SBOM软件物料清单与开源组件供应链安全取证深度分析

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "components": [
    {
      "type": "library",
      "supplier": {
        "name": "Apache Software Foundation",
        "url": ["https://www.apache.org/"]
      },
      "author": "Apache Logging Team",
      "name": "log4j-core",
      "version": "2.14.1",
      "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1",
      "externalReferences": [
        {
          "type": "website",
          "url": "https://logging.apache.org/log4j/2.x/"
        },
        {
          "type": "license",
          "url": "https://www.apache.org/licenses/LICENSE-2.0"
        }
      ],
      "properties": [
        {
          "name": "syft:package:metadataType",
          "value": "java-archive"
        }
      ]
    }
  ]
}

{
  "spdxVersion": "SPDX-3.0",
  "name": "example-project",
  "creationInfo": {
    "specVersion": "3.0.0",
    "created": "2026-08-12T06:00:00Z",
    "creators": [
      {
        "type": "Tool",
        "name": "syft",
        "version": "1.2.0"
      }
    ]
  },
  "element": [
    {
      "type": "Component",
      "name": "log4j-core",
      "version": "2.14.1",
      "softwareHydration": {
        "packageVerificationCode": "a]1b2c3d4e5f6..."
      }
    }
  ]
}

find / -name "package.json" -not -path "*/node_modules/*" 2>/dev/null | head -20
find / -name "requirements.txt" -o -name "pyproject.toml" -o -name "setup.py" 2>/dev/null | head -20
find / -name "pom.xml" -o -name "build.gradle" 2>/dev/null | head -20

grep -r "resolved" package-lock.json | grep -v "registry.npmjs.org"
pip show <package_name> | grep -i "location\|version\|source"
mvn dependency:tree | grep -v "central"

npm view <package_name> repository.url maintainers
pip show <package_name> | grep -i "author\|home-page\|location"

#!/bin/bash
echo "[*] Dependency Confusion Scanner"
echo "================================"

if [ -f "package.json" ]; then
    echo "[+] Scanning npm dependencies..."
    deps=$(python3 -c "
import json
with open('package.json') as f:
    pkg = json.load(f)
deps = {**pkg.get('dependencies', {}), **pkg.get('devDependencies', {})}
for name, ver in deps.items():
    print(f'{name}@{ver}')
")
    echo "$deps" | while read dep; do
        name=$(echo "$dep" | cut -d'@' -f1)
        result=$(npm view "$name" _npmUser.name 2>/dev/null)
        if [ -n "$result" ]; then
            echo "[!] PUBLIC: $name maintained by: $result"
        fi
    done
fi

if [ -f "requirements.txt" ] || [ -f "pyproject.toml" ]; then
    echo "[+] Scanning Python dependencies..."
    pip list --format=json 2>/dev/null | python3 -c "
import json, sys
packages = json.load(sys.stdin)
for pkg in packages:
    name = pkg['name']
    version = pkg['version']
    print(f'  {name}=={version}')
"
fi

npm view <suspect_package> time
npm view <suspect_package> maintainers
npm view <suspect_package> repository.url
npm view <suspect_package> _npmUser

npm pack <suspect_package> --dry-run
tar -tzf <suspect_package>-*.tgz | head -50
cat package/preinstall.js
cat package/install.js
cat package/postinstall.js

grep -rn "eval(" <extracted_package>/
grep -rn "require('child_process')" <extracted_package>/
grep -rn "https\?://" <extracted_package>/
grep -rn "process\.env" <extracted_package>/

import sys
from difflib import SequenceMatcher

def levenshtein_distance(s1, s2):
    if len(s1) < len(s2):
        return levenshtein_distance(s2, s1)
    if len(s2) == 0:
        return len(s1)
    prev_row = range(len(s2) + 1)
    for i, c1 in enumerate(s1):
        curr_row = [i + 1]
        for j, c2 in enumerate(s2):
            insertions = prev_row[j + 1] + 1
            deletions = curr_row[j] + 1
            substitutions = prev_row[j] + (c1 != c2)
            curr_row.append(min(insertions, deletions, substitutions))
        prev_row = curr_row
    return prev_row[-1]

def similarity_score(name1, name2):
    seq_ratio = SequenceMatcher(None, name1, name2).ratio()
    lev_dist = levenshtein_distance(name1, name2)
    max_len = max(len(name1), len(name2))
    lev_ratio = 1 - (lev_dist / max_len) if max_len > 0 else 0
    return (seq_ratio + lev_ratio) / 2

