MLAB(7)mlab packagesMLAB(7)

sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://apt.mlab.sh/mlab.asc -o /etc/apt/keyrings/mlab.asc
sudo tee /etc/apt/sources.list.d/mlab.sources >/dev/null <<'EOF'
Types: deb
URIs: https://apt.mlab.sh
Suites: stable
Components: main
Signed-By: /etc/apt/keyrings/mlab.asc
EOF
sudo apt-get update && sudo apt-get install <name>

sudo curl -fsSL https://pkg.mlab.sh/rpm/mlab.repo -o /etc/yum.repos.d/mlab.repo
sudo dnf install <name>

sudo zypper addrepo https://pkg.mlab.sh/rpm/mlab.repo
sudo zypper install <name>

engram       0.1.0    engram as an mlab-agent tool (`engram-tool serve`), plus offline `analyze` and
inkdex       0.4.2    inkdex command line
inkdex-vuln  0.9.1    Vulnerabilities found in a repository's inkdex: injections from its flows,
k3sec        1.8.0    Runtime security CLI for Kubernetes, Talos and Docker hosts, live k8s + eBPF
mlab-agent   1.0.0    mlab workspace agent: on-site, outbound-only, runs the tools its local policy
postmortem   2.9.2    Supply-chain scanner. Flags malicious install code, typosquats, and shady
virtsec      0.2.0    Runtime security CLI for Proxmox VE nodes: LXC and VM inventory, loaded/dormant

engram as an mlab-agent tool (`engram-tool serve`), plus offline `analyze` and

`inspect`. engram is the memory forensics tool of the mlab.sh workspace agent. It parses Windows memory dumps on the host (raw, crash dumps, hibernation files, VM snapshots, EWF) and serves an index and targeted reads to the members of a workspace; the dump never leaves the host. Runs under mlab-agent: https://mlab.sh

latest 0.1.0 · depends libc6 (>= 2.34) · https://mlab.sh

sudo apt-get install engram
sudo apt-get install engram=0.1.0   # pin
sudo dnf install engram
sudo dnf install engram-0.1.0   # pin

apt (.deb)

0.1.0  amd64    6.3M  b83e714245f709a44bc6237d6ee0356b963c600025053d053c8abac8f2ec3cb4

dnf / zypper (.rpm)

0.1.0  x86_64   6.8M  3e2f3e402f49fdcee02f810894d0f6e7d4e2e38121ed6c5a8bced4476c15d748

inkdex command line

inkdex indexes a codebase as a whole (symbols, calls, routes, dependencies, data flows) and lets you explore it. Needs an inkdex license from mlab.sh: https://inkdex.mlab.sh

latest 0.4.2 · depends libc6 (>= 2.34) · https://mlab.sh/code

sudo apt-get install inkdex
sudo apt-get install inkdex=0.4.2   # pin
sudo dnf install inkdex
sudo dnf install inkdex-0.4.2   # pin

apt (.deb)

0.4.2  amd64    7.4M  ee74f4f7efb1a8145c00064abf62ece7e4f3f15e0f97eb1d4d41030853048710
0.4.1  amd64    7.3M  fd7f81820b36439aea693864efe8f55e1827a50f5648295e2b6dcfa763100bf6
0.4.0  amd64    7.3M  35f372900cae6bc04445f5a2f14088a293798bfd328b1aba8266a96d1af6e7c2

dnf / zypper (.rpm)

0.4.2  x86_64   7.9M  24aa471db1e1216018be524d8d603d9c7a7a3e07a82e34a626b43b903f337197
0.4.1  x86_64   7.8M  7577fc1063e57202079e5bfb9363b01a25c67c337c80c0f3c4bc474930ef2be8
0.4.0  x86_64   7.8M  1d36be55f04e7e7fdfbe2c524cc845e73b8235af5b9a93fb3f0655d4b8e4ac06

Vulnerabilities found in a repository's inkdex: injections from its flows,

secrets, weak crypto, dangerous APIs, vulnerable dependencies inkdex-vuln is inkdex plus `scan`: the vulnerabilities of a repository, with their CWE, a severity and a verdict, as text, JSON or SARIF. Needs an inkdex license from mlab.sh: https://inkdex.mlab.sh

latest 0.9.1 · depends libc6 (>= 2.34) · https://mlab.sh/code

sudo apt-get install inkdex-vuln
sudo apt-get install inkdex-vuln=0.9.1   # pin
sudo dnf install inkdex-vuln
sudo dnf install inkdex-vuln-0.9.1   # pin

apt (.deb)

0.9.1  amd64    7.6M  a7b415015b4c69f42b88eab0379f7605675f778ee138c67231e0e88bdb0e21fc
0.9.0  amd64    7.5M  f179529604f04c2414d8f4f4650a381d70aedb4f9149775b4d61bd2813e2112b
0.4.0  amd64    7.4M  7de6d1d5ff165daa1744bdd8b79c5c74febbb6e74908c22c2036e979ff765133

dnf / zypper (.rpm)

