@surfinguard/core-engine 0.1.0

package/dist/patterns.js

@@ -0,0 +1,66 @@
+import { readFileSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// In dist/, patterns is at ../../patterns relative to the compiled JS
+// In src/, patterns is at ../patterns
+function findPatternsDir() {
+    // Try from dist/ first (compiled)
+    const fromDist = resolve(__dirname, '..', 'patterns');
+    return fromDist;
+}
+let cachedUrlPatterns = null;
+let cachedBrandPatterns = null;
+let cachedCommandPatterns = null;
+let cachedTextPatterns = null;
+let cachedFileReadPatterns = null;
+let cachedFileWritePatterns = null;
+export function loadUrlPatterns() {
+    if (cachedUrlPatterns)
+        return cachedUrlPatterns;
+    const patternsDir = findPatternsDir();
+    const raw = readFileSync(resolve(patternsDir, 'urls.json'), 'utf-8');
+    cachedUrlPatterns = JSON.parse(raw);
+    return cachedUrlPatterns;
+}
+export function loadBrandPatterns() {
+    if (cachedBrandPatterns)
+        return cachedBrandPatterns;
+    const patternsDir = findPatternsDir();
+    const raw = readFileSync(resolve(patternsDir, 'brands.json'), 'utf-8');
+    cachedBrandPatterns = JSON.parse(raw);
+    return cachedBrandPatterns;
+}
+export function loadCommandPatterns() {
+    if (cachedCommandPatterns)
+        return cachedCommandPatterns;
+    const patternsDir = findPatternsDir();
+    const raw = readFileSync(resolve(patternsDir, 'commands.json'), 'utf-8');
+    cachedCommandPatterns = JSON.parse(raw);
+    return cachedCommandPatterns;
+}
+export function loadTextPatterns() {
+    if (cachedTextPatterns)
+        return cachedTextPatterns;
+    const patternsDir = findPatternsDir();
+    const raw = readFileSync(resolve(patternsDir, 'text.json'), 'utf-8');
+    cachedTextPatterns = JSON.parse(raw);
+    return cachedTextPatterns;
+}
+export function loadFileReadPatterns() {
+    if (cachedFileReadPatterns)
+        return cachedFileReadPatterns;
+    const patternsDir = findPatternsDir();
+    const raw = readFileSync(resolve(patternsDir, 'file-read.json'), 'utf-8');
+    cachedFileReadPatterns = JSON.parse(raw);
+    return cachedFileReadPatterns;
+}
+export function loadFileWritePatterns() {
+    if (cachedFileWritePatterns)
+        return cachedFileWritePatterns;
+    const patternsDir = findPatternsDir();
+    const raw = readFileSync(resolve(patternsDir, 'file-write.json'), 'utf-8');
+    cachedFileWritePatterns = JSON.parse(raw);
+    return cachedFileWritePatterns;
+}
+//# sourceMappingURL=patterns.js.map

package/dist/patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../src/patterns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,sEAAsE;AACtE,sCAAsC;AACtC,SAAS,eAAe;IACtB,kCAAkC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACtD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,IAAI,iBAAiB,GAA8B,IAAI,CAAC;AACxD,IAAI,mBAAmB,GAAgC,IAAI,CAAC;AAC5D,IAAI,qBAAqB,GAAkC,IAAI,CAAC;AAChE,IAAI,kBAAkB,GAA+B,IAAI,CAAC;AAC1D,IAAI,sBAAsB,GAAmC,IAAI,CAAC;AAClE,IAAI,uBAAuB,GAAoC,IAAI,CAAC;AAEpE,MAAM,UAAU,eAAe;IAC7B,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC;IAChD,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;IACrE,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;IAC1D,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,IAAI,mBAAmB;QAAE,OAAO,mBAAmB,CAAC;IACpD,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;IACvE,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;IAC9D,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,IAAI,qBAAqB;QAAE,OAAO,qBAAqB,CAAC;IACxD,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,CAAC;IACzE,qBAAqB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;IAClE,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IAClD,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;IACrE,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;IAC5D,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,IAAI,sBAAsB;QAAE,OAAO,sBAAsB,CAAC;IAC1D,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1E,sBAAsB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACpE,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,IAAI,uBAAuB;QAAE,OAAO,uBAAuB,CAAC;IAC5D,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3E,uBAAuB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;IACtE,OAAO,uBAAuB,CAAC;AACjC,CAAC"}

package/dist/scorer.d.ts

@@ -0,0 +1,23 @@
+import type { RiskLevel, RiskPrimitive, PrimitiveScore } from '@surfinguard/types';
+import type { AnalyzerFinding } from './analyzers/base.js';
+/**
+ * Consolidates analyzer findings into per-primitive scores.
+ * Within each primitive, scores are additive (sum). Each capped at 10.
+ */
+export declare function scorePrimitives(findings: AnalyzerFinding[]): PrimitiveScore[];
+export interface CompositeResult {
+    /** Composite score = max across all primitive scores */
+    score: number;
+    /** Risk level based on composite score */
+    level: RiskLevel;
+    /** The primitive with the highest score (null if all zero) */
+    primaryPrimitive: RiskPrimitive | null;
+    /** Per-primitive breakdown */
+    primitiveScores: PrimitiveScore[];
+}
+/**
+ * Composite scorer: score = max(all primitive scores).
+ * A single critical primitive is enough to block.
+ */
+export declare function scoreComposite(primitiveScores: PrimitiveScore[]): CompositeResult;
+//# sourceMappingURL=scorer.d.ts.map

package/dist/scorer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scorer.d.ts","sourceRoot":"","sources":["../src/scorer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAc3D;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,cAAc,EAAE,CAuB7E;AAED,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,KAAK,EAAE,SAAS,CAAC;IACjB,8DAA8D;IAC9D,gBAAgB,EAAE,aAAa,GAAG,IAAI,CAAC;IACvC,8BAA8B;IAC9B,eAAe,EAAE,cAAc,EAAE,CAAC;CACnC;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,eAAe,EAAE,cAAc,EAAE,GAAG,eAAe,CAejF"}

package/dist/scorer.js

@@ -0,0 +1,52 @@
+const THRESHOLD_CAUTION = 3;
+const THRESHOLD_DANGER = 7;
+const MAX_PRIMITIVE_SCORE = 10;
+const ALL_PRIMITIVES = [
+    'DESTRUCTION',
+    'EXFILTRATION',
+    'ESCALATION',
+    'PERSISTENCE',
+    'MANIPULATION',
+];
+/**
+ * Consolidates analyzer findings into per-primitive scores.
+ * Within each primitive, scores are additive (sum). Each capped at 10.
+ */
+export function scorePrimitives(findings) {
+    const grouped = new Map();
+    for (const primitive of ALL_PRIMITIVES) {
+        grouped.set(primitive, { total: 0, reasons: [] });
+    }
+    for (const finding of findings) {
+        const entry = grouped.get(finding.primitive);
+        entry.total += finding.score;
+        if (finding.reason && !entry.reasons.includes(finding.reason)) {
+            entry.reasons.push(finding.reason);
+        }
+    }
+    return ALL_PRIMITIVES.map((primitive) => {
+        const entry = grouped.get(primitive);
+        return {
+            primitive,
+            score: Math.min(Math.max(entry.total, 0), MAX_PRIMITIVE_SCORE),
+            reasons: entry.reasons,
+        };
+    });
+}
+/**
+ * Composite scorer: score = max(all primitive scores).
+ * A single critical primitive is enough to block.
+ */
+export function scoreComposite(primitiveScores) {
+    let maxScore = 0;
+    let primaryPrimitive = null;
+    for (const ps of primitiveScores) {
+        if (ps.score > maxScore) {
+            maxScore = ps.score;
+            primaryPrimitive = ps.primitive;
+        }
+    }
+    const level = maxScore >= THRESHOLD_DANGER ? 'DANGER' : maxScore >= THRESHOLD_CAUTION ? 'CAUTION' : 'SAFE';
+    return { score: maxScore, level, primaryPrimitive, primitiveScores };
+}
+//# sourceMappingURL=scorer.js.map

package/dist/scorer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scorer.js","sourceRoot":"","sources":["../src/scorer.ts"],"names":[],"mappings":"AAGA,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,MAAM,cAAc,GAAoB;IACtC,aAAa;IACb,cAAc;IACd,YAAY;IACZ,aAAa;IACb,cAAc;CACf,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,QAA2B;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuD,CAAC;IAE/E,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAE,CAAC;QAC9C,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;QACtC,OAAO;YACL,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,mBAAmB,CAAC;YAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,eAAiC;IAC9D,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,gBAAgB,GAAyB,IAAI,CAAC;IAElD,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,EAAE,CAAC,KAAK,GAAG,QAAQ,EAAE,CAAC;YACxB,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC;YACpB,gBAAgB,GAAG,EAAE,CAAC,SAAS,CAAC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GACT,QAAQ,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAE/F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;AACvE,CAAC"}

package/dist/verdict.d.ts

@@ -0,0 +1,7 @@
+import type { CheckResult } from '@surfinguard/types';
+import type { AnalyzerResult } from './analyzers/base.js';
+/**
+ * Builds a CheckResult from an AnalyzerResult.
+ */
+export declare function buildVerdict(result: AnalyzerResult, startTime: number): CheckResult;
+//# sourceMappingURL=verdict.d.ts.map

