Overview

  ┌─────────────┐       ┌──────────────┐       ┌────────────────┐
  │  Storefront  │       │  korp         │       │   Dashboard    │
  │  /var/www/   │──────▶│  CLI agent   │──────▶│   + API        │
  │              │ scan  │              │ POST  │                │
  └─────────────┘       └──────────────┘       └────────────────┘
                         │ Signature engine      │ Alerts
                         │ Hash engine           │ Incidents
                         │ YARA rules            │ Threat intel
                         │ Heuristic engine      │ Compliance
                         │ Delta detection       │ Webhooks
                         │ Attack chain          └────────────────
                         └──────────────

# Install korp CLI
$ curl -fsSL https://github.com/ecomscan/korp/releases/latest | sh

# Or with wget
$ wget -qO- https://github.com/ecomscan/korp/releases/latest | sh

# Download binary directly
$ wget https://github.com/ecomscan/korp/releases/latest/download/korp-linux-amd64.tar.gz
$ tar xzf korp-linux-amd64.tar.gz
$ sudo mv korp /usr/local/bin/
$ korp --version

$ docker run --rm -v /var/www/html:/scan ecomscan/korp scan /scan

$ korp --version
korp v1.0.4 (build: 2026-05-13, commit: a8f3c2d)

$ korp status
  CLI:        v1.4.2
  API:        connected (https://api.ecomscan.io)
  License:    EC-GROW-**** (Growth tier)
  Auth:       authenticated as user@company.com

$ korp auth login
  Email: user@company.com
  Password: ********
  ✓ Authenticated. Token saved to ~/.ecomscan/credentials.json

$ korp scan --path /var/www/html --platform magento

  ▸ Scanning /var/www/html (magento)
  ▸ 15,241 files scanned in 12.3s
  ▸ Engines: signature ✓  hash ✓  heuristic ✓  YARA ✓  delta ✓

  ┌─────────────────────────────────────────────────────────┐
  │  RISK SCORE: 78/100 (CRITICAL)                         │
  │  Findings:  2 critical · 3 high · 1 medium · 0 low      │
  └─────────────────────────────────────────────────────────┘

  CRITICAL  Magecart · KeepUp.v3          /checkout/js/bundle.min.js
  CRITICAL  PHP webshell · WSO 4.0        /pub/media/.thumbs/x.php
  HIGH      Obfuscated eval chain         /app/code/local/helper.php
  HIGH      Exfil POST to 185.234.72.19  /skin/frontend/loader.js
  HIGH      XOR-encoded payload          /var/tmp/.cache.php
  MEDIUM    Unsigned 3rd-party script    /checkout/head.phtml

# Option A: Install registers an agent and saves the secret
$ korp install --license-key EC-GROW-XXXX-XXXX-XXXX \
    --tenant-id YOUR_TENANT_UUID \
    --store-id YOUR_STORE_UUID

# Option B: Create a key from the dashboard or CLI
$ korp keys create --name "prod-server" --store-id YOUR_STORE_UUID

# Then scan + upload using the agent secret (set via --token or env)
$ ECOMSCAN_TOKEN=ec_key_xxxxx korp scan \
    --path /var/www/html \
    --platform magento \
    --upload

  ✓ 6 findings uploaded to dashboard
  ✓ 2 alerts created (CRITICAL, HIGH)

# Watch for file changes in real time
$ korp monitor --path /var/www/html --platform magento

  ▸ Baseline created: 15,241 files hashed
  ▸ Watching /var/www/html for changes...
  ▸ Next scheduled scan: 6h0m0s
  ▸ Heartbeat: every 60s → api.ecomscan.io

$ korp install --license-key=EC-GROW-XXXX-XXXX-XXXX

  ✓ License validated: Growth tier
  ✓ Agent registered: store-01-agent
  ✓ API key saved to ~/.ecomscan/credentials.json

# ~/.ecomscan/config.yaml

agent:
  store_id: "550e8400-e29b-41d4-a716-446655440000"
  secret_key: "ec_key_xxxxx"

api:
  endpoint: "https://api.ecomscan.io"
  timeout: 30s
  retry_max: 3

scanner:
  store_paths:
    - /var/www/html
  platform: magento
  scan_interval: 6h
  max_concurrency: 4
  enable_heuristics: true
  enable_yara: true
  extensions:
    - .php
    - .phtml
    - .js
    - .html
    - .xml
  exclude_paths:
    - node_modules
    - vendor
    - .git

monitor:
  enabled: true
  heartbeat_interval: 60s
  change_detection: true

$ korp config show                # View current config
$ korp config set scan.concurrency 8   # Update a value
$ korp config reset               # Reset to defaults

# Required for agent mode
export ECOMSCAN_AGENT_STORE_ID="your-store-uuid"
export ECOMSCAN_AGENT_SECRET_KEY="ec_key_xxxxx"
export ECOMSCAN_API_ENDPOINT="https://api.ecomscan.io"

# Optional overrides
export ECOMSCAN_SCANNER_PLATFORM="magento"
export ECOMSCAN_SCANNER_STORE_PATHS=""/var/www/html""

# Start the agent daemon
$ korp monitor \
    --path /var/www/html \
    --platform magento \
    --scan-interval 6h

# What the daemon does:
  1. Creates filesystem baseline (SHA256 per file)
  2. Watches for file modifications via fsnotify
  3. Runs full scan every 6h (configurable)
  4. Sends heartbeat to API every 60s
  5. Uploads findings + change events automatically

  Agent daemon                         API server
  ────────────                         ──────────
  Heartbeat (60s)  ──────────────────▶ POST /api/v1/agents/heartbeat
  Scan results     ──────────────────▶ POST /api/v1/scans/results
  File changes     ──────────────────▶ POST /api/v1/events/file-change

  Auth header: X-Agent-Secret: ec_key_xxxxx

# /etc/systemd/system/korp.service

[Unit]
Description=korp agent
After=network.target

[Service]
Type=simple
User=ecomscan
ExecStart=/usr/local/bin/korp monitor --path /var/www/html --platform magento
Restart=always
RestartSec=10
Environment=ECOMSCAN_AGENT_SECRET_KEY=ec_key_xxxxx
Environment=ECOMSCAN_AGENT_STORE_ID=your-store-uuid

[Install]
WantedBy=multi-user.target

$ sudo systemctl enable --now korp
$ sudo systemctl status korp
$ sudo journalctl -u korp -f             # tail logs

# docker-compose.yml
services:
  korp:
    image: ecomscan/korp:latest
    command: monitor --path /scan --platform magento
    volumes:
      - /var/www/html:/scan:ro
    environment:
      ECOMSCAN_AGENT_SECRET_KEY: ec_key_xxxxx
      ECOMSCAN_AGENT_STORE_ID: your-store-uuid
      ECOMSCAN_API_ENDPOINT: https://api.ecomscan.io
    restart: unless-stopped

# Deploy as a DaemonSet on nodes with storefronts
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: ecomscan-agent
spec:
  selector:
    matchLabels:
      app: ecomscan
  template:
    spec:
      containers:
      - name: ecomscan
        image: ecomscan/korp:latest
        args: ["monitor", "--path", "/scan"]
        volumeMounts:
        - name: store
          mountPath: /scan
          readOnly: true
        envFrom:
        - secretRef:
            name: ecomscan-secrets

$ korp scan --path /var/www/html --platform magento

$ korp scan --path /var/www/html --platform woocommerce

$ korp scan --path /var/www/html --platform shopware

$ korp scan --path /app/dist --platform other \
    --extensions .js,.ts,.jsx,.tsx

  File
   │
   ├──▶ 1. Signature engine     500+ regex patterns (webshells, skimmers, backdoors)
   ├──▶ 2. Hash engine           Known-bad MD5/SHA256 database
   ├──▶ 3. YARA engine           Community + ecomscan YARA rules
   ├──▶ 4. IOC matcher           Domain, IP, hash indicators from threat feeds
   ├──▶ 5. Heuristic engine      40+ behavioral signals (entropy, obfuscation, exfil)
   ├──▶ 6. Delta detector        Baseline diff — what changed since last scan?
   │
   ▼
  Unified Detection
   │
   ├──▶ Family classification    Match to 100+ known malware families
   ├──▶ Confidence calibration   Engine reliability × context × rule override
   ├──▶ Risk scoring             Evidence-weighted, path-aware, exploit-chain amplified
   ├──▶ MITRE ATT&CK mapping    Technique + tactic assignment
   └──▶ Attack chain             Kill-chain reconstruction across files

