Tuto Créer un Scanner Antivirus pour VS Code

 { "activationEvents": ["onCommand:malwareScanner.scanWorkspace"], "contributes": { "commands": [ { "command": "malwareScanner.scanWorkspace", "title": "Scanner le workspace (Malware)" } ] } }

 import * as vscode from 'vscode'; import * as fs from 'fs'; 
import * as path from 'path'; 
import { exec } from 'child_process';

interface Finding { file: vscode.Uri; range: vscode.Range; message: string; severity: vscode.DiagnosticSeverity; ruleId: string; }

const suspiciousPatterns: { ruleId: string; regex: RegExp; message: string }[] = [ { ruleId: 'JS-EVAL', regex: /\beval\s*(/i, message: "Usage de 'eval' potentiellement dangereux." }, { ruleId: 'JS-FUNCTION-CALL', regex: /\bnew\s+Function\s*(/i, message: "Construction dynamique de code (new Function)." }, { ruleId: 'JS-CHILD-PROC', regex: /\b(child_process|spawn|exec|execFile)\b/i, message: "Exécution de commandes système." }, { ruleId: 'PS-ENC', regex: /powershell(?:.exe)?\s+-enc\s+[A-Za-z0-9+/=]+/i, message: "Commande PowerShell encodée." }, { ruleId: 'B64-LONG', regex: /'"`['"`]/, message: "Chaîne base64 longue suspecte." }, { ruleId: 'URL-EXFIL', regex: /\bhttps?://[^\s'"`]+/i, message: "Lien externe (potentielle exfiltration)." }, { ruleId: 'WIN-PERSIST', regex: /\b(\Run\|\RunOnce\|Startup\|schtasks.exe)\b/i, message: "Indicateurs de persistance Windows." } ];

export function activate(context: vscode.ExtensionContext) { const diagnostics = vscode.languages.createDiagnosticCollection('malwareScanner'); context.subscriptions.push(diagnostics);

const scanCmd = vscode.commands.registerCommand('malwareScanner.scanWorkspace', async () => { diagnostics.clear(); const folders = vscode.workspace.workspaceFolders; if (!folders) { vscode.window.showWarningMessage('Aucun dossier de workspace ouvert.'); return; }

const findings: Finding[] = [];
for (const folder of folders) {
  await scanFolder(folder.uri.fsPath, findings);
}

// Publier les diagnostics
const byFile = new Map<string, vscode.Diagnostic[]>();
for (const f of findings) {
  const diag = new vscode.Diagnostic(f.range, \`[\${f.ruleId}] \${f.message}\`, f.severity);
  diag.source = 'MalwareScanner';
  const key = f.file.toString();
  if (!byFile.has(key)) byFile.set(key, []);
  byFile.get(key)!.push(diag);
}
byFile.forEach((diags, file) => diagnostics.set(vscode.Uri.parse(file), diags));

vscode.window.showInformationMessage(\`Scan terminé: \${findings.length} alerte(s).\`);
 
});

context.subscriptions.push(scanCmd); 
}
async function scanFolder(dir: string, findings: Finding[]) { const entries = await fs.promises.readdir(dir, { withFileTypes: true }); for (const entry of entries) { const full = path.join(dir, entry.name);

if (entry.isDirectory()) {
  if (['.git', 'node_modules', 'dist', 'build', '.venv', '.tox', '.pytest_cache'].includes(entry.name)) continue;
  await scanFolder(full, findings);
  continue;
}

if (!/\.(js|ts|mjs|cjs|jsx|tsx|py|ps1|bat|cmd|sh|php|rb|go|cs|json|yml|yaml|ini|conf|txt)$/i.test(entry.name)) continue;

await scanFile(full, findings);
 
} }

async function scanFile(filePath: string, findings: Finding[]) { try { const text = await fs.promises.readFile(filePath, 'utf8'); const lines = text.split(/\r?\n/); 
for (let i = 0; i < lines.length; i++) {
  const line = lines[i];
  for (const rule of suspiciousPatterns) {
    const m = rule.regex.exec(line);
   if (m) {
      const start = m.index;
      const end = m.index + m[0].length;
      findings.push({
        file: vscode.Uri.file(filePath),
        range: new vscode.Range(new vscode.Position(i, start), new vscode.Position(i, end)),
        message: rule.message,
        severity: vscode.DiagnosticSeverity.Warning,
        ruleId: rule.ruleId
      });
    }
  }

  // Heuristique: détecter une base64 longue et vérifier du contenu décodé potentiellement dangereux
  const b64Match = line.match(/(['"\`])([A-Za-z0-9+/]{80,}={0,2})\1/);
  if (b64Match) {
    try {
      const buf = Buffer.from(b64Match[2], 'base64');
      const decoded = buf.toString('utf8');
      if (/\b(eval|cmd\.exe|powershell|wget|curl|Invoke-WebRequest|nc -e)\b/i.test(decoded)) {
        findings.push({
          file: vscode.Uri.file(filePath),
          range: new vscode.Range(new vscode.Position(i, 0), new vscode.Position(i, line.length)),
          message: "Chaîne base64 décodée contenant des indicateurs dangereux.",
          severity: vscode.DiagnosticSeverity.Error,
          ruleId: 'B64-DECODED-DANGEROUS'
        });
      }
    } catch {
      // ignore
    }
  }
}
} catch { // binaire ou permissions: ignorer } }

export function deactivate() {}

 const watcher = vscode.workspace.createFileSystemWatcher('**/.{js,ts,py,ps1,sh}'); watcher.onDidChange(uri => scanFile(uri.fsPath, [] / vous pouvez réémettre les diagnostics ciblés ici /)); watcher.onDidCreate(uri => scanFile(uri.fsPath, [])); watcher.onDidDelete(uri => { / retirer diagnostics pour ce fichier */ }); context.subscriptions.push(watcher);

 function runClamAV(rootPath: string): Promise { return new Promise((resolve) => { exec(`clamscan -r --bell -i "${rootPath}"`, { timeout: 5 * 60_000 }, (err, stdout) => { resolve(stdout || ''); }); }); }

 { "version": "2.0.0", "tasks": [ { "label": "Scan ClamAV", "type": "shell", "command": "clamscan -r --bell -i .", "problemMatcher": [] }, { "label": "Scan Semgrep", "type": "shell", "command": "semgrep --config auto", "problemMatcher": [] } ] }

 npm i -D husky lint-staged npx husky install npx husky add .husky/pre-commit "npm run scan:quick"

 "scripts": { "scan:quick": "semgrep --config auto && echo 'OK Semgrep' || (echo 'Semgrep KO' && exit 1)" }