muaddib-scanner 1.0.0

package/results.sarif

@@ -0,0 +1,379 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+  "version": "2.1.0",
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "name": "MUADDIB",
+          "version": "1.0.0",
+          "informationUri": "https://github.com/DNSZLSK/muad-dib",
+          "rules": [
+            {
+              "id": "MUADDIB-AST-001",
+              "name": "Sensitive String Reference",
+              "shortDescription": {
+                "text": "Reference a un chemin ou identifiant sensible (.npmrc, .ssh, tokens)"
+              },
+              "fullDescription": {
+                "text": "Reference a un chemin ou identifiant sensible (.npmrc, .ssh, tokens)"
+              },
+              "helpUri": "https://blog.phylum.io/shai-hulud-npm-worm",
+              "properties": {
+                "severity": "HIGH",
+                "confidence": "medium",
+                "mitre": "T1552.001"
+              }
+            },
+            {
+              "id": "MUADDIB-AST-002",
+              "name": "Sensitive Environment Variable Access",
+              "shortDescription": {
+                "text": "Acces a une variable d'environnement sensible (GITHUB_TOKEN, NPM_TOKEN, AWS_*)"
+              },
+              "fullDescription": {
+                "text": "Acces a une variable d'environnement sensible (GITHUB_TOKEN, NPM_TOKEN, AWS_*)"
+              },
+              "helpUri": "https://blog.phylum.io/shai-hulud-npm-worm",
+              "properties": {
+                "severity": "HIGH",
+                "confidence": "high",
+                "mitre": "T1552.001"
+              }
+            },
+            {
+              "id": "MUADDIB-AST-003",
+              "name": "Dangerous Function Call",
+              "shortDescription": {
+                "text": "Appel a une fonction dangereuse (exec, spawn, eval, Function)"
+              },
+              "fullDescription": {
+                "text": "Appel a une fonction dangereuse (exec, spawn, eval, Function)"
+              },
+              "helpUri": "https://owasp.org/www-community/attacks/Command_Injection",
+              "properties": {
+                "severity": "MEDIUM",
+                "confidence": "medium",
+                "mitre": "T1059"
+              }
+            },
+            {
+              "id": "MUADDIB-AST-004",
+              "name": "Eval Usage",
+              "shortDescription": {
+                "text": "Utilisation de eval() ou new Function() - execution de code dynamique"
+              },
+              "fullDescription": {
+                "text": "Utilisation de eval() ou new Function() - execution de code dynamique"
+              },
+              "helpUri": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!",
+              "properties": {
+                "severity": "HIGH",
+                "confidence": "high",
+                "mitre": "T1059.007"
+              }
+            },
+            {
+              "id": "MUADDIB-SHELL-001",
+              "name": "Remote Code Execution via Curl",
+              "shortDescription": {
+                "text": "Telecharge et execute du code distant via curl | sh"
+              },
+              "fullDescription": {
+                "text": "Telecharge et execute du code distant via curl | sh"
+              },
+              "helpUri": "https://blog.phylum.io/shai-hulud-npm-worm",
+              "properties": {
+                "severity": "CRITICAL",
+                "confidence": "high",
+                "mitre": "T1105"
+              }
+            },
+            {
+              "id": "MUADDIB-SHELL-002",
+              "name": "Reverse Shell",
+              "shortDescription": {
+                "text": "Tentative de connexion reverse shell"
+              },
+              "fullDescription": {
+                "text": "Tentative de connexion reverse shell"
+              },
+              "helpUri": "https://attack.mitre.org/techniques/T1059/004/",
+              "properties": {
+                "severity": "CRITICAL",
+                "confidence": "high",
+                "mitre": "T1059.004"
+              }
+            },
+            {
+              "id": "MUADDIB-SHELL-003",
+              "name": "Dead Man's Switch",
+              "shortDescription": {
+                "text": "Suppression du repertoire home - dead man's switch de Shai-Hulud"
+              },
+              "fullDescription": {
+                "text": "Suppression du repertoire home - dead man's switch de Shai-Hulud"
+              },
+              "helpUri": "https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack",
