Pompelmi is a lightweight TypeScript library and CLI tool designed to integrate file scanning and YARA rule execution directly into your reverse engineering workflows. Run scans completely offline, embed in Node.js tools, or use the command-line interface.

Key Features for Reverse Engineers

• 🔍 YARA Rule Engine: Load and run custom YARA rulesets (no external dependencies).
• 🛡 Binary & Archive Inspection: Magic-byte detection for executables (PE, ELF), nested ZIP and basic zip-bomb protection.
• 🎛 Flexible API & CLI: Use as a library in Node.js or via the pompelmi CLI for quick scans.
• ⚙️ TypeScript-Powered: Strong typings, easy integration into TypeScript/JavaScript projects.
• 🌐 Remote Engine Option: Expose a HTTP endpoint for browser-based tools or dashboards.

Quickstart as a CLI

Install globally or locally:

npm install -g pompelmi 

Scan a file with a YARA rule:

pompelmi scan --file path/to/binary.exe --rules path/to/rules.yara --output json 

Sample JSON output:

[ { "rule": "detect_pe_file", "matches": ["$mz"] } ] 

Quickstart in Node.js

import { scanBuffer, createEngine } from 'pompelmi'; import fs from 'fs'; // Load YARA rules const rules = fs.readFileSync('rules.yara', 'utf8'); async function run() { const engine = createEngine({ rules }); const buffer = fs.readFileSync('path/to/binary.elf'); const matches = await scanBuffer(buffer, engine); console.log(matches); } run(); 

⚠️ Alpha release. Breaking changes may occur. Use at your own risk; the author assumes no liability.