package-detection-cli/banner_test.txt at main · teamoptimadev/package-detection-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104

██████╗  █████╗  ██████╗██╗
██╗ █████╗  ██████╗ ███████╗
██╔══██╗██╔══██╗██╔════╝██║
██╔╝██╔══██╗██╔════╝ ██╔════╝
██████╔╝███████║██║     █████╔╝
███████║██║  ███╗█████╗
██╔═══╝ ██╔══██║██║     ██╔═██╗
██╔══██║██║   ██║██╔══╝
██║     ██║  ██║╚██████╗██║
██╗██║  ██║╚██████╔╝███████╗
╚═╝     ╚═╝  ╚═╝ ╚═════╝╚═╝
╚═╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝

██████╗
███████╗████████╗███████╗
██████╗████████╗ ██████╗
██████╗
██╔══██╗██╔════╝╚══██╔══╝██╔═══
═╝██╔════╝╚══██╔══╝██╔═══██╗██╔
══██╗
██║  ██║█████╗     ██║   █████╗
██║        ██║   ██║
██║██████╔╝
██║  ██║██╔══╝     ██║   ██╔══╝
██║        ██║   ██║
██║██╔══██╗
██████╔╝███████╗   ██║
███████╗╚██████╗   ██║
╚██████╔╝██║  ██║
╚═════╝ ╚══════╝   ╚═╝
╚══════╝ ╚═════╝   ╚═╝
╚═════╝ ╚═╝  ╚═╝


Loading weights:   0%|          | 0/103 [00:00<?, ?it/s]
Loading weights: 100%|██████████| 103/103 [00:00<00:00, 6226.50it/s]


╭── 🛡️ PD Security Analysis ──╮
│                             │
│   Package: cross-env (npm)  │
│   Verdict: MALICIOUS        │
│   Risk Score: 100/100       │
│                             │
╰────── Analyzer v0.1.0 ──────╯
╭─── 🔍 Detected Behaviors ───╮
│   Indicator         Level   │
│   •             SUSPICIO…   │
│   ENV_VARIA…                │
│   •              CRITICAL   │
│   IMPORT_SE…                │
│   •              CRITICAL   │
│   SHELL_EXE…                │
╰─────────────────────────────╯
╭─ 🔗 Threat Database Match ──╮
│ Topic: Data Exfiltration    │
│ (Environment Variables)     │
│ Similarity: 77%             │
│ "The package likely reads   │
│ API keys or AWS credentials │
│ and sends them to a remote  │
│ server."                    │
╰─────────────────────────────╯
╭─── 🧠 AI Security Logic ────╮
│                             │
│  Step 1: Extracted          │
│  Behaviors                  │
│  The code exhibits 3        │
│  distinct behavioral        │
│  indicators, specifically:  │
│  ENV_VARIABLE_ACCESS,       │
│  IMPORT_SENSITIVE_JS_CROSS  │
│  -SPAWN, SHELL_EXECUTION.   │
│                             │
│  Step 2: Threat Pattern     │
│  Match (RAG)                │
│  Match found in vector      │
│  database with 77%          │
│  similarity to 'Data        │
│  Exfiltration (Environment  │
│  Variables)'.               │
│  Description: The package   │
│  likely reads API keys or   │
│  AWS credentials and sends  │
│  them to a remote server.   │
│                             │
│  Step 3: Correlation &      │
│  Verdict                    │
│  CRITICAL: The combination  │
│  of sensitive imports,      │
│  network activity, and      │
│  shell execution is highly  │
│  characteristic of          │
│  supply-chain attacks. The  │
│  risk of data exfiltration  │
│  or credential theft is     │
│  extremely high.            │
│                             │
│  Confidence: High           │
│                             │
╰─────────────────────────────╯