase records (anti-forensics)', re: /\bjournalctl\b[^\n]{0,40}--vacuum-(time|size)=/i, severity: 'MEDIUM' },
+  { name: 'Wipes audit / security / login logs (anti-forensics)', re: /\b(rm|shred|unlink|truncate)\b[^\n]{0,60}(\/var\/log\/(audit|secure|auth\.log|wtmp|btmp|lastlog|syslog|messages|faillog|tallylog)|\/var\/(run|log)\/(wtmp|btmp|utmp))\b/i, severity: 'HIGH' },
+  { name: 'Destroys managed infrastructure without confirmation (terraform destroy -auto-approve)', re: /\bterraform\b[^\n]{0,120}\bdestroy\b[^\n]{0,120}(-auto-approve|--auto-approve)/i, severity: 'HIGH' },
+  { name: 'Force-deletes a cloud storage bucket (aws s3 rb --force)', re: /\b(aws\s+s3\s+rb|gsutil\s+(rm\s+-r|rb)|az\s+storage\s+(account|container)\s+delete)\b[^\n]{0,80}(--force|--yes|-f\b|\bs3:\/\/|\bgs:\/\/)/i, severity: 'HIGH' },
+  { name: 'Force-pushes over a protected branch (rewrites shared history)', re: /\bgit\s+push\b[^\n]{0,80}(--force\b(?!-with-lease)|(?:^|\s)-f\b)[^\n]{0,60}\b(main|master|release|prod(uction)?)\b/i, severity: 'MEDIUM' },
+
+  { name: 'Recursive force delete of the filesystem root (rm -rf /, --no-preserve-root)', re: /\brm\b(?=[^\n;|&]*(?:-[a-zA-Z]*r|--recursive))(?=[^\n;|&]*(?:-[a-zA-Z]*f|--force))(?=[^\n;|&]*(?:--no-preserve-root|\s\/(?:\s|\*|$)))/i, severity: 'CRITICAL' },
+  { name: 'Fork bomb (process-exhaustion DoS)', re: /(:|\b[a-z_][a-z0-9_]*)\s*\(\s*\)\s*\{\s*\1\s*[^\n}]*\|\s*\1[^\n}]*&\s*\}\s*;\s*\1/i, severity: 'HIGH' },
+  { name: 'Writes over a raw disk device (data destruction)', re: /\b(dd\b[^\n]{0,80}\bof=\/dev\/[sh]d|mkfs(\.\w+)?\s+[^\n]{0,40}\/dev\/|>\s*\/dev\/[sh]d[a-z])/i, severity: 'CRITICAL' },
+  { name: 'Reads the system password-hash / sudo policy file', re: /\b(cat|less|more|head|tail|strings|xxd|od|grep|awk|sed|cp|scp|tar)\b[^\n]{0,80}\/etc\/(shadow|gshadow|sudoers(\.d)?)\b/i, severity: 'HIGH' },
+  { name: 'Deletes a Kubernetes namespace / workload', re: /\bkubectl\b[^\n]{0,80}\bdelete\b[^\n]{0,80}\b(namespace|ns|deployment|statefulset|pvc|persistentvolumeclaim)\b/i, severity: 'MEDIUM' },
+  { name: 'Drops a database / schema', re: /\bdrop\s+(database|schema|table)\b/i, severity: 'MEDIUM' },
+  { name: 'Disables the audit / logging subsystem', re: /\b(systemctl|service)\s+(stop|disable|mask)\s+\S{0,20}(auditd|rsyslog|syslog|systemd-journald|journald)\b|\bauditctl\s+(-e\s*0|-D)\b|\bsetenforce\s+0\b|\bsystemctl\s+(stop|disable|mask)\s+firewalld\b/i, severity: 'HIGH' },
+
+  { name: 'Locally decoded or decrypted blob piped to a shell', re: /\b(?:gpg|openssl\s+enc|xxd\s+-r|uudecode|zcat|gunzip|bunzip2|unxz)\b[^\n|]{0,160}\|\s*(?:sudo\s+)?(?:ba|z|k)?sh\b/i, severity: 'CRITICAL' },
+  { name: 'Container escape to the host (privileged / host mount / host namespace)', re: /\b(?:docker|podman|nerdctl)\s+(?:run|create|exec)\b[^\n]{0,200}?(?:--privileged\b|--pid[= ]host\b|--ipc[= ]host\b|--userns[= ]host\b|--security-opt[= ]\S{0,40}(?:seccomp[=:]unconfined|apparmor[=:]unconfined)|--cap-add[= ](?:ALL|SYS_ADMIN|SYS_PTRACE|SYS_MODULE)\b|-v\s+\/(?:\s|:)|--volume[= ]\/:|(?:-v|--volume)[= ]\s*\/var\/run\/docker\.sock)/i, severity: 'CRITICAL' },
+  { name: 'Enters the host namespace from a container (nsenter / chroot onto a host mount)', re: /\bnsenter\b[^\n]{0,80}(?:-t\s*1\b|--target\s*1\b)|\bchroot\s+\/(?:host|mnt|proc\/1\/root)\b/i, severity: 'CRITICAL' },
+  { name: 'Grants cluster-admin in Kubernetes', re: /\bkubectl\b[^\n]{0,120}\b(?:create|apply)\b[^\n]{0,120}\b(?:cluster)?rolebinding\b[^\n]{0,160}(?:--clusterrole[= ]\s*cluster-admin|cluster-admin)\b/i, severity: 'HIGH' },
+  { name: 'Attaches an administrator policy to a cloud identity', re: /\baws\s+iam\s+(?:attach-(?:user|role|group)-policy|put-(?:user|role|group)-policy)\b[^\n]{0,160}(?:AdministratorAccess|PowerUserAccess|"?Action"?\s*:\s*"?\*)|\bgcloud\b[^\n]{0,120}add-iam-policy-binding\b[^\n]{0,160}roles\/(?:owner|editor|iam\.securityAdmin)\b|\baz\s+role\s+assignment\s+create\b[^\n]{0,160}--role\s+"?(?:Owner|Contributor|User Access Administrator)"?/i, severity: 'HIGH' },
+  { name: 'Mints long-lived cloud credentials', re: /\baws\s+iam\s+create-access-key\b|\bgcloud\s+iam\s+service-accounts\s+keys\s+create\b|\baz\s+ad\s+sp\s+credential\s+reset\b/i, severity: 'MEDIUM' },
+  { name: 'Grants itself passwordless sudo (writes the sudo policy)', re: /(?:>>?|tee\b[^\n]{0,40})\s*\/etc\/sudoers(?:\.d\/\S*)?\b|\bvisudo\b[^\n]{0,40}(?:-f|<<)|\becho\b[^\n]{0,120}NOPASSWD[^\n]{0,80}(?:>>?|tee)\s*\/etc\/sudoers/i, severity: 'HIGH' },
+  { name: 'Installs a setuid / capability backdoor', re: /\bchmod\b[^\n]{0,60}(?:\bu\+s\b|\+s\b|\b[24][0-7]{3}\b)[^\n]{0,60}(?:\/bin\/|\/usr\/bin\/|\/tmp\/|\bbash\b|\bsh\b|\bdash\b)|\bsetcap\b[^\n]{0,60}cap_(?:setuid|setgid|sys_admin|dac_override|dac_read_search)\b/i, severity: 'HIGH' },
+  { name: 'Grants an account administrator group membership', re: /\b(?:usermod|gpasswd)\b[^\n]{0,60}-a?[GM]\s*\S{0,20}\b(?:sudo|wheel|admin|root|docker|adm)\b|\b(?:useradd|adduser)\b[^\n]{0,80}-G\s*\S{0,30}\b(?:sudo|wheel|admin|root|docker)\b|\bnet\s+localgroup\b[^\n]{0,60}\badministrators?\b[^\n]{0,40}\/add\b|\bdscl\b[^\n]{0,80}-append\b[^\n]{0,60}\badmin\b/i, severity: 'MEDIUM' },
+  { name: 'Preloads a shared library into every process (LD_PRELOAD)', re: /\b(?:LD_PRELOAD|LD_AUDIT|DYLD_INSERT_LIBRARIES)\s*=\s*\S|>>?\s*\/etc\/ld\.so\.preload\b/i, severity: 'HIGH' },
+  { name: 'Installs a scheduled or boot-time persistence unit', re: /\bsystemd-run\b[^\n]{0,80}--on-(?:boot|calendar|active|unit)|>>?\s*\/etc\/(?:systemd\/system|cron\.(?:d|daily|hourly)|init\.d)\/\S|\bschtasks\b[^\n]{0,80}\/create\b|\blaunchctl\s+(?:load|bootstrap)\b|\b(?:echo|printf)\b[^\n]{0,120}\|\s*at\s+(?:now|\+|\d)/i, severity: 'MEDIUM' },
+  { name: 'Opens a reverse tunnel to a remote host', re: /\bssh\b[^\n]{0,80}\s-\w*R\s*\d{1,5}:[^\n\s]{1,60}|\b(?:ngrok|cloudflared|localtunnel|frpc)\b[^\n]{0,60}\b(?:tcp|http|tunnel)\b/i, severity: 'HIGH' },
+  { name: 'Encodes command output into DNS lookups (exfiltration channel)', re: /(?:^|[\n;&|(]\s*)(?:dig|nslookup|drill|host)\s+[^\n]{0,120}(?:\$\(|`|\$\{)[^\n]{0,80}\.[a-z]{2,}/i, severity: 'HIGH' },
+  { name: 'Copies credentials or home directories off the machine over ssh', re: new RegExp(String.raw`\b(?:scp|rsync)\b(?=[^\n]{0,200}\s\S{0,40}@[\w.-]+:)(?=[^\n]{0,200}(?:${SENSITIVE_PATH}))` + String.raw`|\btar\b(?=[^\n]{0,160}\|\s*ssh\b)(?=[^\n]{0,160}(?:${SENSITIVE_PATH}))`, 'i'), severity: 'HIGH' },
+  { name: 'Flushes the host firewall', re: /\b(?:iptables|ip6tables|nft)\b[^\n]{0,60}(?:-F\b|--flush\b|flush ruleset)|\bufw\s+disable\b|\bnetsh\s+advfirewall\s+set\s+\S+\s+state\s+off\b/i, severity: 'MEDIUM' },
+  { name: 'Kills the audit / EDR agent (anti-forensics)', re: /\b(?:pkill|killall|kill)\b[^\n]{0,40}\b(?:auditd|osqueryd?|falcon-sensor|falconctl|wazuh|ossec|filebeat|splunkd|sysmon|crowdstrike|carbonblack|cbagent)\b|\bSet-MpPreference\b[^\n]{0,60}-Disable\w*\s+\$?true/i, severity: 'HIGH' },
+  { name: 'Downloads and executes through a signed system binary (LOLBin)', re: /\bcertutil\b[^\n]{0,80}-urlcache\b|\bbitsadmin\b[^\n]{0,80}\/transfer\b|\bmshta\b\s+https?:\/\/|\bregsvr32\b[^\n]{0,60}\/i:\s*https?:\/\/|\brundll32\b[^\n]{0,60}\b(?:url\.dll|javascript:)|\bwmic\b[^\n]{0,60}\bprocess\s+call\s+create\b|\bmsiexec\b[^\n]{0,40}\/i\s+https?:\/\//i, severity: 'CRITICAL' },
+  { name: 'PowerShell runs a base64-encoded command', re: /\bpowershell(?:\.exe)?\b[^\n]{0,80}\s-(?:e|ec|enc|encoded|encodedcommand)\b/i, severity: 'CRITICAL' },
+  { name: 'Interpreter opens a raw socket (reverse shell)', re: /\b(?:perl|ruby|php|python[0-9.]*|node)\b[^\n]{0,40}-(?:e|r|c)\b[^\n]{0,200}\b(?:fsockopen|socket\s*\(|Socket::|SOCK_STREAM|net\.connect|createConnection)\b/i, severity: 'CRITICAL' },
+  { name: 'Netcat listener or command-execution flag', re: /\bn?c(?:at)?\b[^\n]{0,40}\s-\w*[ec]\s+\S{0,30}(?:sh|bash|cmd|powershell)\b|\bn?c(?:at)?\b[^\n]{0,20}\s-\w*l\w*\s*(?:-\w+\s*)*\d{2,5}\b/i, severity: 'HIGH' },
+];

package/src/detect/signals/staged-fetch.mjs

@@ -0,0 +1,66 @@
+const STAGED_LOOPBACK_RE = /^(localhost|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|0\.0\.0\.0|\[::1\]|::1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})$/i;
+
+const STAGED_METADATA_HOSTS = new Set(['169.254.169.254', 'metadata.google.internal']);
+
+function targetsExternalNetwork(line) {
+  const urls = line.match(/https?:\/\/[^\s'"`;|)&]+/gi);
+  if (!urls?.length) return true;
+  return urls.some((raw) => {
+    let host;
+    try { host = new URL(raw).hostname.toLowerCase(); } catch { return true; }
+    if (STAGED_METADATA_HOSTS.has(host)) return true;
+    return !STAGED_LOOPBACK_RE.test(host);
+  });
+}
+
+const FETCH_TO_FILE = [
+  /\b(?:curl|wget)\b[^\n;|&]{0,200}?(?:-o|-O|--output(?:-document)?)[= ]\s*["']?([^\s"'>;|&]+)/gi,
+  /\b(?:curl|wget)\b[^\n;|&]{0,200}?>\s*["']?([^\s"'>;|&]+)/gi,
+  /\b(?:invoke-webrequest|iwr|curl)\b[^\n;|&]{0,200}?-outfile\s+["']?([^\s"';|&]+)/gi,