0.9.1  x86_64   8.2M  200440e9336f8adbe5abf6f49d559db4dc199a40ce42c9afc13ad76f200b5dab
0.9.0  x86_64   8.0M  a64cede8bdd4c6aba7a8c5ebd4a502742ca30a5fa757ce5b8cd5b294ee0a00ba
0.4.0  x86_64   8.0M  5a76b428a2b0f12d4363525ce7d67a0e17e41d9d28c5112920639806ca020e89

Runtime security CLI for Kubernetes, Talos and Docker hosts, live k8s + eBPF

event streaming k3sec streams what happens on a Kubernetes, Talos or Docker host (Kubernetes events, eBPF exec, connect and file writes, YARA detections) and tells which vulnerabilities touch code that is actually loaded in memory. Standalone CLI, or a tool of mlab-agent for an mlab.sh workspace. The k3sec.service unit is installed but not enabled.

latest 1.8.0 · depends libc6 (>= 2.34) · https://github.com/mlab-sh/k3sec

sudo apt-get install k3sec
sudo apt-get install k3sec=1.8.0   # pin
sudo dnf install k3sec
sudo dnf install k3sec-1.8.0   # pin

apt (.deb)

1.8.0  amd64   10.0M  abe205f289cfaf1a7dca50daa5f6656c21326a54e48e651b67717341b766a3c5
1.7.0  amd64    9.4M  79068cc644c88915a0a5351ded240710cfaaa6bf875963b0e889bff0c0f4aaac
1.6.0  amd64    9.4M  ba63363696bb5aab97ed7acff7a145ea321d613b3f6abd1276254ee0e039271c
1.5.2  amd64    9.4M  2e90e0e608aebf060a9db0cf08bfe8c086ef2a41b52263127b5c3e3a68d43910
1.5.1  amd64    9.4M  74ce6bb606fc2a9e3d72842516484d92a0d9ef2def2ff3451cd2a11aae83c0d6
1.5.0  amd64    9.4M  e28db599a2c12b5ef4045739cfa9f701ec3add7d0b2cae6c442a12fbe824adbc

dnf / zypper (.rpm)

1.8.0  x86_64  10.7M  351628e3d2ea4bca61927a508faf6995fa12549b52f679398832f3a1f23fcbde
1.7.0  x86_64  10.2M  c66e377323006ef681549891c75d1e12e296fdc91fbb9c5111f68d0c3d027775
1.6.0  x86_64  10.2M  871d2f78efbfdeccb9d64746cdd1fe8edc5dafd47f6a6da5adb652a39eaf2c94
1.5.2  x86_64  10.2M  18ffb4815b6fa374afe997685338469ec64d9cce7482cbc4ac52500c133311fc
1.5.1  x86_64  10.1M  0572cc1f36adca83c3ce19971c02fe6c0b00beb3baff3e7af235ab06d404413e
1.5.0  x86_64  10.1M  a0e0ed83e1dc802a392e7706033fc0b9e61bbe54db06cd95d8b44f5f8bca7b10

mlab workspace agent: on-site, outbound-only, runs the tools its local policy

allows and serves them through the relay. The mlab.sh workspace agent runs on customer hosts, connects out to the mlab relay only, and serves the tools its local policy allows (engram for memory forensics) to the members of a workspace. Every request is signed, encrypted, checked against the local policy and audited locally. Needs an mlab.sh workspace: https://mlab.sh

latest 1.0.0 · depends adduser | passwd, ca-certificates, libc6 (>= 2.34) · https://mlab.sh

sudo apt-get install mlab-agent
sudo apt-get install mlab-agent=1.0.0   # pin
sudo dnf install mlab-agent
sudo dnf install mlab-agent-1.0.0   # pin

apt (.deb)

1.0.0  amd64    1.9M  77be27e3f0b15591c4e173330e3a0d9fbfc66b1765f715da5c4fa54156a5a595
0.1.0  amd64    1.9M  6b0193a5b7c51adcafbd252c7139af6acafe43ba7a7a502040e6a684c6169bee

dnf / zypper (.rpm)

1.0.0  x86_64   2.1M  84ab105ae18c87bdeb322a1b8b9d691b0707cec915390a96610cc2f3aeb3e436
0.1.0  x86_64   2.1M  727c48da36bd1578329b4652e86448ad822a33e70277515ae77e45f40d4d7c0d

Supply-chain scanner. Flags malicious install code, typosquats, and shady

provenance across your dependencies and your OS packages. postmortem resolves your dependency graph offline, then optionally enriches it with repository reputation, maintainer provenance and known-CVE intelligence. It also audits the OS package managers installed on the machine.

