This function has become significantly better. I just heavily updated the plugin verification system. The scanner now analyzes not only the source code, but also many ways of hiding potentially dangerous actions.
What changed:
• Over 200 signatures for detecting suspicious code.
• Improved source code analysis.
• Support for composite signatures for more accurate threat detection.
• An exclusion system that reduces the number of false positives.
• Recognition of many common obfuscation and code hiding methods.
• Improved detection of dangerous functions even when attempts are made to mask their usage.
• Decryption and scanning of zlib, xor, base64, caesar, unicode escape, and so on.
• Detection of attempts to retrieve, read, or steal the API key used by Packit.
As a result, local verification has become noticeably more effective and capable of finding more potentially dangerous plugins before their installation. It is important to understand that no analyzer can guarantee 100% detection of any threats, however, the new scanner significantly increases the security level and allows for the identification of many suspicious plugins before launch.
After the release of ElyxCore, it is also planned to add analysis of Python bytecode based on pycdas; Decompilation and analysis of native libraries (.so) based on Ghidra; Decompilation and analysis of JVM components (.dex) based on Jadx; This will allow checking not only source code, but also compiled files.
Forum | PackIt RU