muaddib-scanner 1.0.19 → 1.0.20

package/.muaddib-cache/iocs.json

@@ -12037,6 +12037,9 @@
     "node-gyp.dll",
     "bun_installer.js",
     "environment_source.js",
+    "cl0vd.json",
+    "pigS3cr3ts.json",
+    "actionsSecrets.json",
     "3nvir0nm3nt.json",
     "c9nt3nts.json",
     "c0nt3nts.json",
@@ -12046,5 +12049,5 @@
     "discord-webhook.js",
     "inject.js"
   ],
-  "updated": "2026-01-08T15:51:22.567Z"
+  "updated": "2026-01-08T19:41:50.038Z"
 }

package/iocs/builtin.yaml

@@ -101,6 +101,9 @@ files:
   # Shai-Hulud v3 (nouveaux noms)
   - bun_installer.js
   - environment_source.js
+  - cl0vd.json
+  - pigS3cr3ts.json
+  - actionsSecrets.json
   # Artefacts exfiltration v3
   - 3nvir0nm3nt.json
   - c9nt3nts.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "1.0.19",
+  "version": "1.0.20",
   "description": "Supply-chain threat detection & response for npm",
   "main": "src/index.js",
   "bin": {

package/src/scanner/package.js

@@ -1,5 +1,6 @@
 const fs = require('fs');
 const path = require('path');
+const { loadCachedIOCs } = require('../ioc/updater.js');
 
 const SUSPICIOUS_SCRIPTS = [
   'preinstall',
@@ -23,13 +24,14 @@ async function scanPackageJson(targetPath) {
   const threats = [];
   const pkgPath = path.join(targetPath, 'package.json');
 
-if (!fs.existsSync(pkgPath)) {
+  if (!fs.existsSync(pkgPath)) {
     return threats;
   }
 
   const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
   const scripts = pkg.scripts || {};
 
+  // Scan lifecycle scripts
   for (const scriptName of SUSPICIOUS_SCRIPTS) {
     if (scripts[scriptName]) {
       const scriptContent = scripts[scriptName];
@@ -54,6 +56,34 @@ if (!fs.existsSync(pkgPath)) {
     }
   }
 
+  // Scan declared dependencies against IOCs
+  const iocs = loadCachedIOCs();
+  const allDeps = {
+    ...pkg.dependencies,
+    ...pkg.devDependencies,
+    ...pkg.optionalDependencies,
+    ...pkg.peerDependencies
+  };
+
+  for (const [depName, depVersion] of Object.entries(allDeps)) {
+    const malicious = iocs.packages.find(p => {
+      if (p.name !== depName) return false;
+      if (p.version === '*' || p.version === depVersion) return true;
+      // Check if declared version matches malicious version
+      if (depVersion.includes(p.version)) return true;
+      return false;
+    });
+
+    if (malicious) {
+      threats.push({
+        type: 'known_malicious_package',
+        severity: 'CRITICAL',
+        message: `Dependance malveillante declaree: ${depName}@${depVersion} (source: ${malicious.source || 'IOC'})`,
+        file: 'package.json'
+      });
+    }
+  }
+
   return threats;
 }