<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-backdoored-libraries
description: >-
  Detect backdoored libraries through static analysis, behavioral profiling,
  code diff auditing, and runtime sandboxing. Identify obfuscated payloads,
  data exfiltration patterns, and unauthorized network communication in
  third-party packages.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - backdoor-detection
  - malware-analysis
  - static-analysis
  - behavioral-analysis
  - package-security
  - code-audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Detecting Backdoored Libraries

## Overview

Backdoored libraries contain intentionally hidden malicious functionality —
data exfiltration, reverse shells, credential harvesting, or cryptomining code.
Unlike compromised dependencies (account takeover), backdoors may be inserted
by the original author or injected through build system compromise. This skill
covers static analysis for obfuscation patterns, behavioral sandboxing, code
diff auditing between versions, and automated detection of known malicious patterns.

Mode: `[MODE: RED]` — Backdoor analysis and reverse engineering; `[MODE: BLUE]` — Automated detection.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `ast` module | Required |
| Node.js for JavaScript analysis | Required |
| strings/file utilities for binary inspection | Required |
| Sandbox environment (Docker) for runtime analysis | Required |
| Semgrep for pattern-based static analysis | Required |

## Key Concepts

### Static Analysis for Obfuscation

```bash
# Search for common obfuscation patterns in JavaScript
grep -rn "eval\s*(" node_modules/<package>/
grep -rn "Function\s*(" node_modules/<package>/
grep -rn "Buffer\.from.*base64" node_modules/<package>/
grep -rn "\\\\x[0-9a-f]" node_modules/<package>/

# Search for obfuscation in Python packages
grep -rn "exec\s*(" /path/to/package/
grep -rn "compile\s*(" /path/to/package/
grep -rn "__import__\s*(" /path/to/package/
grep -rn "base64\.b64decode" /path/to/package/

# Semgrep rules for malicious patterns
semgrep --config "p/javascript-audit" node_modules/<package>/
semgrep --config "p/python-audit" /path/to/package/
```

### Network Exfiltration Detection

```bash
# Find hardcoded URLs/IPs in packages
grep -rnoE "https?://[a-zA-Z0-9./?=_-]+" node_modules/<package>/
grep -rnoE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" node_modules/<package>/

# Find DNS lookups
grep -rn "dns\.\(lookup\|resolve\)" node_modules/<package>/
grep -rn "socket\.\(connect\|getaddrinfo\)" /path/to/package/

# Monitor runtime network activity in sandbox
docker run --rm --network=bridge \
  -v $(pwd):/app -w /app \
  node:18 sh -c "npm install <package> 2>&1" | tee install.log
```

### Version Diff Auditing

```bash
# Download two versions and diff
npm pack <package>@1.0.0 && npm pack <package>@1.0.1
mkdir /tmp/v1 /tmp/v2
tar xzf <package>-1.0.0.tgz -C /tmp/v1
tar xzf <package>-1.0.1.tgz -C /tmp/v2
diff -rq /tmp/v1 /tmp/v2

# Focus on code changes (not metadata)
diff -r --exclude='*.md' --exclude='package.json' /tmp/v1 /tmp/v2
```

## Workflow

### Step 1: Scan Package for Backdoor Indicators

```bash
node scripts/agent.js --action scan --path node_modules/suspicious-pkg --output /tmp/backdoor-scan.json
```

### Step 2: Diff Package Versions

```bash
node scripts/agent.js --action diff --package suspicious-pkg --version-a 1.0.0 --version-b 1.0.1 --output /tmp/diff.json
```

### Step 3: Analyze Obfuscated Code

```bash
node scripts/agent.js --action deobfuscate --file /tmp/suspicious-file.js --output /tmp/analysis.json
```

## Detection

```yaml
title: Backdoored Libraries Detection
id: f0bf3b50-ccaa-4959-b7a0-7d456c0e3ae5
status: experimental
description: Detects suspicious activity related to detecting backdoored libraries techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*detecting*backdoored*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Backdoored Libraries Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] Static analysis scans all third-party code for obfuscation patterns
- [ ] Network behavior monitored during package installation
- [ ] Version diffs reviewed for unexpected code additions
- [ ] Semgrep rules configured for known malicious patterns
- [ ] Sandbox environment used for untrusted package analysis
- [ ] Install scripts inspected before execution

## References

- [OpenSSF Package Analysis](https://github.com/ossf/package-analysis)
- [Semgrep Registry — Security Rules](https://semgrep.dev/explore)
- [npm Malware Detection](https://docs.npmjs.com/reporting-malware-in-an-npm-package)
- [Backstabber's Knife Collection](https://arxiv.org/abs/2005.09535)
