osintkit 0.4.0__tar.gz → 0.6.0__tar.gz

{osintkit-0.4.0 → osintkit-0.6.0}/CHANGELOG.md

@@ -6,6 +6,28 @@ All notable changes are recorded here. The format follows
 
 ## Unreleased
 
+## 0.6.0 — 2026-11-02
+
+### Added
+
+- `infostealer` collector for Hudson Rock stealer logs across email, username, and domain
+- any stealer infection forces a high risk floor and a rotate-everything recommendation
+
+## 0.5.0 — 2026-11-02
+
+### Added
+
+- breach rows are enriched with date, exposed fields, domain, and record count from the keyless
+  HIBP and XposedOrNot catalogues
+- `osintkit password` checks Pwned Passwords by SHA-1 prefix; no key, no plaintext sent
+- email lookups also collect the address domain's DNS, mail posture, and WHOIS, marked as derived
+- a failed synthesis now falls back to a locally built report instead of an empty one
+
+### Fixed
+
+- large prompts came back empty on reasoning models: token truncation is detected and retried,
+  and the prompt carries at most 15 breach rows
+
 ## 0.4.0 — 2026-11-02
 
 ### Added

{osintkit-0.4.0 → osintkit-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: osintkit
-Version: 0.4.0
+Version: 0.6.0
 Summary: Public-data OSINT aggregator for emails, usernames, domains, and companies
 Project-URL: Homepage, https://github.com/sjdsjadjajdjsa/osintkit
 Project-URL: Issues, https://github.com/sjdsjadjajdjsa/osintkit/issues
@@ -103,6 +103,7 @@ Optional keys: `HIBP_API_KEY` turns on Have I Been Pwned, `GITHUB_TOKEN` lifts G
 | `lookup` | One target, one report (`--email`, `--username`, `--domain`, `--company`) |
 | `batch` | A CSV of targets, run concurrently, reported in order |
 | `diff` | What changed between two archived runs |
+| `password` | Is a password in Pwned Passwords (free, no key, hash-prefix only) |
 | `history` | Past runs, replayable by id |
 | `doctor` | Key, endpoint, and directory checks (`--deep` verifies auth) |
 | `collectors` | Every collector and what it touches |
@@ -132,8 +133,13 @@ target -> type detection -> collectors (parallel, cached, retried)
 Collectors degrade to a logged gap, never a dead run; a report is produced even when sources or
 the model fail.
 
-- **Merged breaches.** Three indexes listing one incident collapse into one row with every
-  source and the earliest date.
+- **Merged, enriched breaches.** Records collapse into one row per incident, keeping every
+  source and the earliest date, then pick up dates and exposed-field lists from the public HIBP
+  and XposedOrNot catalogues. Those catalogues are free; only HIBP *account* checks need a key.
+- **Email domains follow the address.** An email lookup also checks the domain's DNS, mail
+  posture, and WHOIS, marked as derived.
+- **Info-stealer logs.** Hudson Rock reports machines infected by stealers that saved
+  credentials, with dates and hostnames; one infection forces a high risk floor.
 - **Risk floor.** Breach count and credential types set a floor the model may exceed but never
   undercut.
 - **Cached everything.** 24h default, shorter for volatile sources; repeat prompts cost nothing.
@@ -148,6 +154,20 @@ connect probes, GitHub (profile, commits, user search, org repos), psbdmp with a
 grep.app, Hacker News, Stack Exchange, and username presence. The full table is in
 [docs/REFERENCE.md](docs/REFERENCE.md#collectors) or via `osintkit collectors`.
 
+## Breach depth
+
+Breach name lists are free; breach *metadata* is what makes them useful. Every row is joined
+against the public HIBP and XposedOrNot catalogues for date, exposed fields, and record count, so
+the report can say "LinkedIn, 2021-06, emails and password hashes" instead of a bare name. Add a
+`HIBP_API_KEY` (about $4/month) to get per-account membership with the same metadata, plus pastes.
+
+Stealer logs matter more than most breaches: the credentials were live on an infected machine,
+not just leaked years ago. They are queried for every target type, keyless.
+
+Passwords are checked separately with `osintkit password`: Pwned Passwords covers hundreds of
+millions of leaked passwords, needs no key, and only the first five SHA-1 characters leave the
+machine.
+
 ## Safety and legality
 
 - Public data only. No logins, no scraping behind auth, no paid brokers.

{osintkit-0.4.0 → osintkit-0.6.0}/README.md

@@ -71,6 +71,7 @@ Optional keys: `HIBP_API_KEY` turns on Have I Been Pwned, `GITHUB_TOKEN` lifts G
 | `lookup` | One target, one report (`--email`, `--username`, `--domain`, `--company`) |
 | `batch` | A CSV of targets, run concurrently, reported in order |
 | `diff` | What changed between two archived runs |
+| `password` | Is a password in Pwned Passwords (free, no key, hash-prefix only) |
 | `history` | Past runs, replayable by id |
 | `doctor` | Key, endpoint, and directory checks (`--deep` verifies auth) |
 | `collectors` | Every collector and what it touches |
@@ -100,8 +101,13 @@ target -> type detection -> collectors (parallel, cached, retried)
 Collectors degrade to a logged gap, never a dead run; a report is produced even when sources or
 the model fail.
 
-- **Merged breaches.** Three indexes listing one incident collapse into one row with every
-  source and the earliest date.
+- **Merged, enriched breaches.** Records collapse into one row per incident, keeping every
+  source and the earliest date, then pick up dates and exposed-field lists from the public HIBP
+  and XposedOrNot catalogues. Those catalogues are free; only HIBP *account* checks need a key.
+- **Email domains follow the address.** An email lookup also checks the domain's DNS, mail
+  posture, and WHOIS, marked as derived.
+- **Info-stealer logs.** Hudson Rock reports machines infected by stealers that saved
+  credentials, with dates and hostnames; one infection forces a high risk floor.
 - **Risk floor.** Breach count and credential types set a floor the model may exceed but never
   undercut.
 - **Cached everything.** 24h default, shorter for volatile sources; repeat prompts cost nothing.
@@ -116,6 +122,20 @@ connect probes, GitHub (profile, commits, user search, org repos), psbdmp with a
 grep.app, Hacker News, Stack Exchange, and username presence. The full table is in
 [docs/REFERENCE.md](docs/REFERENCE.md#collectors) or via `osintkit collectors`.
 
+## Breach depth
+
+Breach name lists are free; breach *metadata* is what makes them useful. Every row is joined
+against the public HIBP and XposedOrNot catalogues for date, exposed fields, and record count, so
+the report can say "LinkedIn, 2021-06, emails and password hashes" instead of a bare name. Add a
+`HIBP_API_KEY` (about $4/month) to get per-account membership with the same metadata, plus pastes.
+
+Stealer logs matter more than most breaches: the credentials were live on an infected machine,
+not just leaked years ago. They are queried for every target type, keyless.
+
+Passwords are checked separately with `osintkit password`: Pwned Passwords covers hundreds of
+millions of leaked passwords, needs no key, and only the first five SHA-1 characters leave the
+machine.
+
 ## Safety and legality
 
 - Public data only. No logins, no scraping behind auth, no paid brokers.

{osintkit-0.4.0 → osintkit-0.6.0}/docs/REFERENCE.md

@@ -6,6 +6,7 @@ Everything the README leaves out: every flag, every collector, storage, and fail
 
 | Collector | Targets | Source | Needs key |
 | --- | --- | --- | --- |
+| `infostealer` | email / username / domain | Hudson Rock stealer logs | no |
 | `hibp_breaches`, `hibp_pastes` | email | Have I Been Pwned | yes |
 | `xposed_or_not`, `leakcheck_public` | email | free public breach indexes | no |
 | `gravatar` | email | Gravatar | no |
@@ -61,6 +62,28 @@ Explicit `--base-url` and `--model` beat both the provider and the prefix. Tempe
 Per-command: `--json`, `--markdown`, `-o/--out`, `--raw`, `--offline`, `--dry-run`, `--only`, `--skip`,
 `--ports`, `--fail-fast`, `-c/--concurrency`, `--limit`, `--show`, `--days`, `--clear`, `--deep`.
 
+## Info-stealer logs
+
+`infostealer` queries Hudson Rock's keyless endpoint for infections that saved credentials on a
+compromised machine. It returns the infection count, dates, hostnames, IPs, antivirus state, and
+masked logins and passwords. Any infection forces a `high` risk floor; masked values are shown as
+the source provides them and are not usable as credentials.
+
+The address goes to Hudson Rock; nothing else does.
+
+## Breach catalogue enrichment
+
+Breach names from free indexes are joined against `haveibeenpwned.com/api/v3/breaches` (keyless
+catalogue) with an XposedOrNot catalogue fallback, cached a week, to add dates, exposed fields,
+domains, and record counts. At most 15 enriched rows go into the prompt; the true count stays in
+`signals`.
+
+## Password checks
+
+`osintkit password [VALUE]` hashes locally, sends only the five-character SHA-1 prefix to
+`api.pwnedpasswords.com`, and reports the count and a commonness rating. Exit code `1` means
+pwned. `--json` for machines. Nothing about the password beyond the prefix leaves the machine.
+
 ## Configuration file
 
 `osintkit init` writes `~/.config/osintkit/config.toml` (or `$XDG_CONFIG_HOME`) with mode 600 in

{osintkit-0.4.0 → osintkit-0.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "osintkit"
-version = "0.4.0"
+version = "0.6.0"
 description = "Public-data OSINT aggregator for emails, usernames, domains, and companies"
 readme = "README.md"
 requires-python = ">=3.12"

{osintkit-0.4.0 → osintkit-0.6.0}/src/osintkit/__init__.py

@@ -1,3 +1,3 @@
 """osintkit: a public-data OSINT aggregator."""
 
-__version__ = "0.4.0"
+__version__ = "0.6.0"

osintkit-0.6.0/src/osintkit/catalogue.py

@@ -0,0 +1,94 @@
+"""Public breach catalogues used to enrich bare breach names."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+from .errors import OsintKitError
+from .http import HttpClient, cache_hit, cache_put
+
+NAMESPACE = "catalogue"
+TTL = 7 * 24 * 3600
+KEY_RE = re.compile(r"[^a-z0-9]+")
+
+HIBP = "https://haveibeenpwned.com/api/v3/breaches"
+XPOSED = "https://api.xposedornot.com/v1/breaches"
+
+
+def _key(name: str) -> str:
+    return KEY_RE.sub("", name.lower())
+
+
+def _from_hibp(rows: Any) -> dict[str, dict[str, Any]]:
+    if not isinstance(rows, list):
+        return {}
+    out: dict[str, dict[str, Any]] = {}
+    for row in rows:
+        if not isinstance(row, dict):
+            continue
+        name = str(row.get("Name") or row.get("Title") or "").strip()
+        if not name:
+            continue
+        out[_key(name)] = {
+            "name": name,
+            "date": row.get("BreachDate"),
+            "data_types": [str(kind) for kind in row.get("DataClasses") or []],
+            "domain": row.get("Domain"),
+            "pwn_count": row.get("PwnCount"),
+        }
+    return out
+
+
+def _from_xposed(body: Any) -> dict[str, dict[str, Any]]:
+    rows = body.get("exposedBreaches") if isinstance(body, dict) else None
+    if not isinstance(rows, list):
+        return {}
+    out: dict[str, dict[str, Any]] = {}
+    for row in rows:
+        if not isinstance(row, dict):
+            continue
+        name = str(row.get("breachID") or "").strip()
+        if not name:
+            continue
+        out[_key(name)] = {
+            "name": name,
+            "date": (row.get("breachedDate") or "")[:10] or None,
+            "data_types": [str(kind) for kind in row.get("exposedData") or []],
+            "domain": row.get("domain"),
+            "pwn_count": row.get("exposedRecords"),
+        }
+    return out
+
+
+async def _download(http: HttpClient) -> dict[str, dict[str, Any]]:
+    try:
+        response = await http.get(HIBP, namespace=NAMESPACE, accept="application/json")
+        if response.status_code == 200:
+            data = _from_hibp(response.json())
+            if data:
+                return data
+    except (OsintKitError, ValueError):
+        pass
+
+    try:
+        response = await http.get(XPOSED, namespace=NAMESPACE, accept="application/json")
+    except OsintKitError:
+        return {}
+    if response.status_code != 200:
+        return {}
+    try:
+        return _from_xposed(response.json())
+    except ValueError:
+        return {}
+
+
+async def fetch(http: HttpClient) -> dict[str, dict[str, Any]]:
+    """Return breach metadata keyed by normalised name, cached for a week."""
+    cached = cache_hit(http.settings, NAMESPACE, "index", TTL)
+    if cached is not None:
+        return cached
+    data = await _download(http)
+    if data:
+        cache_put(http.settings, NAMESPACE, "index", data)
+    return data

{osintkit-0.4.0 → osintkit-0.6.0}/src/osintkit/cli.py

@@ -18,7 +18,7 @@ from rich.console import Console
 from rich.panel import Panel
 from rich.table import Table
 
-from . import __version__, diff, doctor, pipeline, render, retention, userconfig
+from . import __version__, diff, doctor, passwords, pipeline, render, retention, userconfig
 from .collectors import REGISTRY
 from .config import (
     DEFAULT_RESOLVERS,
@@ -74,7 +74,7 @@ def root(
     model: str | None = typer.Option(None, "--model", help="Model name (overrides the provider default)."),
     api_key: str | None = typer.Option(None, "--api-key", help="API key (or set API_KEY)."),
     temperature: float = typer.Option(0.3, "--temperature", min=0.0, max=2.0),
-    max_tokens: int = typer.Option(2400, "--max-tokens", min=256, max=16000),
+    max_tokens: int = typer.Option(4000, "--max-tokens", min=256, max=16000),
     timeout: float = typer.Option(30.0, "--timeout", help="HTTP timeout in seconds."),
     max_connections: int = typer.Option(16, "--max-connections", min=1, max=64),
     max_attempts: int = typer.Option(3, "--max-attempts", min=1, max=6),
@@ -627,6 +627,50 @@ def init(
     out.print("[dim]try: osintkit lookup --domain example.com[/dim]")
 
 
+@app.command()
+def password(
+    value: str | None = typer.Argument(None, help="Password to check; prompt if omitted."),
+    json_out: bool = typer.Option(False, "--json", help="JSON output."),
+) -> None:
+    """Check a password against Pwned Passwords, without sending it."""
+    out = _console()
+    secret = value
+    if not secret:
+        if not sys.stdin.isatty():
+            secret = sys.stdin.readline().rstrip("\n")
+        if not secret:
+            secret = typer.prompt("Password", hide_input=True)
+    if not secret:
+        out.print("[red]no password given[/red]")
+        raise typer.Exit(2)
+
+    settings: Settings = STATE["settings"]  # type: ignore[assignment]
+
+    async def run() -> dict[str, object]:
+        from .http import HttpClient
+
+        async with HttpClient(settings) as http:
+            return await passwords.check(http, secret)
+
+    try:
+        result = asyncio.run(run())
+    except OsintKitError as exc:
+        out.print(f"[red]{exc}[/red]")
+        raise typer.Exit(1) from exc
+
+    if json_out:
+        print(json.dumps(result, indent=2))
+        return
+    if result["pwned"]:
+        out.print(
+            f"[red]pwned[/red] {result['count']:,} times "
+            f"({result['rating']}); still only the first 5 SHA-1 characters left this machine"
+        )
+        raise typer.Exit(1)
+    out.print(f"[green]not seen[/green] in Pwned Passwords (checked by hash prefix {result['prefix']})")
+    out.print("[yellow]absence is not proof of strength; length and uniqueness still matter[/yellow]")
+
+
 @app.command("config")
 def config_cmd(
     reveal: bool = typer.Option(False, "--reveal", help="Show the key in full."),

{osintkit-0.4.0 → osintkit-0.6.0}/src/osintkit/collectors/__init__.py

@@ -8,6 +8,7 @@ from . import (  # noqa: F401  (import order matters: side-effect registration)
     ct,
     dns,
     github,
+    infostealer,
     pastes,
     ports,
     subdomains,

osintkit-0.6.0/src/osintkit/collectors/infostealer.py

@@ -0,0 +1,71 @@
+"""Info-stealer log exposure via Hudson Rock's keyless endpoint."""
+
+from __future__ import annotations
+
+from urllib.parse import quote
+
+from .base import Context, collector
+
+BASE = "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by"
+MAX_STEALERS = 5
+
+
+def _clean(value: object) -> str | None:
+    text = str(value or "").strip()
+    if not text or text.lower() == "not found":
+        return None
+    return text[:120]
+
+
+def _summary(body: object) -> dict:
+    if not isinstance(body, dict):
+        return {"infected": False, "infections": 0, "stealers": []}
+    raw = body.get("stealers") or []
+    stealers = []
+    for row in raw[:MAX_STEALERS]:
+        if not isinstance(row, dict):
+            continue
+        stealers.append(
+            {
+                "date": (row.get("date_compromised") or "")[:10] or None,
+                "computer": _clean(row.get("computer_name")),
+                "os": _clean(row.get("operating_system")),
+                "ip": _clean(row.get("ip")),
+                "antiviruses": [av for av in row.get("antiviruses") or [] if av != "None"][:5],
+                "logins": [str(item) for item in (row.get("top_logins") or [])[:5]],
+                "passwords": [str(item) for item in (row.get("top_passwords") or [])[:5]],
+            }
+        )
+    return {
+        "infected": bool(stealers),
+        "infections": len(raw),
+        "corporate_services": body.get("total_corporate_services"),
+        "user_services": body.get("total_user_services"),
+        "stealers": stealers,
+        "source": "hudsonrock",
+    }
+
+
+async def _lookup(ctx: Context, kind: str) -> dict:
+    response = await ctx.http.get(
+        f"{BASE}-{kind}",
+        namespace="hudsonrock",
+        params={kind: ctx.target},
+        empty_on=(404, 429),
+        timeout=ctx.http_timeout or 45,
+    )
+    if response.status_code != 200:
+        return {"infected": False, "infections": 0, "stealers": [], "note": f"HTTP {response.status_code}"}
+    try:
+        return _summary(response.json())
+    except ValueError:
+        return {"infected": False, "infections": 0, "stealers": [], "note": "non-JSON"}
+
+
+@collector("infostealer", ("email", "username", "domain"), "Info-stealer log infections", order=5, ttl=43200)
+async def infostealer(ctx: Context) -> dict:
+    kind = {"email": "email", "username": "username", "domain": "domain"}[ctx.target_type]
+    result = await _lookup(ctx, kind)
+    result["target_kind"] = kind
+    result["checked"] = quote(ctx.target)
+    return result

{osintkit-0.4.0 → osintkit-0.6.0}/src/osintkit/config.py

@@ -110,7 +110,7 @@ class Settings:
     model: str = DEFAULT_MODEL
     api_key: str | None = None
     temperature: float = DEFAULT_TEMPERATURE
-    max_tokens: int = 2400
+    max_tokens: int = 4000
     timeout: float = DEFAULT_TIMEOUT
     max_connections: int = 16
     max_attempts: int = DEFAULT_MAX_ATTEMPTS

{osintkit-0.4.0 → osintkit-0.6.0}/src/osintkit/llm.py

@@ -34,7 +34,7 @@ class LLMClient:
         messages: Sequence[Mapping[str, str]],
         *,
         temperature: float | None = None,
-        max_tokens: int = 2400,
+        max_tokens: int = 4000,
         response_format: Mapping[str, Any] | None = None,
     ) -> str:
         api_key = self.settings.resolved_api_key()
@@ -51,6 +51,15 @@ class LLMClient:
         if response_format:
             payload["response_format"] = dict(response_format)
 
+        content, finish = await self._post(payload, api_key)
+        if finish == "length" and not content and max_tokens < 8000:
+            payload["max_tokens"] = min(8000, max_tokens * 2)
+            content, finish = await self._post(payload, api_key)
+        if finish == "length" and not content:
+            raise SynthesisError("model ran out of tokens before answering")
+        return content
+
+    async def _post(self, payload: dict[str, Any], api_key: str | None) -> tuple[str, str | None]:
         try:
             response = await self._http.post_json(
                 self.endpoint(),
@@ -69,7 +78,17 @@ class LLMClient:
             body = response.json()
         except ValueError as exc:
             raise SynthesisError("Model endpoint returned non-JSON") from exc
-        return extract_content(body)
+        return extract_content(body), extract_finish(body)
+
+
+def extract_finish(body: Any) -> str | None:
+    if not isinstance(body, dict):
+        return None
+    choices = body.get("choices")
+    if not isinstance(choices, list) or not choices:
+        return None
+    finish = choices[0].get("finish_reason")
+    return finish if isinstance(finish, str) else None
 
 
 def extract_content(body: Any) -> str:
@@ -86,6 +105,6 @@ def extract_content(body: Any) -> str:
     if isinstance(content, list):
         parts = [c.get("text", "") for c in content if isinstance(c, dict)]
         content = "".join(parts)
-    if not isinstance(content, str) or not content.strip():
-        raise SynthesisError("Model returned empty content")
+    if not isinstance(content, str):
+        return ""
     return content

{osintkit-0.4.0 → osintkit-0.6.0}/src/osintkit/normalise.py

@@ -11,9 +11,10 @@ BREACH_SOURCES = frozenset({"hibp_breaches", "xposed_or_not", "leakcheck_public"
 KEY_RE = re.compile(r"[^a-z0-9]+")
 CREDENTIAL_RE = re.compile(r"pass|hash|credential|secret|token|api[ _-]?key", re.I)
 SEVERITY = ("low", "medium", "high")
+MAX_PROMPT_BREACHES = 15
 
 
-def signals_for(merged: list[dict[str, Any]]) -> dict[str, Any]:
+def signals_for(merged: list[dict[str, Any]], infections: int = 0) -> dict[str, Any]:
     """Compute risk signals the model can check itself against."""
     credential = [
         entry
@@ -21,10 +22,12 @@ def signals_for(merged: list[dict[str, Any]]) -> dict[str, Any]:
         if any(CREDENTIAL_RE.search(str(kind)) for kind in entry.get("data_types", []))
     ]
     count = len(merged)
+    floor = "high" if infections else _floor(count, len(credential))
     return {
         "breach_count": count,
         "credential_bearing": len(credential),
-        "risk_floor": _floor(count, len(credential)),
+        "stealer_infections": infections,
+        "risk_floor": floor,
     }
 
 
@@ -66,7 +69,10 @@ def _records(result: CollectorResult) -> list[dict[str, Any]]:
     return []
 
 
-def merge_breaches(results: list[CollectorResult]) -> tuple[list[CollectorResult], int]:
+def merge_breaches(
+    results: list[CollectorResult],
+    catalogue: dict[str, dict[str, Any]] | None = None,
+) -> tuple[list[CollectorResult], int]:
     """Merge duplicate breach names across sources.
 
     Returns the results to prompt with (breach sources replaced by one index)
@@ -88,18 +94,23 @@ def merge_breaches(results: list[CollectorResult]) -> tuple[list[CollectorResult
             if not name:
                 continue
             key = _key(name)
+            known = (catalogue or {}).get(key) or {}
+            types = set(_strings(entry.get("data_types"))) or set(known.get("data_types") or [])
+            date = entry.get("date") or known.get("date")
             existing = merged.get(key)
             if existing is None:
                 merged[key] = {
                     "name": name,
-                    "date": entry.get("date"),
-                    "data_types": set(_strings(entry.get("data_types"))),
+                    "date": date,
+                    "data_types": types,
                     "sources": {source},
+                    "domain": known.get("domain"),
+                    "pwn_count": known.get("pwn_count"),
                 }
                 continue
             duplicates += 1
-            if not existing["date"] and entry.get("date"):
-                existing["date"] = entry["date"]
+            if not existing["date"] and date:
+                existing["date"] = date
             existing["data_types"].update(_strings(entry.get("data_types")))
             existing["sources"].add(source)
 
@@ -110,13 +121,16 @@ def merge_breaches(results: list[CollectorResult]) -> tuple[list[CollectorResult
         {
             "name": item["name"],
             "date": item["date"],
-            "data_types": sorted(item["data_types"]),
+            "data_types": sorted(item["data_types"])[:8],
             "sources": sorted(item["sources"]),
             "source": ", ".join(sorted(item["sources"])),
+            "domain": item.get("domain"),
+            "pwn_count": item.get("pwn_count"),
         }
         for item in merged.values()
     ]
     rendered.sort(key=lambda item: (-len(item["data_types"]), item["name"].lower()))
+    rendered = rendered[:MAX_PROMPT_BREACHES]
 
     index = CollectorResult(
         collector="breach_index",

{osintkit-0.4.0 → osintkit-0.6.0}/src/osintkit/offline.py

@@ -91,6 +91,15 @@ def _infrastructure(results: list[CollectorResult], report_notes: list[str]) ->
     if isinstance(wildcard, dict) and wildcard.get("wildcard"):
         notes.append("Wildcard DNS is enabled, so unknown labels resolve")
 
+    stealer = _data(results, "infostealer")
+    if isinstance(stealer, dict) and stealer.get("infections"):
+        first = (stealer.get("stealers") or [{}])[0]
+        notes.append(
+            f"{stealer['infections']} info-stealer infection(s)"
+            + (f", latest {first.get('date')}" if first.get("date") else "")
+            + (f" on {first.get('computer')}" if first.get("computer") else "")
+        )
+
     whois = _data(results, "whois_registration")
     if isinstance(whois, dict) and whois.get("registrar"):
         parts = [f"registrar {whois['registrar']}"]
@@ -117,9 +126,16 @@ def _infrastructure(results: list[CollectorResult], report_notes: list[str]) ->
 
 
 def _recommendations(
-    creds: int, mail: dict | None, wildcard: bool, ports: list[int], breach_count: int
+    creds: int,
+    mail: dict | None,
+    wildcard: bool,
+    ports: list[int],
+    breach_count: int,
+    infections: int = 0,
 ) -> list[str]:
     recs: list[str] = []
+    if infections:
+        recs.append("Change every password saved on the infected machine, then sign out all sessions")
     if creds:
         recs.append("Rotate passwords for the affected services and enable MFA where offered")
     elif breach_count:
@@ -142,7 +158,9 @@ def _recommendations(
     return recs
 
 
-def build(results: list[CollectorResult], report_notes: list[str], target: str) -> Analysis:
+def build(
+    results: list[CollectorResult], report_notes: list[str], target: str, *, narrated: bool = False
+) -> Analysis:
     breaches_raw = next((r.data for r in results if r.collector == "breach_index" and r.has_data), [])
     signals = signals_for(breaches_raw)
     accounts = _found_accounts(results)
@@ -158,8 +176,8 @@ def build(results: list[CollectorResult], report_notes: list[str], target: str)
     failed = [r.collector for r in results if not r.ok and not r.skipped]
 
     summary_parts = [
-        f"Collected public data for {target} from {len(collected)} of "
-        f"{len(results)} sources, with no model call."
+        f"Collected public data for {target} from {len(collected)} of {len(results)} sources"
+        + (", with no model call." if not narrated else "; the model returned no summary.")
     ]
     if signals["breach_count"]:
         summary_parts.append(
@@ -174,7 +192,8 @@ def build(results: list[CollectorResult], report_notes: list[str], target: str)
         summary_parts.append(f"Failed sources: {', '.join(failed)}.")
     if skipped:
         summary_parts.append(f"Skipped sources: {', '.join(skipped)}.")
-    summary_parts.append("Risk is computed from counts and policy checks, not narrated.")
+    if not narrated:
+        summary_parts.append("Risk is computed from counts and policy checks, not narrated.")
 
     risk = apply_floor("low", signals["risk_floor"])
     if risky or (wildcard and isinstance(mail, dict) and not mail.get("dmarc_present")):
@@ -201,5 +220,6 @@ def build(results: list[CollectorResult], report_notes: list[str], target: str)
             wildcard,
             risky,
             signals["breach_count"],
+            int((_data(results, "infostealer") or {}).get("infections") or 0),
         ),
     )