Deprecate malysis active scanner (#155)

* deprecate malysis active scanner

* Update config/config.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* copilot fixes

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

README.md

@@ -171,17 +171,6 @@ This will:
 
 ## Usage
 
-<details>
-<summary>Active Scanning</summary>
-
-Use the `--paranoid` flag to perform active malware scanning on unknown packages (requires [SafeDep Cloud credentials](https://docs.safedep.io/cloud/authentication#api-key-authentication)):
-
-```bash
-pmg --paranoid npm install <package-name>
-```
-
-</details>
-
 <details>
 <summary>Silent Mode</summary>
 

analyzer/malysis_active_scan.go

@@ -1,122 +0,0 @@
-package analyzer
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"os"
-	"time"
-
-	"buf.build/gen/go/safedep/api/grpc/go/safedep/services/malysis/v1/malysisv1grpc"
-	malysisv1pb "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/malysis/v1"
-	packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
-	malysisv1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/services/malysis/v1"
-	drygrpc "github.com/safedep/dry/adapters/grpc"
-	"github.com/safedep/dry/log"
-	"google.golang.org/grpc"
-)
-
-type MalysisActiveScanAnalyzerConfig struct {
-	Timeout  time.Duration
-	TenantId string
-	ApiKey   string
-}
-
-func DefaultMalysisActiveScanAnalyzerConfig() MalysisActiveScanAnalyzerConfig {
-	return MalysisActiveScanAnalyzerConfig{
-		Timeout:  5 * time.Minute,
-		TenantId: os.Getenv("SAFEDEP_TENANT_ID"),
-		ApiKey:   os.Getenv("SAFEDEP_API_KEY"),
-	}
-}
-
-type malysisActiveScanAnalyzer struct {
-	config MalysisActiveScanAnalyzerConfig
-	client malysisv1grpc.MalwareAnalysisServiceClient
-}
-
-var _ Analyzer = &malysisActiveScanAnalyzer{}
-
-func NewMalysisActiveScanAnalyzer(config MalysisActiveScanAnalyzerConfig) (*malysisActiveScanAnalyzer, error) {
-	if config.TenantId == "" || config.ApiKey == "" {
-		return nil, fmt.Errorf("active scanning requires SafeDep Cloud credentials. See: https://docs.safedep.io/cloud/malware-analysis")
-	}
-
-	headers := http.Header{}
-	headers.Set("x-tenant-id", config.TenantId)
-
-	client, err := drygrpc.GrpcClient("pmg-malysis-active-scan",
-		"api.safedep.io", "443", config.ApiKey, headers, []grpc.DialOption{})
-	if err != nil {
-		return nil, fmt.Errorf("failed to create gRPC client: %w", err)
-	}
-
-	return &malysisActiveScanAnalyzer{
-		config: config,
-		client: malysisv1grpc.NewMalwareAnalysisServiceClient(client),
-	}, nil
-}
-
-func (a *malysisActiveScanAnalyzer) Name() string {
-	return "malysis-active-scan"
-}
-
-func (a *malysisActiveScanAnalyzer) Analyze(ctx context.Context,
-	packageVersion *packagev1.PackageVersion) (*PackageVersionAnalysisResult, error) {
-
-	log.Debugf("Running active analysis on package %s@%s", packageVersion.Package.Name, packageVersion.Version)
-
-	ctx, cancel := context.WithTimeout(ctx, a.config.Timeout)
-	defer cancel()
-
-	scanResponse, err := a.client.AnalyzePackage(ctx, &malysisv1.AnalyzePackageRequest{
-		Target: &malysisv1pb.PackageAnalysisTarget{
-			PackageVersion: packageVersion,
-		},
-	})
-
-	if err != nil {
-		return nil, fmt.Errorf("failed to submit package for active scanning: %w", err)
-	}
-
-	var res *malysisv1.GetAnalysisReportResponse
-	for {
-		select {
-		case <-ctx.Done():
-			log.Debugf("Active analysis on package %s@%s timed out", packageVersion.Package.Name, packageVersion.Version)
-			return nil, fmt.Errorf("active scanning timed out")
-		case <-time.After(1 * time.Second):
-		}
-
-		res, err = a.client.GetAnalysisReport(ctx, &malysisv1.GetAnalysisReportRequest{
-			AnalysisId: scanResponse.AnalysisId,
-		})
-		if err != nil {
-			return nil, fmt.Errorf("failed to get analysis report: %w", err)
-		}
-
-		if res.Status == malysisv1.AnalysisStatus_ANALYSIS_STATUS_COMPLETED {
-			log.Debugf("Active analysis on package %s@%s completed", packageVersion.Package.Name, packageVersion.Version)
-			break
-		}
-	}
-
-	pvr := &PackageVersionAnalysisResult{
-		PackageVersion: packageVersion,
-		AnalysisID:     scanResponse.AnalysisId,
-		ReferenceURL:   malysisReportUrl(scanResponse.AnalysisId),
-		Action:         ActionAllow,
-		Summary:        res.GetReport().GetInference().GetSummary(),
-		Data:           res.GetReport(),
-	}
-
-	if res.GetReport().GetInference().GetIsMalware() {
-		pvr.Action = ActionConfirm
-	}
-
-	if res.GetVerificationRecord().GetIsMalware() {
-		pvr.Action = ActionBlock
-	}
-
-	return pvr, nil
-}

