Add a new YARA-X Scan operation backed by the official @virustotal/yara-x WASM package

[zainnadeem786]

Summary

This PR adds a new YARA-X Scan operation to CyberChef using the official @virustotal/yara-x WebAssembly package.

The existing YARA Rules operation remains unchanged. This PR introduces a separate operation that supports modern YARA-X syntax (including features such as with) while preserving backward compatibility.

Closes #2622.

---

Background

CyberChef currently provides a legacy YARA Rules operation based on libyara-wasm.

YARA-X is the official successor to YARA and provides a modern rule engine, improved performance, new language features, and officially maintained JavaScript/WASM bindings.

This feature request aims to bring modern YARA-X capabilities directly into CyberChef, allowing users to write and test YARA-X rules without switching to external tools or the YARA-X CLI.

---

Design

Rather than replacing the existing operation, this PR introduces a new operation:

YARA-X Scan

This approach:

• Preserves backward compatibility.
• Avoids changing the existing YARA implementation.
• Allows users to explicitly choose between legacy YARA and YARA-X.
• Provides a foundation for future YARA-X enhancements.

---

Implementation

New Operation

Added:

src/core/operations/YARAXScan.mjs

The operation:

• Initializes the official YARA-X WASM runtime.
• Compiles user-supplied rules.
• Scans the current CyberChef input.
• Formats matches into readable output.
• Reports initialization, compilation, and scanning failures through OperationError.

---

Dependency

Added:

@virustotal/yara-x

This is the official first-party JavaScript/WASM package published by the YARA-X project.

---

Categories

Added the new operation to the existing Yara category alongside the legacy YARA Rules operation.

---

WASM Initialization

The YARA-X runtime is initialized once through a cached module-level initialization promise so the WebAssembly module is only initialized once per session.

---

Node Test Support

Updated:

tests/lib/wasmFetchPolyfill.mjs

to support file: URLs.

The official YARA-X package loads its bundled WASM through a file URL during Node-based operation tests. Recent Node versions reject this by default, so the test fetch polyfill was extended to support this scenario.

---

Supported Features

The initial implementation supports:

• Rule compilation
• Input scanning
• Namespaces
• Rule tags
• Metadata
• Matching pattern information
• Configurable scan timeout
• Human-readable text output

---

Tests

Added:

tests/operations/tests/YARAX.mjs

Coverage includes:

• Simple matching rule
• No matches
• Invalid rule syntax
• Binary input
• Metadata output
• Tag output
• YARA-X with rule
• Whitespace-only rules

---

Validation

Successfully validated with:

npm install

npx grunt configTests

node --no-warnings --no-deprecation tests/operations/index.mjs
TOTAL 2063
PASSING 2063

node --no-warnings --no-deprecation tests/node/index.mjs
TOTAL 254
PASSING 254

npx grunt lint

git diff --check

A targeted Webpack build also successfully emitted the YARA-X WASM asset.

---

Compatibility

This PR is intentionally additive.

No existing operations were modified or removed.

The existing YARA Rules operation continues to behave exactly as before.

Users can continue using the legacy implementation while choosing YARA-X Scan whenever modern YARA-X language features are required.

---

Future Work

Potential future enhancements include:

• External variables
• Include support
• JSON output mode
• Custom modules

---

Notes

This implementation intentionally focuses on the core YARA-X scanning workflow while keeping the integration small and maintainable.

Additional YARA-X functionality can be introduced in follow-up pull requests without affecting the existing legacy YARA implementation.