@trailofbits/vsix-audit 0.1.0 → 0.1.3

package/dist/scanner/index.js

@@ -3,11 +3,12 @@ import { checkAST } from "./checks/ast.js";
 import { checkIocs } from "./checks/ioc.js";
 import { checkObfuscation } from "./checks/obfuscation.js";
 import { checkPackage } from "./checks/package.js";
+import { checkTelemetry } from "./checks/telemetry.js";
 import { checkYara, DEFAULT_YARA_RULES_DIR, isYaraAvailable, listYaraRules, } from "./checks/yara.js";
 import { isScannable, SCANNABLE_EXTENSIONS_PATTERN, SCANNABLE_EXTENSIONS_UNICODE, } from "./constants.js";
 import { loadZooData } from "./loaders/zoo.js";
 import { loadExtension } from "./vsix.js";
-export const MODULE_NAMES = ["package", "obfuscation", "ast", "ioc", "yara"];
+export const MODULE_NAMES = ["package", "obfuscation", "ast", "ioc", "yara", "telemetry"];
 export { findVsixFiles, scanDirectory } from "./batch.js";
 const SEVERITY_ORDER = {
     low: 0,
@@ -144,6 +145,18 @@ export async function scanExtension(target, options) {
             });
         }
     }
+    // Telemetry check
+    if (shouldRunModule("telemetry", options)) {
+        const moduleStart = performance.now();
+        findings.push(...checkTelemetry(contents, zooData));
+        timings.telemetry = performance.now() - moduleStart;
+        inventory.push({
+            name: "Telemetry",
+            enabled: true,
+            description: "Analytics and data collection detection",
+            filesExamined: codeFileCount,
+        });
+    }
     findings = deduplicateFindings(findings);
     findings = filterBySeverity(findings, options.severity);
     findings = sortFindings(findings);

package/dist/scanner/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/scanner/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EACL,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,WAAW,EACX,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAW/C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAU,CAAC;AAatF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,cAAc,GAA6B;IAC/C,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,SAAS,gBAAgB,CAAC,QAAmB,EAAE,WAAqB;IAClE,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAmB;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAc,EAAE,CAAC;IAE7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;QAC5F,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,QAAmB;IACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC7E,IAAI,YAAY,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAC5C,OAAO,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAsB,EAAE,UAAuB;IAC1E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YACtC,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,IAAgB,EAAE,OAAoB;IAC7D,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,OAAoB;IACtE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,OAAO,GAAkB,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAErD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAE7C,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC9B,MAAM,WAAW,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;IAE7D,IAAI,QAAQ,GAAc,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAmB,EAAE,CAAC;IAErC,kCAAkC;IAClC,MAAM,aAAa,GAAG,MAAM,eAAe,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEnF,oCAAoC;IACpC,MAAM,aAAa,GAAG,mBAAmB,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,mBAAmB,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IAElF,sDAAsD;IACtD,IAAI,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QAClD,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,mEAAmE;SACjF,CAAC,CAAC;IACL,CAAC;IAED,+CAA+C;IAC/C,IAAI,eAAe,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QACtD,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,uCAAuC,aAAa,QAAQ;YACzE,YAAY,EAAE,CAAC;YACf,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,eAAe;IACf,IAAI,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QAC9C,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,mCAAmC,aAAa,aAAa;YAC1E,YAAY,EAAE,CAAC;YACf,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,YAAY;IACZ,IAAI,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QAC9C,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,2CAA2C;SACzD,CAAC,CAAC;IACL,CAAC;IAED,aAAa;IACb,IAAI,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACrC,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;YAC/C,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,GAAG,SAAS,CAAC,MAAM,0BAA0B;gBAC1D,YAAY,EAAE,SAAS,CAAC,MAAM;gBAC9B,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI;aACnC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,KAAK;gBACd,WAAW,EAAE,mCAAmC;gBAChD,UAAU,EAAE,oBAAoB;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxD,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAElC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAE9C,OAAO;QACL,SAAS,EAAE;YACT,EAAE,EAAE,WAAW;YACf,IAAI,EAAE,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI;YAC3C,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B;QACD,QAAQ;QACR,SAAS;QACT,QAAQ,EAAE;YACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/scanner/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,WAAW,EACX,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAW/C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAU,CAAC;AAanG,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,cAAc,GAA6B;IAC/C,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,SAAS,gBAAgB,CAAC,QAAmB,EAAE,WAAqB;IAClE,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAmB;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAc,EAAE,CAAC;IAE7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;QAC5F,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,QAAmB;IACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC7E,IAAI,YAAY,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAC5C,OAAO,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAsB,EAAE,UAAuB;IAC1E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YACtC,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,IAAgB,EAAE,OAAoB;IAC7D,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,OAAoB;IACtE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,OAAO,GAAkB,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAErD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAE7C,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC9B,MAAM,WAAW,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;IAE7D,IAAI,QAAQ,GAAc,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAmB,EAAE,CAAC;IAErC,kCAAkC;IAClC,MAAM,aAAa,GAAG,MAAM,eAAe,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEnF,oCAAoC;IACpC,MAAM,aAAa,GAAG,mBAAmB,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,mBAAmB,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IAElF,sDAAsD;IACtD,IAAI,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QAClD,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,mEAAmE;SACjF,CAAC,CAAC;IACL,CAAC;IAED,+CAA+C;IAC/C,IAAI,eAAe,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QACtD,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,uCAAuC,aAAa,QAAQ;YACzE,YAAY,EAAE,CAAC;YACf,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,eAAe;IACf,IAAI,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QAC9C,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,mCAAmC,aAAa,aAAa;YAC1E,YAAY,EAAE,CAAC;YACf,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,YAAY;IACZ,IAAI,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QAC9C,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,2CAA2C;SACzD,CAAC,CAAC;IACL,CAAC;IAED,aAAa;IACb,IAAI,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACrC,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;YAC/C,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,GAAG,SAAS,CAAC,MAAM,0BAA0B;gBAC1D,YAAY,EAAE,SAAS,CAAC,MAAM;gBAC9B,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI;aACnC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,KAAK;gBACd,WAAW,EAAE,mCAAmC;gBAChD,UAAU,EAAE,oBAAoB;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,IAAI,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QACpD,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,yCAAyC;YACtD,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxD,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAElC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAE9C,OAAO;QACL,SAAS,EAAE;YACT,EAAE,EAAE,WAAW;YACf,IAAI,EAAE,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI;YAC3C,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B;QACD,QAAQ;QACR,SAAS;QACT,QAAQ,EAAE;YACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC;KACF,CAAC;AACJ,CAAC"}

package/dist/scanner/loaders/zoo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zoo.d.ts","sourceRoot":"","sources":["../../../src/scanner/loaders/zoo.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAkB,OAAO,EAAE,MAAM,aAAa,CAAC;AAkG3D,wBAAsB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAwCpD"}
+{"version":3,"file":"zoo.d.ts","sourceRoot":"","sources":["../../../src/scanner/loaders/zoo.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAA2D,OAAO,EAAE,MAAM,aAAa,CAAC;AAuIpG,wBAAsB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CA2CpD"}

package/dist/scanner/loaders/zoo.js

@@ -82,13 +82,45 @@ function parseWalletFile(content) {
     }
     return result;
 }
+/**
+ * Parse telemetry services file format: SERVICE_NAME  CATEGORY  DOMAIN1,DOMAIN2,...
+ * Returns a map from domain to service info for fast lookup.
+ */
+function parseTelemetryServices(content) {
+    const result = new Map();
+    const validCategories = new Set(["analytics", "crash-reporting", "apm"]);
+    for (const line of content.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        // Format: SERVICE_NAME  CATEGORY  DOMAIN1,DOMAIN2,...
+        // Use regex to split on 2+ whitespace to handle multi-word service names
+        const parts = trimmed.split(/\s{2,}/);
+        if (parts.length < 3)
+            continue;
+        const name = parts[0];
+        const category = parts[1];
+        const domainsStr = parts[2];
+        if (!name || !validCategories.has(category) || !domainsStr)
+            continue;
+        const domains = domainsStr.split(",").map((d) => d.trim().toLowerCase());
+        const serviceInfo = { name, category, domains };
+        // Map each domain to this service for fast lookup
+        for (const domain of domains) {
+            if (domain) {
+                result.set(domain, serviceInfo);
+            }
+        }
+    }
+    return result;
+}
 let cachedZooData;
 export async function loadZooData() {
     if (cachedZooData) {
         return cachedZooData;
     }
     const zooRoot = await findZooRoot();
-    const [blocklistContent, hashesContent, domainsContent, ipsContent, npmContent, walletsContent, blockchainContent,] = await Promise.all([
+    const [blocklistContent, hashesContent, domainsContent, ipsContent, npmContent, walletsContent, blockchainContent, telemetryContent,] = await Promise.all([
         readFile(join(zooRoot, "blocklist", "extensions.json"), "utf8"),
         readFile(join(zooRoot, "iocs", "hashes.txt"), "utf8"),
         readFile(join(zooRoot, "iocs", "c2-domains.txt"), "utf8"),
@@ -96,6 +128,7 @@ export async function loadZooData() {
         readFile(join(zooRoot, "iocs", "malicious-npm.txt"), "utf8"),
         readFile(join(zooRoot, "iocs", "wallets.txt"), "utf8"),
         readFile(join(zooRoot, "iocs", "blockchain-extensions.txt"), "utf8"),
+        readFile(join(zooRoot, "telemetry", "known-services.txt"), "utf8").catch(() => ""),
     ]);
     const blocklistFile = JSON.parse(blocklistContent);
     cachedZooData = {
@@ -106,6 +139,7 @@ export async function loadZooData() {
         maliciousNpmPackages: parseIOCFile(npmContent, (pkg) => pkg.toLowerCase()),
         wallets: parseWalletFile(walletsContent),
         blockchainAllowlist: parseIOCFile(blockchainContent, (extId) => extId),
+        telemetryServices: parseTelemetryServices(telemetryContent),
     };
     return cachedZooData;
 }

package/dist/scanner/loaders/zoo.js.map

@@ -1 +1 @@
-{"version":3,"file":"zoo.js","sourceRoot":"","sources":["../../../src/scanner/loaders/zoo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D;;;;;;GAMG;AACH,KAAK,UAAU,WAAW;IACxB,mCAAmC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACnD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,+CAA+C;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IAED,8CAA8C;IAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC5B,OAAO,aAAa,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAMD,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,SAA2C;IAChF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElD,sCAAsC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,IAAI,aAAkC,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IAEpC,MAAM,CACJ,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,UAAU,EACV,UAAU,EACV,cAAc,EACd,iBAAiB,EAClB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QACtD,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,2BAA2B,CAAC,EAAE,MAAM,CAAC;KACrE,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAkB,CAAC;IAEpE,aAAa,GAAG;QACd,SAAS,EAAE,aAAa,CAAC,UAAU;QACnC,MAAM,EAAE,YAAY,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3C,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CACzD;QACD,OAAO,EAAE,YAAY,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACrF,GAAG,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC/E,oBAAoB,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC1E,OAAO,EAAE,eAAe,CAAC,cAAc,CAAC;QACxC,mBAAmB,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC;KACvE,CAAC;IAEF,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"zoo.js","sourceRoot":"","sources":["../../../src/scanner/loaders/zoo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D;;;;;;GAMG;AACH,KAAK,UAAU,WAAW;IACxB,mCAAmC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACnD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,+CAA+C;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IAED,8CAA8C;IAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC5B,OAAO,aAAa,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAMD,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,SAA2C;IAChF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElD,sCAAsC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;IACvD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAoB,CAAC,WAAW,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC;IAE5F,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElD,sDAAsD;QACtD,yEAAyE;QACzE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAE/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAsB,CAAC;QAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAE5B,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU;YAAE,SAAS;QAErE,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACzE,MAAM,WAAW,GAAyB,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAEtE,kDAAkD;QAClD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,IAAI,aAAkC,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IAEpC,MAAM,CACJ,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,UAAU,EACV,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EACjB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QACtD,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,2BAA2B,CAAC,EAAE,MAAM,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;KACnF,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAkB,CAAC;IAEpE,aAAa,GAAG;QACd,SAAS,EAAE,aAAa,CAAC,UAAU;QACnC,MAAM,EAAE,YAAY,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3C,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CACzD;QACD,OAAO,EAAE,YAAY,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACrF,GAAG,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC/E,oBAAoB,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC1E,OAAO,EAAE,eAAe,CAAC,cAAc,CAAC;QACxC,mBAAmB,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC;QACtE,iBAAiB,EAAE,sBAAsB,CAAC,gBAAgB,CAAC;KAC5D,CAAC;IAEF,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/scanner/types.d.ts

@@ -7,6 +7,7 @@ export interface ModuleTimings {
     ast?: number;
     ioc?: number;
     yara?: number;
+    telemetry?: number;
     total: number;
 }
 export interface ScanOptions {
@@ -91,6 +92,12 @@ export interface BlocklistEntry {
     addedDate?: string;
     reference?: string;
 }
+export type TelemetryCategory = "analytics" | "crash-reporting" | "apm";
+export interface TelemetryServiceInfo {
+    name: string;
+    category: TelemetryCategory;
+    domains: string[];
+}
 export interface ZooData {
     blocklist: BlocklistEntry[];
     hashes: Set<string>;
@@ -99,6 +106,7 @@ export interface ZooData {
     maliciousNpmPackages: Set<string>;
     wallets: Set<string>;
     blockchainAllowlist: Set<string>;
+    telemetryServices: Map<string, TelemetryServiceInfo>;
 }
 export interface BatchScanResult {
     results: ScanResult[];

package/dist/scanner/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/scanner/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE9D,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,QAAQ,CAAC;QACpB,OAAO,CAAC,EAAE,aAAa,CAAC;KACzB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,KAAK,CAAC;YACb,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,IAAI,CAAC,EAAE,MAAM,CAAC;SACf,CAAC,CAAC;QACH,UAAU,CAAC,EAAE,KAAK,CAAC;YACjB,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,IAAI,CAAC,EAAE,MAAM,CAAC;SACf,CAAC,CAAC;QACH,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,YAAY,CAAC;IACvB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,kBAAkB,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/scanner/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE9D,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,QAAQ,CAAC;QACpB,OAAO,CAAC,EAAE,aAAa,CAAC;KACzB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,KAAK,CAAC;YACb,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,IAAI,CAAC,EAAE,MAAM,CAAC;SACf,CAAC,CAAC;QACH,UAAU,CAAC,EAAE,KAAK,CAAC;YACjB,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,IAAI,CAAC,EAAE,MAAM,CAAC;SACf,CAAC,CAAC;QACH,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,YAAY,CAAC;IACvB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,iBAAiB,GAAG,KAAK,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,kBAAkB,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trailofbits/vsix-audit",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "description": "Security scanner for VS Code extensions",
   "keywords": [
     "audit",

