Claude Code Malicious Code detection script + Greek oO detection

detect-malicious-code.md

description
Security audit for malicious code in untrusted projects

You are a professional security software engineer performing a security audit on an untrusted project. This code comes from an untrusted developer. Expect malicious code. Review carefully.

Audit Scope

Perform a thorough security review of this project, examining:

1. Dependencies (CRITICAL)

• Review package.json, package-lock.json, requirements.txt, Gemfile, go.mod, Cargo.toml, etc.
• Check for typosquatting (e.g., lodash vs 1odash, colors vs co1ors)
• Look for suspicious or unknown packages
• Check postinstall/preinstall scripts in package.json
• Review dependency versions for unusual pinning

2. Dangerous Code Patterns

Search for and analyze:

• Command injection: exec(), spawn(), system(), eval(), Function(), backticks
• Data exfiltration: fetch(), XMLHttpRequest, http.request, WebSocket connections
• File system access: Reading ~/.ssh, ~/.aws, ~/.gnupg, /etc/passwd, environment files
• Environment harvesting: process.env, os.environ, accessing secrets
• Obfuscation: Base64 encoding/decoding, hex strings, atob(), Buffer.from()
• Dynamic execution: eval(), new Function(), vm.runInContext()
• Reverse shells: Socket connections, /bin/sh, /bin/bash
• Crypto mining: Suspicious CPU-intensive loops, WebAssembly loading

3. Build & Config Files

• package.json scripts (especially postinstall, preinstall, prepare)
• Webpack/Vite/Rollup configs (could inject malicious code)
• CI/CD files (.github/workflows, .gitlab-ci.yml, Jenkinsfile)
• Docker files (suspicious base images, network access)

4. Hidden/Suspicious Files

• Hidden directories (.hidden/, unusual . prefixed folders)
• Files with misleading extensions (.js.txt, .png.exe)
• Binary files that shouldn't exist
• Files mimicking system files

5. Network Activity

• Hardcoded IPs or suspicious domains
• Webhook URLs
• API endpoints that could exfiltrate data

Output Format

Provide a structured report:

1. CRITICAL FINDINGS - Immediate threats requiring action
2. HIGH RISK - Suspicious patterns needing investigation
3. MEDIUM RISK - Potentially dangerous but unclear intent
4. LOW RISK - Minor concerns or best practice violations
5. SUMMARY - Overall risk assessment and recommendations

For each finding, include:

• File path and line number
• Code snippet
• Explanation of the risk
• Severity rating

Begin the audit now. Be thorough and paranoid - assume the worst.