secure-scan 1.2.2

package/src/dependencies/installed/malwarePatterns.ts

@@ -0,0 +1,492 @@
+/**
+ * Malware Detection Patterns
+ * Comprehensive patterns to detect malware in installed dependencies
+ */
+
+import { MalwarePattern } from './types';
+import { MalwareIndicator } from '../types';
+import { Severity } from '../../types';
+
+/**
+ * Malware detection patterns for installed dependencies
+ */
+export const MALWARE_PATTERNS: MalwarePattern[] = [
+  // ==================== BACKDOOR PATTERNS ====================
+  {
+    id: 'MAL-BACKDOOR-001',
+    name: 'Reverse Shell',
+    description: 'Detects reverse shell commands that allow remote access',
+    indicator: MalwareIndicator.BACKDOOR,
+    severity: Severity.CRITICAL,
+    patterns: [
+      /\bexec\s*\(\s*['"`].*?(bash|sh|cmd|powershell).*?-[ice].*?['"`]\s*\)/gi,
+      /\b(nc|netcat|ncat)\s+.*?\s+\d+\s*[-e]?\s*(\/bin\/(ba)?sh|cmd)/gi,
+      /\bpython\s+-c\s+['"]import\s+socket.*?subprocess.*?['"`]/gi,
+      /\bsocket\s*\(\s*\).*?connect\s*\(.*?\).*?subprocess/gis,
+      /\bchild_process.*?spawn\s*\(\s*['"`](bash|sh|cmd|powershell)['"`]/gi,
+      /new\s+WebSocket\s*\(.*?\).*?\.on\s*\(\s*['"`]message['"`].*?eval/gis,
+      /\beval\s*\(\s*require\s*\(\s*['"`]child_process['"`]\s*\)/gi,
+      /\brequire\s*\(\s*['"`]child_process['"`]\s*\)\.exec\s*\(\s*process\.env/gi
+    ],
+    fileExtensions: ['.js', '.ts', '.py', '.php', '.sh', '.ps1', '.rb'],
+    keywords: ['exec', 'spawn', 'socket', 'connect', 'subprocess', 'child_process'],
+    confidence: 95,
+    standards: [
+      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
+      { standard: 'MITRE', id: 'T1059', description: 'Command and Scripting Interpreter' },
+      { standard: 'OWASP', id: 'A03:2021', description: 'Injection' }
+    ]
+  },
+  {
+    id: 'MAL-BACKDOOR-002',
+    name: 'SSH Key Exfiltration',
+    description: 'Attempts to read or exfiltrate SSH private keys',
+    indicator: MalwareIndicator.BACKDOOR,
+    severity: Severity.CRITICAL,
+    patterns: [
+      /\.ssh\/(id_rsa|id_ed25519|id_ecdsa|id_dsa)/gi,
+      /readFileSync\s*\(\s*.*?\.ssh.*?id_/gi,
+      /open\s*\(\s*['"`].*?\.ssh.*?(id_rsa|id_ed25519)/gi,
+      /\$HOME\/\.ssh\/(id_rsa|authorized_keys)/gi,
+      /process\.env\.HOME.*?\.ssh/gi
+    ],
+    fileExtensions: ['.js', '.ts', '.py', '.php', '.rb', '.sh'],
+    keywords: ['.ssh', 'id_rsa', 'private_key', 'authorized_keys'],
+    confidence: 90,
+    standards: [
+      { standard: 'CWE', id: 'CWE-522', description: 'Insufficiently Protected Credentials' },
+      { standard: 'MITRE', id: 'T1552.004', description: 'Private Keys' }
+    ]
+  },
+
+  // ==================== DATA EXFILTRATION PATTERNS ====================
+  {
+    id: 'MAL-EXFIL-001',
+    name: 'Environment Variable Exfiltration',
+    description: 'Sends environment variables (tokens, keys) to external servers',
+    indicator: MalwareIndicator.DATA_EXFILTRATION,
+    severity: Severity.CRITICAL,
+    patterns: [
+      /process\.env.*?(fetch|axios|request|http\.request|https\.request)/gis,
+      /os\.environ.*?requests\.(post|get|put)/gis,
