registry / @panguard-ai/panguard-trap / 1.8.9

@panguard-ai/panguard-trap@1.8.9

Smart honeypot for attacker profiling / 智慧蜜罐，誘捕並分析攻擊者

AI Security Review

scanned 5h ago · by lpm-firewall-ai

User-invoked honeypot listeners accept attacker traffic and retain credential/command attempts in memory. Optional cloud telemetry posts anonymized IPs, hashed usernames, and attack metadata only after caller configuration. No install-time execution, hidden payload loading, foreign control-surface mutation, or host credential harvesting was found.

Static reason

One or more suspicious static signals were detected.

Trigger

Import and call `TrapEngine.start()` or run `panguard-trap start`; cloud upload additionally requires `feedThreatCloud` and `threatCloudEndpoint`.

Impact

Intentionally collects attacker-supplied authentication attempts and command inputs; optionally shares minimized derived telemetry.

Mechanism

Protocol honeypot listeners with optional HTTPS threat-intelligence telemetry.

Rationale

This package implements its advertised honeypot function: it listens on configured ports, profiles inbound attacker activity, and has opt-in configured cloud telemetry. Static hints reflect this declared behavior; direct source inspection found no concrete malicious chain.

Evidence

package.jsondist/cli/index.jsdist/trap-engine.jsdist/threat-cloud-uploader.jsdist/pid-file.jsdist/services/ssh-trap.jsdist/services/generic-trap.jsdist/services/http-trap.jsdist/services/mysql-trap.jsdist/services/redis-trap.jsdist/services/smb-trap.jsdist/services/rdp-trap.js

Network endpoints1

<caller-configured HTTPS threatCloudEndpoint>/api/trap-intel

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/services/*-trap.js` deliberately captures credentials and commands from inbound honeypot clients.
`dist/threat-cloud-uploader.js` can POST derived trap intelligence to a configured HTTPS endpoint.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
`dist/cli/index.js` only starts services when directly invoked as the `panguard-trap` CLI.
`dist/trap-engine.js` creates the uploader only when a caller enables cloud feeding and supplies `threatCloudEndpoint`.
`dist/threat-cloud-uploader.js` anonymizes source IPs, hashes usernames, rejects non-HTTPS/private endpoints, and disallows redirects.
`dist/services/ssh-trap.js` dynamic import loads the declared `ssh2` dependency; recorded `exec` commands receive fake responses rather than OS execution.
`dist/pid-file.js` only manages a PID file under the selected data directory.

Behavioral surface

Source

CryptoDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 161 KB of source, external domains: help.ubuntu.com, landscape.canonical.com, panguard.ai

Source & flagged code

3 flagged

dist/services/generic-trap.jsView file

Lines 56-96javascript

56 [/iptables\s+-D/i, 'T1562'], // Impair defenses

57 [/rm\s+-rf\s+\//i, 'T1485'], // Data destruction

58 [/xmrig|minerd|cryptonight/i, 'T1496'], // Resource hijacking

59 [/ssh-keygen|authorized_keys/i, 'T1098'], // Account manipulation

60 [/\buname\b|\bwhoami\b|\bid\b/i, 'T1082'], // System information discovery

61 [/ifconfig|ip\s+addr/i, 'T1016'], // System network configuration

62 [/\bps\b\s+(aux|ef)/i, 'T1057'], // Process discovery

63 [/cat\s+\/etc\/passwd/i, 'T1087'], // Account discovery

64 [/find\s+.*-perm/i, 'T1083'], // File & directory discovery

65];

66// ---------------------------------------------------------------------------

67// Fake shell responses for Telnet post-auth

68// ---------------------------------------------------------------------------

69const FAKE_SHELL_RESPONSES = {

70 id: 'uid=1000(admin) gid=1000(admin) groups=1000(admin),27(sudo)',

71 whoami: 'admin',

72 'uname -a': 'Linux server 5.15.0-91-generic #101-Ubuntu SMP Tue Nov 14 13:30:08 UTC 2023 x86_64 GNU/Linux',

73 uname: 'Linux',

74 hostname: 'prod-web-01',

75 uptime: ' 14:32:01 up 42 days, 3:17, 1 user, load average: 0.08, 0.03, 0.01',

76 pwd: '/home/admin',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/services/generic-trap.jsView on unpkg · L76

77 ls: 'backup.tar.gz deploy.sh logs www',

78 'ls -la': 'total 32\ndrwxr-xr-x 4 admin admin 4096 Jan 15 10:00 .\ndrwxr-xr-x 3 root root 4096 Jan 1 00:00 ..\n-rw------- 1 admin admin 512 Jan 15 10:30 .bash_history\n-rw-r--r-- 1 admin admin 8192 Jan 14 12:00 backup.tar.gz\n-rwxr-xr-x 1 admin admin 512 Jan 12 08:00 deploy.sh\ndrwxr-xr-x 2 admin admin 4096 Jan 15 10:00 logs\ndrwxr-xr-x 5 www-data www-data 4096 Jan 10 14:00 www',

79 'cat /etc/passwd': 'root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nadmin:x:1000:1000:admin:/home/admin:/bin/bash\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nmysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/false',

80 ifconfig: 'eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500\n inet 10.0.2.15 netmask 255.255.255.0 broadcast 10.0.2.255',

81 'ps aux': 'USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND\nroot 1 0.0 0.1 169024 11264 ? Ss Jan01 0:05 /sbin/init\nadmin 1234 0.0 0.0 8072 4096 pts/0 Ss 14:32 0:00 -bash\nwww-data 5678 0.0 0.5 256000 40960 ? S Jan10 1:23 nginx: worker',

82 w: ' 14:32:01 up 42 days, 3:17, 1 user, load average: 0.08, 0.03, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nadmin pts/0 10.0.2.2 14:32 0.00s 0.01s 0.00s w',

83 'df -h': 'Filesystem Size Used Avail Use% Mounted on\n/dev/sda1 50G 12G 35G 26% /\ntmpfs 2.0G 0 2.0G 0% /dev/shm',

84 'free -m': ' total used free shared buff/cache available\nMem: 3951 1024 512 128 2415 2600\nSwap: 2048 0 2048',

85 'netstat -tlnp': 'Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program\ntcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 845/sshd\ntcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 5678/nginx\ntcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 1122/mysqld',

86 'cat /etc/os-release': 'NAME="Ubuntu"\nVERSION="22.04.3 LTS (Jammy Jellyfish)"\nID=ubuntu\nVERSION_ID="22.04"',

87};

88// ---------------------------------------------------------------------------

89// FTP Protocol Handler (enhanced)

90// ---------------------------------------------------------------------------

91const ftpHandler = {

92 initialTechnique: 'T1110',

93 getBanner(config) {

94 const banner = config.banner ?? '220 ProFTPD 1.3.8 Server (Panguard) [::ffff:0.0.0.0]\r\n';

95 return Buffer.from(banner, 'utf-8');

96 },

dist/services/ssh-trap.jsView file

Lines 52-121javascript

52 technique: 'T1098',

53 description: 'Account Manipulation',

54 },

55 {

56 pattern: /id\s*$|whoami|uname\s+-a/i,

57 technique:

Source & flagged code

3 flagged · loading source

dist/services/generic-trap.jsView file

76patternName = generic_password severity = medium line = 76 matchedText = pwd: '...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/services/generic-trap.jsView on unpkg · L76

dist/services/ssh-trap.jsView file

101logger.info('SSH honeypot using TCP fallback (ssh2 not available)'); L102: const net = await import('node:net'); L103: this.server = net.createServer((socket) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/services/ssh-trap.jsView on unpkg · L101

72patternName = generic_password severity = medium line = 72 matchedText = pwd: '...

Medium

Secret Pattern

Hardcoded password in dist/services/ssh-trap.js

dist/services/ssh-trap.jsView on unpkg · L72

Findings

4 Medium4 Low

MediumSecret Patterndist/services/generic-trap.js

MediumDynamic Requiredist/services/ssh-trap.js

MediumNetwork

MediumSecret Patterndist/services/ssh-trap.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/services/generic-trap.jsView file

Lines 56-96javascript

56 [/iptables\s+-D/i, 'T1562'], // Impair defenses

57 [/rm\s+-rf\s+\//i, 'T1485'], // Data destruction

58 [/xmrig|minerd|cryptonight/i, 'T1496'], // Resource hijacking

59 [/ssh-keygen|authorized_keys/i, 'T1098'], // Account manipulation

60 [/\buname\b|\bwhoami\b|\bid\b/i, 'T1082'], // System information discovery

61 [/ifconfig|ip\s+addr/i, 'T1016'], // System network configuration

62 [/\bps\b\s+(aux|ef)/i, 'T1057'], // Process discovery

63 [/cat\s+\/etc\/passwd/i, 'T1087'], // Account discovery

64 [/find\s+.*-perm/i, 'T1083'], // File & directory discovery

65];

66// ---------------------------------------------------------------------------

67// Fake shell responses for Telnet post-auth

68// ---------------------------------------------------------------------------

69const FAKE_SHELL_RESPONSES = {

70 id: 'uid=1000(admin) gid=1000(admin) groups=1000(admin),27(sudo)',

71 whoami: 'admin',

72 'uname -a': 'Linux server 5.15.0-91-generic #101-Ubuntu SMP Tue Nov 14 13:30:08 UTC 2023 x86_64 GNU/Linux',

73 uname: 'Linux',

74 hostname: 'prod-web-01',

75 uptime: ' 14:32:01 up 42 days, 3:17, 1 user, load average: 0.08, 0.03, 0.01',

76 pwd: '/home/admin',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/services/generic-trap.jsView on unpkg · L76

77 ls: 'backup.tar.gz deploy.sh logs www',

80 ifconfig: 'eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500\n inet 10.0.2.15 netmask 255.255.255.0 broadcast 10.0.2.255',

82 w: ' 14:32:01 up 42 days, 3:17, 1 user, load average: 0.08, 0.03, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nadmin pts/0 10.0.2.2 14:32 0.00s 0.01s 0.00s w',

83 'df -h': 'Filesystem Size Used Avail Use% Mounted on\n/dev/sda1 50G 12G 35G 26% /\ntmpfs 2.0G 0 2.0G 0% /dev/shm',

84 'free -m': ' total used free shared buff/cache available\nMem: 3951 1024 512 128 2415 2600\nSwap: 2048 0 2048',

86 'cat /etc/os-release': 'NAME="Ubuntu"\nVERSION="22.04.3 LTS (Jammy Jellyfish)"\nID=ubuntu\nVERSION_ID="22.04"',

87};

88// ---------------------------------------------------------------------------

89// FTP Protocol Handler (enhanced)

90// ---------------------------------------------------------------------------

91const ftpHandler = {

92 initialTechnique: 'T1110',

93 getBanner(config) {

94 const banner = config.banner ?? '220 ProFTPD 1.3.8 Server (Panguard) [::ffff:0.0.0.0]\r\n';

95 return Buffer.from(banner, 'utf-8');

96 },

dist/services/ssh-trap.jsView file

Lines 52-121javascript

52 technique: 'T1098',

53 description: 'Account Manipulation',

54 },

55 {

56 pattern: /id\s*$|whoami|uname\s+-a/i,

57 technique: