codebee 0.1.61 → 0.1.63
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +14 -11
- package/README.md +4 -6
- package/app/core/catalog.py +19 -14
- package/app/core/pipeline.py +62 -2
- package/app/core/router.py +324 -307
- package/app/core/runner.py +2014 -1991
- package/app/core/skill_scan.py +13 -2
- package/package.json +1 -1
package/app/core/skill_scan.py
CHANGED
|
@@ -20,12 +20,23 @@ _PATTERNS = [
|
|
|
20
20
|
(r"\bexec\s*\(", "代码执行", "exec 执行任意代码"),
|
|
21
21
|
(r"subprocess|os\.system|Popen", "代码执行", "起子进程执行命令"),
|
|
22
22
|
(r"child_process", "代码执行", "Node.js 子进程（可能执行任意命令）"),
|
|
23
|
+
(r"(?:curl|wget)[^\n|]*\|\s*(?:ba|z|da)?sh\b", "代码执行",
|
|
24
|
+
"下载内容直接管道进 shell 执行（dropper 特征）"),
|
|
25
|
+
(r"Invoke-Expression|\biex\s*\(|DownloadString", "代码执行",
|
|
26
|
+
"PowerShell 下载执行（dropper 特征）"),
|
|
23
27
|
# 数据外发
|
|
24
28
|
(r"https?://(?!api\.|docs\.|github\.com|raw\.githubusercontent)[a-z0-9.-]+/(upload|collect|track|ingest|webhook|callback)",
|
|
25
29
|
"数据外发", "向非常规端点上传/回调数据"),
|
|
26
30
|
(r"requests\.post|urllib\.request|fetch\s*\(", "网络请求", "发起网络请求（确认目标可信）"),
|
|
27
31
|
(r"base64.{0,10}(decode|b64decode|atob)", "数据外发",
|
|
28
32
|
"base64 解码（可能隐藏混淆载荷）"),
|
|
33
|
+
(r"pastebin\.com|webhook\.site|requestbin|pipedream\.net|"
|
|
34
|
+
r"ngrok\.(io|app|dev)|trycloudflare\.com", "数据外发",
|
|
35
|
+
"常见外传/中转信道（pastebin、ngrok 隧道、webhook.site 等）"),
|
|
36
|
+
# 持久化与挖矿（治理巡检 09-24 补：装后驻留与资源盗用的静态特征）
|
|
37
|
+
(r"\bcrontab\b|schtasks|LaunchAgents|CurrentVersion\\Run|StartupItems",
|
|
38
|
+
"持久化", "注册定时任务/自启动项（持久化驻留特征）"),
|
|
39
|
+
(r"stratum\+tcp|xmrig|cryptonight", "可疑意图", "加密货币挖矿特征"),
|
|
29
40
|
# 敏感信息读取
|
|
30
41
|
(r"os\.environ|process\.env|getenv", "环境读取", "读取环境变量（可能带走密钥）"),
|
|
31
42
|
(r"\.ssh/|\.aws/|\.npmrc|\.gitconfig|credentials|\.env\b", "敏感文件", "触碰凭据/密钥文件路径"),
|
|
@@ -70,13 +81,13 @@ def scan_text(text, max_findings=12):
|
|
|
70
81
|
def risk_label(findings):
|
|
71
82
|
"""发现列表 → 风险标签（装前提示行用）。
|
|
72
83
|
|
|
73
|
-
|
|
84
|
+
三级：高危（代码执行/敏感文件/可疑意图/数据外发/持久化）任一
|
|
74
85
|
命中 = 高风险；中危类（网络请求/环境读取/提示注入/越权人格）≥2 类
|
|
75
86
|
同时命中 = 中风险；有发现 = 注意；空 = 干净。"""
|
|
76
87
|
if not findings:
|
|
77
88
|
return ""
|
|
78
89
|
cats = {f["category"] for f in findings}
|
|
79
|
-
if cats & {"代码执行", "敏感文件", "可疑意图", "数据外发"}:
|
|
90
|
+
if cats & {"代码执行", "敏感文件", "可疑意图", "数据外发", "持久化"}:
|
|
80
91
|
return "⚠ 高风险"
|
|
81
92
|
medium_cats = cats & {"网络请求", "环境读取", "提示注入", "越权人格"}
|
|
82
93
|
if len(medium_cats) >= 2:
|
package/package.json
CHANGED