guarddog 2.0.5__py3-none-any.whl → 2.0.6__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- guarddog/analyzer/sourcecode/exfiltrate-sensitive-data.yml +1 -1
- guarddog/analyzer/sourcecode/npm-exfiltrate-sensitive-data.yml +13 -5
- guarddog/analyzer/sourcecode/shady-links.yml +3 -2
- {guarddog-2.0.5.dist-info → guarddog-2.0.6.dist-info}/METADATA +2 -2
- {guarddog-2.0.5.dist-info → guarddog-2.0.6.dist-info}/RECORD +10 -10
- {guarddog-2.0.5.dist-info → guarddog-2.0.6.dist-info}/LICENSE +0 -0
- {guarddog-2.0.5.dist-info → guarddog-2.0.6.dist-info}/LICENSE-3rdparty.csv +0 -0
- {guarddog-2.0.5.dist-info → guarddog-2.0.6.dist-info}/NOTICE +0 -0
- {guarddog-2.0.5.dist-info → guarddog-2.0.6.dist-info}/WHEEL +0 -0
- {guarddog-2.0.5.dist-info → guarddog-2.0.6.dist-info}/entry_points.txt +0 -0
|
@@ -5,7 +5,7 @@ rules:
|
|
|
5
5
|
metadata:
|
|
6
6
|
description: Identify when a package reads and exfiltrates sensitive data from the local system
|
|
7
7
|
pattern-sources:
|
|
8
|
-
- pattern: os.environ
|
|
8
|
+
- pattern: os.environ
|
|
9
9
|
- pattern: '[... for ... in os.environ.items()]'
|
|
10
10
|
- pattern: socket.gethostname()
|
|
11
11
|
- pattern: getpass.getuser()
|
|
@@ -10,6 +10,19 @@ rules:
|
|
|
10
10
|
- patterns:
|
|
11
11
|
- pattern-either:
|
|
12
12
|
- pattern: process.env
|
|
13
|
+
|
|
14
|
+
- patterns:
|
|
15
|
+
- pattern-either: # after defining fs
|
|
16
|
+
- pattern-inside: |
|
|
17
|
+
$OS = require('os')
|
|
18
|
+
...
|
|
19
|
+
- pattern-either:
|
|
20
|
+
# match use of ootb functions
|
|
21
|
+
- pattern: $OS. ... .homedir()
|
|
22
|
+
- pattern: $OS. ... .hostname()
|
|
23
|
+
- pattern: $OS. ... .userInfo()
|
|
24
|
+
|
|
25
|
+
|
|
13
26
|
- patterns:
|
|
14
27
|
- pattern-either: # after defining fs
|
|
15
28
|
- pattern-inside: |
|
|
@@ -31,11 +44,6 @@ rules:
|
|
|
31
44
|
import $FS from 'fs/promises'
|
|
32
45
|
...
|
|
33
46
|
- pattern-either:
|
|
34
|
-
# match use of ootb functions
|
|
35
|
-
- pattern: $FS. ... .homedir()
|
|
36
|
-
- pattern: $FS. ... .hostname()
|
|
37
|
-
- pattern: $FS. ... .userInfo()
|
|
38
|
-
|
|
39
47
|
# match access to sensitive files
|
|
40
48
|
- patterns:
|
|
41
49
|
- pattern-either:
|
|
@@ -31,8 +31,8 @@ rules:
|
|
|
31
31
|
- pattern: ("...")
|
|
32
32
|
- pattern-either:
|
|
33
33
|
# complete domains
|
|
34
|
-
- pattern-regex: ((?:https?:\/\/)?[^\n\[\/\?#"']*?(bit\.ly|discord\.com|workers\.dev|transfer\.sh|filetransfer\.io|sendspace\.com|appdomain\.cloud|backblazeb2\.com\|paste\.ee|ngrok\.io|termbin\.com|localhost\.run|webhook\.site|oastify\.com|burpcollaborator\.me)
|
|
35
|
-
- pattern-regex: ((?:https?:\/\/)?[^\n\[\/\?#"']*?(oast\.(pro|live|site|online|fun|me)|api\.telegram\.org|rentry\.co)
|
|
34
|
+
- pattern-regex: ((?:https?:\/\/)?[^\n\[\/\?#"']*?(bit\.ly|discord\.com|workers\.dev|transfer\.sh|filetransfer\.io|sendspace\.com|appdomain\.cloud|backblazeb2\.com\|paste\.ee|ngrok\.io|termbin\.com|localhost\.run|webhook\.site|oastify\.com|burpcollaborator\.me)\b)
|
|
35
|
+
- pattern-regex: ((?:https?:\/\/)?[^\n\[\/\?#"']*?(oast\.(pro|live|site|online|fun|me)|api\.telegram\.org|rentry\.co|ngrok-free\.(app|dev))\b)
|
|
36
36
|
# top-level domains
|
|
37
37
|
- pattern-regex: (https?:\/\/[^\n\[\/\?#"']*?\.(link|xyz|tk|ml|ga|cf|gq|pw|top|club|mw|bd|ke|am|sbs|date|quest|cd|bid|cd|ws|icu|cam|uno|email|stream)\/)
|
|
38
38
|
# IPv4
|
|
@@ -46,6 +46,7 @@ rules:
|
|
|
46
46
|
- "*/test_*"
|
|
47
47
|
languages:
|
|
48
48
|
- javascript
|
|
49
|
+
- json
|
|
49
50
|
- python
|
|
50
51
|
- typescript
|
|
51
52
|
- go
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.1
|
|
2
2
|
Name: guarddog
|
|
3
|
-
Version: 2.0.
|
|
3
|
+
Version: 2.0.6
|
|
4
4
|
Summary: GuardDog is a CLI tool to Identify malicious PyPI packages
|
|
5
5
|
Home-page: https://github.com/DataDog/guarddog
|
|
6
6
|
License: Apache-2.0
|
|
@@ -18,7 +18,7 @@ Requires-Dist: colorama (>=0.4.6,<0.5.0)
|
|
|
18
18
|
Requires-Dist: configparser (>=5.3,<8.0)
|
|
19
19
|
Requires-Dist: disposable-email-domains (>=0.0.103,<0.0.108)
|
|
20
20
|
Requires-Dist: prettytable (>=3.6.0,<4.0.0)
|
|
21
|
-
Requires-Dist: pygit2 (>=1.11,<1.
|
|
21
|
+
Requires-Dist: pygit2 (>=1.11,<1.17)
|
|
22
22
|
Requires-Dist: python-dateutil (>=2.8.2,<3.0.0)
|
|
23
23
|
Requires-Dist: python-whois (>=0.8,<0.10)
|
|
24
24
|
Requires-Dist: pyyaml (>=6.0,<7.0)
|
|
@@ -47,17 +47,17 @@ guarddog/analyzer/sourcecode/code-execution.yml,sha256=gbnbvpnmSCY3Q5BANziWCRA-J
|
|
|
47
47
|
guarddog/analyzer/sourcecode/dll-hijacking.yml,sha256=GwsOIN8lgmKhMk9IibDm1lHE6roPNYVnTx62Cd470qc,3337
|
|
48
48
|
guarddog/analyzer/sourcecode/download-executable.yml,sha256=8Q1Swughd3xuYA_yYfrWJItJOaZet2-xO8pc5WMCjk8,3055
|
|
49
49
|
guarddog/analyzer/sourcecode/exec-base64.yml,sha256=Wg1jI_ff9I58Xq8gt8wXOQMrwHcPnzkAPyAURxnKHgw,2371
|
|
50
|
-
guarddog/analyzer/sourcecode/exfiltrate-sensitive-data.yml,sha256=
|
|
50
|
+
guarddog/analyzer/sourcecode/exfiltrate-sensitive-data.yml,sha256=hUxQEsJ4qF_25oMF8pdzAFOzq59m6k28WKz280uyaMg,2264
|
|
51
51
|
guarddog/analyzer/sourcecode/npm-dll-hijacking.yml,sha256=TPIXvWm8Ot9RVtDXWFmoNZw9-3PH7NuXK6x1fQCiRt4,3506
