// Suspicious indicators in GitHub repositories
type MalwareRepoIndicators struct {
    NoSourceCode bool           // No actual implementation
    FakeCrackPromise bool        // Promises "cracked" commercial software
    RapidStarGrowth float64      // Stars per day > 2.0 is suspicious
    MaliciousTopics []string     // "bypass", "crack", "keygen", "loader"
    NoLicense string             // "NOASSERTION" or missing
    ExternalDownloads bool       // Links to external download sites
    RecentCreation bool          // Created very recently
}

func AnalyzeRepository(repo Repository) (risk string) {
    score := 0
    
    if repo.NoREADME || len(repo.SourceFiles) == 0 {
        score += 3
    }
    
    if repo.StarsPerDay > 2.0 {
        score += 2
    }
    
    maliciousKeywords := []string{
        "crack", "keygen", "loader", "pre-activated",
        "bypass", "thread-hijacking", "full-version",
    }
    
    for _, keyword := range maliciousKeywords {
        if strings.Contains(strings.ToLower(repo.Description), keyword) {
            score += 1
        }
    }
    
    if score >= 5 {
        return "CRITICAL - Likely malware distribution"
    } else if score >= 3 {
        return "HIGH - Suspicious activity"
    }
    
    return "Low risk"
}

package security

import (
    "fmt"
    "net/url"
)

// Legitimate sources for security software
var TrustedSecurityVendors = map[string]string{
    "bitdefender": "https://www.bitdefender.com",
    "kaspersky":   "https://www.kaspersky.com",
    "eset":        "https://www.eset.com",
    "malwarebytes": "https://www.malwarebytes.com",
}

func ValidateDownloadSource(downloadURL string) (bool, error) {
    parsed, err := url.Parse(downloadURL)
    if err != nil {
        return false, err
    }
    
    // Check if from official vendor domain
    for _, trustedDomain := range TrustedSecurityVendors {
        vendorURL, _ := url.Parse(trustedDomain)
        if parsed.Host == vendorURL.Host {
            return true, nil
        }
    }
    
    return false, fmt.Errorf("untrusted download source: %s", parsed.Host)
}

package analysis

import (
    "crypto/sha256"
    "encoding/hex"
    "io"
    "os"
)

// Calculate file hash for malware database lookup
func CalculateFileHash(filePath string) (string, error) {
    file, err := os.Open(filePath)
    if err != nil {
        return "", err
    }
    defer file.Close()
    
    hash := sha256.New()
    if _, err := io.Copy(hash, file); err != nil {
        return "", err
    }
    
    return hex.EncodeToString(hash.Sum(nil)), nil
}

// Check against known malware hashes
func CheckVirusTotal(fileHash string) error {
    // Use VirusTotal API
    apiKey := os.Getenv("VIRUSTOTAL_API_KEY")
    
    // Make request to VT API
    // url := fmt.Sprintf("https://www.virustotal.com/api/v3/files/%s", fileHash)
    
    // Implementation would use HTTP client with API key
    return nil
}

package behavior

// Suspicious behaviors to monitor
type SuspiciousBehavior struct {
    ProcessName string
    Behaviors   []string
}

var MalwareIndicators = []string{
    "Creates files in system directories",
    "Modifies registry run keys",
    "Establishes network connections to unknown IPs",
    "Injects code into other processes",
    "Disables Windows Defender",
    "Accesses browser credential storage",
    "Encrypts user files",
    "Downloads additional payloads",
}

func MonitorProcess(pid int) []string {
    var detectedBehaviors []string
    
    // Monitor file system access
    // Monitor registry changes
    // Monitor network connections
    // Monitor process injection attempts
    
    return detectedBehaviors
}

# Report to GitHub Security
# Navigate to: https://github.com/contact/report-abuse

# Report to Google Safe Browsing
# https://safebrowsing.google.com/safebrowsing/report_phish/

# Report to security vendors
# norton: https://submit.norton.com
# mcafee: https://www.mcafee.com/enterprise/en-us/threat-center/threat-feedback.html

package main

import (
    "context"
    "fmt"
    "os"
    
    "github.com/google/go-github/v50/github"
)

func ScanRepositoryForMalware(owner, repo string) {
    client := github.NewClient(nil)
    
    repository, _, err := client.Repositories.Get(
        context.Background(),
        owner,
        repo,
    )
    if err != nil {
        fmt.Printf("Error fetching repo: %v\n", err)
        return
    }
    
    // Check for malware indicators
    indicators := []string{
        "crack", "keygen", "pre-activated",
        "bypass", "loader", "full-version",
    }
    
    description := *repository.Description
    riskScore := 0
    
    for _, indicator := range indicators {
        if contains(description, indicator) {
            riskScore++
            fmt.Printf("⚠️  Found indicator: %s\n", indicator)
        }
    }
    
    if riskScore >= 3 {
        fmt.Println("🚨 HIGH RISK: Likely malware distribution")
    }
}

func contains(s, substr string) bool {
    // Case-insensitive check
    return false // Implementation needed
}

# For malware analysis tools
export VIRUSTOTAL_API_KEY="your-virustotal-api-key"
export HYBRID_ANALYSIS_API_KEY="your-hybrid-analysis-key"
export GITHUB_TOKEN="your-github-token"