latest 2.9.2 · depends libc6:arm64 (>= 2.35) · https://github.com/mlab-sh/postmortem

sudo apt-get install postmortem
sudo apt-get install postmortem=2.9.2   # pin
sudo dnf install postmortem
sudo dnf install postmortem-2.9.2   # pin

apt (.deb)

2.9.2  amd64    4.0M  95722850437c167fedd23c0049c0de964e9653f6fcd8c7cb56473c50defad989
       arm64    3.4M  b9da1cacfd46260735fa3f6c03754903a042b7935628f50a0a578f7231240ffd
2.9.1  amd64    4.0M  2b12ce9ca49659050e641ed839d69d6c99fc1f7dea0b8fe722c887c08ce5c4e3
       arm64    3.4M  ecbfe4b6125e80b575f4b60941a96d4b0460b4f781a77a5ed482f3b977d2fc3f
2.9.0  amd64    4.0M  b989864419d8bb0dd3b2a66bc2b952a80744648df9c713523c632419c54f686d
       arm64    3.4M  360e183949e280cc1e08eb7b980a3b288466ae4e52ed7c545d7c90f96b695bcb
2.8.0  amd64    3.7M  7abc34b44e58deff06d1b5000ea98eab89daed1d901029ba6b1b98daf6ad10f0
       arm64    3.2M  375d8ac36e898dd36057b80b45c80706529ab9eeacf7f87f53901f10f6c71368
2.7.2  amd64    3.5M  9727c7c27894ac1138e0395248192afce152b33199f75ecfafe1431eaa227f4f
       arm64    3.0M  1eb32d2aa219ff92827ecc8e15d041429954c6614c2fb9698fa380a44a4455ae
2.7.1  amd64    3.4M  27f9fddbbbee3270f3e6f67f88e7bc98ca16437d49b6162f54b0cd4223098bee
       arm64    3.0M  cf228038a9dd47917955f5923ef500d96efef831c092ba786a6285d2f0db0bc5
2.7.0  amd64    3.4M  6aba4c915a6f32bd52cd54d19796614fcee5a60f26fe340943aa5b739959c022
       arm64    3.0M  d4f540ddb32301614dad0ec1197e89de18a841858b3dbb99d8e712475b75a11d
2.6.0  amd64    3.2M  6f68f42034cffdac05c6f369a19368eb210dcc128afa17dcbb951a5ee623d5d2
       arm64    2.8M  e85e33e95f4692e4c82a01fc9e0af7cb284e18c60679a3297e65d6f84ae884ac
2.5.0  amd64    3.1M  b148c022028d72ea335d40470c3554b308e951c7b581268f95aa2b304af3a643
       arm64    2.7M  c01c60a4b67d4b1f404263b91aba0564a2df3c70aef7ec3f2336792c075519d9
2.4.0  amd64    3.1M  ce56ceedb7e3994804734707bdcbb7462f02752552dc694ad75d46c1e03c1029
       arm64    2.7M  3423ab8f32d9695bcc226ea30df943b55b8298c777abd38b4f0381799dad2a4f
... 1 older not shown

dnf / zypper (.rpm)

2.9.2  aarch64  4.0M  2279de74b1f107dd4778b30d636916f64c00b7f048c427fb4b5e4f150d6cde5a
       x86_64   4.2M  188d8a2d1c17cf5754e4b799feb5584047682a4b85f1b38d8b870a4b58cc99c1

Runtime security CLI for Proxmox VE nodes: LXC and VM inventory, loaded/dormant

vulnerabilities virtsec tells what runs in every LXC container and VM of a Proxmox VE node, which vulnerabilities touch code that is actually loaded in memory, and streams what happens on the node (execs, connects, writes, logins, config changes). Standalone CLI, or a tool of mlab-agent for an mlab.sh workspace.

latest 0.2.0 · depends libc6 (>= 2.34) · https://mlab.sh

sudo apt-get install virtsec
sudo apt-get install virtsec=0.2.0   # pin
sudo dnf install virtsec
sudo dnf install virtsec-0.2.0   # pin

apt (.deb)

0.2.0  amd64    3.2M  c4293dc5198106527fc043951a0374700e3805fddc8929cb191ce6a75bcb9193
0.1.0  amd64    3.1M  8460fda6ecfd40025e51fe8176dd2fe41c05ab4ceb62f7ccea67be7fe6c7d5b8

dnf / zypper (.rpm)

0.2.0  x86_64   3.4M  1a92d3720b06321c81b94b4f69d6ea1a7d392a7799ff228cba06872d319171d8
0.1.0  x86_64   3.3M  e25caac960c1f7fb45723d55ea668a79a443dd607d3e19037848b67a6dc4171a