package analysis

type RepositoryFlags struct {
    HasKeygenTerms       bool   // "keygen", "crack", "loader", "serial"
    HasActivationClaims  bool   // "pre-activated", "full version"
    EmptyHomepage        bool   // No official website
    NoLicense            bool   // NOASSERTION or missing
    SuspiciousTopics     []string
    FutureDatedVersion   bool
    RapidStarGrowth      bool   // Artificial engagement
}

func AnalyzeRepository(repo *Repository) *ThreatAssessment {
    flags := &RepositoryFlags{
        HasKeygenTerms:      containsTerms(repo.Description, []string{"keygen", "crack", "loader", "serial"}),
        HasActivationClaims: containsTerms(repo.Description, []string{"pre-activated", "full"}),
        EmptyHomepage:       repo.Homepage == "",
        NoLicense:           repo.License == "NOASSERTION" || repo.License == "",
        FutureDatedVersion:  parseVersion(repo.Name) > currentYear(),
    }
    
    riskScore := calculateRisk(flags)
    
    return &ThreatAssessment{
        Flags:     flags,
        RiskLevel: riskScore,
        Verdict:   determineVerdict(riskScore),
    }
}

package investigation

import (
    "time"
    "strings"
)

type RepoMetadata struct {
    Name        string
    Description string
    Stars       int
    StarsPerDay float64
    CreatedAt   time.Time
    UpdatedAt   time.Time
    Topics      []string
    License     string
    Forks       int
    Issues      int
}

func AnalyzeMetadata(meta RepoMetadata) []string {
    var warnings []string
    
    // Check for piracy keywords
    piracyTerms := []string{
        "keygen", "crack", "loader", "serial", 
        "pre-activated", "full version", "license key",
    }
    
    desc := strings.ToLower(meta.Description)
    for _, term := range piracyTerms {
        if strings.Contains(desc, term) {
            warnings = append(warnings, 
                "Contains piracy indicator: " + term)
        }
    }
    
    // Artificial engagement detection
    if meta.StarsPerDay > 5 && meta.Forks == 0 {
        warnings = append(warnings, 
            "Suspicious star growth with no forks")
    }
    
    // No license or empty homepage
    if meta.License == "NOASSERTION" || meta.License == "" {
        warnings = append(warnings, 
            "Missing or unspecified license")
    }
    
    return warnings
}

package malware

import (
    "os"
    "path/filepath"
)

// Common Go malware patterns to watch for
type MalwareIndicators struct {
    NetworkConnections []string
    FileOperations     []string
    RegistryKeys       []string
    ProcessInjection   bool
    ObfuscationLevel   string
}

func ScanGoExecutable(binPath string) (*MalwareIndicators, error) {
    // Static analysis indicators
    indicators := &MalwareIndicators{}
    
    // Check for suspicious imports
    suspiciousImports := []string{
        "syscall",           // Direct system calls
        "unsafe",            // Memory manipulation
        "net/http",          // C2 communication
        "os/exec",           // Process execution
        "golang.org/x/sys",  // Low-level OS access
    }
    
    // Check file permissions
    info, err := os.Stat(binPath)
    if err != nil {
        return nil, err
    }
    
    // Executable should not request excessive permissions
    if info.Mode().Perm() > 0755 {
        indicators.FileOperations = append(
            indicators.FileOperations,
            "Excessive file permissions requested",
        )
    }
    
    return indicators, nil
}

package reporting

import (
    "bytes"
    "encoding/json"
    "net/http"
    "os"
)

type SecurityReport struct {
    RepositoryURL string   `json:"repository_url"`
    ReportType    string   `json:"report_type"`
    Details       string   `json:"details"`
    Indicators    []string `json:"indicators"`
}

func ReportMaliciousRepo(repoURL string, indicators []string) error {
    report := SecurityReport{
        RepositoryURL: repoURL,
        ReportType:    "malware_distribution",
        Details:       "Repository distributing fake/cracked antivirus software",
        Indicators:    indicators,
    }
    
    // Use GitHub's abuse reporting API
    // Requires authentication token
    token := os.Getenv("GITHUB_TOKEN")
    
    payload, _ := json.Marshal(report)
    req, _ := http.NewRequest(
        "POST",
        "https://api.github.com/repos/abuse",
        bytes.NewBuffer(payload),
    )
    req.Header.Set("Authorization", "token "+token)
    req.Header.Set("Content-Type", "application/json")
    
    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        return err
    }
    defer resp.Body.Close()
    
    return nil
}

# Dockerfile for safe malware analysis
FROM golang:1.21-alpine AS analyzer

RUN apk add --no-cache \
    git \
    ca-certificates \
    binutils \
    file

WORKDIR /analysis

# Network isolation
RUN echo "127.0.0.1 localhost" > /etc/hosts

# Create non-root user
RUN adduser -D -u 1000 researcher
USER researcher

# Static analysis tools only - no execution
CMD ["/bin/sh"]

#!/bin/bash
# analyze_suspicious_repo.sh

REPO_URL="$1"
ANALYSIS_DIR="/tmp/analysis_$(date +%s)"

# Clone in isolated environment
docker run --rm \
  --network none \
  -v "${ANALYSIS_DIR}:/analysis" \
  malware-analyzer \
  git clone --depth 1 "${REPO_URL}" /analysis/repo

# Static analysis only
docker run --rm \
  --network none \
  -v "${ANALYSIS_DIR}:/analysis" \
  malware-analyzer \
  sh -c "cd /analysis/repo && file * && strings * | grep -i 'http\|download\|install'"

# Clean up
rm -rf "${ANALYSIS_DIR}"

// Watch for credential theft patterns
type CredentialTheft struct {
    TargetBrowsers []string
    TargetApps     []string
    ExfilMethod    string
}

var CommonTargets = []string{
    "Chrome", "Firefox", "Edge",
    "Steam", "Discord", "Telegram",
    "Cryptocurrency wallets",
}

# For reporting tools
export GITHUB_TOKEN="your_github_personal_access_token"
export VIRUSTOTAL_API_KEY="your_virustotal_api_key"