CLU
2 minutes read
Overview
CLU is a Malicious PyPI and npm package hunter that I decided to build after a recovering from new years eve celebrations in 2026.
CLU monitors every update in the PyPI and npm feeds for new packages, runs heuristic analysis, yara patterns and also conducts an LLM-based code review. When it finds something it will alert your team via discord integration.
⚠️ SECURITY NOTE: This tool analyzes potentially malicious code. Always run inside a container as a non-root user.
Other Features
Four-Stage Analysis Pipeline:
- Heuristics
- Regex/keyword metadata scanning on package names, authors, descriptions. Built-in rule engine; custom rules via heuristics.toml.
- Typosquat Detection
- Levenshtein distance matching against popular packages (e.g., requestss vs requests). Configurable similarity threshold.
- YARA Pattern Scanning (~sub-second)
- Native Rust yara-x crate (no external CLI). Built-in + custom rule support. Replaced the deprecated GuardDog CLI; automatic DB migration on upgrade.
- LLM-Powered Semantic Analysis (~2–5s)
- Ollama integration (Qwen2.5-Coder by default). Includes prompt injection detection for supply-chain attack analysis. Rates severity (1–4), likelihood (1–4), and generates confidence scores.
Real-Time Data Pipeline:
- SQLite + WAL: Concurrent reads/writes between scanner and API
- Sidecar REST API (clu-api): Findings triage, status updates, OSM export
- Webhook Integration: Fire-and-forget POST to Slack, Teams, or custom endpoints
- Risk Scoring (0–100): SAFE (0–30), REVIEW (31–70), BLOCK (71–100)
Deployment & Usability:
- Docker-first: Non-root user (cluuser), resource limits, health checks, Ollama co-container
- Interactive Setup (clu init): Config generation via CLI
- Makefile Ops: make docker-build, docker-up, docker-logs, etc.
- npm Support: Feed monitoring live; download/analysis in progress
Findings Management:
- Stateful Triage: new → triaging → confirmed_malicious/benign/duplicate → reported
- Analyst Notes: Add context per finding
- Prometheus Metrics: /metrics endpoint for observability
- Log Aggregation: ELK, Splunk, CloudWatch driver support