Repository Index

A modular Python application to pull intelligence about malicious files

• malware-analysis
• malware-research
• investigation
• cybersecurity

The current repository contains all the scripts needed to build kernel-mode mac-a-mal malicious activity hooking on macOS.

• macos

YALIH (Yet Another Low Interaction Honeyclient) is a low Interaction Client honeypot designed to detect malicious websites through signature, anomaly and pattern matching techniques

A minimalist Crystal authorization system inspired by https://github.com/varvet/pundit.

• praetorian
• crystal
• authorization
• authorisation

PocketBase + SvelteKit (Static): minimalistic template with configured authorization featuring a single binary or Docker image for deploying.

• pocketbase
• sveltekit
• authorization

Normalizer for honeypot data.

🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.

• ansible
• ansible-playbook
• devsecops
• infrastructure-as-code

Fetch and normalize parameterized URLs from the Wayback CDX API (OSINT, inspired by ParamSpider).

• bugbounty
• cdx
• cli
• kali-linux

Detect the Shai Hulud 2.0 npm supply chain attack (796+ packages). Scans for malicious files, hashes, and compromised ecosystems. Fast, accurate scanner.

• cdn
• cve
• polyfill
• polyfill-io

Deep network visibility, powered by Suricata. Artica integrates the Suricata IDS engine directly inside your server, giving you enterprise-grade intrusion detection without the complexity. Monitor every packet in real time, detect advanced threats, and visualize malicious

• appliance
• network-monitoring
• suricata

A simple tool to organise large malicious/benign files into a organised Structure.

• malware
• malware-analysis
• malware-research
• clean-file