mirror of https://github.com/garrytan/gstack.git
fix(cso): make Phase 8 Tier 3 rules deterministic (#1523 review)
Keep all four campaign rules but rework R2/R3 to match only on deterministic, primary-source indicators. R1 and R4 unchanged. - R2 (auto-run reference): drop the undecidable "not present in npm tarball / locked-package artifacts" negative-proof clause; keep the deterministic "listed in package.json files array" exemption as an FP guard. - R3 (packed-dropper): drop the _0x obfuscation pattern, the ">=3 occurrences" count threshold, and the subjective "ordinary minified bundle" exclusion. Fire only when an R2 auto-run file also contains a literal createDecipheriv/gunzip/inflate call. - Restore the GHSA-g7cv-rxg3-hmpx / CVE-2026-45321 primary-source anchor.
This commit is contained in:
LYH
parent
ee27fb4efb
commit
ceb1d25fc9
|
|
@ -156,19 +156,22 @@ If approved, run the same Grep patterns on globally installed skill files and ch
|
|||
|
||||
**FP rules:** gstack's own skills are trusted (check if skill path resolves to a known repo). Skills that use `curl` for legitimate purposes (downloading tools, health checks) need context — only flag when the target URL is suspicious or when the command includes credential variables.
|
||||
|
||||
**Tier 3 — known-campaign IOCs (comprehensive mode only):** All rules in this tier surface only under `/cso --comprehensive` with TENTATIVE marking — daily mode's 8/10 zero-noise contract is unaffected.
|
||||
**Tier 3 — known-campaign IOCs (comprehensive mode only):** Detection for the mini-shai-hulud npm/PyPI supply-chain campaign (GitHub Security Advisory GHSA-g7cv-rxg3-hmpx / CVE-2026-45321). Every rule matches on a deterministic primary-source indicator — a hard C2 IOC string or a settings/`tasks.json` execution-context reference. All rules surface only under `/cso --comprehensive` with TENTATIVE marking — daily mode's 8/10 zero-noise contract is unaffected.
|
||||
|
||||
**R1** — Any Claude Code settings file (`.claude/settings.json`, `.claude/settings.local.json`, `~/.claude/settings.json`, or `~/.claude/settings.local.json`) `hooks.*.command` field containing a `/proc/.*/mem` read pattern. Direct process-memory introspection from a Claude Code hook has no legitimate use; it is a known credential-exfiltration technique against runner processes.
|
||||
|
||||
**R2** — `.claude/**/*.{js,mjs,ts,cjs}` or `.vscode/**/*.{js,mjs,ts,cjs}` containing **both** the `_0x[0-9a-f]{4,}` variable pattern (≥3 distinct occurrences) **and** at least one of `createDecipheriv`, `gunzip`, `gunzipSync`, `inflateRawSync`, `inflateSync`. Do not alert on ordinary minified bundles or inline sourcemap output unless both halves match.
|
||||
**R2** — File under `.claude/**` or `.vscode/**` that is (a) referenced from a Claude Code settings file (`.claude/settings.json`, `.claude/settings.local.json`, `~/.claude/settings.json`, or `~/.claude/settings.local.json`) `hooks.*.command` via `node|bun|python3?|bash|sh <path>`, `node --require <path>`, `node -e <inline-require>`, or direct path invocation, **OR** referenced from a `tasks.json` task with `runOptions.runOn: "folderOpen"`; and (b) not exempt by the Tier 3 FP guards below. Auto-run persistence bridge in TTP form — renaming the payload file does not evade.
|
||||
|
||||
**R3** — File under `.claude/**` or `.vscode/**` where **all three** hold: (a) referenced from any Claude Code settings file (`.claude/settings.json`, `.claude/settings.local.json`, `~/.claude/settings.json`, or `~/.claude/settings.local.json`) `hooks.*.command` via `node|bun|python3?|bash|sh <path>`, `node --require <path>`, `node -e <inline-require>`, or direct path invocation, **OR** from a `tasks.json` task with `runOptions.runOn: "folderOpen"`; (b) not present in package manifest evidence (`package.json` `files` array, npm tarball, or installed locked-package artifacts); (c) not exempt by the Tier 3 FP guards below. Auto-run persistence bridge in TTP form — renaming the payload file does not evade.
|
||||
**R3** — A file matched by R2 (auto-run-referenced under `.claude/**` or `.vscode/**`) that **also** contains a literal call to at least one of `createDecipheriv`, `gunzip`, `gunzipSync`, `inflateRawSync`, or `inflateSync`. An auto-run bridge that decrypts or decompresses an embedded payload at load time is a packed-dropper TTP. Deterministic: the R2 execution-context reference plus a literal decrypt/decompress API-name match — no obfuscation heuristic, occurrence count, or minified-bundle judgment.
|
||||
|
||||
**R4** — Strings `filev2.getsession.org`, `seed1.getsession.org`, `seed2.getsession.org`, or `seed3.getsession.org` appearing inside an executable context: a `hooks.*.command` value, a `tasks.json` `command`/`args` field, or a `fetch`/`http.get`/`axios`/`socket.connect`/`curl`/`nc` call inside a `.{js,mjs,ts,cjs,sh,py}` file under `.claude/**`/`.vscode/**`. Documentation or IOC-note mentions do not fire.
|
||||
|
||||
**Tier 3 FP guards:**
|
||||
- gstack-installed paths trusted: `~/.claude/skills/gstack/`, `~/.claude/skills/gstack-*/`, `~/.claude/hooks/` when content matches distributed checksums (extends the existing "gstack's own skills are trusted" precedent above).
|
||||
- R3 excluded under `.vscode/extensions/` and inside any directory listed in the root `package.json` `workspaces` field.
|
||||
- R2 and R3 excluded under `.vscode/extensions/` and inside any directory listed in the root `package.json` `workspaces` field.
|
||||
- R2 and R3 excluded when the referenced file is listed in the root `package.json` `files` array — a published-package artifact declared in the manifest, deterministically checkable by reading the manifest.
|
||||
|
||||
**Tier 3 references:** GHSA-g7cv-rxg3-hmpx (CVE-2026-45321). C2 IOCs: `filev2.getsession.org`, `seed1.getsession.org`, `seed2.getsession.org`, `seed3.getsession.org`.
|
||||
|
||||
### Phase 9: OWASP Top 10 Assessment
|
||||
|
||||
|
|
|
|||
|
|
@ -154,19 +154,22 @@ If approved, run the same Grep patterns on globally installed skill files and ch
|
|||
|
||||
**FP rules:** gstack's own skills are trusted (check if skill path resolves to a known repo). Skills that use `curl` for legitimate purposes (downloading tools, health checks) need context — only flag when the target URL is suspicious or when the command includes credential variables.
|
||||
|
||||
**Tier 3 — known-campaign IOCs (comprehensive mode only):** All rules in this tier surface only under `/cso --comprehensive` with TENTATIVE marking — daily mode's 8/10 zero-noise contract is unaffected.
|
||||
**Tier 3 — known-campaign IOCs (comprehensive mode only):** Detection for the mini-shai-hulud npm/PyPI supply-chain campaign (GitHub Security Advisory GHSA-g7cv-rxg3-hmpx / CVE-2026-45321). Every rule matches on a deterministic primary-source indicator — a hard C2 IOC string or a settings/`tasks.json` execution-context reference. All rules surface only under `/cso --comprehensive` with TENTATIVE marking — daily mode's 8/10 zero-noise contract is unaffected.
|
||||
|
||||
**R1** — Any Claude Code settings file (`.claude/settings.json`, `.claude/settings.local.json`, `~/.claude/settings.json`, or `~/.claude/settings.local.json`) `hooks.*.command` field containing a `/proc/.*/mem` read pattern. Direct process-memory introspection from a Claude Code hook has no legitimate use; it is a known credential-exfiltration technique against runner processes.
|
||||
|
||||
**R2** — `.claude/**/*.{js,mjs,ts,cjs}` or `.vscode/**/*.{js,mjs,ts,cjs}` containing **both** the `_0x[0-9a-f]{4,}` variable pattern (≥3 distinct occurrences) **and** at least one of `createDecipheriv`, `gunzip`, `gunzipSync`, `inflateRawSync`, `inflateSync`. Do not alert on ordinary minified bundles or inline sourcemap output unless both halves match.
|
||||
**R2** — File under `.claude/**` or `.vscode/**` that is (a) referenced from a Claude Code settings file (`.claude/settings.json`, `.claude/settings.local.json`, `~/.claude/settings.json`, or `~/.claude/settings.local.json`) `hooks.*.command` via `node|bun|python3?|bash|sh <path>`, `node --require <path>`, `node -e <inline-require>`, or direct path invocation, **OR** referenced from a `tasks.json` task with `runOptions.runOn: "folderOpen"`; and (b) not exempt by the Tier 3 FP guards below. Auto-run persistence bridge in TTP form — renaming the payload file does not evade.
|
||||
|
||||
**R3** — File under `.claude/**` or `.vscode/**` where **all three** hold: (a) referenced from any Claude Code settings file (`.claude/settings.json`, `.claude/settings.local.json`, `~/.claude/settings.json`, or `~/.claude/settings.local.json`) `hooks.*.command` via `node|bun|python3?|bash|sh <path>`, `node --require <path>`, `node -e <inline-require>`, or direct path invocation, **OR** from a `tasks.json` task with `runOptions.runOn: "folderOpen"`; (b) not present in package manifest evidence (`package.json` `files` array, npm tarball, or installed locked-package artifacts); (c) not exempt by the Tier 3 FP guards below. Auto-run persistence bridge in TTP form — renaming the payload file does not evade.
|
||||
**R3** — A file matched by R2 (auto-run-referenced under `.claude/**` or `.vscode/**`) that **also** contains a literal call to at least one of `createDecipheriv`, `gunzip`, `gunzipSync`, `inflateRawSync`, or `inflateSync`. An auto-run bridge that decrypts or decompresses an embedded payload at load time is a packed-dropper TTP. Deterministic: the R2 execution-context reference plus a literal decrypt/decompress API-name match — no obfuscation heuristic, occurrence count, or minified-bundle judgment.
|
||||
|
||||
**R4** — Strings `filev2.getsession.org`, `seed1.getsession.org`, `seed2.getsession.org`, or `seed3.getsession.org` appearing inside an executable context: a `hooks.*.command` value, a `tasks.json` `command`/`args` field, or a `fetch`/`http.get`/`axios`/`socket.connect`/`curl`/`nc` call inside a `.{js,mjs,ts,cjs,sh,py}` file under `.claude/**`/`.vscode/**`. Documentation or IOC-note mentions do not fire.
|
||||
|
||||
**Tier 3 FP guards:**
|
||||
- gstack-installed paths trusted: `~/.claude/skills/gstack/`, `~/.claude/skills/gstack-*/`, `~/.claude/hooks/` when content matches distributed checksums (extends the existing "gstack's own skills are trusted" precedent above).
|
||||
- R3 excluded under `.vscode/extensions/` and inside any directory listed in the root `package.json` `workspaces` field.
|
||||
- R2 and R3 excluded under `.vscode/extensions/` and inside any directory listed in the root `package.json` `workspaces` field.
|
||||
- R2 and R3 excluded when the referenced file is listed in the root `package.json` `files` array — a published-package artifact declared in the manifest, deterministically checkable by reading the manifest.
|
||||
|
||||
**Tier 3 references:** GHSA-g7cv-rxg3-hmpx (CVE-2026-45321). C2 IOCs: `filev2.getsession.org`, `seed1.getsession.org`, `seed2.getsession.org`, `seed3.getsession.org`.
|
||||
|
||||
### Phase 9: OWASP Top 10 Assessment
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue