A Python 3.14+ CLI tool (stdlib only) for detecting malware in packages from the Arch User Repository. It scans currently installed AUR packages, historical pacman logs, systemd services, eBPF rootkit artifacts, and npm/bun/yarn/pnpm caches against configurable campaign-based threat lists (e.g., the June 2026 atomic-lockfile attack, CHAOS RAT 2025, Russian spam campaigns). The architecture is modular: campaign configuration is data-driven (JSON), the scanner is split into focused mixin classes (PackageMixin, SystemMixin, CacheMixin) combined via the AurScanner class, and all results are typed dataclasses. The package runs with zero external dependencies, has comprehensive unit tests, and includes an integration layer (pacman hook + systemd timer) for continuous monitoring. The code demonstrates high craftsmanship: strict typing, defensive I/O, locale-safe date parsing, cache-efficient file scanning, and a clean exit-code scheme based on Nagios conventions.
This repository, branded as "The Malware Bible," is a curated educational knowledge base for cybersecurity, malware analysis, reverse engineering, and exploit development. It is not a conventional software application or an operational data pipeline; under the available classifications it is closest to data/research because its core assets are reference documentation, course-style Markdown modules, and research-oriented binaries rather than runnable application code. The content is organized into four learning paths: The Beginning (C, Python, x86 assembly, shellcode, reverse engineering basics), The Journey (PE/ELF structures, Android/iOS package formats), The Rituals (obfuscation, evasion, and writing malware), and The Scriptures (tool cheatsheets for radare2, IDA Pro, WinDbg, YARA, WinAPI, and evasion tactics). In practice, the repository serves as a self-study curriculum and analyst reference, not as a deployable system. It includes a large Windows DLL export catalog in Markdown, example ELF binaries demonstrating heap overflow, use-after-free, ROP chains and format string bugs, and numerous screenshots/diagrams. There is no CI/CD, dependency management, or automated testing; several files are marked "Coming soon" or "WORK IN PROGRESS," and external links or sponsor images may rot over time. The Windows API and DLL reference content is broad but may drift as Windows evolves. The last commit is recent, indicating active maintenance, and the repository benefits from a structured table of contents and consistent formatting across chapters.
This repository is a curated list (awesome list) of resources related to malware persistence techniques, tools, and references across multiple platforms (Windows, Linux, macOS, Cloud, Firmware, Databases). It does not contain any executable code, application logic, or data pipelines; it is purely a collection of external links and descriptions organized into categories such as Techniques, Persistence Removal, Detection Testing, Prevention, and Collection. The repository is maintained under the 'awesome' standard with a CI workflow that runs awesome-lint to ensure formatting compliance. It serves as a reference knowledge base for cybersecurity professionals researching persistence mechanisms.
This repository is a listing of 50 final-year project ideas covering machine learning, blockchain, web development, and cryptography. It contains only a README file that describes each project and provides links to YouTube tutorials. The actual source code, documents, and explanation videos are not included in the repository; instead, the README directs users to contact the author via email or WhatsApp to obtain the materials. The repository functions as a marketing page rather than a functional codebase. No code, data, or configuration files are present, making it impossible to evaluate architecture, reusability, or data lineage.