[
  {
    "name": "Obfuscated Javascript (Base64 \"platform\")",
    "signature": "cGxhdGZvcm0",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "malicious"
  },
  {
    "name": "Obfuscated Javascript (Base64 \"eval\")",
    "signature": "ZXZhbAo=",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "malicious"
  },
  {
    "name": "Obfuscated Javascript (Base64 \"team15\")",
    "signature": "dGVhbTE1",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "malicious"
  },
  {
    "name": "Obfuscated Javascript (Buffered \"child_process\")",
    "signature": "FhwPVBErFkoaFwNLBg",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "malicious"
  },
  {
    "name": "Obfuscated Javascript (Buffered \"Local State\")",
    "signature": "ORsFWRlUNUwUAAM",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "malicious"
  },
  {
    "name": "Obfuscated Javascript (Hex Functions)",
    "signature": "function(_0x",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "malicious"
  },
  {
    "name": "Obfuscated Javascript (Function Constructor)",
    "signature": "new Function(",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "malicious"
  },
  {
    "name": "Evaluated Response (res)",
    "signature": "eval(res",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "malicious"
  },
  {
    "name": "Evaluated Response (err)",
    "signature": "eval(err",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "malicious"
  },
  {
    "name": "Eval",
    "signature": "eval(",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "warning"
  },
  {
    "name": "Malicious Endpoint (Fake Alchemy API)",
    "signature": "alchemy-api-v3.cloud",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "malicious"
  },
  {
    "name": "Escaped Unicode",
    "signature": "\\u0",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "warning"
  },
  {
    "name": "Reassigned Eval",
    "signature": "=eval",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "malicious"
  },
  {
    "name": "Reassigned Eval",
    "signature": "= eval",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "malicious"
  },
  {
    "name": "Obfuscated Javascript (Hex Variable Array Access)",
    "regex": true,
    "signature": "_0x[a-f0-9]{4,}\\[",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "malicious"
  },
  {
    "name": "Obfuscated Javascript (String.fromCharCode)",
    "signature": "String.fromCharCode(",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "warning"
  },
  {
    "name": "Obfuscated Javascript (parseInt High Radix)",
    "regex": true,
    "signature": "parseInt\\([^,]+,\\s*(?:[1-9]\\d+|[2-9])\\)",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "warning"
  },
  {
    "name": "Obfuscated Javascript (Encoded Constructor)",
    "signature": "modsbeulqtcnrcgprwofjtcixoakrhvuytnsz",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "malicious"
  },
  {
    "name": "Excessive Whitespace",
    "regex": true,
    "signature": "\\s{80,}",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx"
    ],
    "level": "warning"
  },
  {
    "name": "Obfuscated Python (PyArmor Runtime Import)",
    "signature": "from pytransform import pyarmor_runtime",
    "extensions": [
      "py"
    ],
    "level": "malicious"
  },
  {
    "name": "Obfuscated Python (PyArmor Runtime Call)",
    "signature": "pyarmor_runtime()",
    "extensions": [
      "py"
    ],
    "level": "malicious"
  },
  {
    "name": "Obfuscated Python (PyArmor Hook)",
    "signature": "__pyarmor__(",
    "extensions": [
      "py"
    ],
    "level": "malicious"
  },
  {
    "name": "Python Eval Call",
    "signature": "eval(",
    "extensions": [
      "py"
    ],
    "level": "malicious"
  },
  {
    "name": "Python Exec Call",
    "signature": "exec(",
    "extensions": [
      "py"
    ],
    "level": "warning"
  },
  {
    "name": "Python Base64 Decode",
    "signature": "base64.b64decode(",
    "extensions": [
      "py"
    ],
    "level": "warning"
  },
  {
    "name": "Python Marshal Load",
    "signature": "marshal.loads(",
    "extensions": [
      "py"
    ],
    "level": "malicious"
  },
  {
    "name": "Pyminifier Artifact",
    "signature": "# Created by pyminifier",
    "extensions": [
      "py"
    ],
    "level": "warning"
  },
  {
    "name": "Unicode Private Use Area Characters",
    "regex": true,
    "signature": "[\\uE000-\\uF8FF\\U000F0000-\\U000FFFFD\\U00100000-\\U0010FFFD]",
    "extensions": [
      "js",
      "mjs",
      "cjs",
      "ts",
      "mts",
      "cts",
      "jsx",
      "tsx",
      "json",
      "py"
    ],
    "level": "malicious"
  }
]