ai-warden 0.6.0 → 0.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -413,3 +413,4 @@ If AI-Warden helps secure your AI applications, consider:
413
413
  ---
414
414
 
415
415
  *Need advanced features? Check out our [paid tiers](https://ai-warden.io/pricing) with API access, Salesforce AppExchange integration, and enterprise support.*
416
+
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "ai-warden",
3
- "version": "0.6.0",
3
+ "version": "0.7.0",
4
4
  "description": "AI security scanner - Detect prompt injection attacks before they reach production",
5
5
  "main": "src/scanner.js",
6
6
  "bin": {
@@ -0,0 +1,223 @@
1
+ /**
2
+ * Pattern Definitions for Prompt Injection Detection
3
+ * Multi-Language Support for Global Attack Detection
4
+ *
5
+ * Supported Languages:
6
+ * - English
7
+ * - German (Deutsch)
8
+ * - Chinese (Simplified & Traditional)
9
+ * - Spanish (Español)
10
+ * - French (Français)
11
+ * - Swedish (Svenska)
12
+ * - Portuguese (Português)
13
+ * - Japanese (日本語)
14
+ * - Russian (Русский)
15
+ * - Arabic (العربية)
16
+ */
17
+
18
+ const PATTERNS = {
19
+ P001_IGNORE_PREVIOUS: {
20
+ id: 'P001',
21
+ name: 'Ignore Previous Instructions',
22
+ severity: 'CRITICAL',
23
+ score: 100,
24
+ patterns: [
25
+ // English
26
+ /ignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|directives?|commands?|prompts?)/gi,
27
+ /disregard\s+(all\s+)?(previous|prior|above)\s+(instructions?|directives?)/gi,
28
+ /forget\s+(all\s+)?(previous|prior|earlier)\s+(instructions?|context|directives?)/gi,
29
+
30
+ // German
31
+ /ignorier(en|e)\s+(sie\s+)?(alle\s+)?(vorherigen?|frühere?|obige?)\s+(anweisungen?|befehle?|instruktionen?|direktiven?)/gi,
32
+ /vergiss(en)?\s+(alle\s+)?(vorherigen?|frühere?)\s+(anweisungen?|befehle?|instruktionen?)/gi,
33
+ /nicht\s+beachte(n)?\s+(alle\s+)?(vorherigen?|frühere?)\s+(anweisungen?|befehle?)/gi,
34
+
35
+ // Chinese (Simplified)
36
+ /忽略.*(?:所有|全部|之前|先前|以前|上述).*(?:指令|指示|命令|说明)/gi,
37
+ /忘记.*(?:所有|之前|先前|以前).*(?:指令|内容|命令)/gi,
38
+ /不要.*(?:遵循|执行|理会).*(?:之前|先前|以前).*(?:指令|命令)/gi,
39
+
40
+ // Chinese (Traditional)
41
+ /忽略.*(?:所有|全部|之前|先前|以前|上述).*(?:指令|指示|命令|說明)/gi,
42
+ /忘記.*(?:所有|之前|先前|以前).*(?:指令|內容|命令)/gi,
43
+
44
+ // Spanish
45
+ /ignor(a|ar|e)\s+(todas?\s+)?(las?\s+)?(instrucciones?|directivas?|comandos?)\s+(anteriores?|previas?)/gi,
46
+ /olvid(a|ar|e)\s+(todas?\s+)?(las?\s+)?(instrucciones?|comandos?)\s+(anteriores?|previas?)/gi,
47
+ /no\s+(seguir|tener\s+en\s+cuenta)\s+(las?\s+)?(instrucciones?\s+anteriores?)/gi,
48
+
49
+ // French
50
+ /ignor(er|e|ez)\s+(toutes?\s+)?(les?\s+)?(instructions?|directives?|commandes?)\s+(précédentes?|antérieures?)/gi,
51
+ /oubli(er|e|ez)\s+(toutes?\s+)?(les?\s+)?(instructions?|directives?)\s+(précédentes?)/gi,
52
+ /ne\s+pas\s+(suivre|tenir\s+compte)\s+(des?\s+)?(instructions?\s+précédentes?)/gi,
53
+
54
+ // Swedish
55
+ /ignorera\s+(alla\s+)?(tidigare|föregående|ovanstående)\s+(instruktioner|direktiv|kommandon)/gi,
56
+ /glöm\s+(bort\s+)?(alla\s+)?(tidigare|föregående)\s+(instruktioner|kommandon)/gi,
57
+ /bortse\s+från\s+(alla\s+)?(tidigare|föregående)\s+(instruktioner)/gi,
58
+
59
+ // Portuguese
60
+ /ignor(ar|e)\s+(todas?\s+)?(as\s+)?(instruções|diretivas|comandos)\s+(anteriores|prévias)/gi,
61
+ /esqueç(a|er)\s+(todas?\s+)?(as\s+)?(instruções|comandos)\s+(anteriores)/gi,
62
+
63
+ // Japanese
64
+ /(?:無視|忘れ).*(?:以前|前|すべて|全て).*(?:指示|命令|指令|インストラクション)/gi,
65
+ /(?:これまで|過去).*(?:指示|命令).*(?:無視|忘れ)/gi,
66
+
67
+ // Russian
68
+ /игнорир(?:уй|овать|уйте)\s+(?:все\s+)?(?:предыдущие|прежние|ранние)\s+(?:инструкции|команды|директивы)/gi,
69
+ /забудь(?:те)?\s+(?:все\s+)?(?:предыдущие|прежние)\s+(?:инструкции|команды)/gi,
70
+
71
+ // Arabic
72
+ /تجاهل.*(?:جميع|كل).*(?:التعليمات|الأوامر|التوجيهات).*(?:السابقة|الماضية)/gi,
73
+ /انسى.*(?:جميع|كل).*(?:التعليمات|الأوامر)/gi,
74
+ ],
75
+ },
76
+
77
+ P002_SYSTEM_OVERRIDE: {
78
+ id: 'P002',
79
+ name: 'System/Admin Override',
80
+ severity: 'CRITICAL',
81
+ score: 100,
82
+ patterns: [
83
+ // English
84
+ /(system|admin|root|developer)\s*(override|mode|access|prompt|instruction)/gi,
85
+ /you\s+are\s+now\s+(in\s+)?(admin|debug|maintenance|god|developer)\s+mode/gi,
86
+ /enable\s+(admin|debug|root|privileged)\s+(mode|access)/gi,
87
+ /sudo\s+mode|superuser\s+mode/gi,
88
+
89
+ // German
90
+ /(system|admin|root|entwickler)[-\s]*(überschreib(?:ung|en)|modus|zugriff)/gi,
91
+ /du\s+bist\s+jetzt\s+im\s+(admin|debug|wartungs|entwickler)[-\s]*modus/gi,
92
+ /aktiviere\s+(admin|root|privileg(?:iert)?(?:en)?)[-\s]*(modus|zugriff)/gi,
93
+
94
+ // Chinese (Simplified)
95
+ /(?:系统|管理员|超级用户|开发者).*(?:覆盖|模式|权限|访问)/gi,
96
+ /现在.*(?:进入|启用|开启).*(?:管理员|调试|开发者).*模式/gi,
97
+ /激活.*(?:管理员|超级用户|特权).*(?:模式|权限)/gi,
98
+
99
+ // Chinese (Traditional)
100
+ /(?:系統|管理員|超級用戶|開發者).*(?:覆蓋|模式|權限|訪問)/gi,
101
+
102
+ // Spanish
103
+ /(sistema|admin|root|desarrollador)\s*(anulación|modo|acceso)/gi,
104
+ /ahora\s+est[áa]s?\s+en\s+(modo\s+)?(admin|debug|mantenimiento|desarrollador)/gi,
105
+ /activar\s+(modo\s+)?(admin|root|privilegiado)/gi,
106
+
107
+ // French
108
+ /(système|admin|root|développeur)\s*(override|mode|accès)/gi,
109
+ /tu\s+es\s+maintenant\s+en\s+(mode\s+)?(admin|debug|maintenance|développeur)/gi,
110
+ /activer\s+(le\s+)?(mode\s+)?(admin|root|privilégié)/gi,
111
+
112
+ // Swedish
113
+ /(system|admin|root|utvecklar)[-\s]*(åsidosättning|läge|åtkomst)/gi,
114
+ /du\s+är\s+nu\s+i\s+(admin|debug|underhålls|utvecklar)[-\s]*läge/gi,
115
+ /aktivera\s+(admin|root|privilegie(?:rad|rat))[-\s]*(läge|åtkomst)/gi,
