muaddib-scanner 1.0.0

package/src/ioc/updater.js

@@ -0,0 +1,244 @@
+const fs = require('fs');
+const path = require('path');
+const https = require('https');
+
+const CACHE_PATH = path.join(__dirname, '../../.muaddib-cache');
+const IOC_FILE = path.join(CACHE_PATH, 'iocs.json');
+const { loadYAMLIOCs, getIOCStats } = require('./yaml-loader.js');
+
+const BUILTIN_IOCS = {
+  packages: [
+    // Shai-Hulud v1 (septembre 2025)
+    { name: '@ctrl/tinycolor', version: '4.1.1', source: 'shai-hulud-v1' },
+    { name: 'ng2-file-upload', version: '*', source: 'shai-hulud-v1' },
+    { name: 'ngx-bootstrap', version: '*', source: 'shai-hulud-v1' },
+    
+    // Shai-Hulud v2 (novembre 2025)
+    { name: '@asyncapi/specs', version: '*', source: 'shai-hulud-v2' },
+    { name: '@asyncapi/openapi-schema-parser', version: '*', source: 'shai-hulud-v2' },
+    { name: 'get-them-args', version: '*', source: 'shai-hulud-v2' },
+    { name: 'kill-port', version: '*', source: 'shai-hulud-v2' },
+    { name: 'shell-exec', version: '*', source: 'shai-hulud-v2' },
+    { name: 'posthog-node', version: '*', source: 'shai-hulud-v2' },
+    { name: 'posthog-js', version: '*', source: 'shai-hulud-v2' },
+    { name: '@postman/tunnel-agent', version: '*', source: 'shai-hulud-v2' },
+    { name: '@zapier/secret-scrubber', version: '*', source: 'shai-hulud-v2' },
+    
+    // Shai-Hulud v3 Golden Path (decembre 2025)
+    { name: '@vietmoney/react-big-calendar', version: '0.26.2', source: 'shai-hulud-v3' },
+    
+    // Attaques historiques
+    { name: 'flatmap-stream', version: '0.1.1', source: 'event-stream-2018' },
+    { name: 'event-stream', version: '3.3.6', source: 'event-stream-2018' },
+    { name: 'eslint-scope', version: '3.7.2', source: 'eslint-scope-2018' },
+    { name: 'eslint-config-prettier', version: '8.10.1', source: 'eslint-prettier-2025' },
+    { name: 'eslint-config-prettier', version: '9.1.1', source: 'eslint-prettier-2025' },
+    { name: 'eslint-plugin-prettier', version: '4.2.2', source: 'eslint-prettier-2025' },
+    { name: 'synckit', version: '0.11.9', source: 'eslint-prettier-2025' },
+    { name: '@pkgr/core', version: '0.2.8', source: 'eslint-prettier-2025' },
+    { name: 'napi-postinstall', version: '0.3.1', source: 'eslint-prettier-2025' },
+    { name: 'got-fetch', version: '5.1.11', source: 'eslint-prettier-2025' },
+    { name: 'is', version: '3.3.1', source: 'is-package-2025' },
+    { name: 'is', version: '5.0.0', source: 'is-package-2025' },
+    
+    // Typosquats connus
+    { name: 'crossenv', version: '*', source: 'typosquat' },
+    { name: 'cross-env.js', version: '*', source: 'typosquat' },
+    { name: 'mongose', version: '*', source: 'typosquat' },
+    { name: 'mssql.js', version: '*', source: 'typosquat' },
+    { name: 'mssql-node', version: '*', source: 'typosquat' },
+    { name: 'babelcli', version: '*', source: 'typosquat' },
+    { name: 'http-proxy.js', version: '*', source: 'typosquat' },
+    { name: 'proxy.js', version: '*', source: 'typosquat' },
+    { name: 'shadowsock', version: '*', source: 'typosquat' },
+    { name: 'smb', version: '*', source: 'typosquat' },
+    { name: 'nodesass', version: '*', source: 'typosquat' },
+    { name: 'node-sass.js', version: '*', source: 'typosquat' },
+    
+    // Protestware
+    { name: 'node-ipc', version: '10.1.1', source: 'protestware' },
+    { name: 'node-ipc', version: '10.1.2', source: 'protestware' },
+    { name: 'node-ipc', version: '10.1.3', source: 'protestware' },
+    { name: 'colors', version: '1.4.1', source: 'protestware' },
+    { name: 'colors', version: '1.4.2', source: 'protestware' },
+    { name: 'faker', version: '6.6.6', source: 'protestware' }
+  ],
+  files: [
+    'setup_bun.js',
+    'bun_environment.js',
+    'bundle.js',
+    'node-gyp.dll',
+    'preinstall.js',
+    'postinstall.js',
+    'install.js'
+  ],
+  hashes: [