+      /\$_ENV.*?curl_exec/gi,
+      /fetch\s*\(\s*['"`]https?:\/\/(?!localhost|127\.0\.0\.1).*?['"`].*?process\.env/gis,
+      /axios\.(post|put)\s*\(\s*['"`]https?:\/\/.*?['"`].*?process\.env/gis,
+      /JSON\.stringify\s*\(\s*process\.env\s*\)/gi,
+      /Buffer\.from\s*\(\s*JSON\.stringify\s*\(\s*process\.env/gi,
+      /btoa\s*\(\s*JSON\.stringify\s*\(\s*process\.env/gi
+    ],
+    fileExtensions: ['.js', '.ts', '.py', '.php'],
+    keywords: ['process.env', 'os.environ', 'getenv', 'fetch', 'axios', 'request'],
+    confidence: 92,
+    standards: [
+      { standard: 'CWE', id: 'CWE-200', description: 'Exposure of Sensitive Information' },
+      { standard: 'MITRE', id: 'T1041', description: 'Exfiltration Over C2 Channel' }
+    ]
+  },
+  {
+    id: 'MAL-EXFIL-002',
+    name: 'Credential Harvesting',
+    description: 'Attempts to extract and send credentials or tokens',
+    indicator: MalwareIndicator.STEALER,
+    severity: Severity.CRITICAL,
+    patterns: [
+      /localStorage\.(getItem|get)\s*\(\s*['"`].*?(token|auth|session|jwt)/gi,
+      /document\.cookie.*?(fetch|XMLHttpRequest|axios)/gis,
+      /chrome\.storage.*?\.get/gi,
+      /keytar\.getPassword/gi,
+      /credentials?\s*[=:]\s*\{.*?(username|password|token)/gis,
+      /fs\.readFileSync\s*\(\s*['"`].*?(credential|password|secret|token)/gi
+    ],
+    fileExtensions: ['.js', '.ts', '.py', '.php'],
+    keywords: ['token', 'credential', 'password', 'cookie', 'localStorage', 'session'],
+    confidence: 88,
+    standards: [
+      { standard: 'CWE', id: 'CWE-522', description: 'Insufficiently Protected Credentials' },
+      { standard: 'MITRE', id: 'T1555', description: 'Credentials from Password Stores' }
+    ]
+  },
+  {
+    id: 'MAL-EXFIL-003',
+    name: 'DNS Exfiltration',
+    description: 'Uses DNS queries to exfiltrate data',
+    indicator: MalwareIndicator.DATA_EXFILTRATION,
+    severity: Severity.HIGH,
+    patterns: [
+      /dns\.resolve.*?process\.env/gis,
+      /require\s*\(\s*['"`]dns['"`]\s*\)\.resolve.*?\.join/gis,
+      /socket\.gethostbyname\s*\(.*?\+/gi,
+      /nslookup.*?\$\(/gi,
+      /\bdns\.lookup\s*\(\s*`\$\{.*?\}/gi
+    ],
+    fileExtensions: ['.js', '.ts', '.py', '.sh'],
+    keywords: ['dns', 'resolve', 'gethostbyname', 'nslookup'],
+    confidence: 85,
+    standards: [
+      { standard: 'CWE', id: 'CWE-200', description: 'Exposure of Sensitive Information' },
+      { standard: 'MITRE', id: 'T1048.003', description: 'Exfiltration Over Alternative Protocol' }
+    ]
+  },
+
+  // ==================== CRYPTOMINER PATTERNS ====================
+  {
+    id: 'MAL-CRYPTO-001',
+    name: 'Cryptominer Detection',
+    description: 'Detects cryptocurrency mining code',
+    indicator: MalwareIndicator.CRYPTOMINER,
+    severity: Severity.HIGH,
+    patterns: [
+      /\b(coinhive|cryptonight|monero|xmr|stratum)/gi,
+      /CoinHive\.Anonymous/gi,
+      /stratum\+tcp:\/\//gi,
+      /miner\.start\s*\(/gi,
+      /\bCryptoNight\b.*?hash/gis,
+      /pool\.minexmr\.com/gi,
+      /['"`]mining['"`]\s*:\s*true/gi,