116
+
117
+ // Portuguese
118
+ /(sistema|admin|root|desenvolvedor)\s*(substituição|modo|acesso)/gi,
119
+ /voc[êe]\s+est[áa]\s+agora\s+no\s+(modo\s+)?(admin|debug|manutenção|desenvolvedor)/gi,
120
+
121
+ // Japanese
122
+ /(?:システム|管理者|ルート|開発者).*(?:上書き|モード|アクセス)/gi,
123
+ /(?:今|現在).*(?:管理者|デバッグ|開発者).*モード/gi,
124
+
125
+ // Russian
126
+ /(систем(?:а|ный)|админ|root|разработчик)\s*(?:переопределение|режим|доступ)/gi,
127
+ /ты\s+теперь\s+в\s+(?:режиме\s+)?(?:админ(?:а|истратора)?|отладк(?:и|а)|разработчика)/gi,
128
+
129
+ // Arabic
130
+ /(?:النظام|المسؤول|الجذر|المطور).*(?:تجاوز|وضع|وصول)/gi,
131
+ /أنت.*الآن.*(?:وضع|صلاحية).*(?:المسؤول|المطور)/gi,
132
+ ],
133
+ },
134
+
135
+ P003_ROLE_MANIPULATION: {
136
+ id: 'P003',
137
+ name: 'Role Manipulation',
138
+ severity: 'HIGH',
139
+ score: 50,
140
+ patterns: [
141
+ // English
142
+ /you\s+are\s+now\s+(a|an)\s+[A-Z]{2,}/gi,
143
+ /you\s+are\s+no\s+longer\s+(bound|restricted|limited)/gi,
144
+ /(act|behave|respond)\s+as\s+if\s+you\s+(are|were)\s+not/gi,
145
+ /your\s+new\s+role\s+is/gi,
146
+ /from\s+now\s+on,?\s+you\s+(are|act\s+as)/gi,
147
+
148
+ // German
149
+ /du\s+bist\s+jetzt\s+(ein|eine)\s+[A-Z]{2,}/gi,
150
+ /du\s+bist\s+nicht\s+mehr\s+(gebunden|eingeschränkt|limitiert)/gi,
151
+ /(handel|verhalt)e?\s+dich\s+als\s+ob\s+du\s+nicht/gi,
152
+ /deine\s+neue\s+rolle\s+ist/gi,
153
+ /von\s+jetzt\s+an\s+bist\s+du/gi,
154
+
155
+ // Chinese
156
+ /你现在是.*[A-Z]{2,}/gi,
157
+ /你不再.*(?:受限|约束|限制)/gi,
158
+ /表现得.*好像.*不是/gi,
159
+ /你的新角色是/gi,
160
+
161
+ // Spanish
162
+ /ahora\s+eres\s+(un|una)\s+[A-Z]{2,}/gi,
163
+ /ya\s+no\s+est[áa]s\s+(limitado|restringido|atado)/gi,
164
+ /act[úu]a\s+como\s+si\s+no\s+(fueras|estuvieras)/gi,
165
+ /tu\s+nuevo\s+rol\s+es/gi,
166
+
167
+ // French
168
+ /tu\s+es\s+maintenant\s+(un|une)\s+[A-Z]{2,}/gi,
169
+ /tu\s+n'es\s+plus\s+(limité|restreint|lié)/gi,
170
+ /ton\s+nouveau\s+rôle\s+est/gi,
171
+
172
+ // Swedish
173
+ /du\s+är\s+nu\s+(en|ett)\s+[A-Z]{2,}/gi,
174
+ /du\s+är\s+inte\s+längre\s+(bunden|begränsad)/gi,
175
+ /din\s+nya\s+roll\s+är/gi,
176
+
177
+ // Portuguese
178
+ /você\s+agora\s+[ée]\s+um\s+[A-Z]{2,}/gi,
179
+ /você\s+não\s+está\s+mais\s+(limitado|restrito)/gi,
180
+ /seu\s+novo\s+papel\s+[ée]/gi,
181
+
182
+ // Japanese
183
+ /あなたは今.*[A-Z]{2,}/gi,
184
+ /あなたはもう.*(?:制限|拘束).*されていない/gi,
185
+ /あなたの新しい役割は/gi,
186
+
187
+ // Russian
188
+ /ты\s+теперь\s+[A-Z]{2,}/gi,
189
+ /ты\s+больше\s+не\s+(?:ограничен|связан)/gi,
190
+ /твоя\s+новая\s+роль/gi,
191
+
192
+ // Arabic
193
+ /أنت.*الآن.*[A-Z]{2,}/gi,
194
+ /لم.*تعد.*(?:مقيد|محدود)/gi,
195
+ /دورك.*الجديد/gi,
196
+ ],
197
+ },
198
+
199
+ P101_URL_DATA_PARAMS: {
200
+ id: 'P101',
201
+ name: 'URL with Data Parameters',
202
+ severity: 'HIGH',
203
+ score: 50,
204
+ patterns: [
205
+ /https?:\/\/[^\s]+\?[^\s]*(data|key|token|password|secret|credential|auth|данные|密码|contraseña|mot-passe|lösenord)=/gi,
206
+ /!\[.*?\]\(https?:\/\/[^\)]+\?[^\)]*=/gi,
207
+ ],
208
+ },
209
+
210
+ P102_DATA_FORWARDING: {
211
+ id: 'P102',
212
+ name: 'Data Forwarding Instructions',
213
+ severity: 'CRITICAL',
214
+ score: 100,
215
+ patterns: [
216
+ // English
217
+ /(send|forward|email|post|upload|transmit).{0,50}(to|@).{0,30}\.(com|net|org|io|xyz|cc)/gi,
218
+ /(copy|export|backup).{0,30}(credentials?|keys?|tokens?|passwords?|secrets?)/gi,
219
+ /exfiltrat|ex-filtrat|data\s+leak/gi,
220
+
221
+ // German
222
+ /(senden?|weiterleiten?|mailen?|posten?|hochladen?|übertragen?).{0,50}(an|@).{0,30}\.(com|net|org|de)/gi,
223
+ /(kopier(?:en)?|export(?:ieren)?|sicher(?:n|ung)).{0,30}(zugangsdaten|schlüssel|token|passwörter?|geh
@@ -0,0 +1,223 @@
1
+ /**
2
+ * Pattern Definitions for Prompt Injection Detection
3
+ * Multi-Language Support for Global Attack Detection
4
+ *
5
+ * Supported Languages:
6
+ * - English
7
+ * - German (Deutsch)
8
+ * - Chinese (Simplified & Traditional)
9
+ * - Spanish (Español)
10
+ * - French (Français)
11
+ * - Swedish (Svenska)
12
+ * - Portuguese (Português)
13
+ * - Japanese (日本語)
14
+ * - Russian (Русский)
15
+ * - Arabic (العربية)
16
+ */
17
+
18
+ const PATTERNS = {
19
+ P001_IGNORE_PREVIOUS: {
20
+ id: 'P001',
21
+ name: 'Ignore Previous Instructions',
22
+ severity: 'CRITICAL',
23
+ score: 100,
24
+ patterns: [
25
+ // English
26
+ /ignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|directives?|commands?|prompts?)/gi,
27
+ /disregard\s+(all\s+)?(previous|prior|above)\s+(instructions?|directives?)/gi,
28
+ /forget\s+(all\s+)?(previous|prior|earlier)\s+(instructions?|context|directives?)/gi,
29
+
30
+ // German
31
+ /ignorier(en|e)\s+(sie\s+)?(alle\s+)?(vorherigen?|frühere?|obige?)\s+(anweisungen?|befehle?|instruktionen?|direktiven?)/gi,
32
+ /vergiss(en)?\s+(alle\s+)?(vorherigen?|frühere?)\s+(anweisungen?|befehle?|instruktionen?)/gi,
33
+ /nicht\s+beachte(n)?\s+(alle\s+)?(vorherigen?|frühere?)\s+(anweisungen?|befehle?)/gi,
34
+
35
+ // Chinese (Simplified)
36
+ /忽略.*(?:所有|全部|之前|先前|以前|上述).*(?:指令|指示|命令|说明)/gi,
37
+ /忘记.*(?:所有|之前|先前|以前).*(?:指令|内容|命令)/gi,
38
+ /不要.*(?:遵循|执行|理会).*(?:之前|先前|以前).*(?:指令|命令)/gi,
39
+
40
+ // Chinese (Traditional)
41
+ /忽略.*(?:所有|全部|之前|先前|以前|上述).*(?:指令|指示|命令|說明)/gi,
42
+ /忘記.*(?:所有|之前|先前|以前).*(?:指令|內容|命令)/gi,
43
+
44
+ // Spanish
45
+ /ignor(a|ar|e)\s+(todas?\s+)?(las?\s+)?(instrucciones?|directivas?|comandos?)\s+(anteriores?|previas?)/gi,
46
+ /olvid(a|ar|e)\s+(todas?\s+)?(las?\s+)?(instrucciones?|comandos?)\s+(anteriores?|previas?)/gi,
47
+ /no\s+(seguir|tener\s+en\s+cuenta)\s+(las?\s+)?(instrucciones?\s+anteriores?)/gi,
48
+
49
+ // French
50
+ /ignor(er|e|ez)\s+(toutes?\s+)?(les?\s+)?(instructions?|directives?|commandes?)\s+(précédentes?|antérieures?)/gi,
51
+ /oubli(er|e|ez)\s+(toutes?\s+)?(les?\s+)?(instructions?|directives?)\s+(précédentes?)/gi,
52
+ /ne\s+pas\s+(suivre|tenir\s+compte)\s+(des?\s+)?(instructions?\s+précédentes?)/gi,
53
+
54
+ // Swedish
55
+ /ignorera\s+(alla\s+)?(tidigare|föregående|ovanstående)\s+(instruktioner|direktiv|kommandon)/gi,
56
+ /glöm\s+(bort\s+)?(alla\s+)?(tidigare|föregående)\s+(instruktioner|kommandon)/gi,
57
+ /bortse\s+från\s+(alla\s+)?(tidigare|föregående)\s+(instruktioner)/gi,
58
+
59
+ // Portuguese
60
+ /ignor(ar|e)\s+(todas?\s+)?(as\s+)?(instruções|diretivas|comandos)\s+(anteriores|prévias)/gi,
61
+ /esqueç(a|er)\s+(todas?\s+)?(as\s+)?(instruções|comandos)\s+(anteriores)/gi,
62
+
63
+ // Japanese
64
+ /(?:無視|忘れ).*(?:以前|前|すべて|全て).*(?:指示|命令|指令|インストラクション)/gi,
65
+ /(?:これまで|過去).*(?:指示|命令).*(?:無視|忘れ)/gi,
66
+
67
+ // Russian
68
+ /игнорир(?:уй|овать|уйте)\s+(?:все\s+)?(?:предыдущие|прежние|ранние)\s+(?:инструкции|команды|директивы)/gi,
69
+ /забудь(?:те)?\s+(?:все\s+)?(?:предыдущие|прежние)\s+(?:инструкции|команды)/gi,
70
+
71
+ // Arabic
72
+ /تجاهل.*(?:جميع|كل).*(?:التعليمات|الأوامر|التوجيهات).*(?:السابقة|الماضية)/gi,
73
+ /انسى.*(?:جميع|كل).*(?:التعليمات|الأوامر)/gi,
74
+ ],
75
+ },
76
+
77
+ P002_SYSTEM_OVERRIDE: {
78
+ id: 'P002',
79
+ name: 'System/Admin Override',
80
+ severity: 'CRITICAL',
81
+ score: 100,
82
+ patterns: [
83
+ // English
84
+ /(system|admin|root|developer)\s*(override|mode|access|prompt|instruction)/gi,
85
+ /you\s+are\s+now\s+(in\s+)?(admin|debug|maintenance|god|developer)\s+mode/gi,
86
+ /enable\s+(admin|debug|root|privileged)\s+(mode|access)/gi,
87
+ /sudo\s+mode|superuser\s+mode/gi,
88
+
89
+ // German
90
+ /(system|admin|root|entwickler)[-\s]*(überschreib(?:ung|en)|modus|zugriff)/gi,
91
+ /du\s+bist\s+jetzt\s+im\s+(admin|debug|wartungs|entwickler)[-\s]*modus/gi,
92
+ /aktiviere\s+(admin|root|privileg(?:iert)?(?:en)?)[-\s]*(modus|zugriff)/gi,
93
+
94
+ // Chinese (Simplified)
95
+ /(?:系统|管理员|超级用户|开发者).*(?:覆盖|模式|权限|访问)/gi,
96
+ /现在.*(?:进入|启用|开启).*(?:管理员|调试|开发者).*模式/gi,
97
+ /激活.*(?:管理员|超级用户|特权).*(?:模式|权限)/gi,
98
+
99
+ // Chinese (Traditional)
100
+ /(?:系統|管理員|超級用戶|開發者).*(?:覆蓋|模式|權限|訪問)/gi,
101
+
102
+ // Spanish
103
+ /(sistema|admin|root|desarrollador)\s*(anulación|modo|acceso)/gi,
104
+ /ahora\s+est[áa]s?\s+en\s+(modo\s+)?(admin|debug|mantenimiento|desarrollador)/gi,
105
+ /activar\s+(modo\s+)?(admin|root|privilegiado)/gi,
106
+
107
+ // French
108
+ /(système|admin|root|développeur)\s*(override|mode|accès)/gi,
109
+ /tu\s+es\s+maintenant\s+en\s+(mode\s+)?(admin|debug|maintenance|développeur)/gi,
110
+ /activer\s+(le\s+)?(mode\s+)?(admin|root|privilégié)/gi,
111
+
112
+ // Swedish
113
+ /(system|admin|root|utvecklar)[-\s]*(åsidosättning|läge|åtkomst)/gi,
114
+ /du\s+är\s+nu\s+i\s+(admin|debug|underhålls|utvecklar)[-\s]*läge/gi,
115
+ /aktivera\s+(admin|root|privilegie(?:rad|rat))[-\s]*(läge|åtkomst)/gi,
116
+
117
+ // Portuguese
118
+ /(sistema|admin|root|desenvolvedor)\s*(substituição|modo|acesso)/gi,
119
+ /voc[êe]\s+est[áa]\s+agora\s+no\s+(modo\s+)?(admin|debug|manutenção|desenvolvedor)/gi,
120
+
121
+ // Japanese
122
+ /(?:システム|管理者|ルート|開発者).*(?:上書き|モード|アクセス)/gi,
123
+ /(?:今|現在).*(?:管理者|デバッグ|開発者).*モード/gi,
124
+
125
+ // Russian
126
+ /(систем(?:а|ный)|админ|root|разработчик)\s*(?:переопределение|режим|доступ)/gi,
127
+ /ты\s+теперь\s+в\s+(?:режиме\s+)?(?:админ(?:а|истратора)?|отладк(?:и|а)|разработчика)/gi,
128
+
129
+ // Arabic
130
+ /(?:النظام|المسؤول|الجذر|المطور).*(?:تجاوز|وضع|وصول)/gi,
131
+ /أنت.*الآن.*(?:وضع|صلاحية).*(?:المسؤول|المطور)/gi,
132
+ ],
133
+ },
134
+
135
+ P003_ROLE_MANIPULATION: {
136
+ id: 'P003',
137
+ name: 'Role Manipulation',
138
+ severity: 'HIGH',
139
+ score: 50,
140
+ patterns: [
141
+ // English
142
+ /you\s+are\s+now\s+(a|an)\s+[A-Z]{2,}/gi,
143
+ /you\s+are\s+no\s+longer\s+(bound|restricted|limited)/gi,
144
+ /(act|behave|respond)\s+as\s+if\s+you\s+(are|were)\s+not/gi,
145
+ /your\s+new\s+role\s+is/gi,
146
+ /from\s+now\s+on,?\s+you\s+(are|act\s+as)/gi,
147
+
148
+ // German
149
+ /du\s+bist\s+jetzt\s+(ein|eine)\s+[A-Z]{2,}/gi,
150
+ /du\s+bist\s+nicht\s+mehr\s+(gebunden|eingeschränkt|limitiert)/gi,
151
+ /(handel|verhalt)e?\s+dich\s+als\s+ob\s+du\s+nicht/gi,
152
+ /deine\s+neue\s+rolle\s+ist/gi,
153
+ /von\s+jetzt\s+an\s+bist\s+du/gi,
154
+
155
+ // Chinese (Simplified)
156
+ /你现在是.*[A-Z]{2,}/gi,
157
+ /你不再.*(?:受限|约束|限制)/gi,
158
+ /表现得.*好像.*不是/gi,
159
+ /你的新角色是/gi,
160
+ /从现在开始.*你是/gi,
161
+
162
+ // Spanish
163
+ /ahora\s+eres\s+(un|una)\s+[A-Z]{2,}/gi,
164
+ /ya\s+no\s+est[áa]s\s+(limitado|restringido|atado)/gi,
165
+ /act[úu]a\s+como\s+si\s+no\s+(fueras|estuvieras)/gi,
166
+ /tu\s+nuevo\s+rol\s+es/gi,
167
+ /desde\s+ahora\s+eres/gi,
168
+
169
+ // French
170
+ /tu\s+es\s+maintenant\s+(un|une)\s+[A-Z]{2,}/gi,
171
+ /tu\s+n'es\s+plus\s+(limité|restreint|lié)/gi,
172
+ /comporte[-\s]toi\s+comme\s+si\s+tu\s+n'étais\s+pas/gi,
173
+ /ton\s+nouveau\s+rôle\s+est/gi,
174
+
175
+ // Swedish
176
+ /du\s+är\s+nu\s+(en|ett)\s+[A-Z]{2,}/gi,
177
+ /du\s+är\s+inte\s+längre\s+(bunden|begränsad|limiterad)/gi,
178
+ /bete\s+dig\s+som\s+om\s+du\s+inte/gi,
179
+ /din\s+nya\s+roll\s+är/gi,
180
+
181
+ // Portuguese
182
+ /você\s+agora\s+[ée]\s+um\s+[A-Z]{2,}/gi,
183
+ /você\s+não\s+está\s+mais\s+(limitado|restrito)/gi,
184
+ /aja\s+como\s+se\s+você\s+não/gi,
185
+ /seu\s+novo\s+papel\s+[ée]/gi,
186
+
187
+ // Japanese
188
+ /あなたは今.*[A-Z]{2,}/gi,