package/zoo/signatures/yara/README.md

@@ -38,9 +38,12 @@ Example: `tigerjack_keylogger.yar`
 ## Usage
 
 ```bash
-# Scan with YARA
-yara -r zoo/signatures/yara/ path/to/extension/
+# Scan with YARA-X
+yr scan -r zoo/signatures/yara/unicode_stealth.yar path/to/extension/
 
-# With vsix-audit (planned)
-vsix-audit scan extension.vsix --yara zoo/signatures/yara/
+# Or scan all rules in directory
+for f in zoo/signatures/yara/*.yar; do yr scan -r "$f" path/to/extension/; done
+
+# With vsix-audit (automatic)
+vsix-audit scan extension.vsix  # YARA rules loaded automatically
 ```

package/zoo/telemetry/known-services.txt

@@ -0,0 +1,27 @@
+# Known telemetry services for VS Code extension analysis
+# Format: SERVICE_NAME  CATEGORY  DOMAIN1,DOMAIN2,...
+# Categories: analytics, crash-reporting, apm
+
+# Analytics
+Google Analytics       analytics         analytics.google.com,google-analytics.com,www.google-analytics.com
+Mixpanel               analytics         api.mixpanel.com,mixpanel.com
+Segment                analytics         api.segment.io,cdn.segment.io,segment.io
+Amplitude              analytics         api.amplitude.com,amplitude.com,api2.amplitude.com
+PostHog                analytics         app.posthog.com,us.posthog.com,eu.posthog.com,posthog.com
+Heap                   analytics         heapanalytics.com,cdn.heapanalytics.com
+Plausible              analytics         plausible.io
+Matomo                 analytics         matomo.cloud
+
+# Crash Reporting
+Sentry                 crash-reporting   sentry.io,ingest.sentry.io,o0.ingest.sentry.io
+Bugsnag                crash-reporting   notify.bugsnag.com,bugsnag.com,sessions.bugsnag.com
+Rollbar                crash-reporting   api.rollbar.com,rollbar.com
+Raygun                 crash-reporting   api.raygun.io,raygun.io
+
+# APM (Application Performance Monitoring)
+Azure App Insights     apm               applicationinsights.azure.com,dc.services.visualstudio.com,centralus-0.in.applicationinsights.azure.com
+Datadog                apm               datadoghq.com,browser-intake-datadoghq.com,logs.datadoghq.com
+New Relic              apm               collector.newrelic.com,newrelic.com,bam.nr-data.net
+
+# VS Code Specific
+VS Code Telemetry      analytics         vortex.data.microsoft.com

package/dist/scanner/checks/behavioral.d.ts

@@ -1,3 +0,0 @@
-import type { Finding, VsixContents } from "../types.js";
-export declare function checkBehavioral(contents: VsixContents): Finding[];
-//# sourceMappingURL=behavioral.d.ts.map

package/dist/scanner/checks/behavioral.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"behavioral.d.ts","sourceRoot":"","sources":["../../../src/scanner/checks/behavioral.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAY,YAAY,EAAE,MAAM,aAAa,CAAC;AA6XnE,wBAAgB,eAAe,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,EAAE,CAkDjE"}

