Codebase Scanner

npm

Docker Hub

A quick and dirty tool to help defend against common developer-focused malware campaigns since many of these go unnoticed by common antivirus software.

A common scam is to have a developer "take a look" at a codebase or perform a "test task", and then it starts exfiltrating data.

When a signature is found, the filename is printed to the console and optionally fixed (if --fix is passed). When fixing, a header is prepended to the file to prevent the malware from running or being imported. This may not be foolproof, so always exercise caution and do everything possible to avoid letting the codebase run any scripts.

Inspired by this experience (obfuscated Javascript steals your browser profiles and other files via a "test task" on freelancing sites, hidden within a seemingly innocuous codebase).

PRs welcome!

Have you found a new signature? Please submit a PR with the signature added to signatures.js and a sample file in the samples/ directory.

To see samples of some of these malicious codebases, check out this repository.

Usage

Scan a repository in a Docker container

docker run -it --rm mathiscode/codebase-scanner:latest
# Enter the repo url: https://github.com/owner/repo
# ☠️ Found malicious signature Obfuscated Javascript (Buffered "child_process") in file /path/to/codebase/malware.js

Scan a local codebase

# Just scan
npx @mathiscode/codebase-scanner@latest /path/to/codebase
# ☠️ Found malicious signature Obfuscated Javascript (Buffered "child_process") in file /path/to/codebase/malware.js

# Scan and fix
npx @mathiscode/codebase-scanner@latest --fix /path/to/codebase
# ☠️ Found malicious signature Obfuscated Javascript (Buffered "child_process") in file /path/to/codebase/malware.js
# ⚠️ Detected and modified file /path/to/codebase/malware.js - review immediately

Scan all dependencies of a project (package.json)

npx @mathiscode/codebase-scanner@latest --deps /path/to/codebase

Scan an npm package:

npx @mathiscode/codebase-scanner@latest --npm package-name
# ☠️ Found malicious signature Obfuscated Javascript (Buffered "child_process") in file /path/to/codebase/malware.js

Exit Codes

The tool will exit with a non-zero exit code if malicious code is found. This can be used to fail CI pipelines.

Exit Codes:

• 0: No malicious code found
• 1: Malicious code found
• 2: Error

JSON Output

The tool can output a JSON array of detections. This can be used in more complex flows.

npx @mathiscode/codebase-scanner@latest --json /path/to/codebase

[
  {
    "file": "/path/to/codebase/malware.js",
    "triggered": true,
    "level": "malicious",
    "index": 0,
    "name": "Obfuscated Javascript (Buffered \"child_process\")"
  }
]

Malicious File Header

When a file is fixed, the following header is prepended to the file:

========= MALICIOUS ========= [hidden unicode characters to help break loading]
This file has been flagged as malicious by https://github.com/mathiscode/codebase-scanner
Please review the file and remove these lines if appropriate.
========= MALICIOUS ========= [hidden unicode characters to help break loading]