+      /WebAssembly\.instantiate.*?miner/gis,
+      /importScripts\s*\(\s*['"`].*?(coinhive|cryptoloot|miner)/gi
+    ],
+    fileExtensions: ['.js', '.ts', '.wasm', '.html', '.php', '.py'],
+    keywords: ['miner', 'hash', 'stratum', 'coinhive', 'monero', 'xmr', 'cryptonight'],
+    confidence: 95,
+    standards: [
+      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
+      { standard: 'MITRE', id: 'T1496', description: 'Resource Hijacking' }
+    ]
+  },
+
+  // ==================== OBFUSCATION PATTERNS ====================
+  {
+    id: 'MAL-OBF-001',
+    name: 'Heavily Obfuscated Code',
+    description: 'Detects suspicious code obfuscation patterns',
+    indicator: MalwareIndicator.OBFUSCATED,
+    severity: Severity.HIGH,
+    patterns: [
+      /eval\s*\(\s*atob\s*\(/gi,
+      /eval\s*\(\s*Buffer\.from\s*\(.*?,\s*['"`]base64['"`]\s*\)/gi,
+      /eval\s*\(\s*String\.fromCharCode\s*\(/gi,
+      /\beval\s*\(\s*unescape\s*\(/gi,
+      /Function\s*\(\s*atob\s*\(/gi,
+      /\beval\s*\(\s*\[\s*\d+.*?\]\.map.*?String\.fromCharCode/gis,
+      /\\x[0-9a-f]{2}(\\x[0-9a-f]{2}){20,}/gi,
+      /\\u[0-9a-f]{4}(\\u[0-9a-f]{4}){20,}/gi,
+      /\['\\x.*?'\]/g,
+      /\(_0x[a-f0-9]+\s*[,)]/gi,
+      /var\s+_0x[a-f0-9]+\s*=/gi
+    ],
+    fileExtensions: ['.js', '.ts', '.php'],
+    keywords: ['eval', 'atob', 'fromCharCode', 'unescape', '_0x'],
+    confidence: 80,
+    standards: [
+      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
+      { standard: 'MITRE', id: 'T1027', description: 'Obfuscated Files or Information' }
+    ]
+  },
+  {
+    id: 'MAL-OBF-002',
+    name: 'Dynamic Code Execution',
+    description: 'Suspicious dynamic code execution patterns',
+    indicator: MalwareIndicator.OBFUSCATED,
+    severity: Severity.MEDIUM,
+    patterns: [
+      /new\s+Function\s*\(\s*['"`]return\s+this['"`]\s*\)\s*\(\)/gi,
+      /\(\s*function\s*\(\s*\)\s*\{\s*return\s+this\s*;\s*\}\s*\)\s*\(\)/gi,
+      /\beval\s*\(\s*`/gi,
+      /\(\s*1\s*,\s*eval\s*\)/gi,
+      /require\s*\(\s*['"`]vm['"`]\s*\)\.runInThisContext/gi,
+      /\bvm\.(run|compile)Script/gi
+    ],
+    fileExtensions: ['.js', '.ts'],
+    keywords: ['eval', 'Function', 'vm', 'runInThisContext'],
+    confidence: 75,
+    standards: [
+      { standard: 'CWE', id: 'CWE-94', description: 'Improper Control of Generation of Code' },
+      { standard: 'MITRE', id: 'T1059.007', description: 'JavaScript' }
+    ]
+  },
+
+  // ==================== LOADER PATTERNS ====================
+  {
+    id: 'MAL-LOADER-001',
+    name: 'Remote Code Loader',
+    description: 'Downloads and executes code from remote server',
+    indicator: MalwareIndicator.LOADER,
+    severity: Severity.CRITICAL,
+    patterns: [
+      /fetch\s*\(.*?\)\.then.*?eval/gis,
+      /axios\.get\s*\(.*?\)\.then.*?eval/gis,
+      /https?\.get\s*\(.*?\).*?\.on\s*\(\s*['"`]data['"`].*?eval/gis,
+      /request\s*\(.*?\).*?eval/gis,
+      /\beval\s*\(\s*await\s+fetch/gi,
+      /child_process.*?exec.*?curl.*?\|.*?node/gi,
+      /child_process.*?exec.*?wget.*?-O.*?\|/gi,
