Sentinel

Server security scanner — detect malware, backdoors, rootkits, and misconfigurations on Linux servers.

Sentinel was born from a real incident: a production server compromised for months with a cryptominer, botnet, rootkit, and multiple backdoors — all of which survived a server clone. Sentinel makes it easy for any developer running a Linux server to know if they've been compromised.

Install

npm install -g sentinel-scan

Usage

CLI

# Full scan with colored terminal output
sentinel

# JSON output (for CI/CD pipelines and AI agents)
sentinel --format json

# Markdown report
sentinel --format markdown > report.md

# Run specific modules only
sentinel --modules processes,network,rootkit

# Suppress banner
sentinel --no-banner

Programmatic API (for AI agents)

import { scan, formatResult } from 'sentinel-scan';

// Run a scan
const result = await scan();
console.log(result.summary.status); // "CLEAN" | "COMPROMISED" | etc.

// Run specific modules
const result2 = await scan({ modules: ['processes', 'network', 'rootkit'] });

// Format as JSON or markdown
const json = formatResult(result, 'json');
const md = formatResult(result, 'markdown');

Exit Codes

| Code | Meaning | |------|---------| | 0 | Clean — no findings | | 1 | Informational or low findings | | 2 | Medium findings | | 3 | High or critical findings |

Scan Modules

| Module | What It Checks | |--------|----------------| | processes | Running processes — flags known malware names, suspicious paths, high CPU | | network | Listening ports and outbound connections — flags known C2 IPs and suspicious ports | | systemd | Enabled services — flags malicious persistence, suspicious ExecStart paths | | crontabs | All crontabs — flags download-and-execute patterns, base64 commands | | rootkit | ld.so.preload, suspicious .so files, /etc/data directory | | ssh | SSH config, authorized keys, active sessions | | shell | Shell profiles (.bashrc, /etc/profile.d/) — flags wget/curl/eval/reverse shells | | filesystem | Executables in /tmp, hidden directories, SUID binaries, world-writable files | | firewall | UFW status, fail2ban, iptables rules | | credentials | .env files, service account keys, git credentials, SSH private keys |

Threat Database

Sentinel ships with a threat intelligence database seeded from real-world incidents:

• Known malware hashes (Mirai, Kinsing, etc.)
• Known C2 server IPs
• Known malicious process names
• Known malicious file paths
• Known malicious systemd service names
• Known suspicious ports (mining pools, botnet scanning, C2)

Requirements

• Node.js 18+
• Linux (uses standard utilities: ps, ss, find, grep, systemctl)
• Root recommended (some checks require root access for full results)

License

MIT