METHOD
How a package moves through it
Five stages, the same order every time. Nothing carries over between runs.
Fresh sandbox
Every package starts from an identical, pristine container image.
Instrumented install
Scripts enabled, under full system call tracing, isolated from anything real.
Import
Loaded as a consumer would, traced separately, so payloads that wait for import get no free pass.
Attribution
Each action tied to the process tree that produced it.
Correlation
Events that mean little apart are joined into findings that mean something together.
TWO ENGINES
One watches it run. One reads what shipped.
Cohen is a triage tool rather than a classifier. Its job is to surface behaviour worth a human's attention, not to pass final judgment.
That is not modesty. Fred Cohen proved in 1984 that deciding in general whether a program is a virus is undecidable. No detector can be both complete and correct. What remains is observation, and what you do with it.
DYNAMIC
Behaviour in a sandbox
Installed and imported inside an isolated container while its system calls are traced. Files read and written, processes spawned, permissions changed, sockets opened.
A secret read and then compressed into an archive named after it means something neither event means alone.
CORRELATED EVENT PAIRS · ONE RUN
STATIC
Contents of the tarball
The published archive is examined without being run. Rule matches against the source, the capabilities the code holds, and the metadata as the registry reports it.
Every file gets a SHA256 and an entropy score, which reveals packed or encrypted content sitting inside an otherwise readable package.
SHANNON ENTROPY PER FILE · BITS/BYTE
SANDBOX
A sandbox is table stakes. Detection strategy is the open problem.
Worked on across two branches in parallel. The latest stable release runs the feed above.
Evasion resistance
Sandbox realism, against payloads that go quiet the moment they sense they are being watched.
Heuristics on dropped binaries
Run heuristics against the binaries a package drops, and make them available for download alongside the verdict.