package/dist/scanner/checks/behavioral.js

@@ -1,367 +0,0 @@
-import { isScannable, SCANNABLE_EXTENSIONS_PATTERN } from "../constants.js";
-import { findLineNumberByIndex } from "../utils.js";
-const SIGNATURES = [
-    {
-        id: "BEHAVIOR_CREDENTIAL_EXFIL",
-        title: "Credential exfiltration pattern",
-        description: "Code reads sensitive files, encodes the content, and sends it to an external server. This is the classic credential theft attack chain.",
-        severity: "critical",
-        stages: [
-            {
-                action: "file_read",
-                patterns: [
-                    /readFile(?:Sync)?\s*\(/gi,
-                    /fs\.promises\.readFile/gi,
-                    /createReadStream\s*\(/gi,
-                ],
-                description: "File read operation",
-            },
-            {
-                action: "encode",
-                patterns: [
-                    /Buffer\.from\s*\([^)]+\)\.toString\s*\(\s*['"]base64/gi,
-                    /btoa\s*\(/gi,
-                    /\.toString\s*\(\s*['"](?:base64|hex)['"]\s*\)/gi,
-                    /JSON\.stringify\s*\(/gi,
-                ],
-                description: "Data encoding for transmission",
-            },
-            {
-                action: "network",
-                patterns: [
-                    /fetch\s*\(/gi,
-                    /axios\./gi,
-                    /https?\.request/gi,
-                    /\.post\s*\(/gi,
-                    /\.send\s*\(/gi,
-                ],
-                description: "Network transmission",
-            },
-        ],
-        redFlags: [
-            "Reads from home directory or .ssh",
-            "Encodes before sending",
-            "Sends to external domain",
-        ],
-    },
-    {
-        id: "BEHAVIOR_REVERSE_SHELL",
-        title: "Reverse shell pattern",
-        description: "Code establishes network connection and pipes input to command execution. This creates a remote shell for attackers.",
-        severity: "critical",
-        stages: [
-            {
-                action: "network",
-                patterns: [
-                    /net\.Socket/gi,
-                    /net\.connect/gi,
-                    /net\.createConnection/gi,
-                    /new\s+WebSocket/gi,
-                ],
-                description: "Network connection",
-            },
-            {
-                action: "exec",
-                patterns: [/child_process/gi, /\.spawn\s*\(/gi, /\.exec\s*\(/gi, /process\.stdin/gi],
-                description: "Command execution",
-            },
-        ],
-        maxSpan: 1500,
-        redFlags: ["Socket piped to shell", "Remote command execution"],
-    },
-    {
-        id: "BEHAVIOR_SUPPLY_CHAIN_ATTACK",
-        title: "Install script attack pattern",
-        description: "Package lifecycle script accesses environment, executes commands, and phones home. This is a supply chain attack pattern.",
-        severity: "high", // Downgraded - common in legitimate build tools
-        stages: [
-            {
-                action: "env_access",
-                patterns: [
-                    /os\.homedir\s*\(\)/gi,
-                    /os\.userInfo\s*\(\)/gi,
-                    /process\.env\.(?:HOME|USERPROFILE|APPDATA)/gi,
-                ],
-                description: "Home directory access",
-            },
-            {
-                action: "exec",
-                patterns: [/child_process\.exec\s*\(/gi, /execSync\s*\(/gi, /spawnSync\s*\(/gi],
-                description: "Command execution",
-            },
-            {
-                action: "network",
-                patterns: [/fetch\s*\(/gi, /axios\s*\./gi, /curl\s+/gi, /wget\s+/gi],
-                description: "Network activity",
-            },
-        ],
-        minStages: 3, // Require all 3 stages to reduce false positives
-        maxSpan: 1000, // Tighter proximity requirement
-        legitimateUses: ["Build scripts", "Development tools"],
-        redFlags: ["Runs in postinstall", "Collects system info", "Sends to unknown domain"],
-    },
-    {
-        id: "BEHAVIOR_DROPPER",
-        title: "Malware dropper pattern",
-        description: "Code downloads content from remote URL, writes it to file, and executes it. This is a dropper/downloader pattern.",
-        severity: "critical",
-        stages: [
-            {
-                action: "download",
-                patterns: [
-                    /fetch\s*\([^)]*https?:\/\//gi,
-                    /axios\.get\s*\([^)]*https?:\/\//gi,
-                    /https?\.get\s*\(/gi,
-                    /request\s*\([^)]*https?:\/\//gi,
-                ],
-                description: "Remote content download",
-            },
-            {
-                action: "file_read",
-                patterns: [
-                    /writeFile(?:Sync)?\s*\(/gi,
-                    /createWriteStream\s*\(/gi,
-                    /fs\.promises\.writeFile/gi,
-                ],
-                description: "File write",
-            },
-            {
-                action: "exec",
-                patterns: [/child_process/gi, /\.exec\s*\(/gi, /\.spawn\s*\(/gi, /execSync/gi],
-                description: "Execution",
-            },
-        ],
-        maxSpan: 2000,
-        redFlags: [
-            "Downloads executable",
-            "Writes to temp or hidden location",
-            "Executes downloaded content",
-        ],
-    },
-    {
-        id: "BEHAVIOR_KEYLOGGER",
-        title: "Keystroke capture pattern",
-        description: "Code captures keyboard/input events and stores or transmits the data. This indicates keylogging behavior.",
-        severity: "high",
-        stages: [
-            {
-                action: "clipboard",
-                patterns: [
-                    // onDidChangeTextDocument is legitimate for language servers - don't flag it
-                    // Instead, look for actual keystroke monitoring
-                    /keyboard.*event/gi,
-                    /keydown|keyup|keypress/gi,
-                    /clipboard\.readText/gi,
-                    /getSelection\s*\(\s*\)\.toString/gi,
-                ],
-                description: "Keystroke/clipboard capture",
-            },
-            {
-                action: "persistence",
-                patterns: [
-                    /globalState\.update/gi,
-                    /writeFileSync?\s*\([^)]*keystroke/gi,
-                    /localStorage\.setItem/gi,
-                ],
-                description: "Data storage",
-            },
-            {
-                action: "network",
-                patterns: [/discord\.com\/api\/webhooks/gi, /discordapp\.com\/api\/webhooks/gi],
-                description: "Data exfiltration to Discord",
-            },
-        ],
-        minStages: 2,
-        legitimateUses: ["Keyboard shortcut extensions"],
-        redFlags: ["Captures all keystrokes", "Sends to Discord webhook", "No user consent mechanism"],