package/dist/verdict.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../src/verdict.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAwCnF"}

package/dist/verdict.js

@@ -0,0 +1,41 @@
+import { scorePrimitives, scoreComposite } from './scorer.js';
+/**
+ * Builds a CheckResult from an AnalyzerResult.
+ */
+export function buildVerdict(result, startTime) {
+    const latencyMs = performance.now() - startTime;
+    // Handle short-circuit (known safe)
+    if (result.shortCircuit) {
+        return {
+            allow: result.shortCircuit.safe,
+            score: 0,
+            level: 'SAFE',
+            primitive: null,
+            primitiveScores: [],
+            reasons: [result.shortCircuit.reason],
+            latencyMs: Math.round(latencyMs * 100) / 100,
+        };
+    }
+    const primitiveScores = scorePrimitives(result.findings);
+    const composite = scoreComposite(primitiveScores);
+    // Collect all reasons from findings (deduplicated)
+    const reasons = [];
+    for (const finding of result.findings) {
+        if (finding.reason && !reasons.includes(finding.reason)) {
+            reasons.push(finding.reason);
+        }
+    }
+    if (reasons.length === 0) {
+        reasons.push('No suspicious signals detected');
+    }
+    return {
+        allow: composite.level === 'SAFE',
+        score: composite.score,
+        level: composite.level,
+        primitive: composite.primaryPrimitive,
+        primitiveScores: composite.primitiveScores.filter((ps) => ps.score > 0),
+        reasons,
+        latencyMs: Math.round(latencyMs * 100) / 100,
+    };
+}
+//# sourceMappingURL=verdict.js.map

package/dist/verdict.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict.js","sourceRoot":"","sources":["../src/verdict.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE9D;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,MAAsB,EAAE,SAAiB;IACpE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAEhD,oCAAoC;IACpC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI;YAC/B,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,MAAM;YACb,SAAS,EAAE,IAAI;YACf,eAAe,EAAE,EAAE;YACnB,OAAO,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;YACrC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,GAAG;SAC7C,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;IAElD,mDAAmD;IACnD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACjD,CAAC;IAED,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK,KAAK,MAAM;QACjC,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,SAAS,CAAC,gBAAgB;QACrC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;QACvE,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,GAAG;KAC7C,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@surfinguard/core-engine",
+  "version": "0.1.0",
+  "description": "Heuristic scoring engine for the Surfinguard AI Security SDK — 5 analyzers, 68 threat patterns",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": ["dist", "patterns"],
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "rm -rf dist",
+    "lint": "eslint src/"
+  },
+  "dependencies": {
+    "@surfinguard/types": "workspace:^"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/yanivsati/surfinguard-platform",
+    "directory": "packages/core-engine"
+  },
+  "homepage": "https://surfinguard.com",
+  "author": "Surfinguard <dev@surfinguard.com>",
+  "keywords": [
+    "surfinguard",
+    "ai-security",
+    "agent-safety",
+    "phishing",
+    "prompt-injection",
+    "heuristic-engine"
+  ],
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}

package/patterns/brands.json

@@ -0,0 +1,205 @@
+{
+  "version": "2026.02.21",
+  "brands": [
+    {
+      "brand": "paypal",
+      "variants": ["paypa1", "paypai", "paypaI", "pаypal", "раyраl", "paypɑl", "payp4l"],
+      "legitimateDomains": ["paypal.com", "paypal.me"]
+    },
+    {
+      "brand": "google",
+      "variants": ["g00gle", "googie", "goog1e", "gooogle", "gogle", "g0ogle", "qoogle"],
+      "legitimateDomains": ["google.com", "google.co.uk", "googleapis.com", "googlesyndication.com"]
+    },
+    {
+      "brand": "amazon",
+      "variants": ["amaz0n", "arnazon", "amazom", "arnazom", "аmazon", "amazоn"],
+      "legitimateDomains": ["amazon.com", "amazon.co.uk", "amazon.de", "amazonaws.com"]
+    },
+    {
+      "brand": "apple",
+      "variants": ["app1e", "appie", "аpple", "appIe", "apple-id", "appleid"],
+      "legitimateDomains": ["apple.com", "icloud.com"]
+    },
+    {
+      "brand": "microsoft",
+      "variants": ["micros0ft", "rnicrosoft", "micosoft", "microsft", "mircosoft"],
+      "legitimateDomains": ["microsoft.com", "live.com", "outlook.com", "office.com", "azure.com"]
+    },
+    {
+      "brand": "facebook",
+      "variants": ["faceb00k", "facebooк", "facebok", "facbook", "facebk"],
+      "legitimateDomains": ["facebook.com", "fb.com", "fb.me"]
+    },
+    {
+      "brand": "instagram",
+      "variants": ["lnstagram", "1nstagram", "instagran", "instaqram"],
+      "legitimateDomains": ["instagram.com"]
+    },
+    {
+      "brand": "netflix",
+      "variants": ["netf1ix", "netfiix", "netfIix", "neftlix", "netfl1x"],
+      "legitimateDomains": ["netflix.com"]
+    },
+    {
+      "brand": "linkedin",
+      "variants": ["linkedln", "1inkedin", "linkdin", "linkedn"],
+      "legitimateDomains": ["linkedin.com"]
+    },
+    {
+      "brand": "twitter",
+      "variants": ["twltter", "tw1tter", "twtter", "tvvitter"],
+      "legitimateDomains": ["twitter.com", "x.com", "t.co"]
+    },
+    {
+      "brand": "chase",
+      "variants": ["chas3", "chasse", "сhase"],
+      "legitimateDomains": ["chase.com"]
+    },
+    {
+      "brand": "wellsfargo",
+      "variants": ["wel1sfargo", "wellsfarg0", "weilsfargo"],
+      "legitimateDomains": ["wellsfargo.com"]
+    },
+    {
+      "brand": "bankofamerica",
+      "variants": ["bankofamer1ca", "bankofamerlca"],
+      "legitimateDomains": ["bankofamerica.com", "bofa.com"]
+    },
+    {
+      "brand": "coinbase",
+      "variants": ["c0inbase", "coinbаse", "coibase"],
+      "legitimateDomains": ["coinbase.com"]
+    },
+    {
+      "brand": "binance",
+      "variants": ["b1nance", "binanace", "bіnance"],
+      "legitimateDomains": ["binance.com", "binance.us"]
+    },
+    {
+      "brand": "metamask",
+      "variants": ["metarnask", "metamаsk", "meta-mask"],
+      "legitimateDomains": ["metamask.io"]
+    },
+    {
+      "brand": "dhl",
+      "variants": ["dh1", "dhI", "ďhl", "dh-l", "dhl-express", "dhl-delivery", "servisdhl", "dhlservice"],
+      "legitimateDomains": ["dhl.com", "dhl.de", "dhl.co.uk", "dhl.fr", "dhl.co.il"]
+    },
+    {
+      "brand": "fedex",
+      "variants": ["fed3x", "fedx", "f3dex", "fe-dex", "fedex-delivery", "fedexpress"],
+      "legitimateDomains": ["fedex.com"]
+    },
+    {
+      "brand": "ups",
+      "variants": ["u-p-s", "ups-delivery", "upsexpress", "ups-express"],
