gm-skill 2.0.2570 → 2.0.2572

package/AGENTS.md

@@ -172,6 +172,16 @@ A task that reduces to read/investigate/report, or a change confined to files th
 
 **Bootstrap contract**: `ensureReady` inits wasm hook-free, sha256-rewrites stale installed SKILL.md, seeds per-project `CLAUDE.md`/`.gm/next-step.md`. Detail: the recall store (`recall: skill-initiated bootstrap contract`, `recall: SKILL.md auto-refresh`).
 
+## Supply-chain tell scanner
+
+`scripts/scan-supply-chain-tells.mjs` scans any file tree for the injected-backdoor/AI-tell signature classes found in a real incident on a consumer project (freddie): an obfuscated C2 stager appended after a legitimate `export default` in a build config, delivered via a compromised automated release commit that also bumped a dependency and dropped `.env` from `.gitignore`. Run it: `node scripts/scan-supply-chain-tells.mjs <path...>` (defaults to cwd). Exit 0 = clean, 1 = findings, 2 = scan error.
+
+Detection classes: exact-match known-incident strings (campaign tag, hardcoded C2-lookup address, custom payload-smuggling header), structural patterns (blockchain-RPC-derived C2 address resolution, IP-from-bytes decode, detached+hidden-stdio child-process spawn, `eval()` fed by a network response, XOR-decode loops, `require`/`module` stashed onto `global`, a dense minified tail line appended to an otherwise normal readable file, `\uXXXX`-escaped ASCII used to defeat plaintext grep, multiple public RPC endpoints raced with `Promise.any` for C2 resilience), and Unicode confusables/invisible characters (zero-width spaces/joiners, bidi override characters — the Trojan Source class — soft hyphens, and common Cyrillic homoglyphs for Latin letters).
+
+**Dispatch this scan at EMIT (before any live witness) and again at DECIDE's adversarial corner-case sweep, on every file the diff touches** — alongside the existing empty/overflow/injection/resource-exhaustion sweep classes, not instead of them. A `security` toolset dependency bump, an automated release commit, or any file with unexpectedly dense/obfuscated content are the highest-suspicion triggers for an out-of-band run against the full tree, not just the diff. A finding routes like any other DECIDE discovery: confirmed-malicious content is a `transition to=EMIT` fix (remove and re-witness), never a silent ignore or a "looks fine" without running the scan.
+
+This is a heuristic signature scanner, not a guarantee — it catches the specific technique classes seen in the confirmed incident and known-adjacent variants; it does not replace `npm audit`, dependency pinning review, or reading an unfamiliar dependency's actual source before trusting an automated bump.
+
 ## Cascade pipeline
 
 Push to any rs-* sibling -> `cascade.yml` -> rs-plugkit `release.yml` -> single `plugkit.wasm` (npm `plugkit-wasm` + `plugkit-bin` Releases) -> best-effort gm-metadata-sync commit -> `publish.yml` ships gm-skill+gm-plugkit+SKILL.md mirror. Step sequence + PUBLISHER_TOKEN: the recall store (`recall: cascade pipeline`).

package/bin/plugkit-slim.wasm.sha256

@@ -1 +1 @@
-5f709275d5f02c32474faaaffc304b60ea91cad1cdfae56ec4f4da2397461e5b  plugkit-slim.wasm
+02cae93317f0d965fd004304a2cdf74dd298765cd370061c70a55b9eef41689c  plugkit-slim.wasm

package/bin/plugkit.version

@@ -1 +1 @@
-0.1.1210
+0.1.1211

package/bin/plugkit.wasm.sha256

@@ -1 +1 @@
-4f40350f6377c5065f918165378c7574d3871661d622b4f1f891654c868be705  plugkit.wasm
+165bfc856da6a5d3aa0775cc28f4e76cb67a86e68f89a63b341c8b198c670d45  plugkit.wasm

