Add scanner rules for malicious WebSocket handlers #3

[stevehuuuu]

Developed scanner rules for detecting malicious WebSocket handlers:

1. : Detects WebSocket connections to suspicious C2 domains (ngrok, requestbin, reverse-shell, etc.)
2. : Detects sensitive data exfiltration over WebSocket (env vars, ssh keys, base64 encoded secrets)
3. : Detects reverse shell patterns over WebSocket (piping child process stdin/stdout to WebSocket)
4. : Low severity pattern for WebSocket module imports

• Added allowlist patterns and expanded SAFE_DOMAINS list to avoid false positives on legitimate WebSocket usage (Pusher, Socket.io, Ably, PubNub, Firebase, localhost dev servers)
• Tested thoroughly:
  • Malicious WebSocket C2/reverse shell/exfiltration patterns are detected with high/critical severity
  • Legitimate WebSocket usage (real-time services, local dev) returns 0 findings (clean)
  • All existing detection capabilities preserved

[vercel]

Someone is attempting to deploy a commit to the Rapi's projects Team on Vercel.

A member of the Team first needs to authorize it.