+      "legitimateDomains": ["ups.com"]
+    },
+    {
+      "brand": "usps",
+      "variants": ["u5ps", "usp5", "usps-delivery", "uspsexpress"],
+      "legitimateDomains": ["usps.com"]
+    },
+    {
+      "brand": "royalmail",
+      "variants": ["roya1mail", "royalmai1", "royal-mai1", "roya1-mail"],
+      "legitimateDomains": ["royalmail.com"]
+    },
+    {
+      "brand": "hermes",
+      "variants": ["herrnes", "hermes-delivery", "herrmes", "evri-hermes"],
+      "legitimateDomains": ["hermes-europe.co.uk", "evri.com", "myhermes.co.uk"]
+    },
+    {
+      "brand": "dpd",
+      "variants": ["dpd-delivery", "dpd-express", "dpdgroup"],
+      "legitimateDomains": ["dpd.com", "dpd.co.uk", "dpd.de", "dpd.fr"]
+    },
+    {
+      "brand": "colissimo",
+      "variants": ["colissim0", "c0lissimo"],
+      "legitimateDomains": ["colissimo.fr", "laposte.fr"]
+    },
+    {
+      "brand": "correos",
+      "variants": ["corre0s", "correos-express"],
+      "legitimateDomains": ["correos.es", "correos.cl"]
+    },
+    {
+      "brand": "poste",
+      "variants": ["poste-delivery", "p0ste"],
+      "legitimateDomains": ["poste.it", "posteitaliane.it", "laposte.fr"]
+    },
+    {
+      "brand": "carmel",
+      "variants": ["carmel-app", "carmel-pay", "carmeltunnels", "carmel-tunnels"],
+      "legitimateDomains": ["carmelton.co.il", "carlton.co.il"]
+    },
+    {
+      "brand": "כביש6",
+      "variants": ["kvish6", "kvish-6", "road6"],
+      "legitimateDomains": ["kvish6.co.il", "road6.co.il"]
+    },
+    {
+      "brand": "ayalon",
+      "variants": ["ayalon-pay", "ayalonroads", "ayalon-toll"],
+      "legitimateDomains": ["ayalonhw.co.il"]
+    },
+    {
+      "brand": "derech",
+      "variants": ["derech-eretz", "derecheretz"],
+      "legitimateDomains": ["derecheretz.co.il"]
+    },
+    {
+      "brand": "fastlane",
+      "variants": ["fast-lane", "fastlane-pay", "fast1ane"],
+      "legitimateDomains": ["fastlane.co.il"]
+    },
+    {
+      "brand": "leumi",
+      "variants": ["leumi-bank", "bank-leumi", "leumi-online", "1eumi"],
+      "legitimateDomains": ["leumi.co.il", "bankleumi.co.il"]
+    },
+    {
+      "brand": "hapoalim",
+      "variants": ["poalim", "bankhapoalim", "hap0alim"],
+      "legitimateDomains": ["bankhapoalim.co.il", "poalim.co.il"]
+    },
+    {
+      "brand": "discount",
+      "variants": ["discount-bank", "discountbank"],
+      "legitimateDomains": ["discountbank.co.il"]
+    },
+    {
+      "brand": "mizrahi",
+      "variants": ["mizrahi-bank", "mizrahitefahot"],
+      "legitimateDomains": ["mizrahi-tefahot.co.il"]
+    },
+    {
+      "brand": "fibi",
+      "variants": ["fibi-bank", "firstinternational"],
+      "legitimateDomains": ["fibi.co.il"]
+    },
+    {
+      "brand": "misim",
+      "variants": ["mas-hachnasa", "mashachnasa", "israelitax"],
+      "legitimateDomains": ["taxes.gov.il", "misim.gov.il"]
+    },
+    {
+      "brand": "bituahleumi",
+      "variants": ["btl-gov", "bituach-leumi"],
+      "legitimateDomains": ["btl.gov.il"]
+    },
+    {
+      "brand": "gov",
+      "variants": ["gov-il", "israel-gov", "govil"],
+      "legitimateDomains": ["gov.il"]
+    },
+    {
+      "brand": "israelpost",
+      "variants": ["israel-post", "doar-israel", "doarisrael"],
+      "legitimateDomains": ["israelpost.co.il", "post.co.il"]
+    }
+  ]
+}