|
|
52
52
|
guarddog/analyzer/sourcecode/npm-exec-base64.yml,sha256=zc5w2FTlHoZ7ot1flzlmYBkQu1I8eG1E63S5Aki7Goc,814
|
|
53
|
-
guarddog/analyzer/sourcecode/npm-exfiltrate-sensitive-data.yml,sha256=
|
|
53
|
+
guarddog/analyzer/sourcecode/npm-exfiltrate-sensitive-data.yml,sha256=0FO91YbLuy0t4YwzE-g6fPfHPYMU4GW9TS3gbRS6Ras,3218
|
|
54
54
|
guarddog/analyzer/sourcecode/npm-install-script.yml,sha256=6BLe_V0SGEi1C79Y-FEIcMYHl4vLOOz8bLPrCU5jre8,1329
|
|
55
55
|
guarddog/analyzer/sourcecode/npm-obfuscation.yml,sha256=FAW9toHYU8adzKv5E68M29OQ4sLO89GwORsXpSr2-50,2026
|
|
56
56
|
guarddog/analyzer/sourcecode/npm-serialize-environment.yml,sha256=gFpr58INp44ZwxYZlIHyzpOgbVMDLv1ZRPTGAczX5dw,835
|
|
57
57
|
guarddog/analyzer/sourcecode/npm-silent-process-execution.yml,sha256=qnJHGesNPNpxGa8n2kQMpttLGck-6vZjI_SsweDyk7M,3513
|
|
58
58
|
guarddog/analyzer/sourcecode/npm-steganography.yml,sha256=XH0udcriAQq_6WOHAG4TpIedw8GgKyWx9gsG_Q_Fki8,915
|
|
59
59
|
guarddog/analyzer/sourcecode/obfuscation.yml,sha256=EwGwmQSftIvyDZ0BZZBT37kS7chtO99s36MfXeZ6hHw,1091
|
|
60
|
-
guarddog/analyzer/sourcecode/shady-links.yml,sha256=
|
|
60
|
+
guarddog/analyzer/sourcecode/shady-links.yml,sha256=ESosXckp2cFJl3Qr_cLDjw6kn_7mKzuWNlQJIfPH0ps,2504
|
|
61
61
|
guarddog/analyzer/sourcecode/silent-process-execution.yml,sha256=b6RjenMv7si7lXGak3uMmD7PMtQRuKPeJFggPW6UDNI,418
|
|
62
62
|
guarddog/analyzer/sourcecode/steganography.yml,sha256=3ceO6SJhu4XpZEjfwelLdOxeZ4Ho1OgUjbcacwtOhR0,606
|
|
63
63
|
guarddog/cli.py,sha256=TPSKAb9b6AHZB3rqtqd4zZeoCYWMYhEdCOzwFvMJQYI,13185
|
|
@@ -77,10 +77,10 @@ guarddog/utils/archives.py,sha256=jOXAhxZx-mTtpDidGGKxQg052CvaQOAVklvOeUn9HTQ,25
|
|
|
77
77
|
guarddog/utils/config.py,sha256=Msz7altsmNKry0vBPtL2BJ_VdBXsBFZX5ksLvXc2ix4,1403
|
|
78
78
|
guarddog/utils/exceptions.py,sha256=23Kzl3exqYK6X-bcGUeb8wPmSglWNX3GIDPkJ6lQzo4,54
|
|
79
79
|
guarddog/utils/package_info.py,sha256=TFjE1xsGNf60SuHlIeDV2pzMUbogl5TKJdSzswat6jI,953
|
|
80
|
-
guarddog-2.0.
|
|
81
|
-
guarddog-2.0.
|
|
82
|
-
guarddog-2.0.
|
|
83
|
-
guarddog-2.0.
|
|
84
|
-
guarddog-2.0.
|
|
85
|
-
guarddog-2.0.
|
|
86
|
-
guarddog-2.0.
|
|
80
|
+
guarddog-2.0.6.dist-info/LICENSE,sha256=w1aNZxHyoyOPJ4fSdiyrr06tCJZbTjCsH9K1uqeDVyU,11377
|
|
81
|
+
guarddog-2.0.6.dist-info/LICENSE-3rdparty.csv,sha256=cS61ONZL_xlXaTMvQXyBEi3J3es-40Gg6G-6idoa5Qk,314
|
|
82
|
+
guarddog-2.0.6.dist-info/METADATA,sha256=x8uspSp2ai-CjVt_DYzsMrb9QUWL27k6ojs6gODlhK8,1471
|
|
83
|
+
guarddog-2.0.6.dist-info/NOTICE,sha256=nlyNt2IjG8IBoQkb7n6jszwAvmREpKAx0POzFO1s2JM,140
|
|
84
|
+
guarddog-2.0.6.dist-info/WHEEL,sha256=Nq82e9rUAnEjt98J6MlVmMCZb-t9cYE2Ir1kpBmnWfs,88
|
|
85
|
+
guarddog-2.0.6.dist-info/entry_points.txt,sha256=vX2fvhnNdkbEL4pDzrH2NqjWVxeOaEYi0sJYmNgS2-s,45
|
|
86
|
+
guarddog-2.0.6.dist-info/RECORD,,
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|