+              "properties": {
+                "severity": "CRITICAL",
+                "confidence": "high",
+                "mitre": "T1485"
+              }
+            },
+            {
+              "id": "MUADDIB-PKG-001",
+              "name": "Suspicious Lifecycle Script",
+              "shortDescription": {
+                "text": "Script preinstall/postinstall suspect dans package.json"
+              },
+              "fullDescription": {
+                "text": "Script preinstall/postinstall suspect dans package.json"
+              },
+              "helpUri": "https://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm",
+              "properties": {
+                "severity": "MEDIUM",
+                "confidence": "medium",
+                "mitre": "T1195.002"
+              }
+            },
+            {
+              "id": "MUADDIB-OBF-001",
+              "name": "Code Obfuscation Detected",
+              "shortDescription": {
+                "text": "Code fortement obfusque detecte - probablement malveillant"
+              },
+              "fullDescription": {
+                "text": "Code fortement obfusque detecte - probablement malveillant"
+              },
+              "helpUri": "https://blog.phylum.io/shai-hulud-npm-worm",
+              "properties": {
+                "severity": "HIGH",
+                "confidence": "medium",
+                "mitre": "T1027"
+              }
+            },
+            {
+              "id": "MUADDIB-DEP-001",
+              "name": "Known Malicious Package",
+              "shortDescription": {
+                "text": "Package present dans la base IOC de packages malveillants connus"
+              },
+              "fullDescription": {
+                "text": "Package present dans la base IOC de packages malveillants connus"
+              },
+              "helpUri": "https://socket.dev/npm/issue",
+              "properties": {
+                "severity": "CRITICAL",
+                "confidence": "high",
+                "mitre": "T1195.002"
+              }
+            },
+            {
+              "id": "MUADDIB-DEP-002",
+              "name": "Suspicious File in Dependency",
+              "shortDescription": {
+                "text": "Fichier suspect detecte dans une dependance (setup_bun.js, etc.)"
+              },
+              "fullDescription": {
+                "text": "Fichier suspect detecte dans une dependance (setup_bun.js, etc.)"
+              },
+              "helpUri": "https://blog.phylum.io/shai-hulud-npm-worm",
+              "properties": {
+                "severity": "CRITICAL",
+                "confidence": "high",
+                "mitre": "T1195.002"
+              }
+            },
+            {
+              "id": "MUADDIB-DEP-003",
+              "name": "Shai-Hulud Marker Detected",
+              "shortDescription": {
+                "text": "Marqueur Shai-Hulud detecte dans le code"
+              },
+              "fullDescription": {
+                "text": "Marqueur Shai-Hulud detecte dans le code"
+              },
+              "helpUri": "https://blog.phylum.io/shai-hulud-npm-worm",
+              "properties": {
+                "severity": "CRITICAL",
+                "confidence": "high",
+                "mitre": "T1195.002"
+              }
+            },
+            {
+              "id": "MUADDIB-DEP-004",
+              "name": "Lifecycle Script in Dependency",
+              "shortDescription": {
+                "text": "Une dependance a un script preinstall/postinstall"
+              },
+              "fullDescription": {
+                "text": "Une dependance a un script preinstall/postinstall"
+              },
+              "helpUri": "https://docs.npmjs.com/cli/v9/using-npm/scripts#life-cycle-scripts",
+              "properties": {
+                "severity": "MEDIUM",
+                "confidence": "low",
+                "mitre": "T1195.002"
+              }
+            },
+            {
+              "id": "MUADDIB-HASH-001",
+              "name": "Known Malicious File Hash",
+              "shortDescription": {
+                "text": "Hash SHA256 correspond a un fichier malveillant connu"
+              },
+              "fullDescription": {
+                "text": "Hash SHA256 correspond a un fichier malveillant connu"
+              },
+              "helpUri": "https://www.virustotal.com",
+              "properties": {
+                "severity": "CRITICAL",
+                "confidence": "high",
+                "mitre": "T1195.002"
+              }
+            },
+            {
+              "id": "MUADDIB-FLOW-001",
+              "name": "Suspicious Data Flow",
+              "shortDescription": {
+                "text": "Flux de donnees suspect: lecture de credentials puis envoi reseau"
+              },
+              "fullDescription": {
+                "text": "Flux de donnees suspect: lecture de credentials puis envoi reseau"
+              },
+              "helpUri": "https://blog.phylum.io/shai-hulud-npm-worm",
+              "properties": {
+                "severity": "CRITICAL",
+                "confidence": "high",
+                "mitre": "T1041"
+              }
+            }
+          ]
+        }
+      },
+      "results": [
+        {
+          "ruleId": "MUADDIB-AST-001",
+          "level": "error",
+          "message": {
+            "text": "Reference a \".npmrc\" detectee."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "malicious.js",
+                  "uriBaseId": "%SRCROOT%"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              }
+            }
+          ],
+          "properties": {
+            "confidence": "medium",
+            "mitre": "T1552.001"
+          }
+        },
+        {
+          "ruleId": "MUADDIB-AST-002",
+          "level": "error",
+          "message": {
+            "text": "Acces a variable sensible process.env.GITHUB_TOKEN."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "malicious.js",
+                  "uriBaseId": "%SRCROOT%"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              }
+            }
+          ],
+          "properties": {
+            "confidence": "high",
+            "mitre": "T1552.001"
+          }
+        },
+        {
+          "ruleId": "MUADDIB-AST-001",
+          "level": "error",
+          "message": {
+            "text": "Reference a \"api.github.com\" detectee."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "malicious.js",
+                  "uriBaseId": "%SRCROOT%"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              }
+            }
+          ],
+          "properties": {
+            "confidence": "medium",
+            "mitre": "T1552.001"
+          }
+        },
+        {
+          "ruleId": "MUADDIB-AST-003",
+          "level": "warning",
+          "message": {
+            "text": "Appel dangereux \"exec\" detecte."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "malicious.js",
+                  "uriBaseId": "%SRCROOT%"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              }
+            }
+          ],
+          "properties": {
+            "confidence": "medium",
+            "mitre": "T1059"
+          }
+        },
+        {
+          "ruleId": "MUADDIB-FLOW-001",
+          "level": "error",
+          "message": {
+            "text": "Flux suspect: lecture credentials (readFileSync, GITHUB_TOKEN) + envoi reseau (request, exec)"
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "malicious.js",
+                  "uriBaseId": "%SRCROOT%"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              }
+            }
+          ],
+          "properties": {
+            "confidence": "high",
+            "mitre": "T1041"
+          }
+        }
+      ]
+    }
+  ]
+}

package/src/index.js

@@ -0,0 +1,142 @@
+const { scanPackageJson } = require('./scanner/package.js');
+const { scanShellScripts } = require('./scanner/shell.js');
+const { analyzeAST } = require('./scanner/ast.js');
+const { detectObfuscation } = require('./scanner/obfuscation.js');
+const { scanDependencies } = require('./scanner/dependencies.js');
+const { scanHashes } = require('./scanner/hash.js');
+const { analyzeDataFlow } = require('./scanner/dataflow.js');
+const { getPlaybook } = require('./response/playbooks.js');
+const { getRule } = require('./rules/index.js');
+const { saveReport } = require('./report.js');
+const { saveSARIF } = require('./sarif.js');
+
+async function run(targetPath, options = {}) {
+  const threats = [];
+
+  const packageThreats = await scanPackageJson(targetPath);
+  threats.push(...packageThreats);
+
+  const shellThreats = await scanShellScripts(targetPath);
+  threats.push(...shellThreats);
+
+  const astThreats = await analyzeAST(targetPath);
+  threats.push(...astThreats);
+
+  const obfuscationThreats = detectObfuscation(targetPath);
+  threats.push(...obfuscationThreats);
+
+  const dependencyThreats = await scanDependencies(targetPath);
+  threats.push(...dependencyThreats);
+
+  const hashThreats = await scanHashes(targetPath);
+  threats.push(...hashThreats);
+
+  const dataflowThreats = await analyzeDataFlow(targetPath);
+  threats.push(...dataflowThreats);
+
+  // Enrichir chaque menace avec les regles
+  const enrichedThreats = threats.map(t => {
+    const rule = getRule(t.type);
+    return {
+      ...t,
+      rule_id: rule.id,
+      rule_name: rule.name,
+      confidence: rule.confidence,
+      references: rule.references,
+      mitre: rule.mitre,
+      playbook: getPlaybook(t.type)
+    };
+  });
+
+  const result = {
+    target: targetPath,
+    timestamp: new Date().toISOString(),
+    threats: enrichedThreats,
+    summary: {
+      total: threats.length,
+      critical: threats.filter(t => t.severity === 'CRITICAL').length,
+      high: threats.filter(t => t.severity === 'HIGH').length,
+      medium: threats.filter(t => t.severity === 'MEDIUM').length
+    }
+  };
+
+  // Sortie JSON
+  if (options.json) {
+    console.log(JSON.stringify(result, null, 2));
+  }
+  // Sortie HTML
+  else if (options.html) {
+    saveReport(result, options.html);
+    console.log(`[OK] Rapport HTML genere: ${options.html}`);
+  }
+  // Sortie SARIF
+  else if (options.sarif) {
+    saveSARIF(result, options.sarif);
+    console.log(`[OK] Rapport SARIF genere: ${options.sarif}`);
+  }
+  // Sortie explain
+  else if (options.explain) {
+    console.log(`\n[MUADDIB] Scan de ${targetPath}\n`);
+
+    if (enrichedThreats.length === 0) {
+      console.log('[OK] Aucune menace detectee.\n');
+    } else {
+      console.log(`[ALERTE] ${enrichedThreats.length} menace(s) detectee(s):\n`);
+      enrichedThreats.forEach((t, i) => {
+        console.log(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━`);
+        console.log(`  ${i + 1}. [${t.severity}] ${t.rule_name}`);
+        console.log(`     Rule ID:    ${t.rule_id}`);
+        console.log(`     Fichier:    ${t.file}`);
+        if (t.line) console.log(`     Ligne:      ${t.line}`);
+        console.log(`     Confidence: ${t.confidence}`);
+        console.log(`     Message:    ${t.message}`);
+        if (t.mitre) console.log(`     MITRE:      ${t.mitre} (https://attack.mitre.org/techniques/${t.mitre.replace('.', '/')})`);
+        if (t.references && t.references.length > 0) {
+          console.log(`     References:`);
+          t.references.forEach(ref => console.log(`       - ${ref}`));
+        }
+        console.log(`     Playbook:   ${t.playbook}`);
+        console.log('');
+      });
+    }
+  }
+  // Sortie normale
+  else {
+    console.log(`\n[MUADDIB] Scan de ${targetPath}\n`);
+
+    if (threats.length === 0) {
+      console.log('[OK] Aucune menace detectee.\n');
+    } else {
+      console.log(`[ALERTE] ${threats.length} menace(s) detectee(s):\n`);
+      threats.forEach((t, i) => {
+        console.log(`  ${i + 1}. [${t.severity}] ${t.type}`);
+        console.log(`     ${t.message}`);
+        console.log(`     Fichier: ${t.file}\n`);
+      });
+
+      console.log('[REPONSE] Recommandations:\n');
+      threats.forEach(t => {
+        const playbook = getPlaybook(t.type);
+        if (playbook) {
+          console.log(`  -> ${playbook}\n`);
+        }
+      });
+    }
+  }
+
+// Calculer exit code selon le niveau de fail
+  const failLevel = options.failLevel || 'high';
+  const severityLevels = {
+    critical: ['CRITICAL'],
+    high: ['CRITICAL', 'HIGH'],
+    medium: ['CRITICAL', 'HIGH', 'MEDIUM'],
+    low: ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW']
+  };
+  
+  const levelsToCheck = severityLevels[failLevel] || severityLevels.high;
+  const failingThreats = threats.filter(t => levelsToCheck.includes(t.severity));
+  
+  return failingThreats.length;
+}
+
+module.exports = { run };

package/src/ioc/feeds.js

@@ -0,0 +1,42 @@
+const KNOWN_MALICIOUS_PACKAGES = [
+  'setup_bun.js',
+  'bun_environment.js',
+  '@ctrl/tinycolor',
+  'flatmap-stream',
+  'event-stream'
+];
+
+const KNOWN_MALICIOUS_HASHES = [
+  '62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0',
+  'cbb9bc5a8496243e02f3cc080efbe3e4a1430ba0671f2e43a202bf45b05479cd',
+  'f099c5d9ec417d4445a0328ac0ada9cde79fc37410914103ae9c609cbc0ee068'
+];
+
+const SUSPICIOUS_REPO_MARKERS = [
+  'Sha1-Hulud',
+  'Shai-Hulud',
+  'The Second Coming'
+];
+
+function isKnownMalicious(packageName) {
+  return KNOWN_MALICIOUS_PACKAGES.includes(packageName);
+}
+
+function isKnownMaliciousHash(hash) {
+  return KNOWN_MALICIOUS_HASHES.includes(hash.toLowerCase());
+}
+
+function hasSuspiciousMarker(text) {
+  return SUSPICIOUS_REPO_MARKERS.some(marker => 
+    text.toLowerCase().includes(marker.toLowerCase())
+  );
+}
+
+module.exports = { 
+  isKnownMalicious, 
+  isKnownMaliciousHash, 
+  hasSuspiciousMarker,
+  KNOWN_MALICIOUS_PACKAGES,
+  KNOWN_MALICIOUS_HASHES,
+  SUSPICIOUS_REPO_MARKERS
+};