恶意依赖行为检测与隔离治理（静态-动态-沙箱）最佳实践

核心要点静态规则：检测 `eval`、`child_process`、可疑 Base64 与网络外连。动态沙箱：限制文件系统、网络与进程能力，记录异常行为。阈值策略：风险评分达到阈值阻断；警告级进入人工复核。实现示例type File = { path: string; content: string }

function staticScore(f: File): number {

let s = 0

if (/eval\(/i.test(f.content)) s += 3

if (/child_process/i.test(f.content)) s += 4

if (/require\(['"]child_process['"]\)/i.test(f.content)) s += 4

if (/[A-Za-z0-9+/=]{200,}/.test(f.content)) s += 2

if (/https?:\/\//i.test(f.content)) s += 1

return s

}

function totalScore(files: File[]): number {

return files.reduce((acc, f) => acc + staticScore(f), 0)

}

function decide(score: number, thresholds: { block: number; warn: number }): 'block' | 'warn' | 'pass' {

if (score >= thresholds.block) return 'block'

if (score >= thresholds.warn) return 'warn'

return 'pass'

}

审计与CI门禁构建前对 tarball 执行检测；达到阻断阈值直接失败并输出证据。警告级进入沙箱复核；审计记录包含文件路径与命中特征。