#!/usr/bin/env python3# -*- coding: utf-8 -*-\"\"\"Scan package-lock.json / package.json for Alibaba npm RAT campaign indicators.\"\"\"
from __future__ import annotations
import argparseimport jsonimport reimport sysfrom dataclasses import asdict, dataclass, fieldfrom pathlib import Pathfrom typing import Any

@dataclassclass Finding:    severity: str    category: str    package: str    detail: str

@dataclassclass ScanReport:    target: str    findings: list[Finding] = field(default_factory=list)    packages_scanned: int = 0
    @property    def overall(self) -> str:        if any(f.severity in (\"critical\", \"warning\") for f in self.findings):            return \"FAIL\"        return \"PASS\"
    def to_dict(self) -> dict[str, Any]:        return {            \"target\": self.target,            \"packages_scanned\": self.packages_scanned,            \"overall\": self.overall,            \"finding_count\": len(self.findings),            \"findings\": [asdict(f) for f in self.findings],        }

def load_rules(rules_path: Path) -> dict[str, Any]:    with rules_path.open(encoding=\"utf-8\") as fh:        return json.load(fh)

def collect_package_names(manifest: dict[str, Any]) -> set[str]:    names: set[str] = set()    for section in (\"dependencies\", \"devDependencies\"):        for name in (manifest.get(section) or {}):            names.add(name)            names.add(name.split(\"/\")[-1])    lock = manifest.get(\"packages\") or {}    if isinstance(lock, dict):        for key in lock:            if key.startswith(\"node_modules/\"):                pkg = key.split(\"node_modules/\")[-1]                names.add(pkg)                names.add(pkg.split(\"/\")[-1])    return names

CAMPAIGN_TAG = \"Alibaba-NPM-2026\"

def threat_detail(category: str, **ctx: str) -> str:    base = ctx.get(\"base\", \"\")    scope = ctx.get(\"scope\", \"\")    if category == \"known_malicious_package\":        return (            f\"Trojan/JS.SupplyChain.{base}!AlibabaRAT \"            f\"[行为:供应链投毒/跨平台后门, 活动:{CAMPAIGN_TAG}, 级别:高危]\"        )    if category == \"scope_impersonation\":        return (            f\"HEUR:Trojan/NPM.Typosquat.{base}!ScopeConfusion \"            f\"[仿冒:{scope}, 风险:作用域混淆/私有包名冲突, 活动:{CAMPAIGN_TAG}]\"        )    return f\"HEUR:Trojan/JS.Generic!Unknown [活动:{CAMPAIGN_TAG}]\"

def scan_package_names(names: set[str], rules: dict[str, Any]) -> list[Finding]:    findings: list[Finding] = []    malicious = set(rules.get(\"malicious_packages\", []))    for pkg in sorted(names):        base = pkg.split(\"/\")[-1]        if base in malicious:            findings.append(Finding(                severity=\"critical\",                category=\"known_malicious_package\",                package=pkg,                detail=threat_detail(\"known_malicious_package\", base=base),            ))    for scope in rules.get(\"impersonated_scopes\", []):        private_name = scope.split(\"/\")[-1]        for pkg in names:            if pkg.split(\"/\")[-1] == private_name and not pkg.startswith(\"@ali/\"):                findings.append(Finding(                    severity=\"warning\",                    category=\"scope_impersonation\",                    package=pkg,                    detail=threat_detail(\"scope_impersonation\", base=pkg.split(\"/\")[-1], scope=scope),                ))    return findings

def scan_target(target: Path, rules: dict[str, Any]) -> ScanReport:    report = ScanReport(target=str(target))    names: set[str] = set()    for fname in (\"package.json\", \"package-lock.json\"):        path = target / fname        if path.is_file():            names |= collect_package_names(json.loads(path.read_text(encoding=\"utf-8\")))    report.packages_scanned = len(names)    report.findings = scan_package_names(names, rules)    return report

def main() -> int:    parser = argparse.ArgumentParser()    parser.add_argument(\"--project\", type=Path, default=Path(\".\"))    parser.add_argument(\"--rules\", type=Path, default=Path(__file__).with_name(\"known_packages.json\"))    parser.add_argument(\"--strict\", action=\"store_true\")    args = parser.parse_args()    report = scan_target(args.project.resolve(), load_rules(args.rules.resolve()))    print(json.dumps(report.to_dict(), ensure_ascii=False, indent=2))    return 1 if args.strict and report.overall == \"FAIL\" else 0

if __name__ == \"__main__\":    sys.exit(main())

{  \"target\": \".../demo_project\",  \"packages_scanned\": 3,  \"overall\": \"FAIL\",  \"finding_count\": 3,  \"findings\": [    {      \"severity\": \"critical\",      \"category\": \"known_malicious_package\",      \"package\": \"lib-mtop\",      \"detail\": \"Trojan/JS.SupplyChain.lib-mtop!AlibabaRAT [行为:供应链投毒/跨平台后门, 活动:Alibaba-NPM-2026, 级别:高危]\"    }  ]}