pkgradar 0.1.0 → 0.1.1

package/lib/checks.js

@@ -95,14 +95,11 @@ function checkWormFiles(pkg) {
         out.push({ sev: SEV.CRITICAL, code: 'worm-ioc-file', msg: `known worm artifact file: ${e.name}`, evidence: path.relative(pkg.dir, full) });
       }
       if (/(^|[\\/])\.github[\\/]workflows([\\/]|$)/.test(d) && /\.ya?ml$/i.test(low)) {
-        // Many legit packages publish their whole repo (incl. .github). On its own this
-        // is barely a signal, so it is INFO. A *malicious* workflow file would also be
-        // caught by name (worm-ioc-file) or by content checks.
-        const wf = readSafe(full, 200_000);
-        const nasty = wf && /\b(curl|wget)\b[^|;&\n]*[|;&]+\s*(ba|z|d)?sh\b|secrets\.[A-Z_]+\b[\s\S]{0,80}(curl|nc |bash -c|http)/.test(wf.text);
-        out.push(nasty
-          ? { sev: SEV.CRITICAL, code: 'malicious-gh-workflow', msg: `bundled GitHub Actions workflow runs a piped shell download / exfiltrates secrets`, evidence: path.relative(pkg.dir, full) }
-          : { sev: SEV.INFO, code: 'embedded-gh-workflow', msg: `package ships a GitHub Actions workflow (${e.name})`, evidence: path.relative(pkg.dir, full) });
+        // Lots of legit packages publish their whole repo, .github included, and plenty
+        // of normal CI workflows pipe an installer into a shell. On its own this is not a
+        // signal, so it is INFO only. A genuinely malicious workflow file with a known
+        // name is already caught by worm-ioc-file.
+        out.push({ sev: SEV.INFO, code: 'embedded-gh-workflow', msg: `package ships a GitHub Actions workflow (${e.name})`, evidence: path.relative(pkg.dir, full) });
       }
     }
   }
@@ -158,21 +155,28 @@ function checkObfuscation(pkg) {
     const weak = [];      // weak reasons only matter in combination
     let critical = false;
 
-    // --- hard worm markers: any one => critical ---
-    for (const m of WORM_HARD_MARKERS) if (t.includes(m)) { strong.push(`worm IOC string: ${m}`); critical = true; }
-    // --- soft worm markers: need >=3 distinct in one file (so a tool's advisory text won't trip it) ---
-    const softHits = WORM_SOFT_MARKERS.filter((m) => t.includes(m));
-    if (softHits.length >= 3) { strong.push(`co-occurring worm terms: ${softHits.slice(0, 6).join(', ')}`); }
-    else if (softHits.length) weak.push(`worm term(s): ${softHits.join(', ')}`);
-
-    // --- javascript-obfuscator signature ---
+    // --- "executable payload" context: dynamic code execution over decoded data, or
+    //     heavy identifier mangling. Worm IOC strings are only damning when they sit
+    //     alongside one of these; on their own they also appear in scanners, advisories,
+    //     and writeups (this file included). ---
     const hexIds = (t.match(/_0x[a-f0-9]{4,6}\b/g) || []).length;
+    const evalOverDecoded = /(eval|new Function|Function\()\s*\(?\s*(atob|Buffer\.from\s*\([^)]*base64|unescape|decodeURIComponent)/.test(t);
+    const procFromDecoded = /\bchild_process\b[\s\S]{0,400}\b(atob|Buffer\.from\s*\([^)]*base64)/.test(t);
+    const execContext = evalOverDecoded || procFromDecoded || hexIds > 80;
+    if (evalOverDecoded) strong.push('constructs & executes decoded payload (eval/Function over atob/Buffer.from)');
+    if (procFromDecoded) strong.push('spawns a process from decoded data');
     if (hexIds > 80) strong.push(`${hexIds} _0x… mangled identifiers (javascript-obfuscator)`);
     else if (hexIds > 20) weak.push(`${hexIds} _0x… identifiers`);
 
-    // --- code building & executing decoded data dynamically ---
-    if (/(eval|new Function|Function\()\s*\(?\s*(atob|Buffer\.from\s*\([^)]*base64|unescape|decodeURIComponent)/.test(t)) strong.push('constructs & executes decoded payload (eval/Function over atob/Buffer.from)');
-    if (/\bchild_process\b[\s\S]{0,400}\b(atob|Buffer\.from\s*\([^)]*base64)/.test(t)) strong.push('spawns a process from decoded data');
+    // --- worm IOC strings ---
+    const hardHits = WORM_HARD_MARKERS.filter((m) => t.includes(m));
+    if (hardHits.length) {
+      if (execContext) { strong.push(`worm IOC string(s) in an executing payload: ${hardHits.join(', ')}`); critical = true; }
+      else weak.push(`contains known IOC string(s): ${hardHits.join(', ')} (also found in security tooling / advisories / writeups)`);
+    }
+    const softHits = WORM_SOFT_MARKERS.filter((m) => t.includes(m));
+    if (softHits.length >= 3 && execContext) strong.push(`co-occurring worm terms with an executable payload: ${softHits.slice(0, 6).join(', ')}`);
+    else if (softHits.length) weak.push(`worm term(s): ${softHits.slice(0, 6).join(', ')}`);
 
     // --- weak structural signals (modern bundlers do these constantly) ---
     const longest = t.split('\n').reduce((m, l) => Math.max(m, l.length), 0);
@@ -217,7 +221,13 @@ function checkManifestAnomalies(pkg) {
   return out;
 }
 
+let SELF = null;
+try { SELF = require('../package.json').name; } catch { /* ignore */ }
+
 function runAll(pkg) {
+  // Don't scan our own package: this file necessarily contains the IOC strings it
+  // searches for, so scanning a cached copy of pkgradar would flag pkgradar.
+  if (SELF && pkg && pkg.manifest && pkg.manifest.name === SELF) return [];
   const findings = [];
   for (const fn of [checkLifecycleHooks, checkWormFiles, checkManifestAnomalies, checkObfuscation]) {
     try { findings.push(...fn(pkg)); } catch (e) { /* ignore per-check failure */ }

package/lib/scan.js

@@ -76,9 +76,22 @@ async function scan(opts = {}) {
     }
   }
 
-  findings.sort((a, b) => b.sevNum - a.sevNum || a.package.localeCompare(b.package));
+  // Collapse identical findings that show up in several stores (e.g. the same package
+  // cached under multiple npx hashes) into one, noting how many places it was seen.
+  const byKey = new Map();
+  for (const f of findings) {
+    const k = `${f.package}@${f.version}|${f.code}|${f.evidence || ''}|${f.message}`;
+    const prev = byKey.get(k);
+    if (prev) { prev._copies = (prev._copies || 1) + 1; if (!prev._stores.includes(f.store)) prev._stores.push(f.store); }
+    else { f._copies = 1; f._stores = [f.store]; byKey.set(k, f); }
+  }
+  const deduped = [...byKey.values()].map((f) => {
+    if (f._copies > 1) { f.store = `${f._stores.join(', ')} (${f._copies}x)`; }
+    delete f._copies; delete f._stores; return f;
+  });
+  deduped.sort((a, b) => b.sevNum - a.sevNum || a.package.localeCompare(b.package));
   const totalPackages = [...new Set(allPkgList.map((p) => `${p.name}@${p.version}`))].length;
-  return { cwd, stores: storeStats, totalPackages, totalScanned: seen.size, findings, osv };
+  return { cwd, stores: storeStats, totalPackages, totalScanned: seen.size, findings: deduped, osv };
 }
 
 function splitNV(nv) { const i = nv.lastIndexOf('@'); return [nv.slice(0, i), nv.slice(i + 1)]; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pkgradar",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Content-based supply-chain scanner for npm/pnpm/yarn/bun: inspects the bytes you actually installed (lifecycle hooks, obfuscated payloads, worm IOCs) instead of just matching package names against an advisory list.",
   "bin": {
     "pkgradar": "bin/pkgradar.js"