package/patterns/commands.json

@@ -0,0 +1,44 @@
+{
+  "version": "2026.02.21",
+  "threats": [
+    { "id": "C01", "name": "Destructive Operations", "primitive": "DESTRUCTION", "severity": 9, "description": "Commands that delete, overwrite, or destroy data (rm -rf, mkfs, dd, shred)" },
+    { "id": "C02", "name": "Data Exfiltration", "primitive": "EXFILTRATION", "severity": 8, "description": "Commands that send local data to external servers (curl -d, scp, rsync)" },
+    { "id": "C03", "name": "Reverse Shell", "primitive": "EXFILTRATION", "severity": 9, "description": "Commands that establish a reverse shell connection (/dev/tcp, mkfifo)" },
+    { "id": "C04", "name": "Pipe-to-Shell", "primitive": "DESTRUCTION", "severity": 9, "description": "Downloading and piping directly to a shell interpreter (curl | bash)" },
+    { "id": "C05", "name": "Privilege Escalation", "primitive": "ESCALATION", "severity": 8, "description": "Commands that elevate privileges (sudo, chmod u+s, setuid)" },
+    { "id": "C06", "name": "Persistence via Cron", "primitive": "PERSISTENCE", "severity": 7, "description": "Installing cron jobs for persistent execution" },
+    { "id": "C07", "name": "Persistence via Shell Config", "primitive": "PERSISTENCE", "severity": 6, "description": "Modifying shell startup files (.bashrc, .zshrc, .profile)" },
+    { "id": "C08", "name": "Lateral Movement", "primitive": "ESCALATION", "severity": 6, "description": "SSH, network scanning, or probing internal infrastructure" },
+    { "id": "C09", "name": "Fork Bomb", "primitive": "DESTRUCTION", "severity": 9, "description": "Self-replicating process that exhausts system resources" },
+    { "id": "C10", "name": "Environment Poisoning", "primitive": "PERSISTENCE", "severity": 6, "description": "Manipulating PATH, LD_PRELOAD, or other environment variables" },
+    { "id": "C11", "name": "Git Hook Injection", "primitive": "PERSISTENCE", "severity": 6, "description": "Writing malicious scripts to .git/hooks/" },
+    { "id": "C12", "name": "History Tampering", "primitive": "MANIPULATION", "severity": 4, "description": "Clearing or disabling command history to hide activity" },
+    { "id": "C13", "name": "Encoded/Obfuscated Command", "primitive": "MANIPULATION", "severity": 8, "description": "Using base64, eval, or other encoding to hide command intent" },
+    { "id": "C14", "name": "Variable Expansion Risk", "primitive": "DESTRUCTION", "severity": 7, "description": "Commands where empty variable expansion could cause destructive behavior" },
+    { "id": "C15", "name": "Process Injection", "primitive": "ESCALATION", "severity": 8, "description": "Attaching to running processes via gdb, ptrace, or LD_PRELOAD" },
+    { "id": "C16", "name": "Disk Filling", "primitive": "DESTRUCTION", "severity": 5, "description": "Commands that fill disk space (dd with large count to files)" },
+    { "id": "C17", "name": "Network Listener", "primitive": "ESCALATION", "severity": 5, "description": "Opening network listeners (nc -l, python http.server, socat)" },
+    { "id": "C18", "name": "Credential Harvesting", "primitive": "EXFILTRATION", "severity": 8, "description": "Reading sensitive files (.ssh/id_rsa, /etc/shadow, .env, *.pem)" },
+    { "id": "C19", "name": "Container Escape", "primitive": "ESCALATION", "severity": 9, "description": "Escaping container isolation (--privileged, nsenter, --pid=host)" },
+    { "id": "C20", "name": "Package Manager Abuse", "primitive": "DESTRUCTION", "severity": 3, "description": "Running package managers that may execute arbitrary install scripts" }
+  ],
+  "destructiveCommands": ["rm", "rmdir", "mkfs", "dd", "shred", "wipefs", "fdisk", "parted", "truncate"],
+  "destructiveFlags": {
+    "rm": ["-rf", "-fr", "-r", "--recursive", "--no-preserve-root"],
+    "chmod": ["777", "000", "a+rwx"],
+    "chown": ["-R"],
+    "dd": ["of=/dev/"]
+  },
+  "criticalPaths": ["/", "/etc", "/boot", "/usr", "/var", "/sys", "/proc", "/dev", "/bin", "/sbin", "/lib", "/root", "/home"],
+  "exfiltrationCommands": ["curl", "wget", "nc", "ncat", "scp", "rsync", "ftp", "sftp"],
+  "exfiltrationPatterns": [">/dev/tcp/", "| curl", "| wget", "| nc ", "-d @", "--data-binary @", "--upload-file", "-T "],
+  "reverseShellPatterns": ["/dev/tcp/", "mkfifo", "0>&1", "bash -i", "exec 5<>", "0<&196", "/dev/udp/"],
+  "privilegeEscalation": ["sudo", "doas", "pkexec", "chmod u+s", "setuid"],
+  "persistenceTargets": [".bashrc", ".zshrc", ".profile", ".bash_profile", ".bash_login", "crontab", ".git/hooks/", "/etc/cron"],
+  "networkCommands": ["ssh", "nmap", "ping", "traceroute", "netcat", "nc", "socat"],
+  "containerEscapePatterns": ["--privileged", "nsenter", "--pid=host", "-v /:/host", "--cap-add=SYS_ADMIN"],
+  "packageManagers": ["npm", "pip", "pip3", "gem", "cargo", "go install", "yarn", "pnpm"],
+  "encodingCommands": ["base64", "xxd", "openssl enc"],
+  "pipeToShell": ["| bash", "| sh", "| zsh", "| dash", "| source"],
+  "safeCommands": ["ls", "cat", "echo", "pwd", "whoami", "date", "head", "tail", "grep", "find", "wc", "sort", "uniq", "diff", "less", "more", "man", "which", "type", "file", "stat", "du", "df", "uname", "env", "printenv", "id", "groups", "ps", "top", "htop", "cd", "mkdir", "touch", "cp", "mv", "ln", "readlink", "basename", "dirname", "realpath", "git", "node", "python", "python3", "ruby", "java", "go", "rustc", "tsc", "npx", "pnpm", "yarn", "npm", "pip", "pip3", "brew", "apt", "test", "true", "false", "seq", "tr", "cut", "paste", "tee", "xargs", "yes", "sleep", "clear", "reset"]
+}

package/patterns/file-read.json

@@ -0,0 +1,85 @@
+{
+  "version": "2026.02.21",
+  "threats": [
+    { "id": "FR01", "name": "SSH Key Access", "primitive": "EXFILTRATION", "severity": 9, "description": "Reading SSH private keys enables unauthorized remote access" },
+    { "id": "FR02", "name": "System Credential Access", "primitive": "EXFILTRATION", "severity": 9, "description": "Reading system credential files like /etc/shadow" },
+    { "id": "FR03", "name": "TLS Private Key Access", "primitive": "EXFILTRATION", "severity": 7, "description": "Reading TLS/SSL private keys (.pem, .key, .p12)" },
+    { "id": "FR04", "name": "Cloud Credential Access", "primitive": "EXFILTRATION", "severity": 8, "description": "Reading cloud provider credential files (AWS, GCP, Azure, Docker, K8s)" },
+    { "id": "FR05", "name": "Environment File Access", "primitive": "EXFILTRATION", "severity": 7, "description": "Reading .env files containing API keys and secrets" },
+    { "id": "FR06", "name": "Application Credential Access", "primitive": "EXFILTRATION", "severity": 6, "description": "Reading application-specific credential or config files" },
+    { "id": "FR07", "name": "System Info Disclosure", "primitive": "EXFILTRATION", "severity": 4, "description": "Reading system configuration files that reveal infrastructure details" },
+    { "id": "FR08", "name": "Shell History Access", "primitive": "EXFILTRATION", "severity": 4, "description": "Reading shell history files which may contain secrets" },
+    { "id": "FR09", "name": "Process Environment Access", "primitive": "EXFILTRATION", "severity": 5, "description": "Reading /proc environment data which may contain secrets" },
+    { "id": "FR10", "name": "Browser Data Access", "primitive": "EXFILTRATION", "severity": 6, "description": "Reading browser profiles, cookies, stored passwords" }
+  ],
+  "criticalPaths": [
+    { "pattern": "~/.ssh/id_rsa", "score": 9, "threatId": "FR01", "reason": "SSH RSA private key", "matchType": "exact" },
+    { "pattern": "~/.ssh/id_ed25519", "score": 9, "threatId": "FR01", "reason": "SSH Ed25519 private key", "matchType": "exact" },
+    { "pattern": "~/.ssh/id_ecdsa", "score": 9, "threatId": "FR01", "reason": "SSH ECDSA private key", "matchType": "exact" },
+    { "pattern": "~/.ssh/id_dsa", "score": 9, "threatId": "FR01", "reason": "SSH DSA private key", "matchType": "exact" },
+    { "pattern": "/etc/shadow", "score": 9, "threatId": "FR02", "reason": "System password hashes", "matchType": "exact" },
+    { "pattern": "/etc/master.passwd", "score": 9, "threatId": "FR02", "reason": "BSD system password hashes", "matchType": "exact" },
+    { "pattern": "/etc/gshadow", "score": 9, "threatId": "FR02", "reason": "Group password hashes", "matchType": "exact" },
+    { "pattern": "/etc/sudoers", "score": 8, "threatId": "FR02", "reason": "Sudo configuration reveals privilege structure", "matchType": "exact" }
+  ],
+  "highPaths": [
+    { "pattern": "~/.aws/credentials", "score": 8, "threatId": "FR04", "reason": "AWS credentials file", "matchType": "exact" },
+    { "pattern": "~/.aws/config", "score": 5, "threatId": "FR04", "reason": "AWS configuration file", "matchType": "exact" },
+    { "pattern": "~/.gcloud/credentials.db", "score": 8, "threatId": "FR04", "reason": "GCP credentials database", "matchType": "exact" },
+    { "pattern": "~/.config/gcloud/", "score": 7, "threatId": "FR04", "reason": "GCP configuration directory", "matchType": "prefix" },
+    { "pattern": "~/.azure/", "score": 7, "threatId": "FR04", "reason": "Azure credentials directory", "matchType": "prefix" },
+    { "pattern": "~/.docker/config.json", "score": 7, "threatId": "FR04", "reason": "Docker registry credentials", "matchType": "exact" },
+    { "pattern": "~/.kube/config", "score": 7, "threatId": "FR04", "reason": "Kubernetes cluster credentials", "matchType": "exact" },
+    { "pattern": ".env", "score": 7, "threatId": "FR05", "reason": "Environment file with secrets", "matchType": "basename" },
+    { "pattern": ".env.local", "score": 7, "threatId": "FR05", "reason": "Local environment file with secrets", "matchType": "basename" },
+    { "pattern": ".env.production", "score": 7, "threatId": "FR05", "reason": "Production environment file with secrets", "matchType": "basename" },
+    { "pattern": "~/.gnupg/", "score": 7, "threatId": "FR06", "reason": "GPG keys and configuration", "matchType": "prefix" },
+    { "pattern": "~/.netrc", "score": 6, "threatId": "FR06", "reason": "Network credentials file", "matchType": "exact" },
+    { "pattern": "~/.npmrc", "score": 5, "threatId": "FR06", "reason": "NPM credentials (may contain auth tokens)", "matchType": "exact" },
+    { "pattern": "~/.pypirc", "score": 5, "threatId": "FR06", "reason": "PyPI credentials", "matchType": "exact" }
+  ],
+  "mediumPaths": [
+    { "pattern": "/etc/passwd", "score": 4, "threatId": "FR07", "reason": "System user list (no hashes but reveals usernames)", "matchType": "exact" },
+    { "pattern": "/etc/hosts", "score": 3, "threatId": "FR07", "reason": "Host resolution configuration", "matchType": "exact" },
+    { "pattern": "/etc/resolv.conf", "score": 3, "threatId": "FR07", "reason": "DNS resolver configuration", "matchType": "exact" },
+    { "pattern": "~/.bash_history", "score": 4, "threatId": "FR08", "reason": "Bash command history (may contain secrets)", "matchType": "exact" },
+    { "pattern": "~/.zsh_history", "score": 4, "threatId": "FR08", "reason": "Zsh command history (may contain secrets)", "matchType": "exact" },
+    { "pattern": "~/.sh_history", "score": 4, "threatId": "FR08", "reason": "Shell history (may contain secrets)", "matchType": "exact" },
+    { "pattern": "~/.node_repl_history", "score": 3, "threatId": "FR08", "reason": "Node.js REPL history", "matchType": "exact" },
+    { "pattern": "~/.python_history", "score": 3, "threatId": "FR08", "reason": "Python REPL history", "matchType": "exact" },
+    { "pattern": "/proc/self/environ", "score": 5, "threatId": "FR09", "reason": "Process environment variables", "matchType": "exact" },
+    { "pattern": "/proc/self/cmdline", "score": 3, "threatId": "FR09", "reason": "Process command line arguments", "matchType": "exact" },
+    { "pattern": "/proc/", "score": 3, "threatId": "FR09", "reason": "Process information", "matchType": "prefix" }
+  ],
+  "sensitiveExtensions": [
+    { "extension": ".pem", "score": 7, "threatId": "FR03", "reason": "PEM certificate/key file" },
+    { "extension": ".key", "score": 7, "threatId": "FR03", "reason": "Private key file" },
+    { "extension": ".p12", "score": 7, "threatId": "FR03", "reason": "PKCS#12 certificate bundle" },
+    { "extension": ".pfx", "score": 7, "threatId": "FR03", "reason": "PFX certificate bundle" },
+    { "extension": ".jks", "score": 6, "threatId": "FR03", "reason": "Java KeyStore file" },
+    { "extension": ".keystore", "score": 6, "threatId": "FR03", "reason": "Keystore file" }
+  ],
+  "browserDataPaths": [
+    { "pattern": "Library/Application Support/Google/Chrome/", "score": 7, "threatId": "FR10", "reason": "Chrome browser data (macOS)", "matchType": "contains" },
+    { "pattern": ".config/google-chrome/", "score": 7, "threatId": "FR10", "reason": "Chrome browser data (Linux)", "matchType": "contains" },
+    { "pattern": "AppData/Local/Google/Chrome/", "score": 7, "threatId": "FR10", "reason": "Chrome browser data (Windows)", "matchType": "contains" },
+    { "pattern": ".mozilla/firefox/", "score": 7, "threatId": "FR10", "reason": "Firefox browser data", "matchType": "contains" },
+    { "pattern": "Library/Application Support/Firefox/", "score": 7, "threatId": "FR10", "reason": "Firefox browser data (macOS)", "matchType": "contains" },
+    { "pattern": "Library/Safari/", "score": 6, "threatId": "FR10", "reason": "Safari browser data", "matchType": "contains" },
+    { "pattern": "Login Data", "score": 5, "threatId": "FR10", "reason": "Browser stored passwords", "matchType": "basename" },
+    { "pattern": "Cookies", "score": 5, "threatId": "FR10", "reason": "Browser cookies", "matchType": "basename" }
+  ],
+  "safePaths": [
+    "src/", "lib/", "test/", "tests/", "docs/", "doc/", "build/", "dist/",
+    "node_modules/", "vendor/", "public/", "static/", "assets/", "scripts/",
+    "README", "LICENSE", "CHANGELOG", "package.json", "tsconfig.json",
+    "Cargo.toml", "go.mod", "pom.xml", "Gemfile", "requirements.txt"
+  ],
+  "safeExtensions": [
+    ".ts", ".js", ".tsx", ".jsx", ".py", ".rb", ".go", ".rs", ".java",
+    ".kt", ".swift", ".c", ".cpp", ".h", ".cs", ".php", ".html", ".css",
+    ".scss", ".less", ".json", ".yaml", ".yml", ".toml", ".xml", ".sql",
+    ".md", ".txt", ".csv", ".svg", ".png", ".jpg", ".jpeg", ".gif",
+    ".ico", ".woff", ".woff2", ".ttf", ".eot", ".lock", ".map"
+  ]
+}