/**
 * Known Indicators of Compromise (IOC) blocklist.
 *
 * Contains known malicious domains, IPs, hashes, GitHub accounts,
 * and compromised package versions. Updated as new threats emerge.
 */
export declare const KNOWN_C2_DOMAINS: string[];
export declare const KNOWN_C2_IPS: string[];
export declare const KNOWN_DEAD_DROPS: string[];
export declare const KNOWN_MALICIOUS_HASHES: Record<string, string>;
export declare const KNOWN_MALICIOUS_GITHUB_ACCOUNTS: string[];
export declare const KNOWN_BAD_NPM_VERSIONS: Record<string, {
    versions: string[];
    description: string;
}>;
export declare const KNOWN_BAD_PYPI_VERSIONS: Record<string, {
    versions: string[];
    description: string;
}>;
import type { Finding } from "./types.js";
export declare function checkIOCBlocklist(content: string, relativePath: string): Finding[];
/**
 * Check a package name + version against the known-bad blocklist.
 */
export declare function checkBadVersion(name: string, version: string, ecosystem: "npm" | "pypi" | "ruby" | "composer" | "nuget"): Finding | null;
//# sourceMappingURL=ioc-blocklist.d.ts.map