<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Detecting Backdoored Libraries — API Reference

## Static Analysis Patterns

### JavaScript Suspicious Patterns

| Pattern | Severity | Description |
|---------|----------|-------------|
| `eval()` | Critical | Arbitrary code execution |
| `Function()` | High | Dynamic function creation |
| `Buffer.from(..., 'base64')` | High | Base64 payload decoding |
| `child_process` | Critical | System command execution |
| `require('http')` | High | HTTP client for exfiltration |
| `process.env` | Medium | Environment variable access |
| `execSync()` | Critical | Synchronous command execution |

### Python Suspicious Patterns

| Pattern | Severity | Description |
|---------|----------|-------------|
| `exec()` | Critical | Arbitrary code execution |
| `eval()` | Critical | Expression evaluation |
| `__import__()` | High | Dynamic module import |
| `base64.b64decode()` | High | Base64 payload decoding |
| `subprocess.*()` | High | System command execution |
| `os.system()` | Critical | Direct shell command |
| `socket.connect()` | High | Network communication |

## Semgrep Rules

```bash
# Run security audit rules
semgrep --config "p/javascript-audit" <path>
semgrep --config "p/python-audit" <path>

# Custom rule for obfuscated eval
semgrep --pattern 'eval(Buffer.from($X, "base64").toString())' <path>

# Find network calls
semgrep --pattern 'require("http").request($URL, ...)' <path>
```

## Runtime Sandboxing

```bash
# Docker sandbox for npm package
docker run --rm --network=none \
  -v $(pwd):/app -w /app \
  node:18 sh -c "npm install <package> && node -e 'require(\"<package>\")'"

# Strace for system call monitoring
strace -f -e trace=network,file -o trace.log npm install <package>

# Firejail sandbox (Linux)
firejail --net=none --private npm install <package>
```

## Version Comparison

```bash
# Download specific versions
npm pack <package>@1.0.0
npm pack <package>@1.0.1

# Extract and diff
mkdir /tmp/{v1,v2}
tar xzf <package>-1.0.0.tgz -C /tmp/v1
tar xzf <package>-1.0.1.tgz -C /tmp/v2
diff -r /tmp/v1 /tmp/v2

# Code-only diff (skip metadata)
diff -r --exclude='*.md' --exclude='*.json' /tmp/v1 /tmp/v2
```
