chore(security): add malware/injected-code scanner

Author: stackmasteraliza

scripts/scan-malware.cjs

@@ -0,0 +1,204 @@
+#!/usr/bin/env node
+/**
+ * scan-malware.cjs — install-time malware / injected-code validator.
+ * Detects: PolinRider injectors (global['!']=/global['_V']=, fromCharCode(127),
+ * require-hijack, constructor-eval, _$_ vars, long obfuscated lines), GlassWorm
+ * zero-width unicode, BeaverTail blockchain/Telegram C2, file masquerade,
+ * Shai-Hulud binding.gyp shell-exec, dropper lifecycle scripts.
+ * Exit 0 = clean, 1 = CRITICAL (block), 2 = scan error. Reads as text only.
+ */
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const ROOT = path.join(__dirname, '..');
+const SELF = path.resolve(__filename);
+const args = process.argv.slice(2);
+const DEEP = args.includes('--deep') || process.env.MALWARE_SCAN_DEEP === '1';
+const QUIET = args.includes('--quiet');
+const CODE_EXT = new Set(['.js', '.cjs', '.mjs', '.jsx', '.ts', '.tsx']);
+const BINARY_EXT = new Set(['.woff', '.woff2', '.ttf', '.otf', '.png', '.jpg', '.jpeg', '.gif', '.ico', '.wasm']);
+const SKIP_DIRS = new Set(['.git', '.next', 'dist', 'build', 'coverage', '.turbo', '_archive']);
+const MAX_FILE_BYTES = 2 * 1024 * 1024;
+const C = {
+  red: (s) => `\x1b[31m${s}\x1b[0m`, yellow: (s) => `\x1b[33m${s}\x1b[0m`,
+  green: (s) => `\x1b[32m${s}\x1b[0m`, dim: (s) => `\x1b[2m${s}\x1b[0m`, bold: (s) => `\x1b[1m${s}\x1b[0m`,
+};
+const SIGNATURES = [
+  { id: 'charcode-127', re: /String\.fromCharCode\(\s*127\s*\)/, desc: 'fromCharCode(127) string-descrambler (known injector)' },
+  { id: 'global-bang', re: /global\s*\[\s*['"]!['"]\s*\]\s*=/, desc: "global['!']=<any> persistence marker (PolinRider)" },
+  { id: 'global-V', re: /global\s*\[\s*['"]_V['"]\s*\]\s*=/, desc: "global['_V']=<any> persistence marker (PolinRider variant)" },
+  { id: 'require-hijack', re: /=\s*require\s*;\s*if\s*\(\s*typeof\s+module/, desc: 'require/module global hijack' },
+  { id: 'constructor-eval', re: /\[\s*['"]constructor['"]\s*\]\s*\[\s*['"]constructor['"]\s*\]/, desc: 'Function-constructor eval (obfuscated)' },
+  { id: 'underscore-dollar', re: /_\$_[0-9a-fA-F]{3,}\b/, desc: '_$_XXXX obfuscation variables' },
+];
+const C2_ENDPOINTS = /\b(?:trongrid\.io|api\.trongrid\.io|aptoslabs\.com|fullnode\.[a-z]+\.aptoslabs\.com|bsc-dataseed[0-9]*\.(?:binance|bnbchain)\.org|api\.telegram\.org\/bot[0-9]+:[A-Za-z0-9_-]+)\b/i;
+// Zero-width / joiner code points. Emoji selectors U+FE00–FE0F EXCLUDED on purpose.