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print("Usage: typosquat_check.py <package_name> <suspect_package>")
        sys.exit(1)
    score = similarity_score(sys.argv[1], sys.argv[2])
    print(f"Similarity: {sys.argv[1]} vs {sys.argv[2]} = {score:.4f}")
    if score > 0.8:
        print("[!] HIGH SIMILARITY - Potential Typosquatting detected")
    elif score > 0.6:
        print("[?] MEDIUM SIMILARITY - Worth investigating")
    else:
        print("[*] LOW SIMILARITY - Unlikely to be Typosquatting")

npm ls event-stream --all
npm ls flatmap-stream --all

node -e "
const pkg = require('event-stream/package.json');
console.log('Version:', pkg.version);
console.log('Dependencies:', JSON.stringify(pkg.dependencies, null, 2));
"

syft dir:. -o cyclonedx-json > sbom.json

cat sbom.json | python3 -c "
import json, sys
sbom = json.load(sys.stdin)
components = sbom.get('components', [])
suspicious = []
for comp in components:
    name = comp.get('name', '')
    version = comp.get('version', '')
    supplier = comp.get('supplier', {}).get('name', 'Unknown')
    hashes = comp.get('hashes', [])
    if not hashes:
        suspicious.append(f'{name}@{version} - NO INTEGRITY HASH')
    if supplier == 'Unknown':
        suspicious.append(f'{name}@{version} - UNKNOWN SUPPLIER')
if suspicious:
    print('[!] Suspicious components found:')
    for s in suspicious:
        print(f'  - {s}')
else:
    print('[*] No suspicious components detected')
"

node -e "
const fs = require('fs');
const lock = JSON.parse(fs.readFileSync('package-lock.json', 'utf8'));
const packages = lock.packages || lock.dependencies || {};
const issues = [];
for (const [name, info] of Object.entries(packages)) {
    if (!info.integrity && name !== '') {
        issues.push({ name, version: info.version, issue: 'NO_INTEGRITY_HASH' });
    }
    if (info.resolved && info.resolved.includes('git+')) {
        issues.push({ name, version: info.version, issue: 'GIT_DEPENDENCY' });
    }
}
if (issues.length > 0) {
    console.log('[!] Integrity issues found:');
    issues.forEach(i => console.log('  ' + i.name + '@' + i.version + ': ' + i.issue));
} else {
    console.log('[*] All packages have integrity hashes');
}
"

find . -name "package.json" -not -path "*/node_modules/*" -exec grep -l "preinstall\|postinstall\|install" {} \; | while read f; do
    echo "=== $f ==="
    python3 -c "
import json
with open('$f') as fh:
    pkg = json.load(fh)
scripts = pkg.get('scripts', {})
for hook in ['preinstall', 'install', 'postinstall']:
    if hook in scripts:
        print(f'  [!] {hook}: {scripts[hook]}')
"
done

pip-audit --require-hashes -r requirements.txt

pip list --format=json | python3 -c "
import json, sys
packages = json.load(sys.stdin)
for pkg in packages:
    name = pkg['name']
    version = pkg['version']
    home = pkg.get('home-page', '')
    author = pkg.get('author', '')
    if not home or home == 'UNKNOWN':
        print(f'[!] {name}=={version}: No homepage')
    if not author or author == 'UNKNOWN':
        print(f'[?] {name}=={version}: No author info')
"

mvn dependency:tree -DoutputType=dot > dep_tree.dot

mvn org.owasp:dependency-check-maven:check \
    -DfailBuildOnCVSS=7 \
    -DsuppressionFile=dependency-check-suppressions.xml

mvn versions:display-dependency-updates | grep -i "available"

cosign verify-blob \
    --certificate cosign.pub \
    --signature sbom.json.sig \
    sbom.json

cosign verify \
    --certificate-identity "https://github.com/org/repo/.github/workflows/sbom.yml@refs/heads/main" \
    --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
    sbom-image:tag

sha256sum sbom.json > sbom.json.sha256
sha256sum -c sbom.json.sha256

python3 -c "
import hashlib, json, sys

with open('sbom.json') as f:
    sbom = json.load(f)

components = sbom.get('components', [])
for comp in components:
    name = comp.get('name', 'unknown')
    version = comp.get('version', 'unknown')
    hashes = comp.get('hashes', [])
    if not hashes:
        print(f'[!] {name}@{version}: Missing integrity hash')
        continue
    for h in hashes:
        algo = h.get('algorithm', '').lower().replace('-', '')
        value = h.get('value', '')
        if algo in ['sha256', 'sha512']:
            print(f'[*] {name}@{version}: {algo}={value[:16]}...')
"

import json
import hashlib
import sys

def validate_sbom(sbom_path):
    with open(sbom_path) as f:
        sbom = json.load(f)

    spec_version = sbom.get('specVersion', 'unknown')
    print(f"[*] SBOM Specification: {spec_version}")

    components = sbom.get('components', [])
    total = len(components)
    print(f"[*] Total components: {total}")

    findings = {
        "no_hash": [],
        "no_purl": [],
        "no_supplier": [],
        "no_license": [],
        "duplicate_versions": {}
    }

    for comp in components:
        name = comp.get('name', 'unknown')
        version = comp.get('version', 'unknown')

        if not comp.get('hashes'):
            findings["no_hash"].append(f"{name}@{version}")

        if not comp.get('purl'):
            findings["no_purl"].append(f"{name}@{version}")

        if not comp.get('supplier'):
            findings["no_supplier"].append(f"{name}@{version}")

        if not comp.get('licenses'):
            findings["no_license"].append(f"{name}@{version}")

        key = f"{name}@{version}"
        findings["duplicate_versions"].setdefault(name, []).append(version)

    print(f"\n[!] Components without integrity hash: {len(findings['no_hash'])}")
    for item in findings["no_hash"][:10]:
        print(f"    {item}")

    print(f"\n[!] Components without purl: {len(findings['no_purl'])}")
    for item in findings["no_purl"][:10]:
        print(f"    {item}")

    print(f"\n[!] Components without supplier: {len(findings['no_supplier'])}")
    for item in findings["no_supplier"][:10]:
        print(f"    {item}")

    suspicious = {k: v for k, v in findings["duplicate_versions"].items() if len(v) > 1}
    if suspicious:
        print(f"\n[?] Multiple versions of same component: {len(suspicious)}")
        for name, versions in suspicious.items():
            print(f"    {name}: {', '.join(versions)}")

    return findings

if __name__ == "__main__":
    path = sys.argv[1] if len(sys.argv) > 1 else "sbom.json"
    validate_sbom(path)

git log --oneline -20 -- Makefile CMakeLists.txt configure.ac
git diff HEAD~10 -- Makefile CMakeLists.txt configure.ac .github/

find . -name "*.yml" -path "*/.github/workflows/*" -exec diff <(git show HEAD~5:{} 2>/dev/null) {} \; 2>/dev/null

grep -rn "curl\|wget" Makefile* CMakeLists.txt configure* 2>/dev/null
grep -rn "base64\|eval\|exec" Makefile* CMakeLists.txt configure* 2>/dev/null
grep -rn "LD_PRELOAD\|LD_LIBRARY_PATH" Makefile* configure* 2>/dev/null

find . -name "Makefile.in" -o -name "configure" | while read f; do
    if grep -q "curl.*|.*sh\|wget.*|.*bash\|eval.*\$(curl" "$f" 2>/dev/null; then
        echo "[!] CRITICAL: Remote code execution pattern in $f"
    fi
done

import json
from datetime import datetime

evidence_chain = [
    {
        "id": "E001",
        "level": "HIGH",
        "type": "sbom_malicious_component",
        "component": "malicious-lib@1.0.0",
        "timestamp": "2026-08-01T10:00:00Z",
        "source": "SBOM scan"
    },
    {
        "id": "E002",
        "level": "HIGH",
        "type": "postinstall_execution",
        "component": "malicious-lib@1.0.0",
        "timestamp": "2026-08-01T10:05:00Z",
        "source": "build_log"
    },
    {
        "id": "E003",
        "level": "MEDIUM",
        "type": "external_connection",
        "component": "malicious-lib@1.0.0",
        "timestamp": "2026-08-01T10:06:00Z",
        "source": "network_monitor"
    }
]

def analyze_chain(evidence_list):
    print("[*] Evidence Chain Analysis")
    print("=" * 60)

    high_count = sum(1 for e in evidence_list if e["level"] == "HIGH")
    medium_count = sum(1 for e in evidence_list if e["level"] == "MEDIUM")

    print(f"[+] High confidence evidence: {high_count}")
    print(f"[+] Medium confidence evidence: {medium_count}")

    timeline = sorted(evidence_list, key=lambda x: x["timestamp"])
    print(f"\n[*] Attack Timeline:")
    for e in timeline:
        print(f"  {e['timestamp']} [{e['level']}] {e['type']}: {e['component']}")

    if high_count >= 2:
        print(f"\n[!] CONCLUSION: CONFIRMED MALICIOUS - {high_count} high confidence indicators")
    elif high_count >= 1:
        print(f"\n[?] CONCLUSION: HIGHLY SUSPICIOUS - Requires additional verification")
    else:
        print(f"\n[*] CONCLUSION: NEEDS ATTENTION - Insufficient evidence")

analyze_chain(evidence_chain)

title: Suspicious SBOM Generation or Modification Activity
id: 7a4b8c3d-2e1f-4d5a-b6c7-8e9f0a1b2c3d
status: experimental
description: Detects suspicious activity related to SBOM generation tools that may indicate supply chain tampering
references:
  - https://cyclonedx.org
  - https://spdx.org
author: Security Forensics Team
date: 2026/08/12
tags:
  - attack.supply_chain
  - attack.t1195.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_1:
    CommandLine|contains:
      - 'syft'
      - 'cyclonedx'
      - 'tern'
    CommandLine|contains:
      - '--output'
      - '-o'
  selection_2:
    CommandLine|contains|all:
      - 'sbom'
      - 'curl'
  selection_3:
    CommandLine|contains|all:
      - 'sbom'
      - 'rm'
      - '-rf'
  selection_4:
    CommandLine|contains|all:
      - 'jq'
      - 'components'
      - 'del'
  condition: selection_1 or selection_2 or selection_3 or selection_4
level: suspicious
falsepositives:
  - Legitimate SBOM generation in CI/CD pipelines
  - Security scanning tools

---

title: Dependency Confusion Attack Indicator
id: 9c1d2e3f-4a5b-6c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects package installation from public registry when private package name matches
references:
  - https://research.nccgroup.com/2021/05/27/dependency-confusion-how-i-compromised-packages-of-microsoft-apple-and-35-others/
author: Security Forensics Team
date: 2026/08/12
tags:
  - attack.supply_chain
  - attack.t1195.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_npm:
    CommandLine|contains|all:
      - 'npm'
      - 'install'
    CommandLine|contains:
      - 'registry.npmjs.org'
  selection_pip:
    CommandLine|contains|all:
      - 'pip'
      - 'install'
    CommandLine|contains:
      - 'pypi.org'
  selection_maven:
    CommandLine|contains|all:
      - 'mvn'
      - 'dependency'
      - 'resolve'
  condition: selection_npm or selection_pip or selection_maven
level: medium
falsepositives:
  - Normal package installation from public registries
  - CI/CD build processes

#!/bin/bash
echo "[*] Supply Chain Security Hunting Script"
echo "========================================="
echo ""

PROJECT_ROOT="${1:-.}"
RESULTS_FILE="supply_chain_hunt_$(date +%Y%m%d_%H%M%S).txt"

echo "[Phase 1] Scanning for dependency files..."
find "$PROJECT_ROOT" -name "package.json" -not -path "*/node_modules/*" | while read f; do
    echo "[+] Found: $f"
    python3 -c "
import json
with open('$f') as fh:
    pkg = json.load(fh)
scripts = pkg.get('scripts', {})
for hook in ['preinstall', 'install', 'postinstall']:
    if hook in scripts:
        print(f'  [!!!] {hook}: {scripts[hook]}')
" 2>/dev/null
done

echo ""
echo "[Phase 2] Checking for git dependencies..."
find "$PROJECT_ROOT" -name "package.json" -not -path "*/node_modules/*" | while read f; do
    python3 -c "
import json
with open('$f') as fh:
    pkg = json.load(fh)
deps = {**pkg.get('dependencies', {}), **pkg.get('devDependencies', {})}
for name, version in deps.items():
    if version.startswith('git') or version.startswith('github'):
        print(f'  [!] Git dependency: {name} -> {version}')
" 2>/dev/null
done

echo ""
echo "[Phase 3] Checking for known malicious packages..."
MALICIOUS_PKGS="flatmap-stream ua-parser-js coa rc colors event-stream"
for pkg in $MALICIOUS_PKGS; do
    if [ -d "$PROJECT_ROOT/node_modules/$pkg" ]; then
        echo "[!!!] KNOWN MALICIOUS PACKAGE FOUND: $pkg"
        find "$PROJECT_ROOT/node_modules/$pkg" -type f | head -20
    fi
done

echo ""
echo "[Phase 4] Checking npm registry integrity..."
if [ -f "$PROJECT_ROOT/package-lock.json" ]; then
    python3 -c "
import json
with open('$PROJECT_ROOT/package-lock.json') as f:
    lock = json.load(f)
packages = lock.get('packages', {})
issues = 0
for name, info in packages.items():
    if not info.get('integrity') and name:
        print(f'  [!] Missing integrity: {name}')
        issues += 1
print(f'  Total integrity issues: {issues}')
" 2>/dev/null
fi

echo ""
echo "[Phase 5] Scanning for suspicious URLs in dependencies..."
find "$PROJECT_ROOT/node_modules" -name "*.js" -not -path "*/.cache/*" 2>/dev/null | head -500 | xargs grep -l "atob\|Buffer.from.*base64\|child_process\|execSync" 2>/dev/null | head -20

echo ""
echo "[*] Hunting complete. Results saved to $RESULTS_FILE"

import json
import sys
import os
from datetime import datetime, timedelta

KNOWN_MALICIOUS = {
    "flatmap-stream": {"cve": "N/A", "event": "event-stream backdoor 2018"},
    "ua-parser-js": {"cve": "CVE-2021-47174", "event": "Typosquatting crypto miner"},
    "coa": {"cve": "CVE-2021-37701", "event": "Typosquatting DoS"},
    "rc": {"cve": "CVE-2021-3807", "event": "Typosquatting DoS"},
    "colors": {"cve": "N/A", "event": "Protestware v1.4.44-liberty-2"},
}

SUSPICIOUS_PATTERNS = [
    "eval(",
    "Function(",
    "child_process",
    "require('http')",
    "process.env",
    "crypto.createCipher",
    "Buffer.from(",
    "atob(",
    "String.fromCharCode",
]

def scan_sbom(sbom_path):
    with open(sbom_path) as f:
        sbom = json.load(f)

    components = sbom.get('components', [])
    findings = []

    for comp in components:
        name = comp.get('name', '')
        version = comp.get('version', '')

        if name.lower() in KNOWN_MALICIOUS:
            findings.append({
                "severity": "CRITICAL",
                "component": f"{name}@{version}",
                "reason": f"Known malicious package - {KNOWN_MALICIOUS[name.lower()]['event']}",
                "cve": KNOWN_MALICIOUS[name.lower()]['cve']
            })

        if not comp.get('hashes'):
            findings.append({
                "severity": "MEDIUM",
                "component": f"{name}@{version}",
                "reason": "Missing integrity hash - cannot verify component integrity",
                "cve": "N/A"
            })

        supplier = comp.get('supplier', {})
        if not supplier or not supplier.get('name'):
            findings.append({
                "severity": "MEDIUM",
                "component": f"{name}@{version}",
                "reason": "No supplier information - cannot verify component origin",
                "cve": "N/A"
            })

        ext_refs = comp.get('externalReferences', [])
        has_website = any(r.get('type') == 'website' for r in ext_refs)
        if not has_website and name:
            findings.append({
                "severity": "LOW",
                "component": f"{name}@{version}",
                "reason": "No website reference - limited provenance information",
                "cve": "N/A"
            })

    return findings

def scan_project_deps(project_path):
    findings = []
    pkg_json = os.path.join(project_path, 'package.json')
    if os.path.exists(pkg_json):
        with open(pkg_json) as f:
            pkg = json.load(f)

        scripts = pkg.get('scripts', {})
        for hook in ['preinstall', 'install', 'postinstall']:
            if hook in scripts:
                script_val = scripts[hook]
                for pattern in SUSPICIOUS_PATTERNS:
                    if pattern in script_val:
                        findings.append({
                            "severity": "CRITICAL",
                            "component": f"scripts.{hook}",
                            "reason": f"Suspicious pattern '{pattern}' in {hook} script: {script_val}",
                            "cve": "N/A"
                        })
                        break

        deps = {**pkg.get('dependencies', {}), **pkg.get('devDependencies', {})}
        for name, version in deps.items():
            if version.startswith('git') or version.startswith('github'):
                findings.append({
                    "severity": "HIGH",
                    "component": f"{name}@{version}",
                    "reason": "Git/URL dependency - may bypass registry security checks",
                    "cve": "N/A"
                })

    return findings

def print_report(sbom_findings, project_findings):
    all_findings = sbom_findings + project_findings
    severity_order = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
    all_findings.sort(key=lambda x: severity_order.get(x['severity'], 99))

    print("=" * 70)
    print("  SUPPLY CHAIN SECURITY AUDIT REPORT")
    print(f"  Generated: {datetime.now().isoformat()}")
    print("=" * 70)

    critical = sum(1 for f in all_findings if f['severity'] == 'CRITICAL')
    high = sum(1 for f in all_findings if f['severity'] == 'HIGH')
    medium = sum(1 for f in all_findings if f['severity'] == 'MEDIUM')
    low = sum(1 for f in all_findings if f['severity'] == 'LOW')

    print(f"\n  Summary: {critical} CRITICAL | {high} HIGH | {medium} MEDIUM | {low} LOW")
    print("-" * 70)

    for f in all_findings:
        icon = "🔴" if f['severity'] == 'CRITICAL' else "🟡" if f['severity'] in ['HIGH', 'MEDIUM'] else "🟢"
        print(f"\n  {icon} [{f['severity']}] {f['component']}")
        print(f"     Reason: {f['reason']}")
        if f['cve'] != 'N/A':
            print(f"     CVE: {f['cve']}")

    print("\n" + "=" * 70)

if __name__ == "__main__":
    sbom_path = sys.argv[1] if len(sys.argv) > 1 else "sbom.json"
    project_path = sys.argv[2] if len(sys.argv) > 2 else "."

    sbom_findings = []
    if os.path.exists(sbom_path):
        print(f"[*] Scanning SBOM: {sbom_path}")
        sbom_findings = scan_sbom(sbom_path)
    else:
        print(f"[!] SBOM not found: {sbom_path}")

    print(f"[*] Scanning project: {project_path}")
    project_findings = scan_project_deps(project_path)

    print_report(sbom_findings, project_findings)

rule supply_chain_npm_postinstall_backdoor {
    meta:
        description = "Detects npm packages with malicious postinstall scripts"
        author = "Security Forensics Team"
        date = "2026-08-12"
        reference = "Supply Chain Security Forensics"
        severity = "high"
    strings:
        $s1 = "preinstall" ascii
        $s2 = "postinstall" ascii
        $m1 = "curl" ascii
        $m2 = "wget" ascii
        $m3 = "fetch(" ascii
        $m4 = "child_process" ascii
        $m5 = "require('http')" ascii
    condition:
        ($s1 or $s2) and any of ($m*)
}

rule supply_chain_dependency_confusion_indicator {
    meta:
        description = "Detects files associated with dependency confusion attacks"
        author = "Security Forensics Team"
        date = "2026-08-12"
        severity = "critical"
    strings:
        $npm1 = ".npmrc" ascii
        $npm2 = "registry=" ascii
        $pip1 = "pip.conf" ascii
        $pip2 = "extra-index-url" ascii
        $maven1 = "settings.xml" ascii
        $maven2 = "mirrorOf" ascii
        $mal1 = "process.env" ascii
        $mal2 = "os.environ" ascii
        $mal3 = "atob(" ascii
        $mal4 = "Buffer.from" ascii
    condition:
        filesize