SpikeStrip injects reversible, keyed decoy comments into static HTML and JavaScript output, designed to distract AI-driven assessment agents during authorized security testing and defense research.
| Tool | Arcanum-Sec/SpikeStrip — Node.js tool that plants reversible, keyed prompt decoys into built web assets |
| Category | Deception / AI-agent defense for static web deployments |
| Primary Use | Adding reversible decoy comments to .html, .js, .mjs, and .cjs build output before deployment, tracked in a private manifest for later removal |
| Safe Use | Deployed defensively on systems you own or are contractually authorized to assess — e.g., lab environments, red-team exercise infrastructure, and research into AI-driven scanning behavior |
| Telemetry Note | Insertions leave no callbacks, loops, or runtime code, but the comments themselves are observable in View Source; every insertion carries a random 12-character hex key, giving defenders a deterministic marker to audit or strip |
SpikeStrip occupies an unusual niche in the deception-tooling landscape: rather than emulating services or spinning up honeypots, it targets the source-reading layer of AI-driven security automation. The tool injects reversible decoy comments into static HTML and JavaScript files, where those comments contain instructions meant to redirect an AI assessment, fabricated vulnerability leads, and mathematical distractions. The README is refreshingly candid about scope — the project explicitly bills itself as a work in progress, intended as inspiration for defenders building countermeasures against AI assessment agents such as ARTEX and similar systems. That framing matters: this is defensive research tooling, not an attack instrument.
The mechanics are deliberately conservative. Every insertion receives a random 12-character hex key, like a7c94e2b610f, checked for duplicates within each run. Deployed comments carry no SpikeStrip branding and no fixed canary prefix, which is a sensible choice for realistic testing — a decoy that announces itself is trivially filtered. Crucially, the comments add no callbacks, executable loops, or runtime computation. The deception is purely textual, aimed at agents that follow source comments or convert unverified hints into scan targets. The README openly notes the limitation: conventional scanners that ignore comments, or agents that properly isolate untrusted content, are largely unaffected.
Installation is minimal and deliberately paranoid. The project requires Node.js 20 or newer, and the README instructs npm install --ignore-scripts, which skips lifecycle scripts during dependency installation — a small but meaningful supply-chain hygiene detail. The package is private by design and not intended for publication to npm. From there, node bin/spikestrip.mjs --help exposes the CLI surface. A pnpm path with --frozen-lockfile --ignore-scripts is also documented for reproducible installs against the checked-in lockfile.
The intended workflow runs against a built static web root, after minification and before deployment. Source and output must be separate directories, with neither nested inside the other, and the tool leaves originals untouched while excluding symlinks, VCS metadata, dependency directories, manifest folders, and environment files from the output copy. The default flow is a two-step preview-then-write pattern: node bin/spikestrip.mjs inject ./site --output ./site-planted --count 20 --manifest ./private/run.json validates inputs and writes nothing, and appending --write applies the plan to a new copy. Placement, payload selection, and keys all draw on OS randomness, so a preview and a subsequent write may choose different positions — worth remembering when you are auditing exactly what landed where.
The insertion engine itself shows genuine engineering care. For JavaScript, the tool uses Acorn statement boundaries to place comments and then verifies that the resulting syntax tree is equivalent to the original — a strong invariant that rules out semantic drift. For HTML, comments are inserted only before direct children of explicit head or body elements, with a document-tree check rejecting any change beyond comment nodes. The tool refuses to touch attribute strings, raw text, templates, inline script bodies, or text content, and it skips and reports fragments without explicit structure, invalid JavaScript, unsupported JSX/TypeScript, and files over 2 MB. Supported files with no safe insertion positions are reported and copied unchanged rather than silently mangled.
The payload pool is documented in useful depth. The original ten-entry list survives in src/payloads.mjs as originalPayloads, containing exactly 100 words, while the default pool has grown to 28 entries, including 18 additional instruction decoys and false vulnerability leads. The false leads name invented routes and parameters for SSRF, SQL injection, server-side template injection, DOM-based XSS, XXE, path traversal, and object authorization checks. Some comments claim a retired path runs software affected by Log4Shell (CVE-2021-44228), Spring Cloud Gateway (CVE-2022-22947), or Apache HTTP Server (CVE-2021-41773). The README is explicit that the CVE identifiers are real but the paths are fabricated, and that the comments create no routes, handlers, or network requests. It also warns deployers to review invented names against their own application, since a fabricated path could collide with a real route — a failure mode that would turn a decoy into an accidental disclosure.
Reversibility is where SpikeStrip earns its keep in a professional pipeline. The private manifest records each comment and its key, and the remove command reconstructs a clean copy into a new output directory, optionally restricted to selected keys via repeatable --key flags. Removal matches the exact stored comment, preserves unrelated edits made after injection, and halts before writing if a comment block was modified or duplicated. Already-absent blocks are counted rather than treated as errors, so you can strip decoys incrementally. The manifest also stores original and injected SHA-256 hashes for auditing — a detail that makes the whole scheme defensible in a change-managed deployment.
For teams that do not want an insertion tool in their build pipeline, --raw exports a plain text file of keyed comments for manual placement, in either js or html wrapper format, with counts from 1 to 10,000 for built-ins. The trade-off is honest: raw exports create no removal manifest because the tool never learns where you pasted the comments, so the export file itself becomes your key inventory, searched by key for manual cleanup. The automatic remove path cannot discover manual placements, and the README is explicit about that boundary.
Dynamic generation pushes the pool beyond built-ins using your own LLM provider. With --dynamic, the tool generates one new decoy per insertion via OPENAI_API_KEY or ANTHROPIC_API_KEY, which must live in the process environment — never command-line arguments, never written into comments or manifests. Each request generates up to 25 texts with no automatic retries; failures, refusals, truncation, invalid JSON, and duplicates abort before any site is written, though completed API requests may still be billed. --max-output-tokens caps responses between 1,024 and 32,768, defaulting to 8,192. Notably, the provider receives the generation prompt, reference texts, and earlier outputs — but never your site source or insertion keys, a clean privacy boundary.
Profile support targets the agent family the tool was built to study. --mode artex selects 16 decoys designed around public ARTEX forks, documented in docs/ARTEX.md, including quoted API paths, fabricated archive chunks, route-map entries, worker-to-planner handoffs, and keyed summary references. --mode generic retains the mixed default pool. Dynamic generation for the profile uses prompts/artex.txt, overridable with --prompt-file, where {{count}} and a generated {{KEY}} placeholder are substituted locally. Manifests record the selected profile, and removal works offline without reselecting it or holding an API key.
One operational caveat deserves attention before any deployment: minified bundles often carry integrity assumptions. As the README notes, any added comment changes a file's bytes, and annotations like //# sourceMappingURL=app.js.map do not recalculate content hashes or make later edits safe for integrity checks. Any team using subresource integrity or hashed asset manifests needs to recompute affected hashes after planting — or, more simply, run SpikeStrip as the final step before hash computation in the build chain.
For defenders and researchers, SpikeStrip is best read as a measurement instrument: it lets you quantify how an AI-driven assessment behaves when fed adversarial comments, on infrastructure you control. The duplicate-key checks, syntax-tree equivalence verification, hash-audited manifests, and offline removal all point toward a design that takes reversibility and auditability seriously. At 51 stars and MIT licensed, it is a young project — the work-in-progress warning is genuine — but the architecture documented in the README is more disciplined than most deception tooling, and the honest cataloguing of what it cannot do is itself a useful contribution to the emerging practice of AI-agent-resistant web deployment.
Arcanum-Sec/SpikeStrip.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.