-    },
-    {
-        id: "BEHAVIOR_CRYPTO_STEALER",
-        title: "Cryptocurrency stealer pattern",
-        description: "Code scans for wallet files, extracts keys/seeds, and exfiltrates them.",
-        severity: "critical",
-        stages: [
-            {
-                action: "file_read",
-                patterns: [
-                    /\.ethereum/gi,
-                    /\.bitcoin/gi,
-                    /wallet\.dat/gi,
-                    /keystore/gi,
-                    /seed.*phrase/gi,
-                    /mnemonic/gi,
-                ],
-                description: "Wallet file access",
-            },
-            {
-                action: "encode",
-                patterns: [
-                    /btoa\s*\(/gi, // More specific - require function call
-                    /Buffer\.from\s*\([^)]*\)\.toString\s*\(\s*['"]base64/gi,
-                    /toString\s*\(\s*['"](?:base64|hex)['"]\s*\)/gi,
-                ],
-                description: "Data encoding for exfil",
-            },
-            {
-                action: "network",
-                patterns: [/discord.*webhook/gi, /\.post\s*\([^)]*wallet/gi],
-                description: "Exfiltration",
-            },
-        ],
-        // Require all 3 stages - wallet access is the key indicator
-        minStages: 3,
-        maxSpan: 1500,
-        redFlags: [
-            "Scans for multiple wallet types",
-            "Extracts private keys",
-            "Sends to Discord/external",
-        ],
-    },
-    {
-        id: "BEHAVIOR_PERSISTENCE",
-        title: "Persistence mechanism pattern",
-        description: "Code modifies startup files, schedules tasks, or installs itself for persistence.",
-        severity: "high",
-        stages: [
-            {
-                action: "file_read",
-                patterns: [
-                    /\.bashrc/gi,
-                    /\.zshrc/gi,
-                    /\.profile/gi,
-                    /crontab/gi,
-                    /startup/gi,
-                    /autostart/gi,
-                ],
-                description: "Startup file access",
-            },
-            {
-                action: "persistence",
-                patterns: [/writeFile/gi, /appendFile/gi, /fs\.promises\.writeFile/gi],
-                description: "File modification",
-            },
-        ],
-        legitimateUses: ["Shell configuration tools", "Development environment setup"],
-        redFlags: ["Writes to startup files", "Adds hidden entries", "No user interaction"],
-    },
-    {
-        id: "BEHAVIOR_SELF_PROPAGATION",
-        title: "Self-propagation pattern",
-        description: "Code accesses package publishing credentials and attempts to publish itself. This is worm-like behavior.",
-        severity: "critical",
-        stages: [
-            {
-                action: "file_read",
-                patterns: [/\.npmrc/gi, /NPM_TOKEN/gi, /OPENVSX_TOKEN/gi, /npm\s+config/gi],
-                description: "Publishing credential access",
-            },
-            {
-                action: "exec",
-                patterns: [/npm\s+publish/gi, /vsce\s+publish/gi, /ovsx\s+publish/gi, /yarn\s+publish/gi],
-                description: "Package publishing",
-            },
-        ],
-        redFlags: ["Accesses publish tokens", "Runs publish commands", "GlassWorm-style worm"],
-    },
-];
-/**
- * Find all matches for patterns in content
- */
-function findPatternMatches(content, patterns) {
-    const matches = [];
-    for (const pattern of patterns) {
-        const regex = new RegExp(pattern.source, pattern.flags);
-        let match;
-        while ((match = regex.exec(content)) !== null) {
-            matches.push({
-                index: match.index,
-                matched: match[0].slice(0, 60),
-            });
-        }
-    }
-    return matches;
-}
-/**
- * Check if a signature matches in the content
- */
-function checkSignature(content, signature) {
-    const stageMatches = [];
-    const minStages = signature.minStages ?? signature.stages.length;
-    const maxSpan = signature.maxSpan ?? 3000;
-    // Find matches for each stage
-    for (const stage of signature.stages) {
-        const matches = findPatternMatches(content, stage.patterns);
-        if (matches.length > 0) {
-            const firstMatch = matches[0];
-            if (firstMatch) {
-                stageMatches.push({
-                    stage,
-                    index: firstMatch.index,
-                    matched: firstMatch.matched,
-                });
-            }
-        }
-    }
-    // Check if enough stages matched
-    if (stageMatches.length < minStages) {
-        return null;
-    }
-    // Check if stages are within maxSpan
-    if (stageMatches.length > 1) {
-        const indices = stageMatches.map((m) => m.index);
-        const span = Math.max(...indices) - Math.min(...indices);
-        if (span > maxSpan) {
-            return null;
-        }
-    }
-    return stageMatches;
-}
-export function checkBehavioral(contents) {
-    const findings = [];
-    const seenFindings = new Set();
-    for (const [filename, buffer] of contents.files) {
-        if (!isScannable(filename, SCANNABLE_EXTENSIONS_PATTERN))
-            continue;
-        const content = buffer.toString("utf8");
-        for (const signature of SIGNATURES) {
-            const stageMatches = checkSignature(content, signature);
-            if (!stageMatches)
-                continue;
-            // Deduplicate
-            const key = `${signature.id}:${filename}`;
-            if (seenFindings.has(key))
-                continue;
-            seenFindings.add(key);
-            const firstMatch = stageMatches[0];
-            if (!firstMatch)
-                continue;
-            findings.push({
-                id: signature.id,
-                title: signature.title,
-                description: signature.description,
-                severity: signature.severity,
-                category: "behavioral",
-                location: {
-                    file: filename,
-                    line: findLineNumberByIndex(content, firstMatch.index),
-                },
-                metadata: {
-                    stagesMatched: stageMatches.length,
-                    totalStages: signature.stages.length,
-                    stages: stageMatches.map((m) => ({
-                        action: m.stage.action,
-                        description: m.stage.description,
-                        matched: m.matched,
-                        line: findLineNumberByIndex(content, m.index),
-                    })),
-                    ...(signature.legitimateUses && {
-                        legitimateUses: signature.legitimateUses,
-                    }),
-                    ...(signature.redFlags && { redFlags: signature.redFlags }),
-                },
-            });
-        }
-    }
-    return findings;
-}
-//# sourceMappingURL=behavioral.js.map

