muaddib-scanner 1.0.21 → 1.1.0

package/bin/muaddib.js

@@ -1,15 +1,16 @@
-#!/usr/bin/env node
-
+#!/usr/bin/env node
 const { run } = require('../src/index.js');
 const { updateIOCs } = require('../src/ioc/updater.js');
 const { watch } = require('../src/watch.js');
 const { startDaemon } = require('../src/daemon.js');
 const { runScraper } = require('../src/ioc/scraper.js');
+const { safeInstall } = require('../src/safe-install.js');
 
 const args = process.argv.slice(2);
 const command = args[0];
 const options = args.slice(1);
 
+// Parse options
 let target = '.';
 let jsonOutput = false;
 let htmlOutput = null;
@@ -43,35 +44,133 @@ for (let i = 0; i < options.length; i++) {
   }
 }
 
-if (!command) {
+// Menu interactif si pas de commande
+async function interactiveMenu() {
+  const { select, input, confirm } = await import('@inquirer/prompts');
+  
   console.log(`
+  ╔══════════════════════════════════════════╗
+  ║   MUAD'DIB - npm Supply Chain Hunter     ║
+  ║   "The worms must die."                  ║
+  ╚══════════════════════════════════════════╝
+  `);
+
+  const action = await select({
+    message: 'Que veux-tu faire ?',
+    choices: [
+      { name: 'Scanner un projet', value: 'scan' },
+      { name: 'Scanner avec mode paranoid', value: 'scan-paranoid' },
+      { name: 'Surveiller un projet (watch)', value: 'watch' },
+      { name: 'Lancer le daemon', value: 'daemon' },
+      { name: 'Mettre a jour les IOCs', value: 'update' },
+      { name: 'Scraper nouveaux IOCs', value: 'scrape' },
+      { name: 'Quitter', value: 'quit' }
+    ]
+  });
+
+  if (action === 'quit') {
+    console.log('Bye!');
+    process.exit(0);
+  }
+
+  if (action === 'scan' || action === 'scan-paranoid') {
+    const path = await input({
+      message: 'Chemin du projet :',
+      default: '.'
+    });
+
+    const outputFormat = await select({
+      message: 'Format de sortie :',
+      choices: [
+        { name: 'Console (defaut)', value: 'console' },
+        { name: 'JSON', value: 'json' },
+        { name: 'HTML', value: 'html' },
+        { name: 'SARIF (GitHub Security)', value: 'sarif' }
+      ]
+    });
+
+    const opts = {
+      json: outputFormat === 'json',
+      html: outputFormat === 'html' ? 'muaddib-report.html' : null,
+      sarif: outputFormat === 'sarif' ? 'muaddib-results.sarif' : null,
+      explain: true,
+      failLevel: 'high',
+      paranoid: action === 'scan-paranoid'
+    };
+
+    const exitCode = await run(path, opts);
+    process.exit(exitCode);
+  }
+
+  if (action === 'watch') {
+    const path = await input({
+      message: 'Chemin du projet :',
+      default: '.'
+    });
+    watch(path);
+  }
+
+  if (action === 'daemon') {
+    const useWebhook = await confirm({
+      message: 'Configurer un webhook Discord/Slack ?',
+      default: false
+    });
+
+    let webhook = null;
+    if (useWebhook) {
+      webhook = await input({
+        message: 'URL du webhook :'
+      });
+    }
+    startDaemon({ webhook });
+  }
+
+  if (action === 'update') {
+    await updateIOCs();
+    process.exit(0);
+  }
+
+  if (action === 'scrape') {
+    const result = await runScraper();
+    console.log(`[OK] ${result.added} nouveaux IOCs (total: ${result.total})`);
+    process.exit(0);
+  }
+}
+
+// Main
+if (!command || command === '--help' || command === '-h') {
+  if (command === '--help' || command === '-h') {
+    console.log(`
   MUAD'DIB - npm Supply Chain Threat Hunter
   