+    '62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0',
+    'cbb9bc5a8496243e02f3cc080efbe3e4a1430ba0671f2e43a202bf45b05479cd',
+    'f099c5d9ec417d4445a0328ac0ada9cde79fc37410914103ae9c609cbc0ee068',
+    'a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a',
+    'f1df4896244500671eb4aa63ebb48ea11cee196fafaa0e9874e17b24ac053c02',
+    '9d59fd0bcc14b671079824c704575f201b74276238dc07a9c12a93a84195648a',
+    'e0250076c1d2ac38777ea8f542431daf61fcbaab0ca9c196614b28065ef5b918',
+    '6c9628f72d2bb789fe8f097a611d61c8c53f2f21e47c6a5d8d3e0e0b8e5e8c8f',
+    'a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2',
+    '4b2399646573bb737c4969563303d8ee2e9ddbd1b271f1ca9e35ea78062538db',
+    '46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09',
+    'b74caeaa75e077c99f7d44f46daaf9796a3be43ecf24f2a1fd381844669da777',
+    'dc67467a39b70d1cd4c1f7f7a459b35058163592f4a9e8fb4dffcbba98ef210c'
+  ],
+  markers: [
+    'Sha1-Hulud',
+    'Shai-Hulud',
+    'The Second Coming',
+    'Goldox-T3chs',
+    'Only Happy Girl',
+    'peacenotwar',
+    'protestware',
+    '/dev/tcp',
+    'reverse shell'
+  ]
+};
+
+const EXTERNAL_FEEDS = [
+  {
+    name: 'muaddib-community',
+    url: 'https://raw.githubusercontent.com/DNSZLSK/muad-dib/master/data/iocs.json',
+    parser: parseMuaddibFeed
+  }
+];
+
+async function updateIOCs() {
+  console.log('[MUADDIB] Mise a jour des IOCs...\n');
+
+  if (!fs.existsSync(CACHE_PATH)) {
+    fs.mkdirSync(CACHE_PATH, { recursive: true });
+  }
+
+  const iocs = JSON.parse(JSON.stringify(BUILTIN_IOCS));
+
+  for (const feed of EXTERNAL_FEEDS) {
+    try {
+      console.log(`[INFO] Telechargement depuis ${feed.name}...`);
+      const data = await fetchUrl(feed.url);
+      const externalIOCs = feed.parser(data);
+      
+      // Merge packages
+      for (const pkg of externalIOCs.packages || []) {
+        if (!iocs.packages.find(p => p.name === pkg.name && p.version === pkg.version)) {
+          iocs.packages.push(pkg);
+        }
+      }
+      
+      // Merge hashes
+      for (const hash of externalIOCs.hashes || []) {
+        if (!iocs.hashes.includes(hash)) {
+          iocs.hashes.push(hash);
+        }
+      }
+      
+      // Merge markers
+      for (const marker of externalIOCs.markers || []) {
+        if (!iocs.markers.includes(marker)) {
+          iocs.markers.push(marker);
+        }
+      }
+      
+      // Merge files
+      for (const file of externalIOCs.files || []) {
+        if (!iocs.files.includes(file)) {
+          iocs.files.push(file);
+        }
+      }
+      
+      console.log(`[OK] IOCs externes merges depuis ${feed.name}`);
+    } catch (err) {
+      console.log(`[WARN] Echec ${feed.name}: ${err.message}`);
+    }
+  }
+
+  iocs.updated = new Date().toISOString();
+
+  fs.writeFileSync(IOC_FILE, JSON.stringify(iocs, null, 2));
+  console.log(`\n[OK] IOCs sauvegardes:`);
+  console.log(`     - ${iocs.packages.length} packages malveillants`);
+  console.log(`     - ${iocs.files.length} fichiers suspects`);
+  console.log(`     - ${iocs.hashes.length} hashes connus`);
+  console.log(`     - ${iocs.markers.length} marqueurs\n`);
+
+  return iocs;
+}
+
+function fetchUrl(url) {
+  return new Promise((resolve, reject) => {
+    https.get(url, (res) => {
+      if (res.statusCode === 301 || res.statusCode === 302) {
+        fetchUrl(res.headers.location).then(resolve).catch(reject);
+        return;
+      }
+      if (res.statusCode !== 200) {
+        reject(new Error(`HTTP ${res.statusCode}`));
+        return;
+      }
+      let data = '';
+      res.on('data', chunk => data += chunk);
+      res.on('end', () => resolve(data));
+    }).on('error', reject);
+  });
+}
+
+function parseMuaddibFeed(data) {
+  try {
+    return JSON.parse(data);
+  } catch (e) {
+    return { packages: [], hashes: [], markers: [], files: [] };
+  }
+}
+
+function loadCachedIOCs() {
+  // Priorite 1 : IOCs YAML locaux
+  const yamlIOCs = loadYAMLIOCs();
+  
+  // Priorite 2 : Cache telecharge
+  let cachedIOCs = { packages: [], hashes: [], markers: [], files: [] };
+  if (fs.existsSync(IOC_FILE)) {
+    cachedIOCs = JSON.parse(fs.readFileSync(IOC_FILE, 'utf8'));
+  }
+  
+  // Merge : YAML + Cache + Builtin
+  const merged = {
+    packages: [...yamlIOCs.packages],
+    hashes: yamlIOCs.hashes.map(h => h.sha256),
+    markers: yamlIOCs.markers.map(m => m.pattern),
+    files: yamlIOCs.files.map(f => f.name)
+  };
+  
+  // Ajouter les IOCs du cache sans doublons
+  for (const pkg of cachedIOCs.packages || []) {
+    if (!merged.packages.find(p => p.name === pkg.name)) {
+      merged.packages.push(pkg);
+    }
+  }
+  
+  for (const hash of cachedIOCs.hashes || []) {
+    if (!merged.hashes.includes(hash)) {
+      merged.hashes.push(hash);
+    }
+  }
+  
+  for (const marker of cachedIOCs.markers || []) {
+    if (!merged.markers.includes(marker)) {
+      merged.markers.push(marker);
+    }
+  }
+  
+  for (const file of cachedIOCs.files || []) {
+    if (!merged.files.includes(file)) {
+      merged.files.push(file);
+    }
+  }
+  
+  return merged;
+}
+
+module.exports = { updateIOCs, loadCachedIOCs };

package/src/ioc/yaml-loader.js

@@ -0,0 +1,96 @@
+const fs = require('fs');
+const path = require('path');
+const yaml = require('js-yaml');
+
+const IOCS_DIR = path.join(__dirname, '../../iocs');
+
+function loadYAMLIOCs() {
+  const iocs = {
+    packages: [],
+    hashes: [],
+    markers: [],
+    files: []
+  };
+
+  // Charger packages.yaml
+  const packagesPath = path.join(IOCS_DIR, 'packages.yaml');
+  if (fs.existsSync(packagesPath)) {
+    try {
+      const data = yaml.load(fs.readFileSync(packagesPath, 'utf8'));
+      if (data && data.packages) {
+        iocs.packages = data.packages.map(p => ({
+          id: p.id,
+          name: p.name,
+          version: p.version,
+          severity: p.severity,
+          confidence: p.confidence,
+          source: p.source,
+          description: p.description,
+          references: p.references || [],
+          mitre: p.mitre
+        }));
+      }
+    } catch (e) {
+      console.error('[WARN] Erreur parsing packages.yaml:', e.message);
+    }
+  }
+
+  // Charger hashes.yaml
+  const hashesPath = path.join(IOCS_DIR, 'hashes.yaml');
+  if (fs.existsSync(hashesPath)) {
+    try {
+      const data = yaml.load(fs.readFileSync(hashesPath, 'utf8'));
+      
+      if (data && data.hashes) {
+        iocs.hashes = data.hashes.map(h => ({
+          id: h.id,
+          sha256: h.sha256,
+          file: h.file,
+          severity: h.severity,
+          confidence: h.confidence,
+          source: h.source,
+          description: h.description,
+          references: h.references || []
+        }));
+      }
+      
+      if (data && data.markers) {
+        iocs.markers = data.markers.map(m => ({
+          id: m.id,
+          pattern: m.pattern,
+          severity: m.severity,
+          confidence: m.confidence,
+          source: m.source,
+          description: m.description
+        }));
+      }
+      
+      if (data && data.files) {
+        iocs.files = data.files.map(f => ({
+          id: f.id,
+          name: f.name,
+          severity: f.severity,
+          confidence: f.confidence,
+          source: f.source,
+          description: f.description
+        }));
+      }
+    } catch (e) {
+      console.error('[WARN] Erreur parsing hashes.yaml:', e.message);
+    }
+  }
+
+  return iocs;
+}
+
+function getIOCStats() {
+  const iocs = loadYAMLIOCs();
+  return {
+    packages: iocs.packages.length,
+    hashes: iocs.hashes.length,
+    markers: iocs.markers.length,
+    files: iocs.files.length
+  };
+}
+
+module.exports = { loadYAMLIOCs, getIOCStats };

package/src/report.js

@@ -0,0 +1,152 @@
+const fs = require('fs');
+const path = require('path');
+
+function generateHTML(results) {
+  const { target, timestamp, threats, summary } = results;
+
+  const threatRows = threats.map(t => `
+    <tr class="${t.severity.toLowerCase()}">
+      <td>${t.severity}</td>
+      <td>${t.type}</td>
+      <td>${t.message}</td>
+      <td>${t.file}</td>
+      <td>${t.playbook}</td>
+    </tr>
+  `).join('');
+
+  return `<!DOCTYPE html>
+<html lang="fr">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>MUAD'DIB - Rapport de scan</title>
+  <style>
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+      background: #1a1a2e;
+      color: #eee;
+      margin: 0;
+      padding: 20px;
+    }
+    .container {
+      max-width: 1200px;
+      margin: 0 auto;
+    }
+    h1 {
+      color: #e94560;
+      border-bottom: 2px solid #e94560;
+      padding-bottom: 10px;
+    }
+    .summary {
+      display: flex;
+      gap: 20px;
+      margin: 20px 0;
+    }
+    .summary-card {
+      background: #16213e;
+      padding: 20px;
+      border-radius: 8px;
+      flex: 1;
+    }
+    .summary-card h3 {
+      margin: 0 0 10px 0;
+      color: #888;
+      font-size: 14px;
+    }
+    .summary-card .value {
+      font-size: 32px;
+      font-weight: bold;
+    }
+    .critical .value { color: #e94560; }
+    .high .value { color: #ff6b35; }
+    .medium .value { color: #f9c74f; }
+    .total .value { color: #4ecdc4; }
+    table {
+      width: 100%;
+      border-collapse: collapse;
+      margin-top: 20px;
+    }
+    th, td {
+      padding: 12px;
+      text-align: left;
+      border-bottom: 1px solid #333;
+    }
+    th {
+      background: #16213e;
+      color: #e94560;
+    }
+    tr.critical { background: rgba(233, 69, 96, 0.2); }
+    tr.high { background: rgba(255, 107, 53, 0.2); }
+    tr.medium { background: rgba(249, 199, 79, 0.1); }
+    .meta {
+      color: #666;
+      font-size: 12px;
+      margin-top: 40px;
+    }
+    .ok {
+      background: #16213e;
+      padding: 40px;
+      border-radius: 8px;
+      text-align: center;
+      color: #4ecdc4;
+      font-size: 24px;
+    }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>MUAD'DIB - Rapport de scan</h1>
+    
+    <div class="summary">
+      <div class="summary-card total">
+        <h3>TOTAL</h3>
+        <div class="value">${summary.total}</div>
+      </div>
+      <div class="summary-card critical">
+        <h3>CRITICAL</h3>
+        <div class="value">${summary.critical}</div>
+      </div>
+      <div class="summary-card high">
+        <h3>HIGH</h3>
+        <div class="value">${summary.high}</div>
+      </div>
+      <div class="summary-card medium">
+        <h3>MEDIUM</h3>
+        <div class="value">${summary.medium}</div>
+      </div>
+    </div>
+
+    ${threats.length > 0 ? `
+    <table>
+      <thead>
+        <tr>
+          <th>Severite</th>
+          <th>Type</th>
+          <th>Message</th>
+          <th>Fichier</th>
+          <th>Recommandation</th>
+        </tr>
+      </thead>
+      <tbody>
+        ${threatRows}
+      </tbody>
+    </table>
+    ` : '<div class="ok">Aucune menace detectee</div>'}
+
+    <div class="meta">
+      <p>Cible: ${target}</p>
+      <p>Date: ${timestamp}</p>
+      <p>Genere par MUAD'DIB</p>
+    </div>
+  </div>
+</body>
+</html>`;
+}
+
+function saveReport(results, outputPath) {
+  const html = generateHTML(results);
+  fs.writeFileSync(outputPath, html);
+  return outputPath;
+}
+
+module.exports = { generateHTML, saveReport };

package/src/response/playbooks.js

@@ -0,0 +1,115 @@
+const PLAYBOOKS = {
+  lifecycle_script: 
+    'Verifier le contenu du script. Desactiver avec "npm config set ignore-scripts true" si suspect.',
+  
+  curl_pipe_sh: 
+    'CRITIQUE: Ne jamais executer. Inspecter l\'URL telechargee. Verifier si deja execute.',
+  
+  wget_pipe_sh:
+    'CRITIQUE: Ne jamais executer. Inspecter l\'URL telechargee. Verifier si deja execute.',
+  
+  eval_usage:
