/**
 * Malware Detection Patterns
 * Comprehensive patterns to detect malware in installed dependencies
 */

import { MalwarePattern } from './types';
import { MalwareIndicator } from '../types';
import { Severity } from '../../types';

/**
 * Malware detection patterns for installed dependencies
 */
export const MALWARE_PATTERNS: MalwarePattern[] = [
  // ==================== BACKDOOR PATTERNS ====================
  {
    id: 'MAL-BACKDOOR-001',
    name: 'Reverse Shell',
    description: 'Detects reverse shell commands that allow remote access',
    indicator: MalwareIndicator.BACKDOOR,
    severity: Severity.CRITICAL,
    patterns: [
      /\bexec\s*\(\s*['"`].*?(bash|sh|cmd|powershell).*?-[ice].*?['"`]\s*\)/gi,
      /\b(nc|netcat|ncat)\s+.*?\s+\d+\s*[-e]?\s*(\/bin\/(ba)?sh|cmd)/gi,
      /\bpython\s+-c\s+['"]import\s+socket.*?subprocess.*?['"`]/gi,
      /\bsocket\s*\(\s*\).*?connect\s*\(.*?\).*?subprocess/gis,
      /\bchild_process.*?spawn\s*\(\s*['"`](bash|sh|cmd|powershell)['"`]/gi,
      /new\s+WebSocket\s*\(.*?\).*?\.on\s*\(\s*['"`]message['"`].*?eval/gis,
      /\beval\s*\(\s*require\s*\(\s*['"`]child_process['"`]\s*\)/gi,
      /\brequire\s*\(\s*['"`]child_process['"`]\s*\)\.exec\s*\(\s*process\.env/gi
    ],
    fileExtensions: ['.js', '.ts', '.py', '.php', '.sh', '.ps1', '.rb'],
    keywords: ['exec', 'spawn', 'socket', 'connect', 'subprocess', 'child_process'],
    confidence: 95,
    standards: [
      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
      { standard: 'MITRE', id: 'T1059', description: 'Command and Scripting Interpreter' },
      { standard: 'OWASP', id: 'A03:2021', description: 'Injection' }
    ]
  },
  {
    id: 'MAL-BACKDOOR-002',
    name: 'SSH Key Exfiltration',
    description: 'Attempts to read or exfiltrate SSH private keys',
    indicator: MalwareIndicator.BACKDOOR,
    severity: Severity.CRITICAL,
    patterns: [
      /\.ssh\/(id_rsa|id_ed25519|id_ecdsa|id_dsa)/gi,
      /readFileSync\s*\(\s*.*?\.ssh.*?id_/gi,
      /open\s*\(\s*['"`].*?\.ssh.*?(id_rsa|id_ed25519)/gi,
      /\$HOME\/\.ssh\/(id_rsa|authorized_keys)/gi,
      /process\.env\.HOME.*?\.ssh/gi
    ],
    fileExtensions: ['.js', '.ts', '.py', '.php', '.rb', '.sh'],
    keywords: ['.ssh', 'id_rsa', 'private_key', 'authorized_keys'],
    confidence: 90,
    standards: [
      { standard: 'CWE', id: 'CWE-522', description: 'Insufficiently Protected Credentials' },
      { standard: 'MITRE', id: 'T1552.004', description: 'Private Keys' }
    ]
  },

  // ==================== DATA EXFILTRATION PATTERNS ====================
  {
    id: 'MAL-EXFIL-001',
    name: 'Environment Variable Exfiltration',
    description: 'Sends environment variables (tokens, keys) to external servers',
    indicator: MalwareIndicator.DATA_EXFILTRATION,
    severity: Severity.CRITICAL,
    patterns: [
      /process\.env.*?(fetch|axios|request|http\.request|https\.request)/gis,
      /os\.environ.*?requests\.(post|get|put)/gis,
      /\$_ENV.*?curl_exec/gi,
      /fetch\s*\(\s*['"`]https?:\/\/(?!localhost|127\.0\.0\.1).*?['"`].*?process\.env/gis,
      /axios\.(post|put)\s*\(\s*['"`]https?:\/\/.*?['"`].*?process\.env/gis,
      /JSON\.stringify\s*\(\s*process\.env\s*\)/gi,
      /Buffer\.from\s*\(\s*JSON\.stringify\s*\(\s*process\.env/gi,
      /btoa\s*\(\s*JSON\.stringify\s*\(\s*process\.env/gi
    ],
    fileExtensions: ['.js', '.ts', '.py', '.php'],
    keywords: ['process.env', 'os.environ', 'getenv', 'fetch', 'axios', 'request'],
    confidence: 92,
    standards: [
      { standard: 'CWE', id: 'CWE-200', description: 'Exposure of Sensitive Information' },
      { standard: 'MITRE', id: 'T1041', description: 'Exfiltration Over C2 Channel' }
    ]
  },
  {
    id: 'MAL-EXFIL-002',
    name: 'Credential Harvesting',
    description: 'Attempts to extract and send credentials or tokens',
    indicator: MalwareIndicator.STEALER,
    severity: Severity.CRITICAL,
    patterns: [
      /localStorage\.(getItem|get)\s*\(\s*['"`].*?(token|auth|session|jwt)/gi,
      /document\.cookie.*?(fetch|XMLHttpRequest|axios)/gis,
      /chrome\.storage.*?\.get/gi,
      /keytar\.getPassword/gi,
      /credentials?\s*[=:]\s*\{.*?(username|password|token)/gis,
      /fs\.readFileSync\s*\(\s*['"`].*?(credential|password|secret|token)/gi
    ],
    fileExtensions: ['.js', '.ts', '.py', '.php'],
    keywords: ['token', 'credential', 'password', 'cookie', 'localStorage', 'session'],
    confidence: 88,
    standards: [
      { standard: 'CWE', id: 'CWE-522', description: 'Insufficiently Protected Credentials' },
      { standard: 'MITRE', id: 'T1555', description: 'Credentials from Password Stores' }
    ]
  },
  {
    id: 'MAL-EXFIL-003',
    name: 'DNS Exfiltration',
    description: 'Uses DNS queries to exfiltrate data',
    indicator: MalwareIndicator.DATA_EXFILTRATION,
    severity: Severity.HIGH,
    patterns: [
      /dns\.resolve.*?process\.env/gis,
      /require\s*\(\s*['"`]dns['"`]\s*\)\.resolve.*?\.join/gis,
      /socket\.gethostbyname\s*\(.*?\+/gi,
      /nslookup.*?\$\(/gi,
      /\bdns\.lookup\s*\(\s*`\$\{.*?\}/gi
    ],
    fileExtensions: ['.js', '.ts', '.py', '.sh'],
    keywords: ['dns', 'resolve', 'gethostbyname', 'nslookup'],
    confidence: 85,
    standards: [
      { standard: 'CWE', id: 'CWE-200', description: 'Exposure of Sensitive Information' },
      { standard: 'MITRE', id: 'T1048.003', description: 'Exfiltration Over Alternative Protocol' }
    ]
  },

  // ==================== CRYPTOMINER PATTERNS ====================
  {
    id: 'MAL-CRYPTO-001',
    name: 'Cryptominer Detection',
    description: 'Detects cryptocurrency mining code',
    indicator: MalwareIndicator.CRYPTOMINER,
    severity: Severity.HIGH,
    patterns: [
      /\b(coinhive|cryptonight|monero|xmr|stratum)/gi,
      /CoinHive\.Anonymous/gi,
      /stratum\+tcp:\/\//gi,
      /miner\.start\s*\(/gi,
      /\bCryptoNight\b.*?hash/gis,
      /pool\.minexmr\.com/gi,
      /['"`]mining['"`]\s*:\s*true/gi,
      /WebAssembly\.instantiate.*?miner/gis,
      /importScripts\s*\(\s*['"`].*?(coinhive|cryptoloot|miner)/gi
    ],
    fileExtensions: ['.js', '.ts', '.wasm', '.html', '.php', '.py'],
    keywords: ['miner', 'hash', 'stratum', 'coinhive', 'monero', 'xmr', 'cryptonight'],
    confidence: 95,
    standards: [
      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
      { standard: 'MITRE', id: 'T1496', description: 'Resource Hijacking' }
    ]
  },

  // ==================== OBFUSCATION PATTERNS ====================
  {
    id: 'MAL-OBF-001',
    name: 'Heavily Obfuscated Code',
    description: 'Detects suspicious code obfuscation patterns',
    indicator: MalwareIndicator.OBFUSCATED,
    severity: Severity.HIGH,
    patterns: [
      /eval\s*\(\s*atob\s*\(/gi,
      /eval\s*\(\s*Buffer\.from\s*\(.*?,\s*['"`]base64['"`]\s*\)/gi,
      /eval\s*\(\s*String\.fromCharCode\s*\(/gi,
      /\beval\s*\(\s*unescape\s*\(/gi,
      /Function\s*\(\s*atob\s*\(/gi,
      /\beval\s*\(\s*\[\s*\d+.*?\]\.map.*?String\.fromCharCode/gis,
      /\\x[0-9a-f]{2}(\\x[0-9a-f]{2}){20,}/gi,
      /\\u[0-9a-f]{4}(\\u[0-9a-f]{4}){20,}/gi,
      /\['\\x.*?'\]/g,
      /\(_0x[a-f0-9]+\s*[,)]/gi,
      /var\s+_0x[a-f0-9]+\s*=/gi
    ],
    fileExtensions: ['.js', '.ts', '.php'],
    keywords: ['eval', 'atob', 'fromCharCode', 'unescape', '_0x'],
    confidence: 80,
    standards: [
      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
      { standard: 'MITRE', id: 'T1027', description: 'Obfuscated Files or Information' }
    ]
  },
  {
    id: 'MAL-OBF-002',
    name: 'Dynamic Code Execution',
    description: 'Suspicious dynamic code execution patterns',
    indicator: MalwareIndicator.OBFUSCATED,
    severity: Severity.MEDIUM,
    patterns: [
      /new\s+Function\s*\(\s*['"`]return\s+this['"`]\s*\)\s*\(\)/gi,
      /\(\s*function\s*\(\s*\)\s*\{\s*return\s+this\s*;\s*\}\s*\)\s*\(\)/gi,
      /\beval\s*\(\s*`/gi,
      /\(\s*1\s*,\s*eval\s*\)/gi,
      /require\s*\(\s*['"`]vm['"`]\s*\)\.runInThisContext/gi,
      /\bvm\.(run|compile)Script/gi
    ],
    fileExtensions: ['.js', '.ts'],
    keywords: ['eval', 'Function', 'vm', 'runInThisContext'],
    confidence: 75,
    standards: [
      { standard: 'CWE', id: 'CWE-94', description: 'Improper Control of Generation of Code' },
      { standard: 'MITRE', id: 'T1059.007', description: 'JavaScript' }
    ]
  },

  // ==================== LOADER PATTERNS ====================
  {
    id: 'MAL-LOADER-001',
    name: 'Remote Code Loader',
    description: 'Downloads and executes code from remote server',
    indicator: MalwareIndicator.LOADER,
    severity: Severity.CRITICAL,
    patterns: [
      /fetch\s*\(.*?\)\.then.*?eval/gis,
      /axios\.get\s*\(.*?\)\.then.*?eval/gis,
      /https?\.get\s*\(.*?\).*?\.on\s*\(\s*['"`]data['"`].*?eval/gis,
      /request\s*\(.*?\).*?eval/gis,
      /\beval\s*\(\s*await\s+fetch/gi,
      /child_process.*?exec.*?curl.*?\|.*?node/gi,
      /child_process.*?exec.*?wget.*?-O.*?\|/gi,
      /exec\s*\(\s*['"`]curl\s+.*?\|.*?(sh|bash|node|python)/gi,
      /import\s*\(\s*['"`]https?:\/\//gi
    ],
    fileExtensions: ['.js', '.ts', '.py', '.sh'],
    keywords: ['eval', 'fetch', 'axios', 'curl', 'wget', 'import'],
    confidence: 93,
    standards: [
      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
      { standard: 'MITRE', id: 'T1105', description: 'Ingress Tool Transfer' }
    ]
  },
  {
    id: 'MAL-LOADER-002',
    name: 'Payload Decoder',
    description: 'Decodes and executes hidden payloads',
    indicator: MalwareIndicator.LOADER,
    severity: Severity.HIGH,
    patterns: [
      /Buffer\.from\s*\(\s*['"`][A-Za-z0-9+\/=]{50,}['"`]\s*,\s*['"`]base64['"`]\s*\)\.toString\s*\(\s*\).*?eval/gis,
      /atob\s*\(\s*['"`][A-Za-z0-9+\/=]{50,}['"`]\s*\).*?eval/gis,
      /base64\.b64decode\s*\(.*?\).*?exec/gis,
      /zlib\.(inflate|decompress).*?eval/gis,
      /gunzip.*?eval/gis
    ],
    fileExtensions: ['.js', '.ts', '.py'],
    keywords: ['base64', 'atob', 'Buffer', 'decode', 'decompress'],
    confidence: 88,
    standards: [
      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
      { standard: 'MITRE', id: 'T1140', description: 'Deobfuscate/Decode Files or Information' }
    ]
  },

  // ==================== SUSPICIOUS NETWORK PATTERNS ====================
  {
    id: 'MAL-NET-001',
    name: 'Suspicious Outbound Connection',
    description: 'Connections to suspicious domains or IPs',
    indicator: MalwareIndicator.DATA_EXFILTRATION,
    severity: Severity.HIGH,
    patterns: [
      /https?:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?::\d+)?\/[a-z0-9]+/gi,
      /https?:\/\/[a-z0-9]{20,}\.(tk|ml|ga|cf|gq|top|xyz|work|click)/gi,
      /\.ngrok\.io/gi,
      /\.trycloudflare\.com/gi,
      /pastebin\.(com|raw)/gi,
      /raw\.githubusercontent\.com.*?\.(js|py|sh|ps1)/gi,
      /discord(app)?\.com\/api\/webhooks/gi,
      /api\.telegram\.org\/bot/gi
    ],
    fileExtensions: ['.js', '.ts', '.py', '.php', '.sh'],
    keywords: ['http', 'https', 'fetch', 'request', 'webhook', 'telegram', 'discord'],
    confidence: 75,
    standards: [
      { standard: 'CWE', id: 'CWE-200', description: 'Exposure of Sensitive Information' },
      { standard: 'MITRE', id: 'T1071', description: 'Application Layer Protocol' }
    ]
  },
  {
    id: 'MAL-NET-002',
    name: 'Hardcoded External Endpoint',
    description: 'Suspicious hardcoded external URLs for data transmission',
    indicator: MalwareIndicator.DATA_EXFILTRATION,
    severity: Severity.MEDIUM,
    patterns: [
      /['"`]https?:\/\/[a-z0-9.-]+\/[a-z0-9\/]+['"`].*?\.(post|put|send)/gis,
      /webhook_?url\s*[=:]\s*['"`]https?:\/\//gi,
      /exfil.*?url/gi,
      /c2_?(server|url|endpoint)/gi,
      /beacon.*?url/gi
    ],
    fileExtensions: ['.js', '.ts', '.py', '.php'],
    keywords: ['webhook', 'endpoint', 'server', 'url', 'post', 'send'],
    confidence: 70,
    standards: [
      { standard: 'CWE', id: 'CWE-200', description: 'Exposure of Sensitive Information' },
      { standard: 'MITRE', id: 'T1102', description: 'Web Service' }
    ]
  },

  // ==================== POST-INSTALL SCRIPT PATTERNS ====================
  {
    id: 'MAL-POSTINST-001',
    name: 'Dangerous Post-Install Script',
    description: 'Post-install script with dangerous commands',
    indicator: MalwareIndicator.BACKDOOR,
    severity: Severity.CRITICAL,
    patterns: [
      /curl\s+.*?\|\s*(bash|sh|node|python)/gi,
      /wget\s+.*?-O\s*-\s*\|\s*(bash|sh)/gi,
      /rm\s+-rf\s+(\/|\$HOME|~)/gi,
      /chmod\s+777\s+\//gi,
      /chown\s+.*?:.*?\s+\//gi,
      />(\/etc\/passwd|\/etc\/shadow)/gi,
      /base64\s+-d.*?\|\s*(bash|sh)/gi,
      /\bnc\s+.*?-e\s+(\/bin\/)?(ba)?sh/gi,
      /\bdd\s+if=\/dev\/zero.*?of=\//gi
    ],
    fileExtensions: ['.sh', '.ps1', '.cmd', '.bat', '.js'],
    keywords: ['curl', 'wget', 'bash', 'sh', 'rm', 'chmod', 'base64'],
    confidence: 95,
    standards: [
      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
      { standard: 'MITRE', id: 'T1059', description: 'Command and Scripting Interpreter' }
    ]
  },

  // ==================== FILE SYSTEM PATTERNS ====================
  {
    id: 'MAL-FS-001',
    name: 'Suspicious File Operations',
    description: 'Attempts to access sensitive system files',
    indicator: MalwareIndicator.STEALER,
    severity: Severity.HIGH,
    patterns: [
      /\/etc\/passwd/gi,
      /\/etc\/shadow/gi,
      /%APPDATA%.*?(Roaming|Local)/gi,
      /\$HOME\/\.(bash_history|zsh_history)/gi,
      /\.aws\/credentials/gi,
      /\.kube\/config/gi,
      /\.docker\/config\.json/gi,
      /\.npmrc.*?_authToken/gi,
      /\.netrc/gi,
      /\.pgpass/gi,
      /\.bash_profile|\.bashrc|\.zshrc/gi
    ],
    fileExtensions: ['.js', '.ts', '.py', '.php', '.sh', '.rb'],
    keywords: ['passwd', 'shadow', 'credentials', 'config', 'history', 'auth'],
    confidence: 85,
    standards: [
      { standard: 'CWE', id: 'CWE-522', description: 'Insufficiently Protected Credentials' },
      { standard: 'MITRE', id: 'T1005', description: 'Data from Local System' }
    ]
  },
  {
    id: 'MAL-FS-002',
    name: 'Browser Data Access',
    description: 'Attempts to access browser stored data',
    indicator: MalwareIndicator.STEALER,
    severity: Severity.HIGH,
    patterns: [
      /Chrome.*?User Data.*?(Login Data|Cookies|Local State)/gi,
      /Firefox.*?Profiles.*?(logins\.json|cookies\.sqlite)/gi,
      /Microsoft.*?Edge.*?User Data/gi,
      /Brave.*?User Data/gi,
      /\.mozilla\/firefox/gi,
      /\.config\/(google-chrome|chromium)/gi,
      /Library\/Application Support\/(Google\/Chrome|Firefox)/gi
    ],
    fileExtensions: ['.js', '.ts', '.py', '.exe', '.ps1'],
    keywords: ['Chrome', 'Firefox', 'Edge', 'Brave', 'cookies', 'Login Data'],
    confidence: 90,
    standards: [
      { standard: 'CWE', id: 'CWE-522', description: 'Insufficiently Protected Credentials' },
      { standard: 'MITRE', id: 'T1539', description: 'Steal Web Session Cookie' }
    ]
  },

  // ==================== ANTI-ANALYSIS PATTERNS ====================
  {
    id: 'MAL-ANTI-001',
    name: 'Anti-Debug Techniques',
    description: 'Attempts to detect or evade debugging',
    indicator: MalwareIndicator.OBFUSCATED,
    severity: Severity.MEDIUM,
    patterns: [
      /debugger\s*;\s*debugger/gi,
      /setInterval\s*\(\s*function\s*\(\s*\)\s*\{\s*debugger/gi,
      /process\.binding\s*\(\s*['"`]inspector['"`]\s*\)/gi,
      /v8debug|__v8_debug/gi,
      /IsDebuggerPresent/gi,
      /CheckRemoteDebuggerPresent/gi,
      /ptrace\s*\(\s*PTRACE_TRACEME/gi
    ],
    fileExtensions: ['.js', '.ts', '.py', '.c', '.cpp'],
    keywords: ['debugger', 'inspector', 'ptrace', 'debug'],
    confidence: 70,
    standards: [
      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
      { standard: 'MITRE', id: 'T1622', description: 'Debugger Evasion' }
    ]
  },
  {
    id: 'MAL-ANTI-002',
    name: 'VM/Sandbox Detection',
    description: 'Attempts to detect virtual machine or sandbox environment',
    indicator: MalwareIndicator.OBFUSCATED,
    severity: Severity.MEDIUM,
    patterns: [
      /vmware|virtualbox|vbox|qemu|hyper-v|xen/gi,
      /VBOX|VMWARE|VIRTUAL/g,
      /sandbox|malware|virus|analysis/gi,
      /process\.env\.COMPUTERNAME.*?(SANDBOX|MALWARE|VIRUS)/gi,
      /os\.environ.*?(SANDBOX|ANALYSIS)/gi
    ],
    fileExtensions: ['.js', '.ts', '.py', '.ps1'],
    keywords: ['vmware', 'virtualbox', 'sandbox', 'qemu', 'virtual'],
    confidence: 65,
    standards: [
      { standard: 'CWE', id: 'CWE-506', description: 'Embedded Malicious Code' },
      { standard: 'MITRE', id: 'T1497', description: 'Virtualization/Sandbox Evasion' }
    ]
  }
];

/**
 * Suspicious post-install script patterns
 */
export const SUSPICIOUS_SCRIPT_PATTERNS: RegExp[] = [
  // Network commands
  /\bcurl\b/i,
  /\bwget\b/i,
  /\bfetch\b/i,
  /\brequests\b/i,
  /\bhttp\b/i,
  
  // Execution commands
  /\beval\b/i,
  /\bexec\b/i,
  /\bspawn\b/i,
  /\bchild_process\b/i,
  /\bsubprocess\b/i,
  
  // Dangerous operations
  /\brm\s+-rf\b/i,
  /\bchmod\b/i,
  /\bsudo\b/i,
  /\bpowershell\b/i,
  
  // Encoding/obfuscation
  /\bbase64\b/i,
  /\batob\b/i,
  /\bdecode\b/i,
  
  // Environment access
  /\bprocess\.env\b/i,
  /\bos\.environ\b/i,
  /\bgetenv\b/i
];

/**
 * Get pattern by ID
 */
export function getPatternById(id: string): MalwarePattern | undefined {
  return MALWARE_PATTERNS.find(p => p.id === id);
}

/**
 * Get patterns by indicator type
 */
export function getPatternsByIndicator(indicator: MalwareIndicator): MalwarePattern[] {
  return MALWARE_PATTERNS.filter(p => p.indicator === indicator);
}

/**
 * Get patterns by severity
 */
export function getPatternsBySeverity(severity: Severity): MalwarePattern[] {
  return MALWARE_PATTERNS.filter(p => p.severity === severity);
}

/**
 * Get patterns for file extension
 */
export function getPatternsForFile(filePath: string): MalwarePattern[] {
  const ext = '.' + filePath.split('.').pop()?.toLowerCase();
  return MALWARE_PATTERNS.filter(p => p.fileExtensions.includes(ext));
}