deparmor

Real-time supply-chain malware scanner and antivirus daemon for developers.

Monitors local projects (npm, pypi, lockfiles, node_modules, virtualenvs), cross-references dependencies against Google's OSV vulnerability database, runs static heuristic analysis for malicious install hooks (curl | sh, token stealers, obfuscated reverse shells), and automatically quarantines infected packages before they run.

---

Features

• Dual-Layer Threat Detection:
  • Google OSV Database: Real-time querying of known CVEs and malicious package registries (MAL-IDs).
  • Heuristic Static Scanner: Catches zero-day stealers, .env/SSH key exfiltration, Discord webhooks, and base64 eval payloads inside postinstall hooks.
• Auto-Quarantine & Kill Switch: Automatically isolates infected package folders into ~/.deparmor/quarantine/ and neutralizes executable scripts.
• Background Watcher Daemon: Watches node_modules and virtualenvs in real-time, scanning automatically when npm install or pip install executes.
• Native Desktop Notifications: Alerts you via Windows desktop toast notifications whenever a malicious install is blocked.

---

Installation

npm install -g deparmor

Or run without installing:

npx deparmor scan

---

Usage

1. Scan a project

Scan the current directory:

deparmor scan

Scan a specific project and automatically quarantine all critical malware:

deparmor scan ./my-project --quarantine

2. Start the Real-Time Background Watcher Daemon

Keep deparmor running in the background while you work. It will automatically intercept and scan whenever npm i or pip install is executed:

deparmor watch ./projects

3. Manage Quarantined Malware

List isolated malicious packages:

deparmor quarantine list

Permanently purge all quarantined files from disk:

deparmor quarantine purge

---

How It Detects Supply-Chain Attacks

Attack Pattern	Detected Vector	Action
Piped Shell Execution	curl ... | bash, wget ... | sh in postinstall	Auto-Quarantine
Credential Stealers	Reading ~/.ssh/id_rsa, .env, .aws/credentials	Auto-Quarantine
Exfiltration Beacons	Outbound calls to Discord Webhooks, Telegram bot API	Auto-Quarantine
Obfuscated Payloads	eval(Buffer.from(..., 'base64')), Python exec(b64decode(...))	Auto-Quarantine
Known CVEs / MAL-IDs	Batch lookup against Google OSV database	Alert & Log

---

Development

# Clone
git clone https://github.com/yanzyuyu/deparmor.git
cd deparmor

# Install dependencies
npm install

# Build
npm run build

# Run unit tests
npm test

License

Apache-2.0