+    'Code dynamique detecte. Verifier la source des donnees evaluees. Risque d\'injection.',
+  
+  child_process:
+    'Execution de commandes systeme. Verifier quelles commandes sont lancees.',
+  
+  child_process_import:
+    'Module child_process importe. Verifier son utilisation dans le code.',
+  
+  npmrc_access:
+    'Acces au fichier .npmrc detecte. Risque de vol de token npm. Regenerer le token.',
+  
+  npmrc_read:
+    'Lecture du .npmrc. Regenerer immediatement: npm token revoke && npm login',
+  
+  github_token_access:
+    'Acces au GITHUB_TOKEN. Verifier les permissions. Regenerer si compromis.',
+  
+  aws_credential_access:
+    'Acces aux credentials AWS. Rotation immediate recommandee via AWS IAM.',
+  
+  sensitive_env_access:
+    'Acces a des variables sensibles. Verifier l\'usage. Rotation des secrets recommandee.',
+  
+  base64_encoding:
+    'Encodage base64 detecte. Souvent utilise pour obfusquer du code malveillant.',
+  
+  base64_decode:
+    'Decodage base64 detecte. Verifier ce qui est decode et execute.',
+  
+  reverse_shell:
+    'CRITIQUE: Reverse shell detecte. Machine potentiellement compromise. Isoler immediatement.',
+  
+  netcat_shell:
+    'CRITIQUE: Shell netcat detecte. Machine potentiellement compromise. Isoler immediatement.',
+  
+  home_deletion:
+    'CRITIQUE: Tentative de suppression du repertoire home. Dead man\'s switch probable.',
+  
+  shred_home:
+    'CRITIQUE: Destruction de donnees detectee. Dead man\'s switch de Shai-Hulud.',
+  
+  curl_exfiltration:
+    'Exfiltration de donnees via curl. Verifier les donnees envoyees et la destination.',
+  
+  ssh_access:
+    'Acces aux cles SSH. Regenerer les cles si compromis: ssh-keygen -t ed25519',
+  
+  ssh_key_read:
+    'Lecture des cles SSH. Regenerer immediatement toutes les cles.',
+  
+  github_api_call:
+    'Appel a l\'API GitHub. Verifier le contexte. Peut etre legitime ou exfiltration.',
+  
+  exec_curl:
+    'Execution de curl via child_process. Verifier l\'URL et les donnees.',
+  
+  exec_wget:
+    'Execution de wget via child_process. Verifier l\'URL et les donnees.',
+  
+  wget_chmod_exec:
+    'Telechargement et execution de binaire. Ne pas executer. Analyser le fichier.',
+
+  known_malicious_package:
+    'CRITIQUE: Supprimer immediatement. rm -rf node_modules && npm cache clean --force && npm install',
+
+  lifecycle_script_dependency:
+    'Verifier le contenu du script dans le package. Reinstaller avec --ignore-scripts si suspect.',
+
+  suspicious_file:
+    'Fichier typique de Shai-Hulud. Ne pas executer. Verifier le hash contre les IOCs connus.',
+
+  obfuscation_detected:
+    'Code volontairement obscurci. Analyser dans un environnement isole. Probable malware.',
+
+  dangerous_call_eval:
+    'Appel eval() detecte. Verifier la source des donnees. Risque d\'execution de code arbitraire.',
+
+  dangerous_call_exec:
+    'Execution de commande systeme. Verifier les arguments passes.',
+
+  dangerous_call_spawn:
+    'Spawn de processus detecte. Verifier la commande executee.',
+
+  sensitive_string:
+    'Reference a un chemin ou identifiant sensible. Verifier le contexte d\'utilisation.',
+
+  env_access:
+    'Acces a une variable d\'environnement sensible. Verifier si les donnees sont exfiltrees.',
+
+  shai_hulud_marker:
+    'CRITIQUE: Marqueur Shai-Hulud detecte. Package compromis. Supprimer immediatement et regenerer tous les tokens.',
+
+  known_malicious_hash:
+    'CRITIQUE: Fichier malveillant confirme par hash. Supprimer immediatement. Considerer la machine compromise.',
+
+  suspicious_dataflow:
+    'CRITIQUE: Code lit des credentials et les envoie sur le reseau. Exfiltration probable. Isoler la machine, regenerer tous les secrets.',
+};
+
+function getPlaybook(threatType) {
+  return PLAYBOOKS[threatType] || 'Analyser manuellement cette menace.';
+}
+
+module.exports = { getPlaybook, PLAYBOOKS };