@kernelforge/triage

Static malware-triage primitives. Format-agnostic evidence extraction with no I/O and no emulation, so the same code runs in Node, in a browser worker, and in the KernelForge analyzer UI.

npm install @kernelforge/triage

What is in it

| Area | Entry points | |---|---| | PE / ELF facts | parsePeStatic, parseElf64, parseElfStatic | | Strings & entropy | extractStrings, shannonEntropy, entropyAt, printableRatio | | Hashes | md5, sha256, ssdeep, ssdeepCompare | | Rules (pure JS) | compileRule, scanRules, KERNEL_DRIVER_RULES, PE_USERLAND_RULES, ELF_USERLAND_RULES, LKM_RULES, SHELLCODE_RULES | | YARA-X | initYaraX, compileYara, scanWithYaraX (optional peer dep) | | capa (lib-free subset) | compileCapaRules, scanCapa, parseCapaSource, CAPA_RULE_PACKS | | Sigma | parseSigma, matchSigma, SIGMA_RULE_PACKS | | ATT&CK | ATTACK_TECHNIQUES, lookupTechnique, groupByTactic | | Telemetry | toTelemetryStream, telemetryToJson, SYSMON_EVENTS | | Encoded strings | decodeEncodedStrings, harvestRuntimeStrings, recoverStrings | | Shellcode facts | shellcodeFacts | | API hashing | detectApiHashes, buildApiHashTable, HASH_ALGOS |

Two honesty guarantees

capa rules that need the capa library are rejected, not silently passed. compileCapaRules evaluates the lib-free subset in JS and returns a diagnostic for anything reaching for the native library. A rule is never skipped in a way that looks like a clean run.

Telemetry events declare how they were produced. Every event is tagged modeled (the emulator actually ran it) or inferred (reconstructed statically from the report). Nothing pretends a static reconstruction is runtime observation.

YARA-X is optional

@virustotal/yara-x is an optional peer dependency. Without it the YARA entry points throw a clear error; every other export works with no extra install.

Example

import { parsePeStatic, extractStrings, decodeEncodedStrings } from "@kernelforge/triage";

const pe = parsePeStatic(bytes);
const strings = extractStrings(bytes);
const decoded = decodeEncodedStrings(bytes);   // XOR/ADD/ROL/ROR brute force

See the KernelForge analyzer repo for the harnesses built on top of this package.

MIT