nethical6
Featured
conversation-steganography
A tool that hides encrypted secret messages inside innocent-looking AI-generated chat text for private communication over any messaging platform.
AI repository intelligence
FR-AI / ANALYSISWhy it is worth attention
It targets an earlier detection point (local interaction with decoys) compared to canary tokens that signal only after exfiltration, and operates unprivileged on personal workstations that often lack EDR or file-access monitoring.
Who it is for
- Security researchers and red teamers
- Developers of macOS/Linux tools and packages
- Individuals concerned about supply-chain attacks on personal workstations
- System administrators evaluating low-privilege detection mechanisms
Use cases
- Detecting credential theft during npm install or other package managers
- Monitoring for unauthorized access to cloud config files (e.g., AWS, GCP) on a developer machine
- Running high-risk commands (e.g., from untrusted sources) inside a protected session with credential-command tripwires
- Identifying infostealers or compromised extensions that attempt to read browser wallets or tokens
Strengths
- Unprivileged default operation (no root required for FIFO baits on macOS and Linux)
- Re-arming FIFO baits that signal on blocking read and automatically reset after the reader closes
- Customizable bait packs (cloud, identity, developer, etc.) and exact file/socket bait paths
- Protected Sessions provide a fake HOME, reduced environment, and credential-command shims to trap credential-gathering tools
Considerations
- Only detects activity that interacts with active traps; does not observe all credential access or identify malware
- Fake HOME redirects common paths but is not isolation; absolute paths, direct APIs, and same-user tampering can bypass
- FIFO baits are visible as named pipes and nonblocking readers can avoid the delay; fanotify backend requires CAP_SYS_ADMIN
README quick start
Stinger
Stinger is an experimental endpoint deception tool for individual macOS and Linux workstations. It places decoy resources at likely collection points and records when a process interacts with them.
Malicious packages, compromised extensions, and infostealers can collect tokens, keys, browser data, or wallet material in a single run. On personal workstations, EDR and privileged file-access monitoring are often absent, while many canary tokens do not signal until collected bait is later rendered, fetched, resolved, or used. Stinger targets an earlier point: local interaction with the decoy during collection.
Main features:
- Watch Mode creates standing, non-destructive file and socket tripwires in
the user's normal HOME while
stinger watchruns. Its default file baits are FIFOs that signal on a blocking read and re-arm after the reader closes. Optional local-service baits cover additional collection paths. - Protected Sessions run a selected command or shell with a fake HOME, reduced environment, decoy resources, and credential-command tripwires. A trap can stop the protected process scope.
- Bait controls include built-in packs, custom file paths, exact exclusions, and JSON configuration.
- Events and response provide structured local events and reports. Depending on the mode and backend, Stinger can delay or deny an interaction or stop a protected process scope.
Both modes are unprivileged by default. Linux also has an experimental fanotify backend that denies opens of exact bait files.
Stinger is not a sandbox or general endpoint monitor. It detects interaction with active traps; it does not observe all credential access, identify malware, or contain hostile code.
Install
Requirements:
- Go 1.25 or newer
- macOS or Linux
- FIFO support for Protected Sessions and the default Watch Mode backend
go install github.com/0x4D31/stinger/cmd/stinger@latest
stinger doctor
stinger doctor --selftest
From a checkout:
go build -o stinger ./cmd/stinger
./stinger doctor --selftest
The examples below assume stinger is on PATH. Use ./stinger for a local
build.
Quickstart
# Inspect the default standing baits, then start Watch Mode.
stinger watch --dry-run
stinger watch
# Run one command or an interactive shell in a protected session.
stinger run -- npm install
stinger run -
Description
Unprivileged endpoint deception for macOS and Linux workstations. Uses FIFO baits, other local traps, and protected sessions to detect secret collection as it happens.
Related repositories
Similar projects matched by category, topics, and programming language.
programmersd21
Featured
flow
flow is a minimalist terminal dashboard that displays real-time network throughput with smooth animations, multiple responsive modes, and zero configuration.
MobAI-App
simslim
simslim reduces iOS simulator memory usage by 4x by disabling unnecessary background daemons, allowing many more simulators to run on a single Mac.