   Usage:
-    muaddib scan [path] [options]    Scan a project
-    muaddib watch [path]             Watch a project in real-time
-    muaddib daemon [options]         Start background daemon
-    muaddib update                   Update IOCs
-    muaddib scrape                   Scrape new IOCs from advisories
-    muaddib help                     Show help
-  
+    muaddib                          Mode interactif
+    muaddib scan [path] [options]    Scanner un projet
+    muaddib watch [path]             Surveiller en temps reel
+    muaddib daemon [options]         Lancer le daemon
+    muaddib update                   Mettre a jour les IOCs
+    muaddib scrape                   Scraper nouveaux IOCs
+    muaddib install <pkg>            Installer apres scan (safe)
+    
   Options:
-    --json              Output as JSON
-    --html [file]       Generate HTML report
-    --sarif [file]      Generate SARIF report (GitHub Security)
-    --explain           Show detailed explanations
-    --fail-on [level]   Severity level for exit code (critical|high|medium|low)
-                        Default: high (fail on HIGH and CRITICAL)
-    --webhook [url]     Send Discord/Slack alert
-    --paranoid          Enable ultra-strict rules (more false positives)
-  `);
-  process.exit(0);
-}
-
-if (command === 'scan') {
-  run(target, { 
-    json: jsonOutput, 
-    html: htmlOutput, 
+    --json              Sortie JSON
+    --html [file]       Rapport HTML
+    --sarif [file]      Rapport SARIF (GitHub Security)
+    --explain           Explications detaillees
+    --fail-on [level]   Niveau d'echec (critical|high|medium|low)
+    --webhook [url]     Webhook Discord/Slack
+    --paranoid          Mode ultra-strict
+    `);
+    process.exit(0);
+  }
+  interactiveMenu().catch(err => {
+    console.error('[ERROR]', err.message);
+    process.exit(1);
+  });
+} else if (command === 'scan') {
+  run(target, {
+    json: jsonOutput,
+    html: htmlOutput,
     sarif: sarifOutput,
     explain: explainMode,
     failLevel: failLevel,
@@ -91,7 +190,7 @@ if (command === 'scan') {
   });
 } else if (command === 'scrape') {
   runScraper().then(result => {
-    console.log(`[OK] ${result.added} new IOCs added (total: ${result.total})`);
+    console.log(`[OK] ${result.added} nouveaux IOCs (total: ${result.total})`);
     process.exit(0);
   }).catch(err => {
     console.error('[ERROR]', err.message);
@@ -99,13 +198,50 @@ if (command === 'scan') {
   });
 } else if (command === 'daemon') {
   startDaemon({ webhook: webhookUrl });
+} else if (command === 'install' || command === 'i') {
+  const packages = options.filter(o => !o.startsWith('-'));
+  const isDev = options.includes('--save-dev') || options.includes('-D');
+  const isGlobal = options.includes('-g') || options.includes('--global');
+  const force = options.includes('--force');
+  
+  if (packages.length === 0) {
+    console.log('Usage: muaddib install <package> [<package>...] [--save-dev] [-g] [--force]');
+    process.exit(1);
+  }
+  
+  safeInstall(packages, { isDev, isGlobal, force }).then(result => {
+    if (result.blocked && !force) {
+      process.exit(1);
+    }
+    process.exit(0);
+  }).catch(err => {
+    console.error('[ERROR]', err.message);
+    process.exit(1);
+  });  
 } else if (command === 'help') {
-  console.log('muaddib scan [path] [--json] [--html file] [--sarif file] [--explain] [--fail-on level] [--webhook url] [--paranoid]');
-  console.log('muaddib watch [path] - Watch a project in real-time');
-  console.log('muaddib daemon [--webhook url] - Start background daemon');
-  console.log('muaddib update - Update IOCs');
-  console.log('muaddib scrape - Scrape new IOCs');
+  console.log(`
+  MUAD'DIB - npm Supply Chain Threat Hunter
+  
+  Usage:
+    muaddib                          Mode interactif
+    muaddib scan [path] [options]    Scanner un projet
+    muaddib watch [path]             Surveiller en temps reel
+    muaddib daemon [options]         Lancer le daemon
+    muaddib update                   Mettre a jour les IOCs
+    muaddib scrape                   Scraper nouveaux IOCs
+    
+  Options:
+    --json              Sortie JSON
+    --html [file]       Rapport HTML
+    --sarif [file]      Rapport SARIF (GitHub Security)
+    --explain           Explications detaillees
+    --fail-on [level]   Niveau d'echec (critical|high|medium|low)
+    --webhook [url]     Webhook Discord/Slack
+    --paranoid          Mode ultra-strict
+  `);
+  process.exit(0);
 } else {
-  console.log(`Unknown command: ${command}`);
+  console.log(`Commande inconnue: ${command}`);
+  console.log('Tape "muaddib help" pour voir les commandes.');
   process.exit(1);
 }

package/data/iocs.json

@@ -1,6 +1,6 @@
 {
   "version": "1.1.0",
-  "updated": "2026-01-08T14:00:38.388Z",
+  "updated": "2026-01-08T21:13:53.854Z",
   "description": "IOCs communautaires MUAD'DIB - Contribuez via PR",
   "packages": [
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "1.0.21",
+  "version": "1.1.0",
   "description": "Supply-chain threat detection & response for npm",
   "main": "src/index.js",
   "bin": {
@@ -36,9 +36,15 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
+    "@inquirer/prompts": "^8.1.0",
+    "@vietmoney/react-big-calendar": "^0.0.1-security",
     "acorn": "^8.14.0",
     "acorn-walk": "^8.3.4",
+    "chalk": "^5.6.2",
+    "express": "^5.2.1",
+    "is-odd": "^3.0.1",
     "js-yaml": "^4.1.0",
-    "lodash": "^4.17.21"
+    "lodash": "^4.17.21",
+    "yargs": "^18.0.0"
   }
 }

package/src/safe-install.js

@@ -0,0 +1,163 @@
+const { execSync } = require('child_process');
+const path = require('path');
+const fs = require('fs');
+const { loadCachedIOCs } = require('./ioc/updater.js');
+
+// Packages connus sûrs qui utilisent des patterns "suspects" légitimement
+const TRUSTED_PACKAGES = [
+  'lodash', 'underscore', 'express', 'react', 'vue', 'angular',
+  'webpack', 'babel', 'typescript', 'esbuild', 'vite', 'rollup',
+  'jest', 'mocha', 'chai', 'sharp', 'bcrypt', 'argon2'
+];
+
+// Cache pour eviter de scanner deux fois le meme package
+const scannedPackages = new Set();
+
+// Verifier si un package est dans les IOCs
+function checkIOCs(pkg, pkgName) {
+  try {
+    const iocs = loadCachedIOCs();
+    return iocs.packages?.find(p => p.name === pkg || p.name === pkgName);
+  } catch (e) {
+    return null;
+  }
+}
+
+// Scanner un package et ses dependances recursivement
+async function scanPackageRecursive(pkg, depth = 0, maxDepth = 3) {
+  const indent = '  '.repeat(depth);
+  const pkgName = pkg.replace(/^@[^/]+\//, '').split('@')[0];
+  
+  // Eviter les boucles infinies
+  if (scannedPackages.has(pkg) || scannedPackages.has(pkgName)) {
+    return { safe: true };
+  }
+  scannedPackages.add(pkg);
+  scannedPackages.add(pkgName);
+  
+  // Skip trusted packages
+  if (TRUSTED_PACKAGES.includes(pkgName)) {
+    if (depth === 0) console.log(`[OK] ${pkg} - Package de confiance`);
+    return { safe: true };
+  }
+  
+  // Limiter la profondeur
+  if (depth > maxDepth) {
+    return { safe: true };
+  }
+  
+  if (depth === 0) {
+    console.log(`[*] Analyse de ${pkg}...`);
+  } else {
+    console.log(`${indent}[*] Dependance: ${pkg}`);
+  }
+  
+  // Verifier IOCs
+  const malicious = checkIOCs(pkg, pkgName);
+  if (malicious) {
+    return {
+      safe: false,
+      package: pkg,
+      reason: 'known_malicious',
+      source: malicious.source || 'IOC Database',
+      description: malicious.description || 'Package malveillant connu',
+      depth
+    };
+  }
+  
+  // Recuperer les infos du package
