@mathiscode/codebase-scanner

[ { "name": "Obfuscated Javascript (Base64 \"platform\")", "signature": "cGxhdGZvcm0", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "malicious" }, { "name": "Obfuscated Javascript (Base64 \"eval\")", "signature": "ZXZhbAo=", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "malicious" }, { "name": "Obfuscated Javascript (Base64 \"team15\")", "signature": "dGVhbTE1", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "malicious" }, { "name": "Obfuscated Javascript (Buffered \"child_process\")", "signature": "FhwPVBErFkoaFwNLBg", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "malicious" }, { "name": "Obfuscated Javascript (Buffered \"Local State\")", "signature": "ORsFWRlUNUwUAAM", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "malicious" }, { "name": "Obfuscated Javascript (Hex Functions)", "signature": "function(_0x", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "malicious" }, { "name": "Obfuscated Javascript (Function Constructor)", "signature": "new Function(", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "malicious" }, { "name": "Evaluated Response (res)", "signature": "eval(res", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "malicious" }, { "name": "Evaluated Response (err)", "signature": "eval(err", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "malicious" }, { "name": "Eval", "signature": "eval(", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "warning" }, { "name": "Malicious Endpoint (Fake Alchemy API)", "signature": "alchemy-api-v3.cloud", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "malicious" }, { "name": "Escaped Unicode", "signature": "\\u0", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "warning" }, { "name": "Reassigned Eval", "signature": "=eval", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "malicious" }, { "name": "Reassigned Eval", "signature": "= eval", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "malicious" }, { "name": "Obfuscated Javascript (Hex Variable Array Access)", "regex": true, "signature": "_0x[a-f0-9]{4,}\\[", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "malicious" }, { "name": "Obfuscated Javascript (String.fromCharCode)", "signature": "String.fromCharCode(", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "warning" }, { "name": "Obfuscated Javascript (parseInt High Radix)", "regex": true, "signature": "parseInt\\([^,]+,\\s*(?:[1-9]\\d+|[2-9])\\)", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "warning" }, { "name": "Obfuscated Javascript (Encoded Constructor)", "signature": "modsbeulqtcnrcgprwofjtcixoakrhvuytnsz", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "malicious" }, { "name": "Excessive Whitespace", "regex": true, "signature": "\\s{80,}", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx" ], "level": "warning" }, { "name": "Obfuscated Python (PyArmor Runtime Import)", "signature": "from pytransform import pyarmor_runtime", "extensions": [ "py" ], "level": "malicious" }, { "name": "Obfuscated Python (PyArmor Runtime Call)", "signature": "pyarmor_runtime()", "extensions": [ "py" ], "level": "malicious" }, { "name": "Obfuscated Python (PyArmor Hook)", "signature": "__pyarmor__(", "extensions": [ "py" ], "level": "malicious" }, { "name": "Python Eval Call", "signature": "eval(", "extensions": [ "py" ], "level": "malicious" }, { "name": "Python Exec Call", "signature": "exec(", "extensions": [ "py" ], "level": "warning" }, { "name": "Python Base64 Decode", "signature": "base64.b64decode(", "extensions": [ "py" ], "level": "warning" }, { "name": "Python Marshal Load", "signature": "marshal.loads(", "extensions": [ "py" ], "level": "malicious" }, { "name": "Pyminifier Artifact", "signature": "# Created by pyminifier", "extensions": [ "py" ], "level": "warning" }, { "name": "Unicode Private Use Area Characters", "regex": true, "signature": "[\\uE000-\\uF8FF\\U000F0000-\\U000FFFFD\\U00100000-\\U0010FFFD]", "extensions": [ "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx", "json", "py" ], "level": "malicious" } ]