config/cobra.go

@@ -16,7 +16,7 @@ func ApplyCobraFlags(cmd *cobra.Command) {
 	cmd.PersistentFlags().BoolVar(&globalConfig.DryRun, "dry-run",
 		globalConfig.DryRun, "Dry run skips execution of package manager")
 	cmd.PersistentFlags().BoolVar(&globalConfig.Config.Paranoid, "paranoid",
-		globalConfig.Config.Paranoid, "Perform active scanning of unknown packages (slow)")
+		globalConfig.Config.Paranoid, "Enable high-security defaults (treat suspicious as malicious)")
 	cmd.PersistentFlags().BoolVar(&globalConfig.Config.SkipEventLogging, "skip-event-log",
 		globalConfig.Config.SkipEventLogging, "Skip event logging")
 	cmd.PersistentFlags().BoolVar(&globalConfig.Config.ExperimentalProxyMode, "experimental-proxy-mode",

config/config.go

@@ -44,7 +44,7 @@ type Config struct {
 	TransitiveDepth        int  `mapstructure:"transitive_depth"`
 	IncludeDevDependencies bool `mapstructure:"include_dev_dependencies"`
 
-	// Paranoid mode enables active scanning of unknown packages for malware.
+	// Paranoid enables high-security defaults (e.g., treating suspicious behavior as malicious).
 	Paranoid bool `mapstructure:"paranoid"`
 
 	// TrustedPackages allows for trusting a suspicious package and ignoring the suspicious behaviour for the package in future installations

internal/flows/common_flow.go

@@ -57,21 +57,12 @@ func (f *commonFlow) Run(ctx context.Context, args []string, parsedCmd *packagem
 
 	startTime := time.Now()
 
-	if cfg.Config.Paranoid {
-		malysisActiveScanAnalyzer, err := analyzer.NewMalysisActiveScanAnalyzer(analyzer.DefaultMalysisActiveScanAnalyzerConfig())
-		if err != nil {
-			return fmt.Errorf("failed to create malware analyzer: %s", err)
-		}
-
-		analyzers = append(analyzers, malysisActiveScanAnalyzer)
-	} else {
 	malysisQueryAnalyzer, err := analyzer.NewMalysisQueryAnalyzer(analyzer.MalysisQueryAnalyzerConfig{})
 	if err != nil {
-			return fmt.Errorf("failed to create malware analyzer: %s", err)
+		return fmt.Errorf("failed to create malware analyzer: %w", err)
 	}
 
 	analyzers = append(analyzers, malysisQueryAnalyzer)
-	}
 
 	interaction := guard.PackageManagerGuardInteraction{
 		SetStatus:                ui.SetStatus,

internal/flows/proxy_flow.go

@@ -242,14 +242,6 @@ func (f *proxyFlow) createCertificateManager(caCert *certmanager.Certificate) (c
 
 // createAnalyzer creates the malysis query analyzer
 func (f *proxyFlow) createAnalyzer() (analyzer.PackageVersionAnalyzer, error) {
-	cfg := config.Get()
-
-	// Use paranoid mode (active scan) if enabled, otherwise use query mode
-	if cfg.Config.Paranoid {
-		log.Debugf("Creating malysis active scan analyzer (paranoid mode)")
-		return analyzer.NewMalysisActiveScanAnalyzer(analyzer.DefaultMalysisActiveScanAnalyzerConfig())
-	}
-
 	log.Debugf("Creating malysis query analyzer")
 	return analyzer.NewMalysisQueryAnalyzer(analyzer.MalysisQueryAnalyzerConfig{})
 }