Pompelmi is a lightweight TypeScript library and CLI tool designed to integrate file scanning and YARA rule execution directly into your reverse engineering workflows. Run scans completely offline, embed in Node.js tools, or use the command-line interface.

• 🔍 YARA Rule Engine: Load and run custom YARA rulesets (no external dependencies).

• 🛡 Binary & Archive Inspection: Magic-byte detection for executables (PE, ELF), nested ZIP and basic zip-bomb protection.

• 🎛 Flexible API & CLI: Use as a library in Node.js or via the pompelmi CLI for quick scans.

• ⚙️ TypeScript-Powered: Strong typings, easy integration into TypeScript/JavaScript projects.

• 🌐 Remote Engine Option: Expose a HTTP endpoint for browser-based tools or dashboards.

Install globally or locally:

npm install -g pompelmi

Scan a file with a YARA rule:

pompelmi scan --file path/to/binary.exe --rules path/to/rules.yara --output json

Sample JSON output:

[
  {
    "rule": "detect_pe_file",
    "matches": ["$mz"]
  }
]

import { scanBuffer, createEngine } from 'pompelmi';
import fs from 'fs';

// Load YARA rules
const rules = fs.readFileSync('rules.yara', 'utf8');

async function run() {
  const engine = createEngine({ rules });
  const buffer = fs.readFileSync('path/to/binary.elf');
  const matches = await scanBuffer(buffer, engine);
  console.log(matches);
}

run();

⚠️ Alpha release. Breaking changes may occur. Use at your own risk; the author assumes no liability.