https://github.com/jordan-wright/ossmalware

https://github.com/jordan-wright/ossmalware

Last synced: 14 days ago
JSON representation

• Host: GitHub
• URL: https://github.com/jordan-wright/ossmalware
• Owner: jordan-wright
• License: mit
• Created: 2020-10-12T02:50:04.000Z (about 4 years ago)
• Default Branch: main
• Last Pushed: 2022-08-30T16:30:13.000Z (about 2 years ago)
• Last Synced: 2024-10-14T12:24:11.908Z (27 days ago)
• Language: Go
• Size: 68.4 KB
• Stars: 93
• Watchers: 8
• Forks: 5
• Open Issues: 8
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# ossmalware

Attempts to use dynamic analysis to find malware hosted on package managers.

## Current Status

This is currently a personal project, so getting setup isn't streamlined. I'll be working to improve this shortly.

## Getting Started

The first thing you'll need to do is to change up the variables in the `terraform/` directory to point to an S3 bucket and SQS queue you control.

Then, you'll need to create an EC2 instance with permission to write to S3 and read from SQS.

When you're SSH'd into that EC2 instance, run the `scripts/setup.sh` script in this repository to bootstrap the host. This downloads the various Docker images and tooling (like sysdig and tcpdump) that you'll need during analysis.

Then, you can adjust the environment variables in the `scripts/start.sh` script in this repository, then run it to start listening for packages on the SQS queue.

At this point, you can upload packages to SQS and the worker(s) will start processing them.