External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

Deprecate malysis active scanner (#155)

Browse Source 
* deprecate malysis active scanner

* Update config/config.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* copilot fixes

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This commit is contained in:
Sahil Bansal
2026-02-10 20:38:55 +05:30
committed by GitHub
co-authored by Copilot
parent b161d34f9e
commit 41e3b9b22e
6 changed files with 7 additions and 157 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
-11
View File
@@ -171,17 +171,6 @@ This will:
## Usage
<details>
<summary>Active Scanning</summary>
Use the `--paranoid` flag to perform active malware scanning on unknown packages (requires [SafeDep Cloud credentials](https://docs.safedep.io/cloud/authentication#api-key-authentication)):
```bash
pmg --paranoid npm install <package-name>
```
</details>
<details>
<summary>Silent Mode</summary>
analyzer/malysis_active_scan.go
-122
View File
@@ -1,122 +0,0 @@
package analyzer
import (
"context"
"fmt"
"net/http"
"os"
"time"
"buf.build/gen/go/safedep/api/grpc/go/safedep/services/malysis/v1/malysisv1grpc"
malysisv1pb "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/malysis/v1"
packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
malysisv1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/services/malysis/v1"
drygrpc "github.com/safedep/dry/adapters/grpc"
"github.com/safedep/dry/log"
"google.golang.org/grpc"
)
type MalysisActiveScanAnalyzerConfig struct {
Timeout time.Duration
TenantId string
ApiKey string
}
func DefaultMalysisActiveScanAnalyzerConfig() MalysisActiveScanAnalyzerConfig {
return MalysisActiveScanAnalyzerConfig{
Timeout: 5 * time.Minute,
TenantId: os.Getenv("SAFEDEP_TENANT_ID"),
ApiKey: os.Getenv("SAFEDEP_API_KEY"),
}
}
type malysisActiveScanAnalyzer struct {
config MalysisActiveScanAnalyzerConfig
client malysisv1grpc.MalwareAnalysisServiceClient
}
var _ Analyzer = &malysisActiveScanAnalyzer{}
func NewMalysisActiveScanAnalyzer(config MalysisActiveScanAnalyzerConfig) (*malysisActiveScanAnalyzer, error) {
if config.TenantId == "" || config.ApiKey == "" {
return nil, fmt.Errorf("active scanning requires SafeDep Cloud credentials. See: https://docs.safedep.io/cloud/malware-analysis")
}
headers := http.Header{}
headers.Set("x-tenant-id", config.TenantId)
client, err := drygrpc.GrpcClient("pmg-malysis-active-scan",
"api.safedep.io", "443", config.ApiKey, headers, []grpc.DialOption{})
if err != nil {
return nil, fmt.Errorf("failed to create gRPC client: %w", err)
}
return &malysisActiveScanAnalyzer{
config: config,
client: malysisv1grpc.NewMalwareAnalysisServiceClient(client),
}, nil
}
func (a *malysisActiveScanAnalyzer) Name() string {
return "malysis-active-scan"
}
func (a *malysisActiveScanAnalyzer) Analyze(ctx context.Context,
packageVersion *packagev1.PackageVersion) (*PackageVersionAnalysisResult, error) {
log.Debugf("Running active analysis on package %s@%s", packageVersion.Package.Name, packageVersion.Version)
ctx, cancel := context.WithTimeout(ctx, a.config.Timeout)
defer cancel()
scanResponse, err := a.client.AnalyzePackage(ctx, &malysisv1.AnalyzePackageRequest{
Target: &malysisv1pb.PackageAnalysisTarget{
PackageVersion: packageVersion,
},
})
if err != nil {
return nil, fmt.Errorf("failed to submit package for active scanning: %w", err)
}
var res *malysisv1.GetAnalysisReportResponse
for {
select {
case <-ctx.Done():
log.Debugf("Active analysis on package %s@%s timed out", packageVersion.Package.Name, packageVersion.Version)
return nil, fmt.Errorf("active scanning timed out")
case <-time.After(1 * time.Second):
}
res, err = a.client.GetAnalysisReport(ctx, &malysisv1.GetAnalysisReportRequest{
AnalysisId: scanResponse.AnalysisId,
})
if err != nil {
return nil, fmt.Errorf("failed to get analysis report: %w", err)
}
if res.Status == malysisv1.AnalysisStatus_ANALYSIS_STATUS_COMPLETED {
log.Debugf("Active analysis on package %s@%s completed", packageVersion.Package.Name, packageVersion.Version)
break
}
}
pvr := &PackageVersionAnalysisResult{
PackageVersion: packageVersion,
AnalysisID: scanResponse.AnalysisId,
ReferenceURL: malysisReportUrl(scanResponse.AnalysisId),
Action: ActionAllow,
Summary: res.GetReport().GetInference().GetSummary(),
Data: res.GetReport(),
}
if res.GetReport().GetInference().GetIsMalware() {
pvr.Action = ActionConfirm
}
if res.GetVerificationRecord().GetIsMalware() {
pvr.Action = ActionBlock
}
return pvr, nil
}
config/cobra.go
+1 -1
View File
@@ -16,7 +16,7 @@ func ApplyCobraFlags(cmd *cobra.Command) {
cmd.PersistentFlags().BoolVar(&globalConfig.DryRun, "dry-run",
globalConfig.DryRun, "Dry run skips execution of package manager")
cmd.PersistentFlags().BoolVar(&globalConfig.Config.Paranoid, "paranoid",
globalConfig.Config.Paranoid, "Perform active scanning of unknown packages (slow)")
globalConfig.Config.Paranoid, "Enable high-security defaults (treat suspicious as malicious)")
cmd.PersistentFlags().BoolVar(&globalConfig.Config.SkipEventLogging, "skip-event-log",
globalConfig.Config.SkipEventLogging, "Skip event logging")
cmd.PersistentFlags().BoolVar(&globalConfig.Config.ExperimentalProxyMode, "experimental-proxy-mode",
config/config.go
+1 -1
View File
@@ -44,7 +44,7 @@ type Config struct {
TransitiveDepth int `mapstructure:"transitive_depth"`
IncludeDevDependencies bool `mapstructure:"include_dev_dependencies"`
// Paranoid mode enables active scanning of unknown packages for malware.
// Paranoid enables high-security defaults (e.g., treating suspicious behavior as malicious).
Paranoid bool `mapstructure:"paranoid"`
// TrustedPackages allows for trusting a suspicious package and ignoring the suspicious behaviour for the package in future installations
internal/flows/common_flow.go
+5 -14
View File
@@ -57,22 +57,13 @@ func (f *commonFlow) Run(ctx context.Context, args []string, parsedCmd *packagem
startTime := time.Now()
if cfg.Config.Paranoid {
malysisActiveScanAnalyzer, err := analyzer.NewMalysisActiveScanAnalyzer(analyzer.DefaultMalysisActiveScanAnalyzerConfig())
if err != nil {
return fmt.Errorf("failed to create malware analyzer: %s", err)
}
analyzers = append(analyzers, malysisActiveScanAnalyzer)
} else {
malysisQueryAnalyzer, err := analyzer.NewMalysisQueryAnalyzer(analyzer.MalysisQueryAnalyzerConfig{})
if err != nil {
return fmt.Errorf("failed to create malware analyzer: %s", err)
}
analyzers = append(analyzers, malysisQueryAnalyzer)
malysisQueryAnalyzer, err := analyzer.NewMalysisQueryAnalyzer(analyzer.MalysisQueryAnalyzerConfig{})
if err != nil {
return fmt.Errorf("failed to create malware analyzer: %w", err)
}
analyzers = append(analyzers, malysisQueryAnalyzer)
interaction := guard.PackageManagerGuardInteraction{
SetStatus: ui.SetStatus,
ClearStatus: ui.ClearStatus,
internal/flows/proxy_flow.go
-8
View File
@@ -242,14 +242,6 @@ func (f *proxyFlow) createCertificateManager(caCert *certmanager.Certificate) (c
// createAnalyzer creates the malysis query analyzer
func (f *proxyFlow) createAnalyzer() (analyzer.PackageVersionAnalyzer, error) {
cfg := config.Get()
// Use paranoid mode (active scan) if enabled, otherwise use query mode
if cfg.Config.Paranoid {
log.Debugf("Creating malysis active scan analyzer (paranoid mode)")
return analyzer.NewMalysisActiveScanAnalyzer(analyzer.DefaultMalysisActiveScanAnalyzerConfig())
}
log.Debugf("Creating malysis query analyzer")
return analyzer.NewMalysisQueryAnalyzer(analyzer.MalysisQueryAnalyzerConfig{})
}