feat(scanner): detect malicious WebSocket handlers

[SINISTER1999]

feat(scanner): detect malicious WebSocket handler patterns

Closes #3

Summary

• detect plaintext and commonly abused tunnel WebSocket endpoints
• detect sensitive data sent through WebSocket .send()
• detect command execution inside WebSocket message handlers
• add seven focused positive and negative test cases
• add a scanner test script using Node's built-in test runner

Detection Coverage

• suspicious endpoints: ws://, ngrok, requestbin, pipedream, and webhook.site
• exfiltration: environment variables, credentials/secrets/tokens, and file reads passed to .send()
• reverse-shell behavior: exec/spawn calls in a WebSocket message handler

Validation

Run from scanner/:

npm test
npm run build

The contribution is static-analysis-only and does not contact or probe external systems.

Bounty Payout

Please confirm the ISNAD chain and claim process. Receiving EVM wallet:

0x21FA0031EDbe23DF5e4B11825ec614018d83080a

[vercel]

@pulsesinister is attempting to deploy a commit to the Rapi's projects Team on Vercel.

A member of the Team first needs to authorize it.