# Create a baseline after a clean deploy
$ korp baseline --path /var/www/html

  ✓ Baseline created: 15,241 files tracked
  ✓ Saved to: ~/.ecomscan/baseline.json

  Initial Access ──▶ Execution ──▶ Persistence ──▶ Collection ──▶ Exfiltration
  T1195.002         T1059.007     T1505.003       T1056.003     T1041
  Supply chain      JavaScript    Web shell       Form capture  C2 channel

# Scanning
korp scan --path <dir>              # Scan directory for malware
korp scan --path <dir> --upload     # Scan + upload to dashboard
korp scan --path <dir> --report     # Generate incident report
korp scan --path <dir> --email X    # Scan + email report
korp scan --path <dir> --db-scan    # Include WordPress DB scan
korp baseline --path <dir>          # Create file integrity baseline

# Monitoring
korp monitor --path <dir>           # Real-time file watching + scans

# Auth & setup
korp auth login                     # Email/password login
korp auth logout                    # Clear credentials
korp install --license-key=EC-...   # Activate license + register agent

# Management
korp keys list                      # List API keys
korp keys create --name "prod"       # Create API key (agent secret)
korp keys revoke --key-id <id>       # Revoke API key
korp check <domain>                 # Quick store health check
korp status                         # Agent + API status
korp report --scan-id=X             # Fetch scan report (JSON/CSV)
korp config show                    # View config
korp update                         # Update CLI binary
korp version                        # Print version

{
  "id": "scan-uuid",
  "store_id": "store-uuid",
  "started_at": "2026-05-13T04:18:00Z",
  "completed_at": "2026-05-13T04:18:12Z",
  "duration": "12.3s",
  "platform": "magento",
  "total_files": 15241,
  "scanned_files": 14800,
  "findings": [
    {
      "path": "/checkout/js/bundle.min.js",
      "severity": "critical",
      "confidence": 97,
      "type": "magecart",
      "family": "KeepUp.v3",
      "mitre": "T1056.003",
      "matches": [
        {
          "signature_name": "Magecart_KeepUp_v3_Loader",
          "line": 42,
          "matched_text": "addEventListener('change'...)",
          "remediation": "Remove injected script, block exfil domain at edge"
        }
      ],
      "heuristic": {
        "verdict": "malicious",
        "score": 0.92,
        "indicators": ["form-hook", "beacon-exfil", "card-selector"]
      }
    }
  ],
  "summary": {
    "critical": 2,
    "high": 3,
    "medium": 1,
    "low": 0,
    "risk_score": 78
  }
}

# List critical incidents
$ curl https://api.ecomscan.io/api/v1/incidents?severity=critical \
  -H "Authorization: Bearer ec_sk_..."

{
  "data": [
    {
      "id": "INC-2391",
      "store_id": "acmegear.com",
      "title": "Magecart KeepUp.v3 on /checkout",
      "severity": "critical",
      "risk_score": 78
    }
  ]
}

expected = HMAC-SHA256(shared_secret, request_body)
actual   = request.headers["X-Ecomscan-Signature"]
valid    = constant_time_compare(expected, actual)

resource "ecomscan_store" "acmegear" {
  name     = "acmegear.com"
  url      = "https://acmegear.com"
  platform = "magento"

  scan_config {
    interval    = "6h"
    platform    = "magento"
    store_paths = ["/var/www/html"]
  }
}

resource "ecomscan_alert_route" "slack_critical" {
  store_id = ecomscan_store.acmegear.id
  provider = "slack"
  severity = "critical"
  channel  = "#security-alerts"
}

# Check connectivity
$ korp status

# Test API directly
$ curl -s https://api.ecomscan.io/healthz

# Verify credentials
$ cat ~/.ecomscan/credentials.json

# Run with debug logging
$ korp scan --path /var/www/html --verbose