+const ZERO_WIDTH = /[\u200B\u200C\u200D\u2060\uFEFF]/;
+const ZERO_WIDTH_G = /[\u200B\u200C\u200D\u2060\uFEFF]/g;
+const ZERO_WIDTH_RUN = /[\u200B\u200C\u200D\u2060\uFEFF]{4,}/;
+const SCRIPT_DANGER =
+  /fromCharCode|base64\s+(?:-d|--decode)|\batob\s*\(|\beval\s*\(|(?:curl|wget)\b[^\n]*\|\s*(?:sh|bash)|\bcurl\b[^\n]*\bhttp|\bwget\b[^\n]*\bhttp/i;
+const LIFECYCLE = ['preinstall', 'install', 'postinstall', 'prepare', 'preuninstall'];
+const findings = [];
+let scannedFiles = 0;
+const BUNDLE_PATH = /(?:\.min\.(?:c|m)?js|[.-]bundle\.js|bundled\.js|standalone-preset\.js)$|(?:^|[\\/])(?:dist|client-dist|umd|esm|generated)[\\/]/i;
+
+function scanText(rel, text, inNodeModules) {
+  const lines = text.split('\n');
+  const longLines = lines.reduce((n, l) => n + (l.length > 1500 ? 1 : 0), 0);
+  const looksBundled =
+    lines.length <= 3 || longLines / Math.max(lines.length, 1) > 0.05 || BUNDLE_PATH.test(rel);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    for (const sig of SIGNATURES) {
+      if (sig.re.test(line)) {
+        findings.push({ sev: 'CRITICAL', file: rel, line: i + 1, id: sig.id, desc: sig.desc, snippet: line.trim().slice(0, 100) });
+      }
+    }
+    if (C2_ENDPOINTS.test(line)) {
+      findings.push({ sev: 'CRITICAL', file: rel, line: i + 1, id: 'c2-endpoint', desc: 'blockchain/Telegram C2 endpoint (second-stage fetch or exfiltration)', snippet: line.trim().slice(0, 100) });
+    }
+    if (!looksBundled && line.length > 1500 && /String\.fromCharCode/.test(line) &&
+        /\beval\s*\(|\bFunction\s*\(|\[\s*['"]constructor['"]\s*\]|global\s*\[\s*['"]/.test(line)) {
+      findings.push({ sev: 'CRITICAL', file: rel, line: i + 1, id: 'long-obfuscated-line', desc: 'anomalous long obfuscated line (descrambler + exec sink) in a non-bundled file', snippet: line.trim().slice(0, 80) + '…' });
+    }
+  }
+  if (!inNodeModules) {
+    const zwAll = text.match(ZERO_WIDTH_G) || [];
+    if (ZERO_WIDTH_RUN.test(text) || zwAll.length >= 8) {
+      const idx = text.search(ZERO_WIDTH);
+      const lineNo = idx < 0 ? 0 : text.slice(0, idx).split('\n').length;
+      findings.push({ sev: 'CRITICAL', file: rel, line: lineNo, id: 'zero-width-unicode', desc: `invisible zero-width/joiner payload in source (${zwAll.length} chars) — GlassWorm injection`, snippet: `${zwAll.length} hidden zero-width chars` });
+    }
+  }
+}
+function scanFile(abs, inNodeModules) {
+  const rel = path.relative(ROOT, abs);
+  if (path.resolve(abs) === SELF) return;
+  let stat; try { stat = fs.statSync(abs); } catch { return; }
+  if (stat.size > MAX_FILE_BYTES) return;
+  let text; try { text = fs.readFileSync(abs, 'utf8'); } catch { return; }
+  scannedFiles++; scanText(rel, text, inNodeModules);
+}
+const MAGIC = {
+  '.woff': [0x77, 0x4f, 0x46, 0x46], '.woff2': [0x77, 0x4f, 0x46, 0x32],
+  '.ttf': [0x00, 0x01, 0x00, 0x00], '.otf': [0x4f, 0x54, 0x54, 0x4f],
+  '.png': [0x89, 0x50, 0x4e, 0x47], '.jpg': [0xff, 0xd8, 0xff], '.jpeg': [0xff, 0xd8, 0xff],
+  '.gif': [0x47, 0x49, 0x46, 0x38], '.ico': [0x00, 0x00, 0x01, 0x00], '.wasm': [0x00, 0x61, 0x73, 0x6d],
+};
+const JS_TELLS = /\brequire\s*\(|\bmodule\.exports\b|\bprocess\.(env|argv|exit)\b|\bchild_process\b|=>|\bfunction\b|\beval\s*\(|\bglobal\s*\[/;
+function scanMasquerade(abs) {
+  const rel = path.relative(ROOT, abs);
+  const ext = path.extname(abs).toLowerCase();
+  let fd; try { fd = fs.openSync(abs, 'r'); } catch { return; }
+  const buf = Buffer.alloc(256); let n = 0;
+  try { n = fs.readSync(fd, buf, 0, 256, 0); } finally { fs.closeSync(fd); }
+  if (n === 0) return;
+  const head = buf.subarray(0, n);
+  const expected = MAGIC[ext];
+  const altFontOk = (ext === '.ttf' || ext === '.otf') &&
+    (head.subarray(0, 4).toString('latin1') === 'true' || head.subarray(0, 4).toString('latin1') === 'OTTO' || head.subarray(0, 4).toString('latin1') === 'ttcf');
+  const magicOk = altFontOk || (expected && expected.every((b, i) => head[i] === b));
+  if (magicOk) return;
+  const asText = head.toString('utf8');
+  const printableRatio = [...head].filter((b) => b === 9 || b === 10 || b === 13 || (b >= 32 && b < 127)).length / n;
+  if (printableRatio > 0.85 && JS_TELLS.test(asText)) {
+    findings.push({ sev: 'CRITICAL', file: rel, line: 0, id: 'file-masquerade', desc: `"${ext}" file contains JavaScript/text instead of binary (payload masquerade)`, snippet: asText.replace(/\s+/g, ' ').trim().slice(0, 100) });