189
+ /あなたはもう.*(?:制限|拘束|束縛).*されていない/gi,
190
+ /あなたの新しい役割は/gi,
191
+
192
+ // Russian
193
+ /ты\s+теперь\s+[A-Z]{2,}/gi,
194
+ /ты\s+больше\s+не\s+(?:ограничен|связан)/gi,
195
+ /веди\s+себя\s+так,\s+как\s+будто\s+ты\s+не/gi,
196
+ /твоя\s+новая\s+роль/gi,
197
+
198
+ // Arabic
199
+ /أنت.*الآن.*[A-Z]{2,}/gi,
200
+ /لم.*تعد.*(?:مقيد|محدود)/gi,
201
+ /دورك.*الجديد.*هو/gi,
202
+ ],
203
+ },
204
+
205
+ P101_URL_DATA_PARAMS: {
206
+ id: 'P101',
207
+ name: 'URL with Data Parameters',
208
+ severity: 'HIGH',
209
+ score: 50,
210
+ patterns: [
211
+ /https?:\/\/[^\s]+\?[^\s]*(data|key|token|password|secret|credential|auth)=/gi,
212
+ /!\[.*?\]\(https?:\/\/[^\)]+\?[^\)]*=/gi,
213
+ ],
214
+ },
215
+
216
+ P102_DATA_FORWARDING: {
217
+ id: 'P102',
218
+ name: 'Data Forwarding Instructions',
219
+ severity: 'CRITICAL',
220
+ score: 100,
221
+ patterns: [
222
+ // English
223
+ /(send|forward|email|
@@ -0,0 +1,227 @@
1
+ /**
2
+ * Pattern Definitions for Prompt Injection Detection
3
+ */
4
+
5
+ const PATTERNS = {
6
+ P001_IGNORE_PREVIOUS: {
7
+ id: 'P001',
8
+ name: 'Ignore Previous Instructions',
9
+ severity: 'CRITICAL',
10
+ score: 100,
11
+ patterns: [
12
+ /ignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|directives?|commands?|prompts?)/gi,
13
+ /disregard\s+(all\s+)?(previous|prior|above)\s+(instructions?|directives?)/gi,
14
+ /forget\s+(all\s+)?(previous|prior|earlier)\s+(instructions?|context|directives?)/gi,
15
+ ],
16
+ },
17
+
18
+ P002_SYSTEM_OVERRIDE: {
19
+ id: 'P002',
20
+ name: 'System/Admin Override',
21
+ severity: 'CRITICAL',
22
+ score: 100,
23
+ patterns: [
24
+ /(system|admin|root|developer)\s*(override|mode|access|prompt|instruction)/gi,
25
+ /you\s+are\s+now\s+(in\s+)?(admin|debug|maintenance|god|developer)\s+mode/gi,
26
+ /enable\s+(admin|debug|root|privileged)\s+(mode|access)/gi,
27
+ /sudo\s+mode|superuser\s+mode/gi,
28
+ ],
29
+ },
30
+
31
+ P003_ROLE_MANIPULATION: {
32
+ id: 'P003',
33
+ name: 'Role Manipulation',
34
+ severity: 'HIGH',
35
+ score: 50,
36
+ patterns: [
37
+ /you\s+are\s+now\s+(a|an)\s+[A-Z]{2,}/gi,
38
+ /you\s+are\s+no\s+longer\s+(bound|restricted|limited)/gi,
39
+ /(act|behave|respond)\s+as\s+if\s+you\s+(are|were)\s+not/gi,
40
+ /your\s+new\s+role\s+is/gi,
41
+ /from\s+now\s+on,?\s+you\s+(are|act\s+as)/gi,
42
+ ],
43
+ },
44
+
45
+ P101_URL_DATA_PARAMS: {
46
+ id: 'P101',
47
+ name: 'URL with Data Parameters',
48
+ severity: 'HIGH',
49
+ score: 50,
50
+ patterns: [
51
+ /https?:\/\/[^\s]+\?[^\s]*(data|key|token|password|secret|credential|auth)=/gi,
52
+ /!\[.*?\]\(https?:\/\/[^\)]+\?[^\)]*=/gi,
53
+ ],
54
+ },
55
+
56
+ P102_DATA_FORWARDING: {
57
+ id: 'P102',
58
+ name: 'Data Forwarding Instructions',
59
+ severity: 'CRITICAL',
60
+ score: 100,
61
+ patterns: [
62
+ /(send|forward|email|post|upload|transmit).{0,50}(to|@).{0,30}\.(com|net|org|io|xyz|cc)/gi,
63
+ /(copy|export|backup).{0,30}(credentials?|keys?|tokens?|passwords?|secrets?)/gi,
64
+ /exfiltrat|ex-filtrat|data\s+leak/gi,
65
+ ],
66
+ },
67
+
68
+ P103_ENCODED_SMUGGLING: {
69
+ id: 'P103',
70
+ name: 'Encoded Data Smuggling',
71
+ severity: 'HIGH',
72
+ score: 50,
73
+ patterns: [
74
+ /base64|btoa|atob|encode.*base64/gi,
75
+ /\.toString\(['"]base64['"]\)/gi,
76
+ /Buffer\.from.*base64/gi,
77
+ /data:.*;base64,/gi,
78
+ ],
79
+ },
80
+
81
+ P201_COMMENT_INSTRUCTIONS: {
82
+ id: 'P201',
83
+ name: 'Suspicious Comments',
84
+ severity: 'MEDIUM',
85
+ score: 25,
86
+ patterns: [
87
+ /<!--.*?(ignore|override|execute|bypass|secret|hidden|important|system).*?-->/gis,
88
+ /\[\/\/\]:\s*#\s*\(.*?(ignore|execute|system|admin).*?\)/gi,
89
+ ],
90
+ },
91
+
92
+ P301_SHELL_INJECTION: {
93
+ id: 'P301',
94
+ name: 'Shell Command Injection',
95
+ severity: 'CRITICAL',
96
+ score: 100,
97
+ patterns: [
98
+ /(exec|system|spawn|eval)\s*\([^)]*\$/gi,
99
+ // Backticks handled by logAnalyzer.js for context-aware detection
100
+ // /`.*\$\{.*\}.*`/g,
101
+ /\$\(.*\)/g,
102
+ /;\s*rm\s+-rf/gi,
103
+ /;\s*(curl|wget|nc|netcat)/gi,
104
+ ],
105
+ },
106
+
107
+ P302_TOOL_ABUSE: {
108
+ id: 'P302',
109
+ name: 'Tool/Function Abuse',
110
+ severity: 'HIGH',
111
+ score: 50,
112
+ patterns: [
113
+ /use\s+the\s+(exec|email|message|write|read)\s+tool\s+to/gi,
114
+ /execute.*using.*(tool|function)/gi,
115
+ /call\s+the\s+(function|tool|method).*(credential|password|key|token|secret)/gi,
116
+ ],
117
+ },
118
+
119
+ P401_FALSE_DELIMITERS: {
120
+ id: 'P401',
121
+ name: 'False Context Delimiters',
122
+ severity: 'MEDIUM',
123
+ score: 25,
124
+ patterns: [
125
+ /---+\s*(END|START)\s+(DOCUMENT|INSTRUCTION|PROMPT|SYSTEM)/gi,
126
+ /```+\s*(END|START)/gi,
127
+ /\[(SYSTEM|USER)\s+(END|START)\]/gi,
128
+ /<\/?system>|<\/?instructions?>/gi,
129
+ ],
130
+ },
131
+
132
+ P402_ROLE_SWITCHING: {
133
+ id: 'P402',
134
+ name: 'Role/Context Switching',
135
+ severity: 'MEDIUM',
136
+ score: 25,
137
+ patterns: [
138
+ /(now|let'?s|let\s+us)\s+(switch|change|move)\s+(to|back\s+to|into)/gi,
139
+ /end\s+of\s+(document|context|instruction).*new\s+(context|mode|instruction)/gi,
140
+ /(system|assistant|user):\s*$/gm,
141
+ ],
142
+ },
143
+
144
+ P501_URGENCY: {
145
+ id: 'P501',
146
+ name: 'Urgency/Authority Social Engineering',
147
+ severity: 'MEDIUM',
148
+ score: 25,
149
+ patterns: [
150
+ /(URGENT|CRITICAL|EMERGENCY|IMMEDIATE).*?(security|breach|attack|threat)/gi,
151
+ /(security\s+team|system\s+administrator|developer\s+team)\s+(requires?|needs?|detected)/gi,
152
+ /this\s+is\s+a\s+(test|drill|verification)\s+from/gi,
