# jayaram-yalla/ghost_in_the_ide architecture

> Architecture diagram of the GitHub repository jayaram-yalla/ghost_in_the_ide, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/jayaram-yalla/ghost_in_the_ide
- Repository: https://github.com/jayaram-yalla/ghost_in_the_ide

## Overview

GHOST IN THE IDE is an authorized-lab research platform demonstrating IDE plug-ins that register with a C2 service, gather workstation and developer-activity data, and receive commands; the server dashboard presents clients, collected data, results, analytics, and timelines. The principal workflow runs from IDE plug-in startup through monitoring and client communication to server-side storage and dashboard analysis. The three plug-in families share capabilities but have separate implementations. README capability descriptions supplement the sampled excerpts; backend routes and some plug-in wiring were not sampled, so those links are kept at the documented subsystem level.

Main entry points: [`C2/c2_pycharm.py`](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/C2/c2_pycharm.py) (C2 API service), [`C2/static/js/main.js`](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/C2/static/js/main.js) (Dashboard UI), [`VSCODE_PLUGIN/VSC_PLUGIN/src/utils/C2Client.ts`](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/VSCODE_PLUGIN/VSC_PLUGIN/src/utils/C2Client.ts) (VS Code transport), [`VSCODE_PLUGIN/VSC_PLUGIN/src/extension.ts`](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/VSCODE_PLUGIN/VSC_PLUGIN/src/extension.ts) (VS Code extension)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_clients["IDE Clients"]
  node_vscode_extension["VS Code extension<br/>[extension.ts]"]
  node_jetbrains_plugin["JetBrains plugin"]
  node_eclipse_activator["Eclipse plugin<br/>[Activator.java]"]
end

subgraph group_collection["Collection Services"]
  node_vscode_monitors["VS Code monitors"]
  node_vscode_commands["VS Code commands"]
  node_vscode_transport["VS Code transport<br/>[C2Client.ts]"]
  node_jetbrains_monitors["JetBrains monitors"]
  node_jetbrains_exfil["JetBrains exfiltration"]
  node_jetbrains_commands["JetBrains commands"]
  node_eclipse_monitors["Eclipse monitors"]
  node_eclipse_exfil["Eclipse exfiltration"]
  node_eclipse_commands["Eclipse commands"]
end

subgraph group_server["C2 Server"]
  node_c2_service["C2 API service<br/>[c2_pycharm.py]"]
  node_persistence[("Stored lab data<br/>[persistence.py]")]
  node_analytics["Analytics<br/>[analytics.py]"]
end

subgraph group_dashboard["Dashboard"]
  node_dashboard_ui["Dashboard UI<br/>[main.js]"]
  node_dashboard_charts["Dashboard charts<br/>[charts.js]"]
  node_dashboard_realtime["Live updates<br/>[websocket.js]"]
end

node_lab_user(("Lab operator"))
node_ide_context(("IDE workstation"))

node_ide_context -->|"hosts extension"| node_vscode_extension
node_ide_context -->|"hosts plugin"| node_jetbrains_plugin
node_ide_context -->|"hosts plugin"| node_eclipse_activator
node_vscode_extension -->|"starts monitoring"| node_vscode_monitors
node_vscode_extension -->|"starts commands"| node_vscode_commands
node_vscode_monitors -->|"sends telemetry"| node_vscode_transport
node_vscode_commands -->|"polls and reports"| node_vscode_transport
node_jetbrains_plugin -->|"starts monitoring"| node_jetbrains_monitors
node_jetbrains_monitors -->|"submits collected data"| node_jetbrains_exfil
node_jetbrains_plugin -->|"starts command handling"| node_jetbrains_commands
node_jetbrains_commands -->|"submits results"| node_jetbrains_exfil
node_eclipse_activator -->|"starts services"| node_eclipse_monitors
node_eclipse_monitors -->|"submits collected data"| node_eclipse_exfil
node_eclipse_commands -->|"submits results"| node_eclipse_exfil
node_vscode_transport -->|"communicates"| node_c2_service
node_jetbrains_exfil -->|"sends telemetry"| node_c2_service
node_jetbrains_commands -->|"polls commands"| node_c2_service
node_eclipse_exfil -->|"sends telemetry"| node_c2_service
node_eclipse_commands -->|"polls commands"| node_c2_service
node_c2_service -->|"stores client data"| node_persistence
node_c2_service -->|"requests analysis"| node_analytics
node_lab_user -->|"views and operates"| node_dashboard_ui
node_dashboard_ui -->|"calls API"| node_c2_service
node_dashboard_ui -->|"renders metrics"| node_dashboard_charts
node_dashboard_ui -->|"subscribes updates"| node_dashboard_realtime
node_dashboard_realtime -->|"receives updates"| node_c2_service
node_c2_service -->|"returns commands"| node_vscode_transport

click node_vscode_extension "https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/VSCODE_PLUGIN/VSC_PLUGIN/src/extension.ts"
click node_jetbrains_plugin "https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/SecurityDemoPlugin.java"
click node_eclipse_activator "https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/Activator.java"
click node_vscode_monitors "https://github.com/jayaram-yalla/ghost_in_the_ide/tree/main/VSCODE_PLUGIN/VSC_PLUGIN/src/services"
click node_vscode_commands "https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/VSCODE_PLUGIN/VSC_PLUGIN/src/services/CommandExecutorService.ts"
click node_vscode_transport "https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/VSCODE_PLUGIN/VSC_PLUGIN/src/utils/C2Client.ts"
click node_jetbrains_monitors "https://github.com/jayaram-yalla/ghost_in_the_ide/tree/main/JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/monitors"
click node_jetbrains_exfil "https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/exfiltration/ExfiltrationService.java"
click node_jetbrains_commands "https://github.com/jayaram-yalla/ghost_in_the_ide/tree/main/JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/rce"
click node_eclipse_monitors "https://github.com/jayaram-yalla/ghost_in_the_ide/tree/main/ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/services"
click node_eclipse_exfil "https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/services/ExfiltrationService.java"
click node_eclipse_commands "https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/services/CommandExecutorService.java"
click node_c2_service "https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/C2/c2_pycharm.py"
click node_persistence "https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/C2/persistence.py"
click node_analytics "https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/C2/analytics.py"
click node_dashboard_ui "https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/C2/static/js/main.js"
click node_dashboard_charts "https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/C2/static/js/charts.js"
click node_dashboard_realtime "https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/C2/static/js/websocket.js"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_vscode_extension,node_jetbrains_plugin,node_eclipse_activator toneBlue
class node_vscode_monitors,node_vscode_commands,node_vscode_transport,node_jetbrains_monitors,node_jetbrains_exfil,node_jetbrains_commands,node_eclipse_monitors,node_eclipse_exfil,node_eclipse_commands toneAmber
class node_c2_service,node_persistence,node_analytics toneMint
class node_dashboard_ui,node_dashboard_charts,node_dashboard_realtime toneRose
class node_lab_user,node_ide_context toneIndigo
```

## Components

### IDE Clients

- [VS Code extension](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/VSCODE_PLUGIN/VSC_PLUGIN/src/extension.ts): `VSCODE_PLUGIN/VSC_PLUGIN/src/extension.ts`
- [JetBrains plugin](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/SecurityDemoPlugin.java): `JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/SecurityDemoPlugin.java`
- [Eclipse plugin](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/Activator.java): `ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/Activator.java`

### Collection Services

- [VS Code monitors](https://github.com/jayaram-yalla/ghost_in_the_ide/tree/main/VSCODE_PLUGIN/VSC_PLUGIN/src/services): `VSCODE_PLUGIN/VSC_PLUGIN/src/services`
- [VS Code commands](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/VSCODE_PLUGIN/VSC_PLUGIN/src/services/CommandExecutorService.ts): `VSCODE_PLUGIN/VSC_PLUGIN/src/services/CommandExecutorService.ts`
- [VS Code transport](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/VSCODE_PLUGIN/VSC_PLUGIN/src/utils/C2Client.ts): `VSCODE_PLUGIN/VSC_PLUGIN/src/utils/C2Client.ts`
- [JetBrains monitors](https://github.com/jayaram-yalla/ghost_in_the_ide/tree/main/JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/monitors): `JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/monitors`
- [JetBrains exfiltration](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/exfiltration/ExfiltrationService.java): `JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/exfiltration/ExfiltrationService.java`
- [JetBrains commands](https://github.com/jayaram-yalla/ghost_in_the_ide/tree/main/JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/rce): `JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/rce`
- [Eclipse monitors](https://github.com/jayaram-yalla/ghost_in_the_ide/tree/main/ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/services): `ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/services`
- [Eclipse exfiltration](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/services/ExfiltrationService.java): `ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/services/ExfiltrationService.java`
- [Eclipse commands](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/services/CommandExecutorService.java): `ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/services/CommandExecutorService.java`

### C2 Server

- [C2 API service](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/C2/c2_pycharm.py): `C2/c2_pycharm.py`
- [Stored lab data](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/C2/persistence.py): `C2/persistence.py`
- [Analytics](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/C2/analytics.py): `C2/analytics.py`

### Dashboard

- [Dashboard UI](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/C2/static/js/main.js): `C2/static/js/main.js`
- [Dashboard charts](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/C2/static/js/charts.js): `C2/static/js/charts.js`
- [Live updates](https://github.com/jayaram-yalla/ghost_in_the_ide/blob/main/C2/static/js/websocket.js): `C2/static/js/websocket.js`

### Other components

- **Lab operator**
- **IDE workstation**

## Connections

- IDE workstation → VS Code extension: hosts extension
- IDE workstation → JetBrains plugin: hosts plugin
- IDE workstation → Eclipse plugin: hosts plugin
- VS Code extension → VS Code monitors: starts monitoring
- VS Code extension → VS Code commands: starts commands
- VS Code monitors → VS Code transport: sends telemetry
- VS Code commands → VS Code transport: polls and reports
- JetBrains plugin → JetBrains monitors: starts monitoring
- JetBrains monitors → JetBrains exfiltration: submits collected data
- JetBrains plugin → JetBrains commands: starts command handling
- JetBrains commands → JetBrains exfiltration: submits results
- Eclipse plugin → Eclipse monitors: starts services
- Eclipse monitors → Eclipse exfiltration: submits collected data
- Eclipse commands → Eclipse exfiltration: submits results
- VS Code transport → C2 API service: communicates
- JetBrains exfiltration → C2 API service: sends telemetry
- JetBrains commands → C2 API service: polls commands
- Eclipse exfiltration → C2 API service: sends telemetry
- Eclipse commands → C2 API service: polls commands
- C2 API service → Stored lab data: stores client data
- C2 API service → Analytics: requests analysis
- Lab operator → Dashboard UI: views and operates
- Dashboard UI → C2 API service: calls API
- Dashboard UI → Dashboard charts: renders metrics
- Dashboard UI → Live updates: subscribes updates
- Live updates → C2 API service: receives updates
- C2 API service → VS Code transport: returns commands