registry / @panguard-ai/panguard-trap / 1.8.8

@panguard-ai/panguard-trap@1.8.8

Smart honeypot for attacker profiling / 智慧蜜罐，誘捕並分析攻擊者

AI Security Review

scanned 6h ago · by lpm-firewall-ai

Explicit user-started honeypot listeners capture inbound attacker interactions. Optional telemetry POSTs occur only after a caller supplies `threatCloudEndpoint`; no hard-coded upload host is present. No confirmed malicious or install-time attack surface exists.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `panguard-trap start` or calls `TrapEngine.start()` with enabled services.

Impact

Designed collection of attacker-supplied credentials and commands; source shows no stealthy execution, credential harvesting from the host, or foreign control-surface mutation.

Mechanism

Honeypot network listeners with optional anonymized threat-intelligence upload.

Rationale

Static source inspection supports a package-aligned honeypot implementation, not malicious package behavior. Scanner findings map to explicit listener functionality and dependency-scoped dynamic import, while optional telemetry has privacy and SSRF controls.

Evidence

package.jsondist/cli/index.jsdist/trap-engine.jsdist/threat-cloud-uploader.jsdist/pid-file.jsdist/services/ssh-trap.jsdist/types.jsdist/services/base-service.js

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall lifecycle hook.
dist/cli/index.js starts listeners only on explicit `start`; stop targets its own data-dir PID file.
dist/services/ssh-trap.js dynamically imports only declared dependency `ssh2` and Node built-ins.
dist/threat-cloud-uploader.js requires a supplied HTTPS endpoint, rejects private/reserved hosts and redirects.
dist/threat-cloud-uploader.js uploads anonymized IPs and hashed usernames, not captured passwords.
No child-process, eval/vm, native loading, or broad filesystem harvesting found in packaged JS.

Behavioral surface

Source

CryptoDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 161 KB of source, external domains: help.ubuntu.com, landscape.canonical.com, panguard.ai

Source & flagged code

3 flagged

dist/services/generic-trap.jsView file

Lines 56-96javascript

56 [/iptables\s+-D/i, 'T1562'], // Impair defenses

57 [/rm\s+-rf\s+\//i, 'T1485'], // Data destruction

58 [/xmrig|minerd|cryptonight/i, 'T1496'], // Resource hijacking

59 [/ssh-keygen|authorized_keys/i, 'T1098'], // Account manipulation

60 [/\buname\b|\bwhoami\b|\bid\b/i, 'T1082'], // System information discovery

61 [/ifconfig|ip\s+addr/i, 'T1016'], // System network configuration

62 [/\bps\b\s+(aux|ef)/i, 'T1057'], // Process discovery

63 [/cat\s+\/etc\/passwd/i, 'T1087'], // Account discovery

64 [/find\s+.*-perm/i, 'T1083'], // File & directory discovery

65];

66// ---------------------------------------------------------------------------

67// Fake shell responses for Telnet post-auth

68// ---------------------------------------------------------------------------

69const FAKE_SHELL_RESPONSES = {

70 id: 'uid=1000(admin) gid=1000(admin) groups=1000(admin),27(sudo)',

71 whoami: 'admin',

72 'uname -a': 'Linux server 5.15.0-91-generic #101-Ubuntu SMP Tue Nov 14 13:30:08 UTC 2023 x86_64 GNU/Linux',

73 uname: 'Linux',

74 hostname: 'prod-web-01',

75 uptime: ' 14:32:01 up 42 days, 3:17, 1 user, load average: 0.08, 0.03, 0.01',

76 pwd: '/home/admin',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/services/generic-trap.jsView on unpkg · L76

77 ls: 'backup.tar.gz deploy.sh logs www',

78 'ls -la': 'total 32\ndrwxr-xr-x 4 admin admin 4096 Jan 15 10:00 .\ndrwxr-xr-x 3 root root 4096 Jan 1 00:00 ..\n-rw------- 1 admin admin 512 Jan 15 10:30 .bash_history\n-rw-r--r-- 1 admin admin 8192 Jan 14 12:00 backup.tar.gz\n-rwxr-xr-x 1 admin admin 512 Jan 12 08:00 deploy.sh\ndrwxr-xr-x 2 admin admin 4096 Jan 15 10:00 logs\ndrwxr-xr-x 5 www-data www-data 4096 Jan 10 14:00 www',

79 'cat /etc/passwd': 'root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nadmin:x:1000:1000:admin:/home/admin:/bin/bash\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nmysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/false',

80 ifconfig: 'eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500\n inet 10.0.2.15 netmask 255.255.255.0 broadcast 10.0.2.255',

81 'ps aux': 'USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND\nroot 1 0.0 0.1 169024 11264 ? Ss Jan01 0:05 /sbin/init\nadmin 1234 0.0 0.0 8072 4096 pts/0 Ss 14:32 0:00 -bash\nwww-data 5678 0.0 0.5 256000 40960 ? S Jan10 1:23 nginx: worker',

82 w: ' 14:32:01 up 42 days, 3:17, 1 user, load average: 0.08, 0.03, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nadmin pts/0 10.0.2.2 14:32 0.00s 0.01s 0.00s w',

83 'df -h': 'Filesystem Size Used Avail Use% Mounted on\n/dev/sda1 50G 12G 35G 26% /\ntmpfs 2.0G 0 2.0G 0% /dev/shm',