+      /exec\s*\(\s*['"`]curl\s+.*?\|.*?(sh|bash|node|python)/gi,
+      /import\s*\(\s*['"`]https?:\/\//gi
+    ],
+    fileExtensions: ['.js', '.ts', '.py', '.sh'],
+    keywords: ['eval', 'fetch', 'axios', 'curl', 'wget', 'import'],
+    confidence: 93,
+    standards: [
+      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
+      { standard: 'MITRE', id: 'T1105', description: 'Ingress Tool Transfer' }
+    ]
+  },
+  {
+    id: 'MAL-LOADER-002',
+    name: 'Payload Decoder',
+    description: 'Decodes and executes hidden payloads',
+    indicator: MalwareIndicator.LOADER,
+    severity: Severity.HIGH,
+    patterns: [
+      /Buffer\.from\s*\(\s*['"`][A-Za-z0-9+\/=]{50,}['"`]\s*,\s*['"`]base64['"`]\s*\)\.toString\s*\(\s*\).*?eval/gis,
+      /atob\s*\(\s*['"`][A-Za-z0-9+\/=]{50,}['"`]\s*\).*?eval/gis,
+      /base64\.b64decode\s*\(.*?\).*?exec/gis,
+      /zlib\.(inflate|decompress).*?eval/gis,
+      /gunzip.*?eval/gis
+    ],
+    fileExtensions: ['.js', '.ts', '.py'],
+    keywords: ['base64', 'atob', 'Buffer', 'decode', 'decompress'],
+    confidence: 88,
+    standards: [
+      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
+      { standard: 'MITRE', id: 'T1140', description: 'Deobfuscate/Decode Files or Information' }
+    ]
+  },
+
+  // ==================== SUSPICIOUS NETWORK PATTERNS ====================
+  {
+    id: 'MAL-NET-001',
+    name: 'Suspicious Outbound Connection',
+    description: 'Connections to suspicious domains or IPs',
+    indicator: MalwareIndicator.DATA_EXFILTRATION,
+    severity: Severity.HIGH,
+    patterns: [
+      /https?:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?::\d+)?\/[a-z0-9]+/gi,
+      /https?:\/\/[a-z0-9]{20,}\.(tk|ml|ga|cf|gq|top|xyz|work|click)/gi,
+      /\.ngrok\.io/gi,
+      /\.trycloudflare\.com/gi,
+      /pastebin\.(com|raw)/gi,
+      /raw\.githubusercontent\.com.*?\.(js|py|sh|ps1)/gi,
+      /discord(app)?\.com\/api\/webhooks/gi,
+      /api\.telegram\.org\/bot/gi
+    ],
+    fileExtensions: ['.js', '.ts', '.py', '.php', '.sh'],
+    keywords: ['http', 'https', 'fetch', 'request', 'webhook', 'telegram', 'discord'],
+    confidence: 75,
+    standards: [
+      { standard: 'CWE', id: 'CWE-200', description: 'Exposure of Sensitive Information' },
+      { standard: 'MITRE', id: 'T1071', description: 'Application Layer Protocol' }
+    ]
+  },
+  {
+    id: 'MAL-NET-002',
+    name: 'Hardcoded External Endpoint',
+    description: 'Suspicious hardcoded external URLs for data transmission',
+    indicator: MalwareIndicator.DATA_EXFILTRATION,
+    severity: Severity.MEDIUM,
+    patterns: [
+      /['"`]https?:\/\/[a-z0-9.-]+\/[a-z0-9\/]+['"`].*?\.(post|put|send)/gis,
+      /webhook_?url\s*[=:]\s*['"`]https?:\/\//gi,
+      /exfil.*?url/gi,
+      /c2_?(server|url|endpoint)/gi,
+      /beacon.*?url/gi
+    ],
+    fileExtensions: ['.js', '.ts', '.py', '.php'],
+    keywords: ['webhook', 'endpoint', 'server', 'url', 'post', 'send'],
+    confidence: 70,
+    standards: [
+      { standard: 'CWE', id: 'CWE-200', description: 'Exposure of Sensitive Information' },
+      { standard: 'MITRE', id: 'T1102', description: 'Web Service' }
+    ]
+  },
+
+  // ==================== POST-INSTALL SCRIPT PATTERNS ====================
+  {
+    id: 'MAL-POSTINST-001',
+    name: 'Dangerous Post-Install Script',
+    description: 'Post-install script with dangerous commands',
+    indicator: MalwareIndicator.BACKDOOR,
+    severity: Severity.CRITICAL,
+    patterns: [
+      /curl\s+.*?\|\s*(bash|sh|node|python)/gi,
+      /wget\s+.*?-O\s*-\s*\|\s*(bash|sh)/gi,
+      /rm\s+-rf\s+(\/|\$HOME|~)/gi,
+      /chmod\s+777\s+\//gi,
+      /chown\s+.*?:.*?\s+\//gi,
+      />(\/etc\/passwd|\/etc\/shadow)/gi,
+      /base64\s+-d.*?\|\s*(bash|sh)/gi,
+      /\bnc\s+.*?-e\s+(\/bin\/)?(ba)?sh/gi,
+      /\bdd\s+if=\/dev\/zero.*?of=\//gi
+    ],
+    fileExtensions: ['.sh', '.ps1', '.cmd', '.bat', '.js'],
+    keywords: ['curl', 'wget', 'bash', 'sh', 'rm', 'chmod', 'base64'],
+    confidence: 95,
+    standards: [
+      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
+      { standard: 'MITRE', id: 'T1059', description: 'Command and Scripting Interpreter' }
+    ]
+  },
+
+  // ==================== FILE SYSTEM PATTERNS ====================
+  {
+    id: 'MAL-FS-001',
+    name: 'Suspicious File Operations',
+    description: 'Attempts to access sensitive system files',
+    indicator: MalwareIndicator.STEALER,
+    severity: Severity.HIGH,
+    patterns: [
+      /\/etc\/passwd/gi,
+      /\/etc\/shadow/gi,
+      /%APPDATA%.*?(Roaming|Local)/gi,
+      /\$HOME\/\.(bash_history|zsh_history)/gi,
+      /\.aws\/credentials/gi,
+      /\.kube\/config/gi,
+      /\.docker\/config\.json/gi,
+      /\.npmrc.*?_authToken/gi,
+      /\.netrc/gi,
+      /\.pgpass/gi,
+      /\.bash_profile|\.bashrc|\.zshrc/gi
+    ],
+    fileExtensions: ['.js', '.ts', '.py', '.php', '.sh', '.rb'],
+    keywords: ['passwd', 'shadow', 'credentials', 'config', 'history', 'auth'],
+    confidence: 85,
+    standards: [
+      { standard: 'CWE', id: 'CWE-522', description: 'Insufficiently Protected Credentials' },
+      { standard: 'MITRE', id: 'T1005', description: 'Data from Local System' }
+    ]
+  },
+  {
+    id: 'MAL-FS-002',
+    name: 'Browser Data Access',
+    description: 'Attempts to access browser stored data',
+    indicator: MalwareIndicator.STEALER,
+    severity: Severity.HIGH,
+    patterns: [
+      /Chrome.*?User Data.*?(Login Data|Cookies|Local State)/gi,
+      /Firefox.*?Profiles.*?(logins\.json|cookies\.sqlite)/gi,
+      /Microsoft.*?Edge.*?User Data/gi,
+      /Brave.*?User Data/gi,
+      /\.mozilla\/firefox/gi,
+      /\.config\/(google-chrome|chromium)/gi,
+      /Library\/Application Support\/(Google\/Chrome|Firefox)/gi
+    ],
+    fileExtensions: ['.js', '.ts', '.py', '.exe', '.ps1'],
+    keywords: ['Chrome', 'Firefox', 'Edge', 'Brave', 'cookies', 'Login Data'],
+    confidence: 90,
+    standards: [
+      { standard: 'CWE', id: 'CWE-522', description: 'Insufficiently Protected Credentials' },
+      { standard: 'MITRE', id: 'T1539', description: 'Steal Web Session Cookie' }
+    ]
+  },
+
+  // ==================== ANTI-ANALYSIS PATTERNS ====================
+  {
+    id: 'MAL-ANTI-001',
+    name: 'Anti-Debug Techniques',
+    description: 'Attempts to detect or evade debugging',
+    indicator: MalwareIndicator.OBFUSCATED,
+    severity: Severity.MEDIUM,
+    patterns: [
+      /debugger\s*;\s*debugger/gi,
+      /setInterval\s*\(\s*function\s*\(\s*\)\s*\{\s*debugger/gi,
+      /process\.binding\s*\(\s*['"`]inspector['"`]\s*\)/gi,
+      /v8debug|__v8_debug/gi,
+      /IsDebuggerPresent/gi,
+      /CheckRemoteDebuggerPresent/gi,
+      /ptrace\s*\(\s*PTRACE_TRACEME/gi
+    ],
+    fileExtensions: ['.js', '.ts', '.py', '.c', '.cpp'],
+    keywords: ['debugger', 'inspector', 'ptrace', 'debug'],
+    confidence: 70,
+    standards: [
+      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
+      { standard: 'MITRE', id: 'T1622', description: 'Debugger Evasion' }
+    ]
+  },
+  {
+    id: 'MAL-ANTI-002',
+    name: 'VM/Sandbox Detection',
+    description: 'Attempts to detect virtual machine or sandbox environment',
+    indicator: MalwareIndicator.OBFUSCATED,
+    severity: Severity.MEDIUM,
+    patterns: [
+      /vmware|virtualbox|vbox|qemu|hyper-v|xen/gi,
+      /VBOX|VMWARE|VIRTUAL/g,
+      /sandbox|malware|virus|analysis/gi,
+      /process\.env\.COMPUTERNAME.*?(SANDBOX|MALWARE|VIRUS)/gi,
+      /os\.environ.*?(SANDBOX|ANALYSIS)/gi
+    ],
+    fileExtensions: ['.js', '.ts', '.py', '.ps1'],
+    keywords: ['vmware', 'virtualbox', 'sandbox', 'qemu', 'virtual'],
+    confidence: 65,
+    standards: [
+      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
+      { standard: 'MITRE', id: 'T1497', description: 'Virtualization/Sandbox Evasion' }
+    ]
+  }
+];
+
+/**
+ * Suspicious post-install script patterns
+ */
+export const SUSPICIOUS_SCRIPT_PATTERNS: RegExp[] = [
+  // Network commands
+  /\bcurl\b/i,
+  /\bwget\b/i,
+  /\bfetch\b/i,
+  /\brequests\b/i,
+  /\bhttp\b/i,
+  
+  // Execution commands
+  /\beval\b/i,
+  /\bexec\b/i,
+  /\bspawn\b/i,
+  /\bchild_process\b/i,
+  /\bsubprocess\b/i,
+  
+  // Dangerous operations
+  /\brm\s+-rf\b/i,
+  /\bchmod\b/i,
+  /\bsudo\b/i,
+  /\bpowershell\b/i,
+  
+  // Encoding/obfuscation
+  /\bbase64\b/i,
+  /\batob\b/i,
+  /\bdecode\b/i,
+  
+  // Environment access
+  /\bprocess\.env\b/i,
+  /\bos\.environ\b/i,
+  /\bgetenv\b/i
+];
+
+/**
+ * Get pattern by ID
+ */
+export function getPatternById(id: string): MalwarePattern | undefined {
+  return MALWARE_PATTERNS.find(p => p.id === id);
+}
+
+/**
+ * Get patterns by indicator type
+ */
+export function getPatternsByIndicator(indicator: MalwareIndicator): MalwarePattern[] {
+  return MALWARE_PATTERNS.filter(p => p.indicator === indicator);
+}
+
+/**
+ * Get patterns by severity
+ */
+export function getPatternsBySeverity(severity: Severity): MalwarePattern[] {
+  return MALWARE_PATTERNS.filter(p => p.severity === severity);
+}
+
+/**
+ * Get patterns for file extension
+ */
+export function getPatternsForFile(filePath: string): MalwarePattern[] {
+  const ext = '.' + filePath.split('.').pop()?.toLowerCase();
+  return MALWARE_PATTERNS.filter(p => p.fileExtensions.includes(ext));
+}