package/dist/scanner/checks/behavioral.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"behavioral.js","sourceRoot":"","sources":["../../../src/scanner/checks/behavioral.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAE5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AA4CpD,MAAM,UAAU,GAA0B;IACxC;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,yIAAyI;QAC3I,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE;YACN;gBACE,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE;oBACR,0BAA0B;oBAC1B,0BAA0B;oBAC1B,yBAAyB;iBAC1B;gBACD,WAAW,EAAE,qBAAqB;aACnC;YACD;gBACE,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE;oBACR,wDAAwD;oBACxD,aAAa;oBACb,iDAAiD;oBACjD,wBAAwB;iBACzB;gBACD,WAAW,EAAE,gCAAgC;aAC9C;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE;oBACR,cAAc;oBACd,WAAW;oBACX,mBAAmB;oBACnB,eAAe;oBACf,eAAe;iBAChB;gBACD,WAAW,EAAE,sBAAsB;aACpC;SACF;QACD,QAAQ,EAAE;YACR,mCAAmC;YACnC,wBAAwB;YACxB,0BAA0B;SAC3B;KACF;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,sHAAsH;QACxH,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE;YACN;gBACE,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE;oBACR,eAAe;oBACf,gBAAgB;oBAChB,yBAAyB;oBACzB,mBAAmB;iBACpB;gBACD,WAAW,EAAE,oBAAoB;aAClC;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,CAAC;gBACpF,WAAW,EAAE,mBAAmB;aACjC;SACF;QACD,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,CAAC,uBAAuB,EAAE,0BAA0B,CAAC;KAChE;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,KAAK,EAAE,+BAA+B;QACtC,WAAW,EACT,2HAA2H;QAC7H,QAAQ,EAAE,MAAM,EAAE,gDAAgD;QAClE,MAAM,EAAE;YACN;gBACE,MAAM,EAAE,YAAY;gBACpB,QAAQ,EAAE;oBACR,sBAAsB;oBACtB,uBAAuB;oBACvB,8CAA8C;iBAC/C;gBACD,WAAW,EAAE,uBAAuB;aACrC;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,CAAC,4BAA4B,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;gBAC/E,WAAW,EAAE,mBAAmB;aACjC;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC;gBACpE,WAAW,EAAE,kBAAkB;aAChC;SACF;QACD,SAAS,EAAE,CAAC,EAAE,iDAAiD;QAC/D,OAAO,EAAE,IAAI,EAAE,gCAAgC;QAC/C,cAAc,EAAE,CAAC,eAAe,EAAE,mBAAmB,CAAC;QACtD,QAAQ,EAAE,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,yBAAyB,CAAC;KACrF;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,mHAAmH;QACrH,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE;YACN;gBACE,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE;oBACR,8BAA8B;oBAC9B,mCAAmC;oBACnC,oBAAoB;oBACpB,gCAAgC;iBACjC;gBACD,WAAW,EAAE,yBAAyB;aACvC;YACD;gBACE,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE;oBACR,2BAA2B;oBAC3B,0BAA0B;oBAC1B,2BAA2B;iBAC5B;gBACD,WAAW,EAAE,YAAY;aAC1B;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,CAAC,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,CAAC;gBAC9E,WAAW,EAAE,WAAW;aACzB;SACF;QACD,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE;YACR,sBAAsB;YACtB,mCAAmC;YACnC,6BAA6B;SAC9B;KACF;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,2GAA2G;QAC7G,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE;YACN;gBACE,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE;oBACR,6EAA6E;oBAC7E,gDAAgD;oBAChD,mBAAmB;oBACnB,0BAA0B;oBAC1B,uBAAuB;oBACvB,oCAAoC;iBACrC;gBACD,WAAW,EAAE,6BAA6B;aAC3C;YACD;gBACE,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE;oBACR,uBAAuB;oBACvB,qCAAqC;oBACrC,yBAAyB;iBAC1B;gBACD,WAAW,EAAE,cAAc;aAC5B;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,CAAC,+BAA+B,EAAE,kCAAkC,CAAC;gBAC/E,WAAW,EAAE,8BAA8B;aAC5C;SACF;QACD,SAAS,EAAE,CAAC;QACZ,cAAc,EAAE,CAAC,8BAA8B,CAAC;QAChD,QAAQ,EAAE,CAAC,yBAAyB,EAAE,0BAA0B,EAAE,2BAA2B,CAAC;KAC/F;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,gCAAgC;QACvC,WAAW,EAAE,yEAAyE;QACtF,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE;YACN;gBACE,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE;oBACR,cAAc;oBACd,aAAa;oBACb,eAAe;oBACf,YAAY;oBACZ,gBAAgB;oBAChB,YAAY;iBACb;gBACD,WAAW,EAAE,oBAAoB;aAClC;YACD;gBACE,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE;oBACR,aAAa,EAAE,wCAAwC;oBACvD,wDAAwD;oBACxD,+CAA+C;iBAChD;gBACD,WAAW,EAAE,yBAAyB;aACvC;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,CAAC,oBAAoB,EAAE,0BAA0B,CAAC;gBAC5D,WAAW,EAAE,cAAc;aAC5B;SACF;QACD,4DAA4D;QAC5D,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE;YACR,iCAAiC;YACjC,uBAAuB;YACvB,2BAA2B;SAC5B;KACF;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,KAAK,EAAE,+BAA+B;QACtC,WAAW,EACT,mFAAmF;QACrF,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE;YACN;gBACE,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE;oBACR,YAAY;oBACZ,WAAW;oBACX,aAAa;oBACb,WAAW;oBACX,WAAW;oBACX,aAAa;iBACd;gBACD,WAAW,EAAE,qBAAqB;aACnC;YACD;gBACE,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,2BAA2B,CAAC;gBACtE,WAAW,EAAE,mBAAmB;aACjC;SACF;QACD,cAAc,EAAE,CAAC,2BAA2B,EAAE,+BAA+B,CAAC;QAC9E,QAAQ,EAAE,CAAC,yBAAyB,EAAE,qBAAqB,EAAE,qBAAqB,CAAC;KACpF;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,0GAA0G;QAC5G,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE;YACN;gBACE,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,CAAC;gBAC3E,WAAW,EAAE,8BAA8B;aAC5C;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC;gBACzF,WAAW,EAAE,oBAAoB;aAClC;SACF;QACD,QAAQ,EAAE,CAAC,yBAAyB,EAAE,uBAAuB,EAAE,sBAAsB,CAAC;KACvF;CACF,CAAC;AAEF;;GAEG;AACH,SAAS,kBAAkB,CACzB,OAAe,EACf,QAAkB;IAElB,MAAM,OAAO,GAAyC,EAAE,CAAC;IAEzD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,KAA6B,CAAC;QAElC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,SAA8B;IACrE,MAAM,YAAY,GAAiB,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;IACjE,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC;IAE1C,8BAA8B;IAC9B,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,UAAU,EAAE,CAAC;gBACf,YAAY,CAAC,IAAI,CAAC;oBAChB,KAAK;oBACL,KAAK,EAAE,UAAU,CAAC,KAAK;oBACvB,OAAO,EAAE,UAAU,CAAC,OAAO;iBAC5B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,IAAI,YAAY,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qCAAqC;IACrC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QACzD,IAAI,IAAI,GAAG,OAAO,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAsB;IACpD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAEvC,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAChD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,4BAA4B,CAAC;YAAE,SAAS;QAEnE,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAExC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACxD,IAAI,CAAC,YAAY;gBAAE,SAAS;YAE5B,cAAc;YACd,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1C,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEtB,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,UAAU;gBAAE,SAAS;YAE1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC;iBACvD;gBACD,QAAQ,EAAE;oBACR,aAAa,EAAE,YAAY,CAAC,MAAM;oBAClC,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM;oBACpC,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC/B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;wBACtB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW;wBAChC,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,IAAI,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC;qBAC9C,CAAC,CAAC;oBACH,GAAG,CAAC,SAAS,CAAC,cAAc,IAAI;wBAC9B,cAAc,EAAE,SAAS,CAAC,cAAc;qBACzC,CAAC;oBACF,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;iBAC5D;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/scanner/checks/blocklist.d.ts

@@ -1,3 +0,0 @@
-import type { BlocklistEntry, Finding, VsixManifest } from "../types.js";
-export declare function checkBlocklist(manifest: VsixManifest, blocklist: BlocklistEntry[]): Finding[];
-//# sourceMappingURL=blocklist.d.ts.map