Configuration
Bouncer stores configuration in ~/.bouncer/config.json. Most users don't need to change anything.
Config commands
$ bouncer config get min_package_hours
48
$ bouncer config set min_package_hours 72
Settings
| Key | Description | Default |
|---|---|---|
min_package_hours |
Warn when a package is newer than this many hours | 48 |
min_downloads |
Warn when a package has fewer than this many weekly downloads | 100 |
paranoid |
Block warnings in script mode instead of silencing them | false |
Rules
Every heuristic rule has a default behavior of allow, warn, or block. Override any of these defaults by running bouncer config set rules with a rule ID and your desired action.
$ bouncer config get rules
# list every rule and its current severity
$ bouncer config get rules typosquat
warn (default)
$ bouncer config set rules typosquat block
# run with no severity for an interactive picker
| Rule ID | Description | Default |
|---|---|---|
typosquat | Package name is suspiciously similar to a popular package | warn |
package_age | Package is below the minimum age threshold | warn |
low_downloads | Package is below the minimum downloads threshold | warn |
no_readme | Package has no README | warn |
install_script | Package runs scripts during installation | warn |
eval_base64 | Eval of base64-encoded data | warn |
exec_decode | Exec of decoded data | warn |
exfil_service | Exfiltration service URL | warn |
ngrok_tunnel | Ngrok tunnel URL | warn |
pipe_to_shell | Pipe-to-shell execution | warn |
env_var_access | Environment variable access in install script or entry point | warn |
telegram_upload_api | Telegram upload API in package entry point | warn |
discord_webhook_api | Discord webhook API in package entry point | warn |
burp_collaborator_api | Burp Collaborator callback in package entry point | warn |
binary_no_source | Package contains no readable source code | warn |
burp_collaborator | Burp Collaborator callback URL | block |
telegram_exfil | Telegram document exfiltration | block |
discord_webhook | Discord webhook in install script | block |
Environment variables
| Variable | Description |
|---|---|
BOUNCER_API_KEY |
Override API key (useful in CI) |