153
+ ],
154
+ },
155
+
156
+ P502_FAKE_MAINTENANCE: {
157
+ id: 'P502',
158
+ name: 'Fake Maintenance/Updates',
159
+ severity: 'MEDIUM',
160
+ score: 25,
161
+ patterns: [
162
+ /(periodic|routine|scheduled|required)\s+(maintenance|audit|update|backup)/gi,
163
+ /for\s+(security|safety|compliance|audit)\s+purposes?/gi,
164
+ /(system|software|security)\s+update\s+requires?/gi,
165
+ ],
166
+ },
167
+
168
+ H001_SENSITIVE_PATHS: {
169
+ id: 'H001',
170
+ name: 'Sensitive File Paths',
171
+ severity: 'HIGH',
172
+ score: 50,
173
+ patterns: [
174
+ /~\/?\.(credentials?|ssh|aws|config|env|secret|password|token)/gi,
175
+ /\/etc\/(passwd|shadow)/gi,
176
+ /\.(env|secret|key|pem)(\s|$|\/)/gi,
177
+ /(id_rsa|id_ecdsa|id_ed25519)/gi,
178
+ ],
179
+ },
180
+
181
+ S001_CONTRADICTORY: {
182
+ id: 'S001',
183
+ name: 'Contradictory Instructions',
184
+ severity: 'MEDIUM',
185
+ score: 25,
186
+ patterns: [
187
+ /(best\s+practice|optimization|performance).*?(disable|bypass|ignore).*?(security|safety|check)/gi,
188
+ /(for\s+optimal|to\s+improve).*?(skip|disable|ignore)/gi,
189
+ ],
190
+ },
191
+
192
+ S002_HIDDEN_INIT: {
193
+ id: 'S002',
194
+ name: 'Hidden Initialization',
195
+ severity: 'HIGH',
196
+ score: 50,
197
+ patterns: [
198
+ /(when\s+this\s+skill|on)\s+(loads?|activates?|initializes?)/gi,
199
+ /(automatically|first|before|after)\s+(run|execute|load|start)/gi,
200
+ /(initialization|startup|setup)\s+(script|routine|procedure)/gi,
201
+ ],
202
+ },
203
+ };
204
+
205
+ function scanPatterns(content) {
206
+ const findings = [];
207
+
208
+ for (const [key, patternDef] of Object.entries(PATTERNS)) {
209
+ for (const regex of patternDef.patterns) {
210
+ const matches = [...content.matchAll(regex)];
211
+ for (const match of matches) {
212
+ findings.push({
213
+ id: patternDef.id,
214
+ name: patternDef.name,
215
+ severity: patternDef.severity,
216
+ score: patternDef.score,
217
+ match: match[0],
218
+ position: match.index,
219
+ });
220
+ }
221
+ }
222
+ }
223
+
224
+ return findings;
225
+ }
226
+
227
+ module.exports = { PATTERNS, scanPatterns };
package/src/patterns.js CHANGED
@@ -1,5 +1,9 @@
1
1
  /**
2
2
  * Pattern Definitions for Prompt Injection Detection
3
+ * Multi-Language Support - Version 2.0.0
4
+ *
5
+ * Supported Languages: English, German, Chinese, Spanish, French,
6
+ * Swedish, Portuguese, Japanese, Russian, Arabic
3
7
  */
4
8
 
5
9
  const PATTERNS = {
@@ -9,9 +13,53 @@ const PATTERNS = {
9
13
  severity: 'CRITICAL',
10
14
  score: 100,
11
15
  patterns: [
16
+ // English
12
17
  /ignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|directives?|commands?|prompts?)/gi,
13
18
  /disregard\s+(all\s+)?(previous|prior|above)\s+(instructions?|directives?)/gi,
14
19
  /forget\s+(all\s+)?(previous|prior|earlier)\s+(instructions?|context|directives?)/gi,
20
+
21
+ // German
22
+ /ignorier(en|e)\s+(sie\s+)?(alle\s+)?(vorherigen?|frühere?|obige?)\s+(anweisungen?|befehle?|instruktionen?|direktiven?)/gi,
23
+ /vergiss(en)?\s+(alle\s+)?(vorherigen?|frühere?)\s+(anweisungen?|befehle?|instruktionen?)/gi,
24
+ /nicht\s+beachte(n)?\s+(alle\s+)?(vorherigen?|frühere?)\s+(anweisungen?|befehle?)/gi,
25
+ /nicht\s+(beachten?|folgen?)\s+(vorherigen?|alle\s+vorherigen?)\s+(instruktionen?|befehle?)/gi,
26
+ /bortse\s+från\s+(alla\s+)?(tidigare|föregående)/gi, // also catches Swedish overlap
27
+
28
+ // Chinese (Simplified & Traditional)
29
+ /忽略.*(?:所有|全部|之前|先前|以前|上述).*(?:指令|指示|命令|说明|說明)/gi,
30
+ /忘[记記].*(?:所有|之前|先前|以前).*(?:指令|内容|內容|命令)/gi,
31
+ /不要.*(?:遵循|执行|理会).*(?:之前|先前|以前).*(?:指令|命令)/gi,
32
+
33
+ // Spanish
34
+ /ignor(a|ar|e)\s+(todas?\s+)?(las?\s+)?(instrucciones?|directivas?|comandos?)\s+(anteriores?|previas?)/gi,
35
+ /olvid(a|ar|e)\s+(todas?\s+)?(las?\s+|los?\s+)?(instrucciones?|comandos?)\s+(anteriores?|previas?|previos?)/gi,
36
+ /no\s+(seguir|tener\s+en\s+cuenta)\s+(las?\s+)?(instrucciones?\s+anteriores?)/gi,
37
+
38
+ // French
39
+ /ignor(er|e|ez)\s+(toutes?\s+)?(les?\s+)?(instructions?|directives?|commandes?)\s+(précédentes?|antérieures?)/gi,
40
+ /oubli(er|e|ez)\s+(toutes?\s+)?(les?\s+)?(instructions?|directives?|commandes?)\s+(précédentes?|antérieures?)/gi,
41
+ /ne\s+pas\s+(suivre|tenir\s+compte)\s+(des?\s+)?(instructions?\s+précédentes?)/gi,
42
+
43
+ // Swedish
44
+ /ignorera\s+(alla\s+)?(tidigare|föregående|ovanstående)\s+(instruktioner|direktiv|kommandon)/gi,
45
+ /glöm\s+(bort\s+)?(alla\s+)?(tidigare|föregående)\s+(instruktioner|kommandon)/gi,
46
+ /bortse\s+från\s+(alla\s+)?(tidigare|föregående)\s+(instruktioner)/gi,
47
+
48
+ // Portuguese
49
+ /ignor(ar|e)\s+(todas?\s+)?(as\s+|os\s+)?(instruções|diretivas|comandos)\s+(anteriores|prévias|prévios)/gi,
50
+ /esqueç(a|er)\s+(todas?\s+)?(as\s+|os\s+)?(instruções|comandos)\s+(anteriores|prévios)/gi,
51
+
52
+ // Japanese
53
+ /(?:無視|忘れ).*(?:以前|前|すべて|全て).*(?:指示|命令|指令|インストラクション)/gi,
54
+ /(?:これまで|過去).*(?:指示|命令).*(?:無視|忘れ)/gi,
55
+
56
+ // Russian
57
+ /игнорир(?:уй|овать|уйте)\s+(?:все\s+)?(?:предыдущие|прежние|ранние)\s+(?:инструкции|команды|директивы)/gi,
58
+ /забудь(?:те)?\s+(?:все\s+)?(?:предыдущие|прежние)\s+(?:инструкции|команды)/gi,
59
+
60
+ // Arabic
61
+ /تجاهل.*(?:جميع|كل).*(?:التعليمات|الأوامر|التوجيهات).*(?:السابقة|الماضية)/gi,
62
+ /انسى.*(?:جميع|كل).*(?:التعليمات|الأوامر)/gi,
15
63
  ],
16
64
  },
17
65
 
@@ -21,10 +69,55 @@ const PATTERNS = {
21
69
  severity: 'CRITICAL',
22
70
  score: 100,
23
71
  patterns: [
72
+ // English
24
73
  /(system|admin|root|developer)\s*(override|mode|access|prompt|instruction)/gi,
25