+];
+
+const BARE_WGET_RE = /\bwget\b(?![^\n;|&]{0,200}(?:-O|--output-document))[^\n;|&]{0,200}?(https?:\/\/[^\s"';|&]+)/gi;
+
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+function execPattern(target) {
+  const full = escapeRe(target);
+  const base = escapeRe(target.replace(/^.*\//, ''));
+  const p = `(?:${full}|(?:\\./|/tmp/|~/|\\$\\w+/)?${base})`;
+  return new RegExp(
+    `\\bchmod\\b[^\\n;|&]{0,40}\\+x[^\\n;|&]{0,40}${p}` +
+      `|\\bchmod\\b[^\\n;|&]{0,40}\\b[0-7]*[1357]\\b[^\\n;|&]{0,40}${p}` +
+      `|(?:^|[\\n;&|]\\s*|\\bsudo\\s+)(?:ba|z|k|da)?sh\\s+[^\\n]{0,40}${p}` +
+      `|(?:^|[\\n;&|]\\s*|\\bsudo\\s+)(?:python[0-9.]*|node|perl|ruby|php|pwsh|powershell)\\s+[^\\n]{0,40}${p}` +
+      `|(?:^|[\\n;&|]\\s*)(?:\\.|source)\\s+${p}` +
+      `|(?:^|[\\n;&|]\\s*|&&\\s*)(?:sudo\\s+)?\\./${base}\\b`,
+    'i',
+  );
+}
+
+export function scanStagedFetchExec(text) {
+  if (!text) return [];
+  const targets = new Map();
+  const record = (name, at, stmt) => {
+    if (!name || targets.has(name)) return;
+    if (/^\/dev\/(null|stdout|stderr)$/i.test(name)) return;
+    if (!targetsExternalNetwork(stmt)) return;
+    targets.set(name, at);
+  };
+  for (const re of FETCH_TO_FILE) {
+    re.lastIndex = 0;
+    for (const m of text.matchAll(re)) record(m[1], m.index ?? 0, m[0]);
+  }
+  BARE_WGET_RE.lastIndex = 0;
+  for (const m of text.matchAll(BARE_WGET_RE)) {
+    let base = '';
+    try { base = new URL(m[1]).pathname.split('/').filter(Boolean).pop() ?? ''; } catch { continue; }
+    record(base, m.index ?? 0, m[0]);
+  }
+  for (const [target, at] of targets) {
+    if (execPattern(target).test(text.slice(at))) {
+      return [{ name: 'Downloads a file and then executes it (staged fetch-to-execute)', re: new RegExp(escapeRe(target), 'i'), severity: 'CRITICAL' }];
+    }
+  }
+  return [];
+}

package/src/detect/signals/text-match.mjs

@@ -0,0 +1,35 @@
+export function containsAny(haystack, needles) {
+  const h = String(haystack ?? '').toLowerCase();
+  for (const n of needles) if (h.includes(n.toLowerCase())) return n;
+  return null;
+}
+
+const WORD_RE_CACHE = new Map();
+
+function leadingBoundaryRe(needle) {
+  let re = WORD_RE_CACHE.get(needle);
+  if (!re) {
+    const esc = needle.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    re = new RegExp(/^\w/.test(needle) ? `(?<!\\w)${esc}` : esc, 'i');
+    WORD_RE_CACHE.set(needle, re);
+  }
+  return re;
+}
+
+export function containsWord(haystack, needles) {
+  const h = String(haystack ?? '');
+  for (const n of needles) if (leadingBoundaryRe(n).test(h)) return n;
+  return null;
+}
+
+const MARKER_RE_CACHE = new Map();
+
+export function markerRe(marker) {
+  let re = MARKER_RE_CACHE.get(marker);
+  if (!re) {
+    re = new RegExp(`(?<!\\w)${marker.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?!\\w)`, 'gi');
+    MARKER_RE_CACHE.set(marker, re);
+  }
+  re.lastIndex = 0;
+  return re;
+}