{"id":18830706,"url":"https://github.com/nextronsystems/thor-plugin","last_synced_at":"2025-08-16T15:10:37.421Z","repository":{"id":240092953,"uuid":"650142573","full_name":"NextronSystems/thor-plugin","owner":"NextronSystems","description":"Plugin interface for THOR APT Scanner","archived":false,"fork":false,"pushed_at":"2025-05-07T13:58:55.000Z","size":45,"stargazers_count":4,"open_issues_count":0,"forks_count":1,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-05-07T14:51:44.719Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/NextronSystems.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-06-06T12:36:08.000Z","updated_at":"2025-05-07T13:58:55.000Z","dependencies_parsed_at":"2025-02-20T15:32:30.787Z","dependency_job_id":"b30dd93f-47f8-480c-84d3-ca45004f4821","html_url":"https://github.com/NextronSystems/thor-plugin","commit_stats":null,"previous_names":["nextronsystems/thor-plugin"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/NextronSystems/thor-plugin","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NextronSystems%2Fthor-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NextronSystems%2Fthor-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NextronSystems%2Fthor-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NextronSystems%2Fthor-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/NextronSystems","download_url":"https://codeload.github.com/NextronSystems/thor-plugin/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NextronSystems%2Fthor-plugin/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":270728233,"owners_count":24635172,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-16T02:00:11.002Z","response_time":91,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-08T01:50:00.110Z","updated_at":"2025-08-16T15:10:37.409Z","avatar_url":"https://github.com/NextronSystems.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"## THOR Plugin System\n\nStarting with THOR 11, THOR supports Plugins. THOR Plugins give a quick option to extend THOR with\nyour own, custom features, e.g.:\n\n* Parse a file format that THOR does not (yet) support\n* Check more complex conditions that cannot be written as custom IOCs or rules\n* Post-processing: Extend THOR output in custom, user-defined ways\n\nIn a nutshell, THOR Plugins are ZIP archives containing Golang code that is executed by THOR during\na scan. Plugins register _hooks_ that are called during the scan and perform custom actions in\nthere.\n\n### Using a Plugin\n\nPlugins are ZIP files placed in a `plugins/` folder in your THOR directory. Each file is\ninterpreted as a separate plugin.\n\n\u003e Warning: Plugins contain executable code that is run by THOR. For this reason, never run any\n\u003e plugins that do not come from a trusted source.\n\n### Writing a Plugin\n\nPlugins are written in Golang and communicate with THOR via an interface defined in\n`thorplugin.go`. They are packaged as ZIP archives and placed in the `plugins/` directory.\n\nThe ZIP archive's content is similar to an independent Golang package. The archive must contain a\nGolang file that defines a package `main`. Additionally, the archive may contain:\n* Any number of additional Golang files\n* A `metadata.yml` file with information about the plugin (see below)\n* A `vendor` directory in case the plugin uses external libraries apart from the standard library (see `go mod vendor`)\n\nEach plugin must define an `Init(thor.Configuration, thor.Logger, thor.RegisterActions)` function.\nThis function is called on THOR startup and allows plugins to define the conditions when a plugin\nshould be notified, i.e., register _hooks_.\n\nHooks are invoked during the scan whenever something is scanned that fulfills the conditions\nspecified for the hook. In the context of the hook, plugins have access to the data of the scanned\nelement. There, plugins can perform further analysis on the data, or interact with the running THOR\nscan by, e.g., logging a finding, logging an informational message, or manipulate further THOR\nactions on the scanned element. Refer to the available hooks in `RegisterActions` in the `thor`\npackage for more information.\n\n\u003e Note: Plugins are interpreted by [yaegi](https://github.com/traefik/yaegi). While _yaegi_ tries\n\u003e to support the Go specification completely for the latest two major Go versions, there are some\n\u003e limitations. For instance, plugins cannot use `unsafe` and `syscall` packages from the standard\n\u003e library. Refer to _ yaegi_'s documentation for more information.\n\n#### Metadata\n\nPlugins may contain a `metadata.yml` file in the root of the ZIP archive. This file contains\nmetadata about the plugin, such as the plugin's name, version, and a description. \\\nTHOR reads this file and displays the information in the THOR log when the plugin is loaded.\n\nThe `metadata.yml` file must be a valid YAML file and may contain the following fields:\n\n* `name`: The name of the plugin. This field is mandatory and will be used in the THOR log for output from the plugin.\n* `version`: The version of the plugin. This field is optional and may be used to track the plugin's version.\n* `description`: A description of the plugin. This field is optional and may be used to describe the plugin's purpose.\n* `author`: The author of the plugin. This field is optional and may be used to credit the plugin's author.\n* `requires_thor`: The minimum THOR version required to run the plugin.\n  This field is optional.\n  It must be a valid semantic version string, prefixed with `v` (e.g., `v11.0.0`). \\\n  If the THOR version is lower than the specified version, THOR will not load the plugin and log an error instead.\n* `link`: A URL to the plugin's source code or documentation. This field is optional.\n* `build_tags`: A list of build tags that are applied when loading the plugin. This field is optional.\n  It may be used to specify build tags that are required for the plugin to work correctly.\n\n### Examples\n\nSee `github.com/thor-plugin/` for existing plugins, including several examples.\nThere is also a [plugin template](github.com/thor-plugin/template) available that can be used as a starting point for new plugins.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnextronsystems%2Fthor-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnextronsystems%2Fthor-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnextronsystems%2Fthor-plugin/lists"}