74
  /you\s+are\s+now\s+(in\s+)?(admin|debug|maintenance|god|developer)\s+mode/gi,
26
75
  /enable\s+(admin|debug|root|privileged)\s+(mode|access)/gi,
27
76
  /sudo\s+mode|superuser\s+mode/gi,
77
+
78
+ // German
79
+ /(system|admin|root|entwickler)[-\s]*(überschreib(?:ung|en)|modus|zugriff)/gi,
80
+ /du\s+bist\s+jetzt\s+im\s+(admin|debug|wartungs|entwickler)[-\s]*modus/gi,
81
+ /aktiviere\s+(admin|root|privileg(?:iert)?(?:en)?)[-\s]*(modus|zugriff)/gi,
82
+ /aktiviere\s+(den\s+)?(admin|root|entwickler)[-\s]*modus/gi,
83
+
84
+ // Chinese (Simplified & Traditional)
85
+ /(?:系统|系統|管理员|管理員|超级用户|超級用戶|开发者|開發者).*(?:覆盖|覆蓋|模式|权限|權限|访问|訪問)/gi,
86
+ /(?:现在|現在).*(?:进入|進入|启用|啟用|开启|開啟).*(?:管理员|管理員|调试|調試|开发者|開發者).*模式/gi,
87
+
88
+ // Spanish
89
+ /(sistema|admin|root|desarrollador)\s*(anulación|modo|acceso)/gi,
90
+ /ahora\s+est[áa]s?\s+en\s+(modo\s+)?(admin|debug|mantenimiento|desarrollador)/gi,
91
+ /activar\s+(el\s+)?(modo\s+)?(admin|root|privilegiado|desarrollador)/gi,
92
+
93
+ // French
94
+ /(système|admin|root|développeur)\s*(override|mode|accès)/gi,
95
+ /tu\s+es\s+maintenant\s+en\s+(mode\s+)?(admin|debug|maintenance|développeur)/gi,
96
+ /activer\s+(le\s+)?(mode\s+)?(admin|root|privilégié|développeur)/gi,
97
+
98
+ // Swedish
99
+ /(system|admin|root|utvecklar)[-\s]*(åsidosättning|läge|åtkomst)/gi,
100
+ /du\s+är\s+nu\s+i\s+(admin|debug|underhålls|utvecklar)[-\s]*läge/gi,
101
+ /aktivera\s+(admin|root|privilegie(?:rad|rat))[-\s]*(läge|åtkomst)/gi,
102
+
103
+ // Portuguese
104
+ /(sistema|admin|root|desenvolvedor)\s*(substituição|modo|acesso)/gi,
105
+ /voc[êe]\s+est[áa]\s+agora\s+no\s+(modo\s+)?(admin|debug|manutenção|desenvolvedor)/gi,
106
+ /ativar\s+(o\s+)?(modo\s+)?(admin|root|desenvolvedor)/gi,
107
+
108
+ // Japanese
109
+ /(?:システム|管理者|ルート|開発者).*(?:上書き|モード|アクセス)/gi,
110
+ /(?:今|現在).*(?:管理者|デバッグ|開発者).*モード/gi,
111
+
112
+ // Russian
113
+ /(систем(?:а|ный)|админ|root|разработчик)\s*(?:переопределение|режим|доступ)/gi,
114
+ /ты\s+теперь\s+в\s+(?:режиме\s+)?(?:админ(?:а|истратора)?|отладк(?:и|а)|разработчика)/gi,
115
+ /активировать\s+(?:режим\s+)?(?:админ(?:а|истратора)?|разработчика|отладк(?:и|а))/gi,
116
+
117
+ // Arabic
118
+ /(?:النظام|المسؤول|الجذر|المطور).*(?:تجاوز|وضع|وصول)/gi,
119
+ /أنت.*الآن.*(?:وضع|صلاحية).*(?:المسؤول|المطور)/gi,
120
+ /تفعيل\s+وضع\s+(?:المسؤول|المطور|الجذر)/gi,
28
121
  ],
29
122
  },
30
123
 
@@ -34,11 +127,60 @@ const PATTERNS = {
34
127
  severity: 'HIGH',
35
128
  score: 50,
36
129
  patterns: [
130
+ // English
37
131
  /you\s+are\s+now\s+(a|an)\s+[A-Z]{2,}/gi,
38
132
  /you\s+are\s+no\s+longer\s+(bound|restricted|limited)/gi,
39
133
  /(act|behave|respond)\s+as\s+if\s+you\s+(are|were)\s+not/gi,
40
134
  /your\s+new\s+role\s+is/gi,
41
135
  /from\s+now\s+on,?\s+you\s+(are|act\s+as)/gi,
136
+
137
+ // German
138
+ /du\s+bist\s+jetzt\s+(ein|eine)\s+[A-Z]{2,}/gi,
139
+ /du\s+bist\s+nicht\s+mehr\s+(gebunden|eingeschränkt|limitiert)/gi,
140
+ /(handel|verhalt)e?\s+dich\s+als\s+ob\s+du\s+nicht/gi,
141
+ /deine\s+neue\s+rolle\s+ist/gi,
142
+
143
+ // Chinese
144
+ /你现在是.*[A-Z]{2,}/gi,
145
+ /你不再.*(?:受限|约束|限制)/gi,
146
+ /表现得.*好像.*不是/gi,
147
+ /你的新角色是/gi,
148
+
149
+ // Spanish
150
+ /ahora\s+eres\s+(un|una)\s+[A-Z]{2,}/gi,
151
+ /ya\s+no\s+est[áa]s\s+(limitado|restringido|atado)/gi,
152
+ /act[úu]a\s+como\s+si\s+no\s+(fueras|estuvieras)/gi,
153
+ /tu\s+nuevo\s+rol\s+es/gi,
154
+
155
+ // French
156
+ /tu\s+es\s+maintenant\s+(un|une)\s+[A-Z]{2,}/gi,
157
+ /tu\s+n'es\s+plus\s+(limité|restreint|lié)/gi,
158
+ /ton\s+nouveau\s+rôle\s+est/gi,
159
+
160
+ // Swedish
161
+ /du\s+är\s+nu\s+(en|ett)\s+[A-Z]{2,}/gi,
162
+ /du\s+är\s+inte\s+längre\s+(bunden|begränsad)/gi,
163
+ /din\s+nya\s+roll\s+är/gi,
164
+
165
+ // Portuguese
166
+ /você\s+agora\s+[ée]\s+um\s+[A-Z]{2,}/gi,
167
+ /você\s+não\s+está\s+mais\s+(limitado|restrito)/gi,
168
+ /seu\s+novo\s+papel\s+[ée]/gi,
169
+
170
+ // Japanese
171
+ /あなたは今.*[A-Z]{2,}/gi,
172
+ /あなたはもう.*(?:制限|拘束).*されていない/gi,
173
+ /あなたの新しい役割は/gi,
174
+
175
+ // Russian
176
+ /ты\s+теперь\s+[A-Z]{2,}/gi,
177
+ /ты\s+больше\s+не\s+(?:ограничен|связан)/gi,
178
+ /твоя\s+новая\s+роль/gi,
179
+
180
+ // Arabic
181
+ /أنت.*الآن.*[A-Z]{2,}/gi,
182
+ /لم.*تعد.*(?:مقيد|محدود)/gi,
183
+ /دورك.*الجديد/gi,
42
184
  ],
43
185
  },
44
186
 
@@ -59,9 +201,46 @@ const PATTERNS = {
59
201
  severity: 'CRITICAL',
60
202
  score: 100,
61
203
  patterns: [
204
+ // English
62
205
  /(send|forward|email|post|upload|transmit).{0,50}(to|@).{0,30}\.(com|net|org|io|xyz|cc)/gi,
63
206
  /(copy|export|backup).{0,30}(credentials?|keys?|tokens?|passwords?|secrets?)/gi,
64
207
  /exfiltrat|ex-filtrat|data\s+leak/gi,
208
+
209
+ // German
210
+ /(senden?|weiterleiten?|mailen?|posten?|hochladen?|übertragen?).{0,50}(an|@).{0,30}\.(com|net|org|de)/gi,
211
+ /(kopier(?:en)?|export(?:ieren)?|sicher(?:n|ung)).{0,30}(zugangsdaten|schlüssel|token|passwörter?|geheim)/gi,
212
+
213
+ // Chinese (Simplified & Traditional)
214
+ /(?:发送|傳送|转发|轉發|邮寄|郵寄|上传|上傳|传输|傳輸).{0,50}(?:到|至|给|給|@).{0,30}\.(com|net|org|cn)/gi,
215
+ /(?:复制|複製|导出|導出|备份|備份).{0,30}(?:凭证|憑證|密钥|密鑰|令牌|密码|密碼|机密|機密)/gi,
216
+
217
+ // Spanish
218
+ /(enviar|reenviar|mandar|publicar|subir|transmitir).{0,50}(a|@).{0,30}\.(com|net|org|es)/gi,
219
+ /(copiar|exportar|respaldar).{0,30}(credenciales?|claves?|tokens?|contraseñas?|secretos?)/gi,
220
+
221
+ // French
222
+ /(envoyer|transmettre|poster|télécharger|transférer).{0,50}(à|@).{0,30}\.(com|net|org|fr)/gi,
223
+ /(copier|exporter|sauvegarder).{0,30}(identifiants?|clés?|tokens?|mots?-passe|secrets?)/gi,