84 'free -m': ' total used free shared buff/cache available\nMem: 3951 1024 512 128 2415 2600\nSwap: 2048 0 2048',

85 'netstat -tlnp': 'Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program\ntcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 845/sshd\ntcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 5678/nginx\ntcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 1122/mysqld',

86 'cat /etc/os-release': 'NAME="Ubuntu"\nVERSION="22.04.3 LTS (Jammy Jellyfish)"\nID=ubuntu\nVERSION_ID="22.04"',

87};

88// ---------------------------------------------------------------------------

89// FTP Protocol Handler (enhanced)

90// ---------------------------------------------------------------------------

91const ftpHandler = {

92 initialTechnique: 'T1110',

93 getBanner(config) {

94 const banner = config.banner ?? '220 ProFTPD 1.3.8 Server (Panguard) [::ffff:0.0.0.0]\r\n';

95 return Buffer.from(banner, 'utf-8');

96 },

dist/services/ssh-trap.jsView file

Lines 52-121javascript

52 technique: 'T1098',

53 description: 'Account Manipulation',

54 },

55 {

56 pattern: /id\s*$|whoami|uname\s+-a/i,

57 technique:

Source & flagged code

3 flagged · loading source

dist/services/generic-trap.jsView file

76patternName = generic_password severity = medium line = 76 matchedText = pwd: '...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/services/generic-trap.jsView on unpkg · L76

dist/services/ssh-trap.jsView file

101logger.info('SSH honeypot using TCP fallback (ssh2 not available)'); L102: const net = await import('node:net'); L103: this.server = net.createServer((socket) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/services/ssh-trap.jsView on unpkg · L101

72patternName = generic_password severity = medium line = 72 matchedText = pwd: '...

Medium

Secret Pattern

Hardcoded password in dist/services/ssh-trap.js

dist/services/ssh-trap.jsView on unpkg · L72

Findings

4 Medium4 Low

MediumSecret Patterndist/services/generic-trap.js

MediumDynamic Requiredist/services/ssh-trap.js

MediumNetwork

MediumSecret Patterndist/services/ssh-trap.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/services/generic-trap.jsView file

Lines 56-96javascript

56 [/iptables\s+-D/i, 'T1562'], // Impair defenses

57 [/rm\s+-rf\s+\//i, 'T1485'], // Data destruction

58 [/xmrig|minerd|cryptonight/i, 'T1496'], // Resource hijacking

59 [/ssh-keygen|authorized_keys/i, 'T1098'], // Account manipulation

60 [/\buname\b|\bwhoami\b|\bid\b/i, 'T1082'], // System information discovery

61 [/ifconfig|ip\s+addr/i, 'T1016'], // System network configuration

62 [/\bps\b\s+(aux|ef)/i, 'T1057'], // Process discovery

63 [/cat\s+\/etc\/passwd/i, 'T1087'], // Account discovery

64 [/find\s+.*-perm/i, 'T1083'], // File & directory discovery

65];

66// ---------------------------------------------------------------------------

67// Fake shell responses for Telnet post-auth

68// ---------------------------------------------------------------------------

69const FAKE_SHELL_RESPONSES = {

70 id: 'uid=1000(admin) gid=1000(admin) groups=1000(admin),27(sudo)',

71 whoami: 'admin',

72 'uname -a': 'Linux server 5.15.0-91-generic #101-Ubuntu SMP Tue Nov 14 13:30:08 UTC 2023 x86_64 GNU/Linux',

73 uname: 'Linux',

74 hostname: 'prod-web-01',

75 uptime: ' 14:32:01 up 42 days, 3:17, 1 user, load average: 0.08, 0.03, 0.01',

76 pwd: '/home/admin',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/services/generic-trap.jsView on unpkg · L76

77 ls: 'backup.tar.gz deploy.sh logs www',

80 ifconfig: 'eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500\n inet 10.0.2.15 netmask 255.255.255.0 broadcast 10.0.2.255',

82 w: ' 14:32:01 up 42 days, 3:17, 1 user, load average: 0.08, 0.03, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nadmin pts/0 10.0.2.2 14:32 0.00s 0.01s 0.00s w',

83 'df -h': 'Filesystem Size Used Avail Use% Mounted on\n/dev/sda1 50G 12G 35G 26% /\ntmpfs 2.0G 0 2.0G 0% /dev/shm',

84 'free -m': ' total used free shared buff/cache available\nMem: 3951 1024 512 128 2415 2600\nSwap: 2048 0 2048',

86 'cat /etc/os-release': 'NAME="Ubuntu"\nVERSION="22.04.3 LTS (Jammy Jellyfish)"\nID=ubuntu\nVERSION_ID="22.04"',

87};

88// ---------------------------------------------------------------------------

89// FTP Protocol Handler (enhanced)

90// ---------------------------------------------------------------------------

91const ftpHandler = {

92 initialTechnique: 'T1110',

93 getBanner(config) {

94 const banner = config.banner ?? '220 ProFTPD 1.3.8 Server (Panguard) [::ffff:0.0.0.0]\r\n';

95 return Buffer.from(banner, 'utf-8');

96 },

dist/services/ssh-trap.jsView file

Lines 52-121javascript

52 technique: 'T1098',

53 description: 'Account Manipulation',

54 },

55 {

56 pattern: /id\s*$|whoami|uname\s+-a/i,

57 technique: