Malware pattern rules

These are the pattern rules in detect/data/patterns.toml at malscan-engine v0.6.1, the version cli@2449840 pins in go.mod. A newer engine on its default branch can have more rules; they reach the CLI only when the pin moves.

How a hit is classed:

• evidence: the rule has override_gate = true, or points of 40 or more. One evidence hit marks the package malicious, gives the finding severity critical, and fails vulnetix malscan with exit code 1.
• context: fewer points and no override. Recorded at severity low, never fails the scan.
• install hook only (hook_only): a dual-use command. In an install script it is classed by points; in the primary manifest a rule under the threshold is dropped and one at or over it is recorded as context.
• only in a PKGBUILD or install hook (pkgbuild_only): source hygiene for Arch packages, skipped on a declarative manifest.

The points are weights inherited from traur. malscan does not add them up into a score; they only decide the class above.

Install scripts

57 rules, section install_script_analysis, capability install-script. Runs over: npm preinstall, install, postinstall, preuninstall, postuninstall, prepare and prepublish scripts, Rust build.rs and Ruby extconf.rb. Always an auto-execution surface.

Rule	Points	Class	Description
P-INSTALL-CURL	45	evidence	curl in install script (should not download during install)
P-INSTALL-WGET	45	evidence	wget in install script (should not download during install)
P-INSTALL-PIPE-SHELL	90	evidence	Download-and-execute in install script
P-INSTALL-PERSISTENCE	45	evidence	Persistence mechanism in install script
P-INSTALL-PROFILE-MOD	55	evidence	Shell profile modification in install script
P-INSTALL-SSH-ACCESS	80	evidence	Accessing SSH keys from install script
P-INSTALL-BROWSER-DATA	75	evidence	Accessing browser profile data from install script
P-INSTALL-GPG-ACCESS	70	evidence	Accessing GPG keyring from install script
P-INSTALL-PASSWD-READ	65	evidence	Reading system password files from install script
P-INSTALL-BASE64	65	evidence	Base64 decoding in install script (possible payload hiding)
P-INSTALL-EVAL	55	evidence	Dynamic code execution via eval in install script
P-INSTALL-NOHUP	75	evidence	nohup with backgrounding in install script (persistent hidden process)
P-INSTALL-TMP-EXEC	80	evidence	Executing from /tmp in install script
P-INSTALL-CHMOD-EXEC	80	evidence	chmod +x followed by execution in install script
P-INSTALL-PYTHON-EXEC	90	evidence	Python fetch-and-execute in install script
P-INSTALL-DEVNULL-BG	75	evidence	Network/shell command backgrounded with suppressed output in install script
P-INSTALL-MINER	85	evidence	Cryptocurrency mining references in install script
P-INSTALL-KERNEL-MOD	70	evidence	Kernel module loading in install script
P-INSTALL-ENV-TOKENS	65	evidence	Accessing sensitive environment variables in install script
P-INSTALL-IFS	65	evidence	$IFS used in install script (obfuscation)
P-INSTALL-ANSI-C-HEX	70	evidence	ANSI-C hex quoting in install script
P-INSTALL-ROT13	65	evidence	ROT13 encoding in install script
P-INSTALL-HISTORY-CLEAR	75	evidence	Shell history clearing in install script
P-INSTALL-LOG-CLEAR	80	evidence	Log clearing in install script
P-INSTALL-SUDOERS-MOD	80	evidence	Sudoers access in install script
P-INSTALL-PROMPT-COMMAND	70	evidence	PROMPT_COMMAND injection from install script
P-INSTALL-XDG-AUTOSTART	60	evidence	XDG autostart creation from install script
P-NPM-HOOK-NODE-EVAL	55	evidence	lifecycle install hook executes inline node code (node -e/–eval)
P-NPM-HOOK-DECODE	45	evidence	lifecycle install hook decodes a base64 payload
P-NPM-HOOK-ENV-EXFIL	50	evidence	lifecycle install hook reads process.env and contacts the network (secret exfiltration)
P-PY-SETUP-EXEC	42	evidence	setup.py spawns a subprocess at install time (download-and-execute vector)
P-PY-SETUP-EVAL-DECODE	55	evidence	setup.py exec/eval of a base64/hex-decoded payload (dynamic code execution)
P-PY-SETUP-URLLIB	40	evidence	setup.py downloads from the network at install time
P-GEM-EXEC-DECODE	55	evidence	Gemspec/extension hook executes a base64/packed-decoded command
P-GEM-POST-INSTALL-URL	30	context	Gemspec post_install_message references a remote URL
P-CARGO-BUILD-PROCESS-EXEC	30	context	build.rs spawns a process at build time (std::process::Command)
P-CARGO-BUILD-SHELL	50	evidence	build.rs invokes a shell at build time (download-and-execute vector)
P-CARGO-BUILD-DOWNLOAD	45	evidence	build.rs downloads a remote resource at build time
GO-MOD-REPLACE-REMOTE	30	context	go.mod replace directive redirecting a dependency to a remote source
P-NUGET-PS-IEX-DOWNLOAD	55	evidence	PowerShell IEX of DownloadString (download-and-execute) in NuGet install hook
P-NUGET-PS-INVOKE-EXPRESSION	35	context	PowerShell Invoke-Expression in NuGet install hook
P-NUGET-PS-ENCODEDCOMMAND	55	evidence	PowerShell base64 -EncodedCommand payload in NuGet install hook
P-NUGET-PS-FROMBASE64	38	context	PowerShell base64 decode of payload in NuGet install hook
P-NUGET-MSBUILD-INLINE-EXEC	50	evidence	MSBuild inline-task code execution via CodeTaskFactory in NuGet .targets/.props
PHP-COMPOSER-CURL-PIPE	55	evidence	Composer lifecycle script pipes curl/wget to a shell (download-and-execute)
PHP-COMPOSER-PHP-EVAL	55	evidence	Composer script invokes php -r with an eval/base64_decode/system payload
MAVEN-POM-EXEC-PLUGIN	30	context	POM declares a build plugin that executes arbitrary code/scripts at build time
HEX-MIX-CODE-EVAL	50	evidence	mix.exs evaluates dynamically constructed Elixir at compile time
HEX-MIX-BASE64-EVAL	55	evidence	mix.exs base64-decodes then executes/evaluates a payload
HEX-MIX-OS-CMD	35	context	mix.exs invokes Erlang :os.cmd at compile time
DART-HOOK-CURL-PIPE	55	evidence	Dart build hook pipes curl output to a shell (download-and-execute)
R-INSTALL-DOWNLOAD-EXEC	55	evidence	download.file feeding source/eval/system at install time (download-and-execute)
R-INSTALL-SYSTEM	30	context	shell-out (system/system2/shell) in a CRAN install-time script
JL-BUILD-SHELL-INTERP	55	evidence	build.jl spawns a shell interpreter at Pkg.build time
JL-DOWNLOAD-EXEC	55	evidence	build.jl downloads a remote artefact and include/eval-executes it
P-CONAN-SELF-RUN-SHELL	50	evidence	conanfile self.run() executing a shell/download command at build time
P-CONAN-SELF-RUN-PIPE-SHELL	55	evidence	conanfile self.run() piping fetched output to a shell (download-and-execute)

Manifest patterns

122 rules, section pkgbuild_analysis, capability manifest-patterns. Runs over: The primary manifest: package.json, setup.py, pyproject.toml, PKG-INFO, Cargo.toml, *.gemspec or composer.json.

Rule	Points	Class	Description
P-CURL-PIPE	90	evidence	curl output piped to shell (download-and-execute)
P-WGET-PIPE	90	evidence	wget output piped to shell (download-and-execute)
P-REVSHELL-DEVTCP	95	evidence	Bash reverse shell via /dev/tcp
P-REVSHELL-NC	95	evidence	Netcat reverse shell
P-REVSHELL-SOCAT	90	evidence	Socat reverse shell
P-REVSHELL-PYTHON	85	evidence	Python reverse shell pattern
P-EVAL-BASE64	85	evidence	Base64-decoded payload executed via eval
P-BASE64	60	evidence	Base64 decoding (possible payload hiding)
P-EVAL-VAR	50	evidence	Dynamic code execution via eval
P-SOURCE-REMOTE	90	evidence	Sourcing remote script via process substitution
P-GZIP-EXEC	70	evidence	Compressed payload piped to shell
P-SSH-ACCESS	75	evidence	Accessing SSH keys
P-BROWSER-DATA	70	evidence	Accessing browser profile data
P-GPG-ACCESS	65	evidence	Accessing GPG keyring
P-PROFILE-MOD	55	evidence	Modifying shell profile (persistence)
P-SYSTEMD-CREATE	35	context	Creating/enabling systemd service
P-CRON-CREATE	45	evidence	Creating cron job (persistence)
P-LD-PRELOAD	60	evidence	LD_PRELOAD injection
P-PASSWD-READ	60	evidence	Reading system password files
P-DISCORD-WEBHOOK	70	evidence	Discord webhook URL (data exfiltration channel)
P-URL-SHORTENER	60	evidence	URL shortener (hiding real destination)
P-CURL-PIPE-PYTHON	90	evidence	curl output piped to Python interpreter (download-and-execute)
P-CURL-PIPE-PERL	90	evidence	curl output piped to Perl interpreter (download-and-execute)
P-WGET-PIPE-PYTHON	90	evidence	wget output piped to Python interpreter (download-and-execute)
P-PYTHON-INLINE	45	evidence	Python inline code execution
P-SUID-BIT	70	evidence	Setting SUID/SGID bit (privilege escalation)
P-MKFIFO	55	evidence	Named pipe creation (possible reverse shell component)
P-OPENSSL-CLIENT	55	evidence	OpenSSL client connection (possible encrypted C2 channel)
P-CLIPBOARD-READ	50	evidence	Clipboard access (possible credential theft)
P-DISK-READ	60	evidence	Direct disk device read (data exfiltration)
P-MINER-BINARY	70	evidence	Reference to cryptocurrency mining software
P-STRATUM-URL	85	evidence	Stratum mining protocol URL (cryptocurrency mining)
P-MINING-POOL	80	evidence	Known cryptocurrency mining pool domain
P-CRYPTO-WALLET	75	evidence	Cryptocurrency wallet address (Monero/Bitcoin/Ethereum)
P-PYTHON-EXEC-URL	90	evidence	Python fetch-and-execute (exec with URL fetch)
P-PYTHON-DYNAMIC-IMPORT	65	evidence	Python dynamic import to execute system commands
P-PYTHON-EXEC-COMPOUND	80	evidence	Python one-liner with exec() (obfuscated code execution)
P-CHMOD-EXEC-CHAIN	75	evidence in an install hook, context elsewhere	chmod +x followed by execution (download-chmod-execute chain)
P-WGET-CHMOD-EXEC	85	evidence in an install hook, context elsewhere	Download followed by chmod +x (download-and-execute preparation)
P-TMP-EXECUTION	70	evidence in an install hook, context elsewhere	Writing or executing files in /tmp (common malware staging)
P-NOHUP-BACKGROUND	55	evidence	nohup with backgrounding (persistent hidden process)
P-DEVNULL-BACKGROUND	65	evidence	Network/shell command backgrounded with suppressed output
P-SYSINFO-RECON	40	evidence	System information gathering (reconnaissance)
P-PRINTF-HEX	60	evidence	printf with hex escape sequences (obfuscated payload)
P-XXD-DECODE	55	evidence	xxd reverse (hex to binary decode, possible payload)
P-KERNEL-MODULE-LOAD	50	evidence	Kernel module loading (potential rootkit)
P-KERNEL-MODULE-WRITE	45	evidence	Writing to kernel module directories
P-PASTEBIN-CODE	75	evidence	Downloading from paste service in build/package code (mutable untrusted source)
P-DNS-EXFIL	60	evidence	DNS lookup with variable interpolation (possible DNS exfiltration)
P-CURL-POST-DATA	55	evidence	curl POST with variable data (possible data exfiltration)
P-ARCHIVE-EXEC	55	evidence	Archive extraction followed by execution (extract-and-execute chain)
P-ENV-TOKEN-ACCESS	55	evidence	Accessing sensitive environment variables (token/credential theft)
P-IFS-OBFUSCATION	60	evidence	$IFS variable used as command separator (shell obfuscation)
P-ANSI-C-HEX	65	evidence	ANSI-C hex quoting to hide command strings
P-ROT13	60	evidence	ROT13 encoding/decoding (payload obfuscation)
P-OCTAL-ENCODE	55	evidence	Octal-encoded payload in printf/echo (3+ sequences)
P-REV-EXEC	70	evidence	Reversed string piped to shell (obfuscation)
P-REVSHELL-PERL	85	evidence	Perl reverse shell (Socket + connect/exec)
P-REVSHELL-RUBY	85	evidence	Ruby reverse shell (TCPSocket)
P-REVSHELL-AWK	85	evidence	Awk reverse shell (/inet/tcp)
P-REVSHELL-LUA	85	evidence	Lua reverse shell (socket.tcp)
P-REVSHELL-PHP	85	evidence	PHP reverse shell (fsockopen/socket_connect)
P-DECOMPRESS-EXEC	70	evidence	Decompressed payload piped to shell
P-PROC-SUB-DOWNLOAD	75	evidence	Process substitution with download command
P-RUBY-EXEC-URL	85	evidence	Ruby fetch-and-execute
P-PERL-EXEC-URL	85	evidence	Perl fetch-and-execute (LWP/HTTP::Tiny + system/exec)
P-DEV-UDP	85	evidence	Bash /dev/udp network connection
P-BASE32	60	evidence	Base32 decoding (payload hiding)
P-OPENSSL-DECRYPT	65	evidence	OpenSSL decryption (encrypted payload)
P-TELNET-PIPE	70	evidence	Telnet connection piped to command
P-XDG-AUTOSTART	55	evidence	XDG autostart entry creation
P-SYSTEMD-USER	50	evidence	Systemd user service creation (no root required)
P-UDEV-RULE	45	evidence	Udev rule creation
P-AT-JOB	60	evidence	at job scheduling (deferred execution)
P-PROMPT-COMMAND	65	evidence	PROMPT_COMMAND injection (runs on every prompt)
P-BASH-LOGOUT	55	evidence	.bash_logout modification (runs on session exit)
P-SUDOERS-MOD	75	evidence	Sudoers file access/modification
P-POLKIT-RULE	55	evidence	Polkit rule creation
P-SETCAP	65	evidence	Linux capability manipulation
P-HISTORY-CLEAR	70	evidence	Shell history clearing/suppression
P-LOG-CLEAR	75	evidence	System log clearing/truncation
P-PACMAN-HOOK	50	evidence	Pacman hook creation (unusual for AUR packages)
P-DD-WRITE	70	evidence	dd writing to device file
P-ALIAS-OVERRIDE	65	evidence	Alias override of common system commands
P-JS-EVAL-DECODE	55	evidence	eval() of a base64/hex-decoded payload (dynamic code execution)
P-JS-NEW-FUNCTION-DECODE	52	evidence	new Function() built from a base64-decoded payload (dynamic code execution)
P-JS-CHILDPROC-DECODE	50	evidence	child_process exec/spawn of a base64-decoded command (download-and-execute)
P-JS-ENV-EXFIL	35	context	serialises process.env (potential credential/secret exfiltration)
P-JS-OBFUSCATOR-SIG	25	context	javascript-obfuscator-style hex identifiers (obfuscated code)
P-JS-DYNAMIC-REQUIRE-NET	48	evidence	dynamic require() of a decoded module name (obfuscated dependency load)
P-PY-EXEC-DECODE	55	evidence	exec/eval of a decoded/decompressed payload (dynamic code execution)
P-PY-COMPILE-EXEC	48	evidence	exec(compile(…)) dynamic code execution
P-PY-DYNAMIC-IMPORT-DECODE	50	evidence	import of a decoded module name (obfuscated import)
P-PY-ENV-EXFIL	35	context	reads environment/host info and contacts the network (recon/exfil)
P-RUBY-EVAL-DECODE	55	evidence	Ruby eval of a base64/packed-decoded payload (dynamic code execution)
P-RUBY-OPEN-PIPE	30	context	Ruby IO.popen/Open3 subprocess execution
P-RUBY-KERNEL-EXEC-DECODE	55	evidence	Ruby system/exec/spawn of a base64/packed-decoded command (OS command injection)
P-RUST-INCLUDE-BYTES-DECODE	40	evidence	embedded byte blob paired with a runtime decoder (obfuscated payload)
P-RUST-ENV-EXFIL	35	context	reads an environment variable then contacts the network (secret exfil)
GO-EXEC-SHELL	55	evidence	exec.Command invoking a shell with -c (arbitrary command execution)
GO-SYSCALL-EXEC	50	evidence	syscall.Exec/ForkExec direct process replacement/spawn
GO-B64-DECODE-EXEC	55	evidence	base64-decoded payload passed to exec (staged execution)
GO-CGO-DOWNLOAD	50	evidence	cgo directive fetching remote code at build time
GO-GENERATE-CURL	45	evidence	//go:generate runs curl/wget (download-and-run at generate time)
P-NUGET-PS-ENV-EXFIL	38	context	PowerShell environment-variable exfiltration to network in NuGet package
PHP-EVAL-DECODE	55	evidence	PHP eval() of a base64/gzip/rot13-decoded payload (obfuscated code execution)
PHP-ASSERT-VAR	45	evidence	PHP assert() on a variable used as a dynamic code-execution sink
PHP-CREATE-FUNCTION	45	evidence	PHP create_function() dynamic code construction (eval backdoor vector)
PHP-SHELL-EXEC-VAR	45	evidence	PHP OS command execution sink invoked on a variable
PHP-OBFUSCATION-CHAIN	45	evidence	PHP nested gzinflate/str_rot13 obfuscation wrapping a decoded payload
MAVEN-JAVA-RUNTIME-EXEC	35	context	Java Runtime.getRuntime().exec() spawns an OS process
MAVEN-JAVA-DEFINECLASS-DECODE	45	evidence	Base64 decode chained into defineClass/Class.forName (runtime loading of decoded bytecode)
MAVEN-JAVA-URLCLASSLOADER-REMOTE	45	evidence	URLClassLoader constructed against a remote URL (loads + executes networked code)
HEX-SRC-BASE64-EVAL	55	evidence	base64-decoded blob fed to an executor/evaluator/deserializer (packed BEAM payload)
HEX-SRC-ENV-EXFIL	35	context	reads env/secrets then sends them over an HTTP client (exfil)
DART-PROCESS-SHELL	55	evidence	Dart Process.run/start spawning a shell (command execution)
DART-HTTPCLIENT-PROCESS-EXEC	50	evidence	dart:io HttpClient download followed by Process exec (download-and-run)
DART-BASE64-PROCESS	50	evidence	base64-decoded payload passed to Process exec
R-EVAL-PARSE-TEXT	30	context	dynamic R code execution via eval(parse(text=))
R-ONLOAD-SYSTEM	50	evidence	R load hook (.onLoad/.onAttach) runs system()/download.file at library load
JL-BASE64-INCLUDE-STRING	50	evidence	base64-decoded payload fed to include_string/eval (obfuscated execution)
P-APK-SOURCE-RAW-IP	45	evidence	APKBUILD source= points at a raw IP address rather than a hostname

GTFOBins

117 rules, section gtfobins_analysis, capability gtfobins. Runs over: Both the primary manifest and the install scripts. A hit in an install script gets the IS- prefix (IS-G-PIPE).

Rule	Points	Class	Description
G-REVSHELL-NODE	85	evidence	Node.js reverse shell (net.Socket connect)
G-REVSHELL-JULIA	85	evidence	Julia reverse shell (TCPSocket)
G-REVSHELL-TCLSH	85	evidence	Tcl reverse shell (socket connect)
G-REVSHELL-JJS	85	evidence	Java Nashorn/JShell reverse shell (Runtime.exec)
G-REVSHELL-KSH	85	evidence	Ksh reverse shell via /dev/tcp or /dev/udp
G-REVSHELL-GDB	85	evidence	GDB reverse shell via embedded Python
G-REVSHELL-GO	80	evidence	Go reverse shell (net.Dial)
G-BINDSHELL-SOCAT	85	evidence	Socat bind shell (LISTEN + EXEC)
G-BINDSHELL-NC	90	evidence	Netcat bind shell (listen + exec)
G-PIPE-NODE	90	evidence	Download piped to Node.js interpreter
G-PIPE-RUBY	90	evidence	Download piped to Ruby interpreter
G-PIPE-PHP	90	evidence	Download piped to PHP interpreter
G-PIPE-LUA	90	evidence	Download piped to Lua interpreter
G-PIPE-TCLSH	90	evidence	Download piped to Tcl interpreter
G-PIPE-RSCRIPT	90	evidence	Download piped to R interpreter
G-PIPE-JULIA	90	evidence	Download piped to Julia interpreter
G-PIPE-AWK	85	evidence	Download piped to Awk interpreter
G-PIPE-JJS	90	evidence	Download piped to Java Nashorn/JShell
G-PIPE-KSH	90	evidence	Download piped to Ksh shell
G-PIPE-CSH	90	evidence	Download piped to C shell
G-PIPE-ZSH	90	evidence	Download piped to Zsh shell
G-PIPE-FISH	90	evidence	Download piped to Fish shell
G-PIPE-DASH	90	evidence	Download piped to Dash shell
G-ALT-PIPE-SHELL	90	evidence	Alternative downloader piped to shell
G-TAR-CHECKPOINT	85	evidence	tar –checkpoint-action=exec (arbitrary command execution)
G-ZIP-EXEC	75	evidence	zip -TT command execution
G-GDB-EXEC	55	evidence	GDB batch mode execution (can run arbitrary commands)
G-VIM-SHELL	70	evidence	Vim/Neovim shell escape via -c flag
G-EXPECT-EXEC	55	evidence	Expect spawn/command execution
G-NSENTER	55	evidence	nsenter namespace entry (container escape / privilege escalation)
G-CAPSH	60	evidence	capsh privilege escalation (capability shell)
G-UNSHARE	55	evidence	unshare with shell execution (namespace escape)
G-NMAP-SCRIPT	55	evidence	Nmap scripting engine (can execute arbitrary Lua code)
G-SSH-PROXYCOMMAND	50	evidence	SSH ProxyCommand (arbitrary command execution on connect)
G-PKEXEC	55	evidence	pkexec privilege escalation via polkit
G-EMACS-EXEC	55	evidence	Emacs batch mode shell command execution
G-RLWRAP-SHELL	60	evidence	rlwrap wrapping shell/network tool (interactive reverse shell)
G-SQLITE-EXEC	55	evidence	SQLite3 .shell/.system command execution
G-SCREEN-EXEC	55	evidence	GNU Screen keystroke injection (-X stuff)
G-TMUX-SEND	50	evidence	tmux send-keys command injection
G-BUSYBOX-SHELL	65	evidence	Busybox shell/network subcommand abuse
G-DOAS	45	evidence	doas privilege escalation (sudo alternative)
G-CHROOT-SHELL	50	evidence	chroot with shell execution
G-DOCKER-RUN	50	evidence in an install hook, context elsewhere	Docker/Podman run with volume mount (host filesystem access)
G-SYSTEMD-RUN	55	evidence	systemd-run transient service execution
G-STRACE-EXEC	50	evidence	strace with output to /dev/null (hidden command execution)
G-SCRIPT-EXEC	45	evidence	script -c command execution
G-FLOCK-EXEC	50	evidence	flock lock file with suspicious command execution
G-DOWNLOAD-ARIA2C	40	evidence in an install hook, context elsewhere	aria2c download utility (alternative to curl/wget)
G-DOWNLOAD-LWP	45	evidence in an install hook, context elsewhere	Perl LWP download utility
G-DOWNLOAD-TFTP	55	evidence in an install hook, context elsewhere	TFTP file transfer (unauthenticated, commonly abused)
G-DOWNLOAD-FINGER	55	evidence	finger protocol data transfer (GTFOBins exfiltration technique)
G-DOWNLOAD-WHOIS	55	evidence	whois as data transfer channel (non-standard port)
G-DOWNLOAD-FTP	40	evidence in an install hook, context elsewhere	Scripted FTP transfer (automated file download)
G-DOWNLOAD-SMBCLIENT	50	evidence in an install hook, context elsewhere	SMB client scripted file transfer
G-DOWNLOAD-SCP	35	context	SCP remote file copy
G-DOWNLOAD-RSYNC	35	context	rsync from remote server
G-DOWNLOAD-NODE	50	evidence in an install hook, context elsewhere	Node.js remote fetch-eval or npx/npm-exec of a remote URL/VCS spec
G-NODE-INLINE	30	install hook only	Node.js inline code execution (dual-use; corroboration only)
G-RUBY-INLINE	30	install hook only	Ruby inline code execution (dual-use; corroboration only)
G-PHP-INLINE	30	install hook only	PHP inline code execution (dual-use; corroboration only)
G-LUA-INLINE	30	install hook only	Lua inline code execution (dual-use; corroboration only)
G-R-INLINE	30	install hook only	R inline code execution (dual-use; corroboration only)
G-JULIA-INLINE	30	install hook only	Julia inline code execution (dual-use; corroboration only)
G-JAVA-INLINE	30	install hook only	Java Nashorn/JShell inline execution (dual-use; corroboration only)
G-TCLSH-INLINE	30	install hook only	Tcl inline heredoc execution (dual-use; corroboration only)
G-GDB-PYTHON	55	evidence	GDB embedded Python execution
G-GNUPLOT-EXEC	55	evidence	gnuplot system() command execution
G-OCTAVE-EXEC	55	evidence	GNU Octave system() command execution
G-GUILE-EXEC	55	evidence	Guile Scheme system() command execution
G-IRONSQL-EXEC	30	install hook only	Ruby IRB interactive session with code execution (dual-use; corroboration only)
G-LD-LIBRARY-PATH	50	evidence	LD_LIBRARY_PATH manipulation (shared library injection)
G-LDCONFIG-CUSTOM	50	evidence	Custom ldconfig configuration (shared library path hijack)
G-TEE-SENSITIVE	75	evidence	tee writing to sensitive system file
G-CP-SENSITIVE	65	evidence	Copying sensitive authentication files
G-BASENC-DECODE	55	evidence	Non-standard base encoding decode (payload hiding)
G-HPING-EXFIL	60	evidence	hping3 packet crafting (data exfiltration / covert channel)
G-CANCEL-EXFIL	55	evidence	CUPS cancel command data exfiltration
G-RESTIC-EXFIL	45	evidence in an install hook, context elsewhere	restic backup to remote (potential data exfiltration)
G-REVSHELL-OPENSSL	80	evidence	OpenSSL s_server (encrypted bind shell / C2 listener)
G-BINDSHELL-GO	75	evidence	Go bind shell (net.Listen)
G-BINDSHELL-LUA	75	evidence	Lua bind shell (socket.bind)
G-BUSYBOX-WGET	50	evidence in an install hook, context elsewhere	Busybox wget alternative downloader
G-BUSYBOX-FTPD	70	evidence	Busybox ftpd (bind FTP server for exfiltration)
G-FIND-EXEC	60	evidence	find -exec with shell (GTFOBins command execution)
G-XARGS-SHELL	60	evidence	xargs executing shell with -c (command injection vector)
G-SED-EXEC	65	evidence	GNU sed e command (executes pattern space as shell command)
G-SPLIT-FILTER	70	evidence	split –filter (executes command per output chunk)
G-CPIO-RSH	70	evidence	cpio –rsh-command (arbitrary command execution)
G-DC-SHELL	55	evidence	dc calculator shell escape (! command)
G-M4-EXEC	60	evidence	m4 macro processor shell execution (esyscmd/syscmd)
G-IP-NETNS-EXEC	55	evidence	ip netns exec (namespace command execution)
G-GCC-WRAPPER	60	evidence	GCC -wrapper (arbitrary command execution via compiler)
G-CMAKE-EXEC	50	evidence	CMake command execution (env wrapper or execute_process)
G-PSQL-SHELL	60	evidence	PostgreSQL psql shell escape (!)
G-DOTNET-EXEC	50	evidence	.NET F# interactive or dotnet-script execution
G-TCPDUMP-EXEC	65	evidence	tcpdump -z post-rotation command execution
G-DOCKER-EXEC	45	evidence in an install hook, context elsewhere	Docker/Podman exec into running container
G-DOCKER-CP	40	evidence in an install hook, context elsewhere	Docker/Podman file copy (container boundary crossing)
G-NANO-SHELL	55	evidence	nano -s spell checker shell command substitution
G-ED-SHELL	55	evidence	ed editor shell escape (! command)
G-CODE-TUNNEL	70	evidence	VS Code tunnel (remote access establishment)
G-DOWNLOAD-SFTP	35	context	SFTP remote file transfer
G-DOWNLOAD-SSHFS	45	evidence in an install hook, context elsewhere	SSHFS remote filesystem mount (remote file access)
G-SSH-KEYGEN-LIB	65	evidence	ssh-keygen -D shared library load (code injection)
G-MYSQL-LIB	55	evidence	MySQL –default-auth shared library load
G-NGINX-LIB	55	evidence	nginx load_module (shared library injection)
G-CHATTR	55	evidence	chattr +i makes files immutable (anti-removal persistence)
G-CHOWN-SENSITIVE	65	evidence	chown on sensitive authentication files
G-LN-SENSITIVE	60	evidence	Symlink attack on sensitive files
G-MOUNT-BIND	55	evidence	Bind mount (filesystem overlay for privilege escalation)
G-INSTALL-SUID	70	evidence	install with SUID/SGID mode bits
G-REDIS-WRITE	65	evidence	Redis config set (arbitrary file write via RDB dump)
G-GIT-EXTDIFF	55	evidence	Git external diff command execution
G-IPTABLES-WRITE	40	evidence	iptables-save arbitrary file write
G-AB-EXFIL	55	evidence	Apache Bench POST data exfiltration
G-TAILSCALE-EXFIL	55	evidence	Tailscale file copy (VPN-based data exfiltration)

Source URLs

10 rules, section source_url_analysis, capability source-url-patterns. Runs over: The primary manifest.

Rule	Points	Class	Description
P-RAW-IP-URL	50	evidence; only in a PKGBUILD or install hook	Source URL uses raw IP address instead of domain
P-URL-SHORTENER	60	evidence	Source URL uses URL shortener (hiding real destination)
P-DISCORD-WEBHOOK	70	evidence	Discord webhook URL (data exfiltration channel)
P-PASTEBIN	50	evidence	Source from paste service (untrusted, mutable content)
P-DYNAMIC-DNS	55	evidence	Source uses dynamic DNS (common in C2 infrastructure)
P-TELEGRAM-BOT	65	evidence	Telegram bot API URL (data exfiltration channel)
P-TUNNEL-SERVICE	55	evidence	Tunnel service URL (obfuscated endpoint)
P-HTTP-SOURCE	15	context; only in a PKGBUILD or install hook	Plain HTTP source URL (no TLS, MITM risk)
P-FILEHOST-SOURCE	45	evidence	Source from ephemeral/anonymous file hosting (untrusted, mutable content)
P-MEGA-SOURCE	40	evidence	Source from MEGA file hosting (encrypted, unverifiable)