菜单
Detect malicious packages and supply chain attacks in Python (PyPI) and Node.js (npm). Scans requirements.txt, package.json, package-lock.json for malware, typosquatting, data exfiltration, and compromised maintainers.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Python AST-based security analysis using Bandit. Detects exec/eval code execution, pickle/yaml deserialization, subprocess shell injection, SQL injection, hardcoded credentials, weak cryptography. Use for Python security audits, malicious code triage.
Multi-language pattern-based security scanner using grep signature databases. Primary use for secrets detection, command injection patterns, and first-pass security scans on unknown codebases. Supports 15+ languages.
Shell script static analysis using ShellCheck. Detects command injection, unquoted variables, reverse shell patterns, dangerous rm operations, obfuscated payloads. Combine with graudit for patterns ShellCheck may miss.
Comprehensive security scanner for filesystems, container images, and IaC. Detects known CVEs in dependencies, hardcoded secrets, and IaC misconfigurations in Terraform, Kubernetes, Dockerfiles, and CloudFormation.
Domain knowledge for extracting headlines from major international news outlets. Covers which tool to use per site, URL patterns, timestamp formats, and filtering rules.
| name | guarddog-security-scan |
| description | Detect malicious packages and supply chain attacks in Python (PyPI) and Node.js (npm). Scans requirements.txt, package.json, package-lock.json for malware, typosquatting, data exfiltration, and compromised maintainers. |
| applyTo | **/requirements*.txt,**/package.json,**/package-lock.json |
GuardDog by DataDog detects malicious PyPI and npm packages using Semgrep source code rules and metadata heuristics. It identifies malware, supply chain attacks, typosquatting, and compromised packages.
# Verify Python dependencies (recommended first step)
guarddog pypi verify requirements.txt
# Verify npm dependencies
guarddog npm verify package-lock.json
# Scan local Python project source for malicious patterns
guarddog pypi scan /path/to/project/
# Scan local Node.js project source
guarddog npm scan /path/to/project/
# Check a specific package before installing
guarddog pypi scan <package-name>
guarddog npm scan <package-name>
# JSON output for automation
guarddog pypi scan /path --output-format=json
| Rule | Ecosystem | Threat | MITRE ATT&CK |
|---|---|---|---|
exec-base64 | Both | Obfuscated code execution | T1027, T1059 |
exfiltrate-sensitive-data | Both | Steals credentials/keys | T1005, T1041 |
code-execution | Python | OS commands in setup.py | T1059 |
download-executable | Python | Downloads and runs malware | T1105 |
typosquatting | Both | Impersonates popular packages | — |
npm-install-script | npm | Malicious install hooks | T1059 |
npm-serialize-environment | npm | Exfiltrates env vars | T1082, T1041 |
obfuscation | Both | Deliberately obscured code | T1027 |
repository_integrity_mismatch | Python | Package differs from source | — |
# Scan with specific rules only
guarddog pypi scan /path --rules exec-base64 --rules code-execution
# Exclude specific rules
guarddog pypi scan /path --exclude-rules repository_integrity_mismatch
Found 2 potentially malicious indicators:
- exec-base64: Identified base64-encoded code execution in setup.py
- exfiltrate-sensitive-data: Package reads SSH keys and sends to external URL
Each rule match indicates a potential malicious pattern that needs investigation.
bandit or graudit)