Metadata-Version: 2.4
Name: navig-antivirus
Version: 0.1.1
Summary: NAVIG Antivirus module — browser-extension malware/PUP scanning, Chrome extension-registry auditing, Chrome profile-index recovery, and a system malware scan (Windows Defender; Malwarebytes best-effort). Wired into `navig antivirus`. A first-party navig plugin (free, toggleable).
Author-email: NAVIG Development Team <opensource@navig.run>
License-Expression: Apache-2.0
Project-URL: Homepage, https://navig.run
Project-URL: Documentation, https://navig.run/docs
Keywords: navig,cli,agent,automation,plugin,antivirus,security,malware,scan
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Utilities
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: navig>=3.24.0
Dynamic: license-file

# navig-antivirus

> Browser-extension malware/PUP scanning, Chrome extension-registry auditing, Chrome
> profile-index recovery, and on-demand system malware scans — wired into `navig antivirus`.

A first-party navig plugin (free, toggleable). Pure-stdlib engine (no third-party runtime deps);
Windows-focused (registry audit + Defender scan are Windows-only), extension scan/recovery work on
any OS with a Chromium-family browser.

## Why

Browser extensions are a top malware/PUP vector: free-VPN "proxyware" that routes your traffic,
coupon extensions that read your shopping activity, and outright malware (remote-code-execution
backdoors, cookie theft) installed via the Web Store or bundled installers. This plugin turns the
manual forensic sweep into repeatable `navig` commands.

## Commands

```bash
navig antivirus report                       # one-pass read-only health report
navig antivirus extensions                   # scan Chrome/Edge/Brave extensions for malware/PUP
navig antivirus extensions -b edge --min-score 5
navig antivirus registry                     # audit registry-forced extensions + policies (Windows)
navig antivirus system --type quick          # kick off a Windows Defender scan
navig antivirus system --type full
navig antivirus system --type custom --path C:\Users\me\Downloads
navig antivirus recover-profiles             # preview Chrome profile-index rebuild
navig antivirus recover-profiles --apply     # restore a collapsed profile list (close Chrome first)
```

### `extensions` — extension malware/PUP scan
Reads each profile's `Secure Preferences` (which embeds every extension's manifest + install
metadata), scores against heuristics, dedupes by id across profiles, and reports risk bands.
Flags: `proxy` (traffic MITM), all-sites `cookies`/`webRequest`, `management`, `debugger`,
`nativeMessaging`, sideloaded / non-Web-Store sources, `unsafe-eval`, and known-malware ids.
Read-only.

### `registry` — extension-registry audit (Windows)
Enumerates registry force-installed Chrome extensions (`…\Software\Google\Chrome\Extensions\<id>`)
and the `ExtensionInstallForcelist` / `ExtensionInstallBlocklist` policies. Flags bundleware
signatures: affiliate `install_parameter` (`clid=…`) and insecure `http://` update URLs. Read-only.

### `system` — on-demand malware scan
Kicks off a **Windows Defender** scan via `MpCmdRun.exe` (`quick` / `full` / `custom`). Malwarebytes
is detected and reported, but consumer Malwarebytes ships no headless scan CLI, so Defender is the
engine (this is surfaced honestly at runtime).

### `recover-profiles` — Chrome profile-index recovery
Fixes the case where Chrome's profile picker collapses to only "Default" but every `Profile N`
folder still exists on disk — the `Local State → profile.info_cache` index was pruned while the
data is intact. Rebuilds the index from each profile's own `Preferences`. Dry-run by default;
`--apply` requires the browser fully closed and backs up `Local State` first.

## Install (dev)

```bash
pip install -e plugins/navig-antivirus     # from the navig repo root
navig antivirus --help
```

## Safety

- Everything is **read-only** except `recover-profiles --apply` (which only edits the profile
  *index*, after a backup, with the browser closed) — no profile data is ever modified.
- No credentials, no network calls (Defender is invoked locally). Extension "scanning" is static
  metadata analysis, not execution.
