Rules and placeholder for more upcoming checks

Signed-off-by: Ashish Bijlani <ashish.bijlani@gmail.com>

Author: ashishbijlani

.packj.yaml

@@ -31,15 +31,22 @@ audit:
       cryptominer:
         - reason: package is a cryptominer
         - enabled: true
+
     #
     # alert category: suspicious packages (potentially malicious)
     #
     suspicious:
       inconsistent with repo source:
-        - reason: package code inconsistent with the public repo source code
+        - reason: package code differs from public repo source code, indicating malicious intention
         - enabled: true
       overwrites system binaries:
-        - reason: package code inconsistent with the public repo source code
+        - reason: overwriting system binaries such as /bin/ls suggests malware persistence
+        - enabled: true
+      risky API sequence:
+        - reason: package code uses risky API sequence such as decode() followed by exec() or eval()
+        - enabled: true
+      anomalous dependency version:
+        - reason: a anomalously high dependency version could indicate confusion attack
         - enabled: true
 
     #
@@ -106,6 +113,14 @@ audit:
         - reason: custom installation hooks may download or execute malicious code
         - enabled: true
 
+      contains executable or other binary blobs:
+        - reason: binary blobs cannot be analyzed accurately and are used to hide malware
+        - enabled: true
+
+      noisy package:
+        - reason: package is a typo-guard, placeholder, dummy, empty, or troll package
+        - enabled: true
+
       #
       # type: repo stats
       #

packj/audit/main.py

@@ -210,6 +210,16 @@ def analyze_deps(pm_proxy, pkg_name, ver_str, pkg_info, ver_info, risks, report)
 	finally:
 		return risks, report
 
+def analyze_install_hooks(pm_proxy, pkg_name, pkg_info, risks, report):
+	try:
+		msg_info('Checking for install-time hooks...', end='', flush=True)
+		# TODO
+		msg_warn('Coming soon!')
+	except Exception as e:
+		msg_fail(str(e))
+	finally:
+		return risks, report
+
 def analyze_typosquatting(pm_proxy, pkg_name, pkg_info, risks, report):
 	try:
 		msg_info('Checking for typo-squatting...', end='', flush=True)
@@ -512,7 +522,12 @@ def analyze_composition(pm_name, pkg_name, ver_str, filepath, risks, report):
 			language=LanguageEnum.ruby
 		else:
 			raise Exception(f'Package manager {pm_name} is not supported!')
+	except Exception as e:
+		msg_fail(str(e))
+		return risks, report
 
+	# analyze package composition
+	try:
 		num_files, lang_files, num_funcs, total_loc = parse_package_composition(
 			pkg_name,
 			ver_str,
@@ -534,10 +549,28 @@ def analyze_composition(pm_name, pkg_name, ver_str, filepath, risks, report):
 		}
 	except Exception as e:
 		msg_fail(str(e))
+
+	# check if this package contains executables or other binary blobs and alert the user
+	try:
+		msg_info('Checking for exe/binary blobs...', end='', flush=True, indent=1)
+		# TODO
+		msg_warn('Coming soon!')
+	except Exception as e:
+		msg_fail(str(e))
+
+	#
+	# check if this package is a noisy package:
+	# i.e., typo-guard, placeholder, dummy, empty, or troll package
+	#
+	try:
+		msg_info('Checking if a noisy package...', end='', flush=True, indent=1)
+		# TODO
+		msg_warn('Coming soon!')
+	except Exception as e:
+		msg_fail(str(e))
 	finally:
 		return risks, report
 
-
 class Risk(tuple, Enum):
 	FILE_IO = 'accesses files and dirs', 'file'
 	USER_IO = 'reads user input', None	# should this really be None?
@@ -587,7 +620,12 @@ def analyze_apis(pm_name, pkg_name, ver_str, filepath, risks, report):
 			system = 'ruby'
 		else:
 			raise Exception(f'Package manager {pm_name} is not supported!')
+	except Exception as e:
+		msg_fail(str(e))
+		return risks, report
 
+	# analyze code for APIs
+	try:
 		static = get_static_proxy_for_language(language=language)
 		try:
 			static.astgen(inpath=filepath, outfile=filepath+'.out', root=None, configpath=configpath,
@@ -720,6 +758,7 @@ def audit(pm_args, pkg_name, ver_str, report_dir, extra_args):
 	risks, report = analyze_readme(pm_proxy, pkg_name, ver_str, pkg_info, risks, report)
 	risks, report = analyze_homepage(pm_proxy, pkg_name, ver_str, pkg_info, risks, report)
 	risks, report = analyze_downloads(pm_proxy, pkg_name, pkg_info, risks, report)
+	risks, report = analyze_install_hooks(pm_proxy, pkg_name, pkg_info, risks, report)
 	risks, report = analyze_typosquatting(pm_proxy, pkg_name, pkg_info, risks, report)
 	risks, report = analyze_dep_confusion(pm_proxy, pkg_name, pkg_info, risks, report)
 	risks, report = analyze_repo_url(pm_proxy, pkg_name, ver_str, pkg_info, ver_info, risks, report)