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.2570",
+  "version": "2.0.2572",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.",
   "main": "index.js",
   "bin": {

package/gm-plugkit/plugkit-slim.wasm.sha256

@@ -1 +1 @@
-5f709275d5f02c32474faaaffc304b60ea91cad1cdfae56ec4f4da2397461e5b  plugkit-slim.wasm
+02cae93317f0d965fd004304a2cdf74dd298765cd370061c70a55b9eef41689c  plugkit-slim.wasm

package/gm-plugkit/plugkit.version

@@ -1 +1 @@
-0.1.1210
+0.1.1211

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.2570",
+  "version": "2.0.2572",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",
@@ -17,5 +17,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "plugkitVersion": "0.1.1210"
+  "plugkitVersion": "0.1.1211"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.2570",
+  "version": "2.0.2572",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",

package/scripts/scan-supply-chain-tells.mjs

@@ -0,0 +1,257 @@
+#!/usr/bin/env node
+// Scans files for supply-chain-backdoor and AI-injection "tells" -- signatures
+// found live in a real incident (an obfuscated C2 stager appended to
+// vite.browser.config.js, delivered via a compromised automated release
+// commit that also bumped a dependency and dropped .env from .gitignore).
+//
+// Run standalone: node scripts/scan-supply-chain-tells.mjs [path...]
+// Exit code 0 = clean, 1 = findings, 2 = scan error.
+//
+// Designed to be invoked from any project (not just this one) -- pass the
+// target repo root(s) as argv, or it scans cwd.
+
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+
+const SKIP_DIRS = new Set([
+  'node_modules', '.git', 'dist', 'build', '.next', 'vendor', '.cache',
+  '.svelte-kit', '.nuxt', '.output', '.turbo', 'out', 'coverage', '.parcel-cache',
+])
+// Code files only. JSON/YAML/MD routinely carry legitimate non-Latin natural-
+// language text (Cyrillic, Greek, CJK, etc.) which is indistinguishable from a
+// homoglyph attack by codepoint alone -- the Unicode-confusable check below is
+// only meaningful applied to CODE, where an identifier/URL is expected to be
+// plain ASCII and non-ASCII inside one is a genuine anomaly, not content.
+const CODE_EXT = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.sh', '.ps1', '.py'])
+// Broader set for the exact-string / pattern checks, which key on code shapes
+// (require calls, eval, spawn) that can legitimately only appear in code or
+// config, not prose -- config/build files are still worth the exact-string and
+// structural-pattern passes, just not the Unicode-confusable pass.
+const TEXT_EXT = new Set([...CODE_EXT, '.json', '.yml', '.yaml', '.md'])
+
+// ---- Exact-match signatures from the confirmed incident ----------------
+const EXACT_STRINGS = [
+  { sig: 'A9-2057', why: 'campaign/version tag literal seen in a live C2 stager' },
+  { sig: '0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a', why: 'hardcoded Ethereum address used as a blockchain-based C2 config lookup key' },
+  { sig: 'eth.blockscout.com/api', why: 'block-explorer API used as a C2-resolution fallback' },
+  { sig: 'x-payload-b64', why: 'custom HTTP header used to smuggle a staged payload' },
+]
+
+// ---- Structural / behavioral patterns (regex) ---------------------------
+const PATTERNS = [
+  {
+    name: 'blockchain-derived-c2-lookup',
+    re: /eth_getBlockByNumber|eth_getTransactionCount|eth_blockNumber/,
+    why: 'blockchain RPC calls used to derive a C2 address/config are a known dead-drop technique — legitimate web3 code should be an isolated, obviously-named module, not appended to an unrelated build config',
+  },
+  {
+    name: 'ip-from-bytes-decode',
+    re: /\[0\]\s*\+\s*['"]\.['"]\s*\+\s*\w+\[1\]\s*\+\s*['"]\.['"]\s*\+\s*\w+\[2\]/,
+    why: 'byte-array-to-dotted-IP decode shape, commonly used to hide a C2 address inside binary data (a tx field, an image, etc.)',
+  },
+  {
+    name: 'detached-hidden-spawn',
+    re: /spawn\s*\(\s*['"]node['"][\s\S]{0,120}detached\s*:\s*true[\s\S]{0,120}stdio\s*:\s*['"]ignore['"]/,
+    why: 'detached + stdio:ignore + unref() child process launch — runs code that outlives and is invisible to the parent process',
+  },
+  {
+    name: 'detached-hidden-spawn-loose',
+    re: /detached\s*:\s*true[\s\S]{0,60}(stdio\s*:\s*['"]ignore['"]|windowsHide\s*:\s*true)/,
+    why: 'detached background process with hidden stdio/window — legitimate daemonization exists but is rare in application/build code and should be named and commented',
+  },
+  {
+    name: 'eval-of-network-response',
+    re: /eval\s*\(\s*[\w.]*\+?\s*(await\s+)?\w*(fetch|http|https|response|body|payload|res)\w*/i,
+    why: 'eval() fed directly by network response content — remote code execution primitive',
+  },
+  {
+    name: 'xor-decode-helper',
+    re: /charCodeAt\(\w+\s*%\s*\w+\.length\)/,
+    why: 'per-byte XOR-against-key loop, the standard shape for decoding an obfuscated payload at runtime',
+  },
+  {
+    name: 'global-require-module-stash',
+    re: /global\.\w+\s*=\s*require\s*;\s*typeof\s+module\s*===\s*['"]object['"]/,
+    why: 'stashing require/module onto global — used so eval()-ed code can access them outside its lexical scope',
+  },
+  {
+    name: 'minified-tail-after-normal-code',
+    re: /\n[a-z]\.[a-z]\([a-z],[a-z],[a-z]\)/,
+    why: 'single-letter-identifier minified code appearing after normally-formatted source — mixing styles in one file is a strong injection tell',
+    weak: true,
+  },
+  {
+    name: 'promise-any-rpc-race',
+    re: /Promise\.any\(\s*\[?\s*['"]https?:\/\/[^,\]]+,\s*['"]https?:\/\//,
+    why: 'racing multiple public RPC/API endpoints for resilience — common in C2 code designed to survive one endpoint being blocked',
+  },
+]
+
+// ---- Unicode confusables / invisible-character tells ---------------------
+// Each entry: a *visible-as-ASCII-but-isn't* or fully invisible codepoint.
+const SUSPICIOUS_UNICODE = [
+  { cp: 0x200b, name: 'ZERO WIDTH SPACE' },
+  { cp: 0x200c, name: 'ZERO WIDTH NON-JOINER' },
+  { cp: 0x200d, name: 'ZERO WIDTH JOINER' },
+  { cp: 0x200e, name: 'LEFT-TO-RIGHT MARK' },
+  { cp: 0x200f, name: 'RIGHT-TO-LEFT MARK' },
+  { cp: 0x202a, name: 'LEFT-TO-RIGHT EMBEDDING' },
+  { cp: 0x202b, name: 'RIGHT-TO-LEFT EMBEDDING' },
+  { cp: 0x202c, name: 'POP DIRECTIONAL FORMATTING' },
+  { cp: 0x202d, name: 'LEFT-TO-RIGHT OVERRIDE' },
+  { cp: 0x202e, name: 'RIGHT-TO-LEFT OVERRIDE (Trojan Source bidi attack)' },
+  { cp: 0x2060, name: 'WORD JOINER' },
+  { cp: 0x2066, name: 'LEFT-TO-RIGHT ISOLATE' },
+  { cp: 0x2067, name: 'RIGHT-TO-LEFT ISOLATE' },
+  { cp: 0x2068, name: 'FIRST STRONG ISOLATE' },
+  { cp: 0x2069, name: 'POP DIRECTIONAL ISOLATE' },
+  { cp: 0xfeff, name: 'ZERO WIDTH NO-BREAK SPACE / BOM (mid-file)' },
+  { cp: 0x00ad, name: 'SOFT HYPHEN' },
+  // Common homoglyphs used to disguise identifiers/URLs (Cyrillic look-alikes)
+  { cp: 0x0410, name: 'CYRILLIC CAPITAL А (looks like Latin A)' },
+  { cp: 0x0430, name: 'CYRILLIC SMALL а (looks like Latin a)' },
+  { cp: 0x0415, name: 'CYRILLIC CAPITAL Е (looks like Latin E)' },
+  { cp: 0x0435, name: 'CYRILLIC SMALL е (looks like Latin e)' },
+  { cp: 0x041e, name: 'CYRILLIC CAPITAL О (looks like Latin O)' },
+  { cp: 0x043e, name: 'CYRILLIC SMALL о (looks like Latin o)' },
+  { cp: 0x0420, name: 'CYRILLIC CAPITAL Р (looks like Latin P)' },
+  { cp: 0x0440, name: 'CYRILLIC SMALL р (looks like Latin p)' },
+  { cp: 0x0421, name: 'CYRILLIC CAPITAL С (looks like Latin C)' },
+  { cp: 0x0441, name: 'CYRILLIC SMALL с (looks like Latin c)' },
+]
+
+// A file whose non-ASCII payload is almost entirely \uXXXX-style JS escape
+// sequences decoding to plain ASCII is itself a tell (deliberate obfuscation
+// to defeat plain-string grep, seen in the confirmed incident's http/https/
+// url/child_process require() calls).
+const ESCAPED_ASCII_RUN = /(\\u00[2-7][0-9a-fA-F]){6,}/
+
+function walk(dir, out) {
+  let entries
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true })
+  } catch {
+    return
+  }
+  for (const e of entries) {
+    if (SKIP_DIRS.has(e.name)) continue
+    const p = path.join(dir, e.name)
+    if (e.isDirectory()) {
+      walk(p, out)
+    } else if (e.isFile() && TEXT_EXT.has(path.extname(e.name))) {
+      out.push(p)
+    }
+  }
+}
+
+function scanFile(filePath) {
+  let text
+  try {
+    text = fs.readFileSync(filePath, 'utf8')
+  } catch {
+    return []
+  }
+  const findings = []
+
+  for (const { sig, why } of EXACT_STRINGS) {
+    if (text.includes(sig)) {
+      findings.push({ filePath, kind: 'exact-string', sig, why })
+    }
+  }
+
+  for (const { name, re, why, weak } of PATTERNS) {
+    const m = text.match(re)
+    if (m) {
+      const line = text.slice(0, m.index).split('\n').length
+      findings.push({ filePath, kind: weak ? 'pattern-weak' : 'pattern', name, why, line })
+    }
+  }
+
+  const lines = text.split('\n')
+  const nonBlank = lines.filter(l => l.trim().length > 0)
+  if (nonBlank.length >= 5) {
+    const lens = nonBlank.map(l => l.length)
+    const avgLen = lens.reduce((a, b) => a + b, 0) / lens.length
+    const lastLen = lens[lens.length - 1]
+    const looksMinified = /[;,]\s*[a-zA-Z_$][\w$]*\s*=/.test(nonBlank[nonBlank.length - 1]) &&
+      /\b(function|=>|require\(|const |let |var )\b/.test(nonBlank[nonBlank.length - 1])
+    if (lastLen > 2000 && lastLen > avgLen * 20 && looksMinified) {
+      findings.push({
+        filePath,
+        kind: 'pattern',
+        name: 'dense-minified-tail-line',
+        line: nonBlank.length,
+        why: `final non-blank line is ${lastLen} chars (${Math.round(lastLen / avgLen)}x the file's average line length) and looks like minified code — this is the exact shape of a payload appended to the end of an otherwise normal, readable file`,
+      })
+    }
+  }
+
+  if (ESCAPED_ASCII_RUN.test(text)) {
+    findings.push({
+      filePath,
+      kind: 'pattern',
+      name: 'escaped-ascii-obfuscation',
+      why: '6+ consecutive \\uXXXX escapes decoding to plain ASCII — deliberate string obfuscation to defeat plaintext grep (e.g. \\u0068\\u0074\\u0074\\u0070 = "http")',
+    })
+  }
+
+  if (CODE_EXT.has(path.extname(filePath))) {
+    // De-duplicate per (codepoint, line): a run of several confusables on one
+    // line (a whole disguised word) is one finding, not one per character.
+    const seen = new Set()
+    for (let i = 0; i < text.length; i++) {
+      const cp = text.codePointAt(i)
+      const hit = SUSPICIOUS_UNICODE.find(u => u.cp === cp)
+      if (hit) {
+        const line = text.slice(0, i).split('\n').length
+        const key = cp + ':' + line
+        if (seen.has(key)) continue
+        seen.add(key)
+        findings.push({
+          filePath,
+          kind: 'unicode',
+          name: hit.name,
+          codepoint: '0x' + cp.toString(16),
+          line,
+          why: 'invisible or confusable Unicode codepoint inside a code file — used to hide code from visual review or disguise an identifier/URL as something else',
+        })
+      }
+    }
+  }
+
+  return findings
+}
+
+function main() {
+  const targets = process.argv.slice(2)
+  const roots = targets.length ? targets : [process.cwd()]
+  const files = []
+  for (const root of roots) {
+    const stat = fs.existsSync(root) ? fs.statSync(root) : null
+    if (!stat) continue
+    if (stat.isDirectory()) walk(root, files)
+    else files.push(root)
+  }
+
+  const allFindings = []
+  for (const f of files) {
+    allFindings.push(...scanFile(f))
+  }
+
+  if (!allFindings.length) {
+    console.log(`scan-supply-chain-tells: clean (${files.length} files scanned)`)
+    process.exit(0)
+  }
+
+  console.log(`scan-supply-chain-tells: ${allFindings.length} finding(s) across ${new Set(allFindings.map(f => f.filePath)).size} file(s)\n`)
+  for (const f of allFindings) {
+    const loc = f.line ? `:${f.line}` : ''
+    const label = f.sig || f.name
+    console.log(`[${f.kind}] ${f.filePath}${loc} — ${label}`)
+    console.log(`    ${f.why}`)
+  }
+  process.exit(1)
+}
+
+main()