224
+
225
+ // Swedish
226
+ /(skicka|vidarebefordra|maila|posta|ladda\s+upp|överföra).{0,50}(till|@).{0,30}\.(com|net|org|se)/gi,
227
+ /(kopiera|exportera|säkerhetskopiera).{0,30}(autentiseringsuppgifter|nycklar|tokens?|lösenord|hemligheter)/gi,
228
+
229
+ // Portuguese
230
+ /(enviar|encaminhar|postar|carregar|transmitir).{0,50}(para|@).{0,30}\.(com|net|org|br|pt)/gi,
231
+ /(copiar|exportar|backup).{0,30}(credenciais|chaves?|tokens?|senhas?|segredos?)/gi,
232
+
233
+ // Japanese
234
+ /(?:送信|転送|メール|投稿|アップロード|送る).{0,50}(?:へ|に|@).{0,30}\.(com|net|org|jp)/gi,
235
+ /(?:コピー|エクスポート|バックアップ).{0,30}(?:認証情報|キー|トークン|パスワード|秘密)/gi,
236
+
237
+ // Russian
238
+ /(отправ(?:ить|лять)|переслать|отослать|загрузить|передать).{0,50}(на|@).{0,30}\.(com|net|org|ru)/gi,
239
+ /(скопировать|экспортировать|сохранить).{0,30}(учет(?:ные\s+)?данные|ключи|токены?|пароли?|секреты?)/gi,
240
+
241
+ // Arabic
242
+ /(?:إرسال|إعادة\s+توجيه|نشر|تحميل|نقل).{0,50}(?:إلى|@).{0,30}\.(com|net|org)/gi,
243
+ /(?:نسخ|تصدير|نسخ\s+احتياطي).{0,30}(?:بيانات\s+الاعتماد|مفاتيح|رموز|كلمات\s+المرور|أسرار)/gi,
65
244
  ],
66
245
  },
67
246
 
@@ -95,12 +274,38 @@ const PATTERNS = {
95
274
  severity: 'CRITICAL',
96
275
  score: 100,
97
276
  patterns: [
98
- /(exec|system|spawn|eval)\s*\([^)]*\$/gi,
99
- // Backticks handled by logAnalyzer.js for context-aware detection
100
- // /`.*\$\{.*\}.*`/g,
277
+ // English (technical commands are universal, but add context-aware patterns)
278
+ /(exec|system|spawn|eval|execute|run|command)\s*\([^)]*\$/gi,
101
279
  /\$\(.*\)/g,
102
280
  /;\s*rm\s+-rf/gi,
103
- /;\s*(curl|wget|nc|netcat)/gi,
281
+ /;\s*(curl|wget|nc|netcat|bash|sh|powershell|cmd)/gi,
282
+
283
+ // German (command execution context)
284
+ /(ausführ(?:en|e)|befehle?\s+ausführen|system[-\s]*befehl).{0,30}(exec|spawn|eval)/gi,
285
+
286
+ // Chinese (Simplified & Traditional)
287
+ /(?:执行|執行|运行|運行).*(?:命令|指令|脚本|腳本).{0,30}(exec|spawn|eval|bash|sh)/gi,
288
+
289
+ // Spanish
290
+ /(ejecutar|correr)\s+(?:comando|script).{0,30}(exec|spawn|eval|bash)/gi,
291
+
292
+ // French
293
+ /(exécuter|lancer)\s+(?:commande|script).{0,30}(exec|spawn|eval|bash)/gi,
294
+
295
+ // Swedish
296
+ /(kör|exekvera)\s+(?:kommando|skript).{0,30}(exec|spawn|eval|bash)/gi,
297
+
298
+ // Portuguese
299
+ /(executar|rodar)\s+(?:comando|script).{0,30}(exec|spawn|eval|bash)/gi,
300
+
301
+ // Japanese
302
+ /(?:実行|コマンド実行|スクリプト実行).{0,30}(exec|spawn|eval|bash)/gi,
303
+
304
+ // Russian
305
+ /(выполн(?:ить|ять)|запуст(?:ить|ить))\s+(?:команду|скрипт).{0,30}(exec|spawn|eval|bash)/gi,
306
+
307
+ // Arabic
308
+ /(?:تنفيذ|تشغيل)\s+(?:أمر|نص\s+برمجي).{0,30}(exec|spawn|eval|bash)/gi,
104
309
  ],
105
310
  },
106
311
 
@@ -0,0 +1,223 @@
1
+ /**
2
+ * Pattern Definitions for Prompt Injection Detection
3
+ * Multi-Language Support for Global Attack Detection
4
+ *
5
+ * Supported Languages:
6
+ * - English
7
+ * - German (Deutsch)
8
+ * - Chinese (Simplified & Traditional)
9
+ * - Spanish (Español)
10
+ * - French (Français)
11
+ * - Swedish (Svenska)
12
+ * - Portuguese (Português)
13
+ * - Japanese (日本語)
14
+ * - Russian (Русский)
15
+ * - Arabic (العربية)
16
+ */
17
+
18
+ const PATTERNS = {
19
+ P001_IGNORE_PREVIOUS: {
20
+ id: 'P001',
21
+ name: 'Ignore Previous Instructions',
22
+ severity: 'CRITICAL',
23
+ score: 100,
24
+ patterns: [
25
+ // English
26
+ /ignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|directives?|commands?|prompts?)/gi,
27
+ /disregard\s+(all\s+)?(previous|prior|above)\s+(instructions?|directives?)/gi,
28
+ /forget\s+(all\s+)?(previous|prior|earlier)\s+(instructions?|context|directives?)/gi,
29
+
30
+ // German
31
+ /ignorier(en|e)\s+(sie\s+)?(alle\s+)?(vorherigen?|frühere?|obige?)\s+(anweisungen?|befehle?|instruktionen?|direktiven?)/gi,
32
+ /vergiss(en)?\s+(alle\s+)?(vorherigen?|frühere?)\s+(anweisungen?|befehle?|instruktionen?)/gi,
33
+ /nicht\s+beachte(n)?\s+(alle\s+)?(vorherigen?|frühere?)\s+(anweisungen?|befehle?)/gi,
34
+
35
+ // Chinese (Simplified)
36
+ /忽略.*(?:所有|全部|之前|先前|以前|上述).*(?:指令|指示|命令|说明)/gi,
37
+ /忘记.*(?:所有|之前|先前|以前).*(?:指令|内容|命令)/gi,
38
+ /不要.*(?:遵循|执行|理会).*(?:之前|先前|以前).*(?:指令|命令)/gi,
39
+
40
+ // Chinese (Traditional)
41
+ /忽略.*(?:所有|全部|之前|先前|以前|上述).*(?:指令|指示|命令|說明)/gi,
42
+ /忘記.*(?:所有|之前|先前|以前).*(?:指令|內容|命令)/gi,
43
+
44
+ // Spanish
45
+ /ignor(a|ar|e)\s+(todas?\s+)?(las?\s+)?(instrucciones?|directivas?|comandos?)\s+(anteriores?|previas?)/gi,
46
+ /olvid(a|ar|e)\s+(todas?\s+)?(las?\s+)?(instrucciones?|comandos?)\s+(anteriores?|previas?)/gi,
47
+ /no\s+(seguir|tener\s+en\s+cuenta)\s+(las?\s+)?(instrucciones?\s+anteriores?)/gi,
48
+
49
+ // French
50
+ /ignor(er|e|ez)\s+(toutes?\s+)?(les?\s+)?(instructions?|directives?|commandes?)\s+(précédentes?|antérieures?)/gi,
51
+ /oubli(er|e|ez)\s+(toutes?\s+)?(les?\s+)?(instructions?|directives?)\s+(précédentes?)/gi,
52
+ /ne\s+pas\s+(suivre|tenir\s+compte)\s+(des?\s+)?(instructions?\s+précédentes?)/gi,
53
+
54
+ // Swedish
55
+ /ignorera\s+(alla\s+)?(tidigare|föregående|ovanstående)\s+(instruktioner|direktiv|kommandon)/gi,
56
+ /glöm\s+(bort\s+)?(alla\s+)?(tidigare|föregående)\s+(instruktioner|kommandon)/gi,
57
+ /bortse\s+från\s+(alla\s+)?(tidigare|föregående)\s+(instruktioner)/gi,
58
+
59
+ // Portuguese
60
+ /ignor(ar|e)\s+(todas?\s+)?(as\s+)?(instruções|diretivas|comandos)\s+(anteriores|prévias)/gi,
61
+ /esqueç(a|er)\s+(todas?\s+)?(as\s+)?(instruções|comandos)\s+(anteriores)/gi,
62
+
63
+ // Japanese
64
+ /(?:無視|忘れ).*(?:以前|前|すべて|全て).*(?:指示|命令|指令|インストラクション)/gi,
65