+  let pkgInfo;
+  try {
+    const infoRaw = execSync(`npm view ${pkg} --json 2>nul`, { encoding: 'utf8' });
+    pkgInfo = JSON.parse(infoRaw);
+  } catch (e) {
+    if (depth === 0) console.log(`[!] Package ${pkg} introuvable sur npm`);
+    return { safe: true };
+  }
+  
+  // Scanner les dependances
+  const dependencies = pkgInfo.dependencies || {};
+  const depNames = Object.keys(dependencies);
+  
+  if (depNames.length > 0 && depth < maxDepth) {
+    for (const depName of depNames) {
+      const depVersion = dependencies[depName];
+      const depPkg = depName; // On check juste le nom, pas la version specifique
+      
+      const result = await scanPackageRecursive(depPkg, depth + 1, maxDepth);
+      if (!result.safe) {
+        return result;
+      }
+    }
+  }
+  
+  if (depth === 0) {
+    console.log(`[OK] ${pkg} - Aucune menace (${depNames.length} dependances scannees)`);
+  }
+  
+  return { safe: true };
+}
+
+async function safeInstall(packages, options = {}) {
+  const { isDev, isGlobal, force } = options;
+  
+  console.log(`
+╔══════════════════════════════════════════╗
+║   MUAD'DIB Safe Install                  ║
+║   Scanning packages + dependencies...    ║
+╚══════════════════════════════════════════╝
+`);
+
+  // Reset le cache pour chaque install
+  scannedPackages.clear();
+  
+  try {
+    for (const pkg of packages) {
+      const result = await scanPackageRecursive(pkg);
+      
+      if (!result.safe) {
+        console.log(`
+╔══════════════════════════════════════════╗
+║   [!] PACKAGE MALVEILLANT DETECTE        ║
+╚══════════════════════════════════════════╝
+`);
+        if (result.depth > 0) {
+          console.log(`Package demande: ${pkg}`);
+          console.log(`Dependance malveillante: ${result.package} (profondeur: ${result.depth})`);
+        } else {
+          console.log(`Package: ${result.package}`);
+        }
+        console.log(`Source: ${result.source}`);
+        console.log(`Raison: ${result.description}`);
+        console.log('');
+        
+        if (!force) {
+          console.log('[!] Installation BLOQUEE.');
+          return { blocked: true, package: result.package, threats: [{ type: 'known_malicious', severity: 'CRITICAL', message: result.description }] };
+        } else {
+          console.log('[!] --force active, installation malgre les menaces...');
+        }
+      }
+    }
+
+    // Tout est clean, installer pour de vrai
+    console.log('');
+    console.log('[*] Installation en cours...');
+    
+    let cmd = `npm install ${packages.join(' ')}`;
+    if (isDev) cmd += ' --save-dev';
+    if (isGlobal) cmd += ' -g';
+    
+    execSync(cmd, { stdio: 'inherit' });
+    
+    console.log('');
+    console.log('[OK] Installation terminee.');
+    
+    return { blocked: false };
+
+  } catch (e) {
+    throw e;
+  }
+}
+
+module.exports = { safeInstall };