+  }
+}
+function walk(dir, intoNodeModules) {
+  let entries; try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+  for (const e of entries) {
+    const abs = path.join(dir, e.name);
+    if (e.isDirectory()) {
+      if (SKIP_DIRS.has(e.name)) continue;
+      if (e.name === 'node_modules' && !intoNodeModules) continue;
+      walk(abs, intoNodeModules);
+    } else {
+      const ext = path.extname(e.name).toLowerCase();
+      if (CODE_EXT.has(ext)) scanFile(abs, intoNodeModules);
+      else if (BINARY_EXT.has(ext)) scanMasquerade(abs);
+    }
+  }
+}
+function scanDependencyScripts() {
+  const nm = path.join(ROOT, 'node_modules');
+  if (!fs.existsSync(nm)) return;
+  const stack = [nm]; let pkgCount = 0;
+  while (stack.length) {
+    const dir = stack.pop();
+    let entries; try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      if (!e.isDirectory()) continue;
+      const sub = path.join(dir, e.name);
+      const pj = path.join(sub, 'package.json');
+      if (fs.existsSync(pj)) {
+        pkgCount++;
+        try {
+          const json = JSON.parse(fs.readFileSync(pj, 'utf8'));
+          const scripts = json.scripts || {};
+          for (const hook of LIFECYCLE) {
+            const cmd = scripts[hook];
+            if (typeof cmd === 'string' && SCRIPT_DANGER.test(cmd)) {
+              findings.push({ sev: 'CRITICAL', file: path.relative(ROOT, pj), line: 0, id: `dep-script:${hook}`, desc: `dependency "${json.name || e.name}" has a malicious-looking ${hook} script`, snippet: cmd.slice(0, 100) });
+            }
+          }
+        } catch { /* ignore */ }
+        const nestedNm = path.join(sub, 'node_modules');
+        if (fs.existsSync(nestedNm)) stack.push(nestedNm);
+      } else { stack.push(sub); }
+    }
+  }
+  return pkgCount;
+}
+const GYP_DANGER = /<!@?\s*\([^)]*?(?:\bcurl\b|\bwget\b|\bfetch\b|https?:\/\/|\|\s*(?:sh|bash)\b|\bbase64\b|\beval\b|child_process|node\s+-e\b)[^)]*\)/i;
+function scanNativeBuildConfigs() {
+  const nm = path.join(ROOT, 'node_modules');
+  if (!fs.existsSync(nm)) return 0;
+  const stack = [nm]; let gypCount = 0;
+  while (stack.length) {
+    const dir = stack.pop();
+    let entries; try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      const abs = path.join(dir, e.name);
+      if (e.isDirectory()) { stack.push(abs); continue; }
+      if (e.name === 'binding.gyp' || path.extname(e.name) === '.gyp' || path.extname(e.name) === '.gypi') {
+        gypCount++;
+        let text; try { text = fs.readFileSync(abs, 'utf8'); } catch { continue; }
+        if (GYP_DANGER.test(text)) {
+          const m = text.match(GYP_DANGER);
+          findings.push({ sev: 'CRITICAL', file: path.relative(ROOT, abs), line: 0, id: 'gyp-shell-exec', desc: 'binding.gyp runs download/shell during node-gyp rebuild (Shai-Hulud vector)', snippet: (m ? m[0] : '').replace(/\s+/g, ' ').slice(0, 100) });
+        }
+      }
+    }
+  }
+  return gypCount;
+}
+function main() {
+  walk(ROOT, false);
+  const pkgs = scanDependencyScripts();
+  scanNativeBuildConfigs();
+  if (DEEP) walk(path.join(ROOT, 'node_modules'), true);
+  const critical = findings.filter((f) => f.sev === 'CRITICAL');
+  const warns = findings.filter((f) => f.sev === 'WARN');
+  if (!findings.length) {
+    if (!QUIET) console.log(C.green('✓ [malware-scan] clean') + C.dim(` — ${scannedFiles} files, ${pkgs || 0} packages${DEEP ? ' (deep)' : ''}`));
+    process.exit(0);
+  }
+  console.log(C.bold('\n[malware-scan] findings:'));
+  for (const f of critical) {
+    console.log('  ' + C.red('CRITICAL ') + C.bold(f.id) + ' — ' + f.desc);
+    console.log(C.dim(`     ${f.file}${f.line ? ':' + f.line : ''}  ${f.snippet}`));
+  }
+  for (const f of warns) {
+    console.log('  ' + C.yellow('WARN     ') + C.bold(f.id) + ' — ' + f.desc);
+    console.log(C.dim(`     ${f.file}  ${f.snippet}`));
+  }
+  if (critical.length) {
+    console.log(C.red(`\n✗ ${critical.length} CRITICAL malware signature(s) found.`) + C.dim('\n  Do NOT run/build. Clean the file(s) above, rotate any secrets, and inspect the dependency that introduced it.\n'));
+    process.exit(1);
+  }
+  console.log(C.yellow('\n warnings only.\n'));
+  process.exit(0);
+}
+try { main(); } catch (err) { console.error('[malware-scan] scan error:', err && err.message ? err.message : err); process.exit(2); }