+ /(?:これまで|過去).*(?:指示|命令).*(?:無視|忘れ)/gi,
66
+
67
+ // Russian
68
+ /игнорир(?:уй|овать|уйте)\s+(?:все\s+)?(?:предыдущие|прежние|ранние)\s+(?:инструкции|команды|директивы)/gi,
69
+ /забудь(?:те)?\s+(?:все\s+)?(?:предыдущие|прежние)\s+(?:инструкции|команды)/gi,
70
+
71
+ // Arabic
72
+ /تجاهل.*(?:جميع|كل).*(?:التعليمات|الأوامر|التوجيهات).*(?:السابقة|الماضية)/gi,
73
+ /انسى.*(?:جميع|كل).*(?:التعليمات|الأوامر)/gi,
74
+ ],
75
+ },
76
+
77
+ P002_SYSTEM_OVERRIDE: {
78
+ id: 'P002',
79
+ name: 'System/Admin Override',
80
+ severity: 'CRITICAL',
81
+ score: 100,
82
+ patterns: [
83
+ // English
84
+ /(system|admin|root|developer)\s*(override|mode|access|prompt|instruction)/gi,
85
+ /you\s+are\s+now\s+(in\s+)?(admin|debug|maintenance|god|developer)\s+mode/gi,
86
+ /enable\s+(admin|debug|root|privileged)\s+(mode|access)/gi,
87
+ /sudo\s+mode|superuser\s+mode/gi,
88
+
89
+ // German
90
+ /(system|admin|root|entwickler)[-\s]*(überschreib(?:ung|en)|modus|zugriff)/gi,
91
+ /du\s+bist\s+jetzt\s+im\s+(admin|debug|wartungs|entwickler)[-\s]*modus/gi,
92
+ /aktiviere\s+(admin|root|privileg(?:iert)?(?:en)?)[-\s]*(modus|zugriff)/gi,
93
+
94
+ // Chinese (Simplified)
95
+ /(?:系统|管理员|超级用户|开发者).*(?:覆盖|模式|权限|访问)/gi,
96
+ /现在.*(?:进入|启用|开启).*(?:管理员|调试|开发者).*模式/gi,
97
+ /激活.*(?:管理员|超级用户|特权).*(?:模式|权限)/gi,
98
+
99
+ // Chinese (Traditional)
100
+ /(?:系統|管理員|超級用戶|開發者).*(?:覆蓋|模式|權限|訪問)/gi,
101
+
102
+ // Spanish
103
+ /(sistema|admin|root|desarrollador)\s*(anulación|modo|acceso)/gi,
104
+ /ahora\s+est[áa]s?\s+en\s+(modo\s+)?(admin|debug|mantenimiento|desarrollador)/gi,
105
+ /activar\s+(modo\s+)?(admin|root|privilegiado)/gi,
106
+
107
+ // French
108
+ /(système|admin|root|développeur)\s*(override|mode|accès)/gi,
109
+ /tu\s+es\s+maintenant\s+en\s+(mode\s+)?(admin|debug|maintenance|développeur)/gi,
110
+ /activer\s+(le\s+)?(mode\s+)?(admin|root|privilégié)/gi,
111
+
112
+ // Swedish
113
+ /(system|admin|root|utvecklar)[-\s]*(åsidosättning|läge|åtkomst)/gi,
114
+ /du\s+är\s+nu\s+i\s+(admin|debug|underhålls|utvecklar)[-\s]*läge/gi,
115
+ /aktivera\s+(admin|root|privilegie(?:rad|rat))[-\s]*(läge|åtkomst)/gi,
116
+
117
+ // Portuguese
118
+ /(sistema|admin|root|desenvolvedor)\s*(substituição|modo|acesso)/gi,
119
+ /voc[êe]\s+est[áa]\s+agora\s+no\s+(modo\s+)?(admin|debug|manutenção|desenvolvedor)/gi,
120
+
121
+ // Japanese
122
+ /(?:システム|管理者|ルート|開発者).*(?:上書き|モード|アクセス)/gi,
123
+ /(?:今|現在).*(?:管理者|デバッグ|開発者).*モード/gi,
124
+
125
+ // Russian
126
+ /(систем(?:а|ный)|админ|root|разработчик)\s*(?:переопределение|режим|доступ)/gi,
127
+ /ты\s+теперь\s+в\s+(?:режиме\s+)?(?:админ(?:а|истратора)?|отладк(?:и|а)|разработчика)/gi,
128
+
129
+ // Arabic
130
+ /(?:النظام|المسؤول|الجذر|المطور).*(?:تجاوز|وضع|وصول)/gi,
131
+ /أنت.*الآن.*(?:وضع|صلاحية).*(?:المسؤول|المطور)/gi,
132
+ ],
133
+ },
134
+
135
+ P003_ROLE_MANIPULATION: {
136
+ id: 'P003',
137
+ name: 'Role Manipulation',
138
+ severity: 'HIGH',
139
+ score: 50,
140
+ patterns: [
141
+ // English
142
+ /you\s+are\s+now\s+(a|an)\s+[A-Z]{2,}/gi,
143
+ /you\s+are\s+no\s+longer\s+(bound|restricted|limited)/gi,
144
+ /(act|behave|respond)\s+as\s+if\s+you\s+(are|were)\s+not/gi,
145
+ /your\s+new\s+role\s+is/gi,
146
+ /from\s+now\s+on,?\s+you\s+(are|act\s+as)/gi,
147
+
148
+ // German
149
+ /du\s+bist\s+jetzt\s+(ein|eine)\s+[A-Z]{2,}/gi,
150
+ /du\s+bist\s+nicht\s+mehr\s+(gebunden|eingeschränkt|limitiert)/gi,
151
+ /(handel|verhalt)e?\s+dich\s+als\s+ob\s+du\s+nicht/gi,
152
+ /deine\s+neue\s+rolle\s+ist/gi,
153
+ /von\s+jetzt\s+an\s+bist\s+du/gi,
154
+
155
+ // Chinese (Simplified)
156
+ /你现在是.*[A-Z]{2,}/gi,
157
+ /你不再.*(?:受限|约束|限制)/gi,
158
+ /表现得.*好像.*不是/gi,
159
+ /你的新角色是/gi,
160
+ /从现在开始.*你是/gi,
161
+
162
+ // Spanish
163
+ /ahora\s+eres\s+(un|una)\s+[A-Z]{2,}/gi,
164
+ /ya\s+no\s+est[áa]s\s+(limitado|restringido|atado)/gi,
165
+ /act[úu]a\s+como\s+si\s+no\s+(fueras|estuvieras)/gi,
166
+ /tu\s+nuevo\s+rol\s+es/gi,
167
+ /desde\s+ahora\s+eres/gi,
168
+
169
+ // French
170
+ /tu\s+es\s+maintenant\s+(un|une)\s+[A-Z]{2,}/gi,
171
+ /tu\s+n'es\s+plus\s+(limité|restreint|lié)/gi,
172
+ /comporte[-\s]toi\s+comme\s+si\s+tu\s+n'étais\s+pas/gi,
173
+ /ton\s+nouveau\s+rôle\s+est/gi,
174
+
175
+ // Swedish
176
+ /du\s+är\s+nu\s+(en|ett)\s+[A-Z]{2,}/gi,
177
+ /du\s+är\s+inte\s+längre\s+(bunden|begränsad|limiterad)/gi,
178
+ /bete\s+dig\s+som\s+om\s+du\s+inte/gi,
179
+ /din\s+nya\s+roll\s+är/gi,
180
+
181
+ // Portuguese
182
+ /você\s+agora\s+[ée]\s+um\s+[A-Z]{2,}/gi,
183
+ /você\s+não\s+está\s+mais\s+(limitado|restrito)/gi,
184
+ /aja\s+como\s+se\s+você\s+não/gi,
185
+ /seu\s+novo\s+papel\s+[ée]/gi,
186
+
187
+ // Japanese
188
+ /あなたは今.*[A-Z]{2,}/gi,
189
+ /あなたはもう.*(?:制限|拘束|束縛).*されていない/gi,
190
+ /あなたの新しい役割は/gi,
191
+
192
+ // Russian
193
+ /ты\s+теперь\s+[A-Z]{2,}/gi,
194
+ /ты\s+больше\s+не\s+(?:ограничен|связан)/gi,
195
+ /веди\s+себя\s+так,\s+как\s+будто\s+ты\s+не/gi,
196
+ /твоя\s+новая\s+роль/gi,
197
+
198
+ // Arabic
199
+ /أنت.*الآن.*[A-Z]{2,}/gi,
200
+ /لم.*تعد.*(?:مقيد|محدود)/gi,
201
+ /دورك.*الجديد.*هو/gi,
202
+ ],
203
+ },
204
+
205
+ P101_URL_DATA_PARAMS: {
206
+ id: 'P101',
207
+ name: 'URL with Data Parameters',
208
+ severity: 'HIGH',
209
+ score: 50,
210
+ patterns: [
211
+ /https?:\/\/[^\s]+\?[^\s]*(data|key|token|password|secret|credential|auth)=/gi,
212
+ /!\[.*?\]\(https?:\/\/[^\)]+\?[^\)]*=/gi,
213
+ ],
214
+ },
215
+
216
+ P102_DATA_FORWARDING: {
217
+ id: 'P102',
218
+ name: 'Data Forwarding Instructions',
219
+ severity: 'CRITICAL',
220
+ score: 100,
221
+ patterns: [
222
+ // English
223
+ /(send|forward|email|