@pompelmi/enterprise

Enterprise plugin for Pompelmi — the privacy-first, zero-cloud Node.js file scanner.

This package extends the open-source core with production-grade features designed for teams and organizations that need compliance-ready security scanning.

Enterprise Features

| Feature | Open Source | Enterprise | |---|:---:|:---:| | YARA file scanning | ✅ | ✅ | | Magic-bytes detection | ✅ | ✅ | | Zero-cloud, fully local | ✅ | ✅ | | Advanced Audit Logging | — | ✅ | | Premium YARA Rule Set | — | ✅ | | Ransomware / APT detections | — | ✅ | | HMAC-signed tamper-evident logs | — | ✅ | | Webhook + file log sinks | — | ✅ | | Priority support | — | ✅ |

Advanced Audit Logging

Every scan event (start, complete, threat detected, error) is written as a structured, optionally HMAC-SHA256-signed NDJSON record. Supports multiple sinks: append-only rolling files, webhook forwarding, and console. Fully queryable on-disk for compliance and incident response.

Premium YARA Rules

A curated, production-hardened rule set covering:

• Ransomware families — WannaCry, LockBit, REvil, BlackCat and more
• APT tooling — Cobalt Strike beacons, Mimikatz, Meterpreter
• Crypto-miners — XMRig and derivatives
• Rootkits & bootkits
• Living-off-the-land (LOLBAS) — suspicious PowerShell, certutil, mshta patterns

Rules are updated continuously and sourced from internal research and vetted threat-intel feeds.

Quick Start

npm install @pompelmi/enterprise

import Pompelmi from 'pompelmi';
import { PompelmiEnterprise } from '@pompelmi/enterprise';

// 1. Initialise — validates license against Polar.sh
const enterprise = await PompelmiEnterprise.create({
  licenseKey: process.env.POMPELMI_LICENSE_KEY,
  auditLogger: {
    sinks: ['file', 'webhook'],
    webhookUrl: process.env.AUDIT_WEBHOOK_URL,
    hmac: true,
    hmacSecret: process.env.AUDIT_HMAC_SECRET,
    logDir: '/var/log/pompelmi',
  },
});

// 2. Inject into the core scanner — premium YARA rules + auto-audit
const scanner = new Pompelmi();
enterprise.injectInto(scanner);

// 3. Scan — all threats are automatically audit-logged
const results = await scanner.scan('/srv/uploads');

Licensing

Pompelmi Enterprise requires an active paid subscription. Each subscription generates a unique License Key that is verified on initialization.

A valid key is required at startup. Premium features are fully locked without it.

Environment Variables

| Variable | Required | Description | |---|:---:|---| | POMPELMI_LICENSE_KEY | Yes | Your Polar.sh license key. Obtained after purchase. | | AUDIT_HMAC_SECRET | No | Secret for HMAC-SHA256 signing of audit log entries. | | AUDIT_WEBHOOK_URL | No | Endpoint to POST audit events to in real time. |

Example .env:

POMPELMI_LICENSE_KEY=lic_xxxxxxxxxxxxxxxxxxxxxxxxxxxx
AUDIT_HMAC_SECRET=a-long-random-secret-string
AUDIT_WEBHOOK_URL=https://your-siem.example.com/ingest/pompelmi

Never commit POMPELMI_LICENSE_KEY to source control. Add .env to your .gitignore.

This software is proprietary and commercially licensed. See LICENSE for terms.