registry / @panguard-ai/panguard-trap / 1.8.4

@panguard-ai/panguard-trap@1.8.4

Smart honeypot for attacker profiling / 智慧蜜罐，誘捕並分析攻擊者

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The package intentionally runs honeypot network services only after explicit API or CLI startup. Optional telemetry sends minimized trap intelligence to a caller-configured HTTPS endpoint; no unconsented installation-time behavior is present.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `panguard-trap start` or calls `TrapEngine.start()` with enabled services.

Impact

Captures data supplied by remote honeypot visitors and may transmit anonymized reports only when an endpoint is configured.

Mechanism

Explicit honeypot listeners with optional sanitized telemetry upload.

Rationale

The suspicious primitives are aligned with the advertised, explicitly invoked honeypot function. Source inspection found no install-time execution, credential/environment harvesting, remote payload execution, or covert persistence.

Evidence

package.jsondist/cli/index.jsdist/trap-engine.jsdist/threat-cloud-uploader.jsdist/pid-file.jsdist/services/ssh-trap.jsdist/services/generic-trap.js/var/lib/panguard/trap/panguard-trap.pid

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/cli/index.js` directly runs `start` only when invoked as the package CLI.
`dist/services/*-trap.js` implement network-facing honeypot listeners and record remote credentials/commands.
`dist/threat-cloud-uploader.js` can POST anonymized trap intelligence to a caller-supplied endpoint.

Evidence against

`package.json` has no preinstall, install, postinstall, or other lifecycle hook.
Imports only export APIs; runtime service startup requires explicit `panguard-trap start` or `TrapEngine.start()`.
Cloud upload initializes only when both `feedThreatCloud` and a user-provided `threatCloudEndpoint` are set.
Uploader hashes usernames, omits passwords, requires HTTPS, blocks private/reserved hosts, and rejects redirects.
Filesystem writes are limited to a PID file under the configured data directory.
No shell execution, eval/vm, payload loading, environment harvesting, or AI-agent configuration mutation found.

Behavioral surface

Source

CryptoDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 161 KB of source, external domains: help.ubuntu.com, landscape.canonical.com, panguard.ai

Source & flagged code

3 flagged

dist/services/generic-trap.jsView file

Lines 56-96javascript

56 [/iptables\s+-D/i, 'T1562'], // Impair defenses

57 [/rm\s+-rf\s+\//i, 'T1485'], // Data destruction

58 [/xmrig|minerd|cryptonight/i, 'T1496'], // Resource hijacking

59 [/ssh-keygen|authorized_keys/i, 'T1098'], // Account manipulation

60 [/\buname\b|\bwhoami\b|\bid\b/i, 'T1082'], // System information discovery

61 [/ifconfig|ip\s+addr/i, 'T1016'], // System network configuration

62 [/\bps\b\s+(aux|ef)/i, 'T1057'], // Process discovery

63 [/cat\s+\/etc\/passwd/i, 'T1087'], // Account discovery

64 [/find\s+.*-perm/i, 'T1083'], // File & directory discovery

65];

66// ---------------------------------------------------------------------------

67// Fake shell responses for Telnet post-auth

68// ---------------------------------------------------------------------------

69const FAKE_SHELL_RESPONSES = {

70 id: 'uid=1000(admin) gid=1000(admin) groups=1000(admin),27(sudo)',

71 whoami: 'admin',

72 'uname -a': 'Linux server 5.15.0-91-generic #101-Ubuntu SMP Tue Nov 14 13:30:08 UTC 2023 x86_64 GNU/Linux',

73 uname: 'Linux',

74 hostname: 'prod-web-01',

75 uptime: ' 14:32:01 up 42 days, 3:17, 1 user, load average: 0.08, 0.03, 0.01',

76 pwd: '/home/admin',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/services/generic-trap.jsView on unpkg · L76

77 ls: 'backup.tar.gz deploy.sh logs www',

78 'ls -la': 'total 32\ndrwxr-xr-x 4 admin admin 4096 Jan 15 10:00 .\ndrwxr-xr-x 3 root root 4096 Jan 1 00:00 ..\n-rw------- 1 admin admin 512 Jan 15 10:30 .bash_history\n-rw-r--r-- 1 admin admin 8192 Jan 14 12:00 backup.tar.gz\n-rwxr-xr-x 1 admin admin 512 Jan 12 08:00 deploy.sh\ndrwxr-xr-x 2 admin admin 4096 Jan 15 10:00 logs\ndrwxr-xr-x 5 www-data www-data 4096 Jan 10 14:00 www',

79 'cat /etc/passwd': 'root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nadmin:x:1000:1000:admin:/home/admin:/bin/bash\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nmysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/false',

80 ifconfig: 'eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500\n inet 10.0.2.15 netmask 255.255.255.0 broadcast 10.0.2.255',

81 'ps aux': 'USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND\nroot 1 0.0 0.1 169024 11264 ? Ss Jan01 0:05 /sbin/init\nadmin 1234 0.0 0.0 8072 4096 pts/0 Ss 14:32 0:00 -bash\nwww-data 5678 0.0 0.5 256000 40960 ? S Jan10 1:23 nginx: worker',

82 w: ' 14:32:01 up 42 days, 3:17, 1 user, load average: 0.08, 0.03, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nadmin pts/0 10.0.2.2 14:32 0.00s 0.01s 0.00s w',

83 'df -h': 'Filesystem Size Used Avail Use% Mounted on\n/dev/sda1 50G 12G 35G 26% /\ntmpfs 2.0G 0 2.0G 0% /dev/shm',

84 'free -m': ' total used free shared buff/cache available\nMem: 3951 1024 512 128 2415 2600\nSwap: 2048 0 2048',

85 'netstat -tlnp': 'Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program\ntcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 845/sshd\ntcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 5678/nginx\ntcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 1122/mysqld',

86 'cat /etc/os-release': 'NAME="Ubuntu"\nVERSION="22.04.3 LTS (Jammy Jellyfish)"\nID=ubuntu\nVERSION_ID="22.04"',

87};

88// ---------------------------------------------------------------------------

89// FTP Protocol Handler (enhanced)

90// ---------------------------------------------------------------------------

91const ftpHandler = {

92 initialTechnique: 'T1110',

93 getBanner(config) {

94 const banner = config.banner ?? '220 ProFTPD 1.3.8 Server (Panguard) [::ffff:0.0.0.0]\r\n';

95 return Buffer.from(banner, 'utf-8');

96 },

dist/services/ssh-trap.jsView file

Lines 52-121javascript

52 technique: 'T1098',

53 description: 'Account Manipulation',

54 },

55 {

56 pattern: /id\s*$|whoami|uname\s+-a/i,

57 technique:

Source & flagged code

3 flagged · loading source

dist/services/generic-trap.jsView file

76patternName = generic_password severity = medium line = 76 matchedText = pwd: '...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/services/generic-trap.jsView on unpkg · L76

dist/services/ssh-trap.jsView file

101logger.info('SSH honeypot using TCP fallback (ssh2 not available)'); L102: const net = await import('node:net'); L103: this.server = net.createServer((socket) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/services/ssh-trap.jsView on unpkg · L101

72patternName = generic_password severity = medium line = 72 matchedText = pwd: '...

Medium

Secret Pattern

Hardcoded password in dist/services/ssh-trap.js

dist/services/ssh-trap.jsView on unpkg · L72

Findings

4 Medium4 Low

MediumSecret Patterndist/services/generic-trap.js

MediumDynamic Requiredist/services/ssh-trap.js

MediumNetwork

MediumSecret Patterndist/services/ssh-trap.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/services/generic-trap.jsView file

Lines 56-96javascript

56 [/iptables\s+-D/i, 'T1562'], // Impair defenses

57 [/rm\s+-rf\s+\//i, 'T1485'], // Data destruction

58 [/xmrig|minerd|cryptonight/i, 'T1496'], // Resource hijacking

59 [/ssh-keygen|authorized_keys/i, 'T1098'], // Account manipulation

60 [/\buname\b|\bwhoami\b|\bid\b/i, 'T1082'], // System information discovery

61 [/ifconfig|ip\s+addr/i, 'T1016'], // System network configuration

62 [/\bps\b\s+(aux|ef)/i, 'T1057'], // Process discovery

63 [/cat\s+\/etc\/passwd/i, 'T1087'], // Account discovery

64 [/find\s+.*-perm/i, 'T1083'], // File & directory discovery

65];

66// ---------------------------------------------------------------------------

67// Fake shell responses for Telnet post-auth

68// ---------------------------------------------------------------------------

69const FAKE_SHELL_RESPONSES = {

70 id: 'uid=1000(admin) gid=1000(admin) groups=1000(admin),27(sudo)',

71 whoami: 'admin',

72 'uname -a': 'Linux server 5.15.0-91-generic #101-Ubuntu SMP Tue Nov 14 13:30:08 UTC 2023 x86_64 GNU/Linux',

73 uname: 'Linux',

74 hostname: 'prod-web-01',

75 uptime: ' 14:32:01 up 42 days, 3:17, 1 user, load average: 0.08, 0.03, 0.01',

76 pwd: '/home/admin',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/services/generic-trap.jsView on unpkg · L76

77 ls: 'backup.tar.gz deploy.sh logs www',

80 ifconfig: 'eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500\n inet 10.0.2.15 netmask 255.255.255.0 broadcast 10.0.2.255',

82 w: ' 14:32:01 up 42 days, 3:17, 1 user, load average: 0.08, 0.03, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nadmin pts/0 10.0.2.2 14:32 0.00s 0.01s 0.00s w',

83 'df -h': 'Filesystem Size Used Avail Use% Mounted on\n/dev/sda1 50G 12G 35G 26% /\ntmpfs 2.0G 0 2.0G 0% /dev/shm',

84 'free -m': ' total used free shared buff/cache available\nMem: 3951 1024 512 128 2415 2600\nSwap: 2048 0 2048',

86 'cat /etc/os-release': 'NAME="Ubuntu"\nVERSION="22.04.3 LTS (Jammy Jellyfish)"\nID=ubuntu\nVERSION_ID="22.04"',

87};

88// ---------------------------------------------------------------------------

89// FTP Protocol Handler (enhanced)

90// ---------------------------------------------------------------------------

91const ftpHandler = {

92 initialTechnique: 'T1110',

93 getBanner(config) {

94 const banner = config.banner ?? '220 ProFTPD 1.3.8 Server (Panguard) [::ffff:0.0.0.0]\r\n';

95 return Buffer.from(banner, 'utf-8');

96 },

dist/services/ssh-trap.jsView file

Lines 52-121javascript

52 technique: 'T1098',

53 description: 'Account Manipulation',

54 },

55 {

56 pattern: /id\s*$|whoami|uname\s+-a/i,

57 technique: