muaddib-scanner 1.6.8 → 1.6.10

package/README.fr.md

@@ -202,10 +202,12 @@ muaddib sandbox <nom-package>
 muaddib sandbox <nom-package> --strict
 ```
 
-Analyse un package dans un container Docker isolé. Capture :
-- Connexions réseau (détecte exfiltration vers hosts suspects)
-- Accès fichiers (détecte vol credentials : .npmrc, .ssh, .aws, .env)
-- Spawn de processus (détecte reverse shells, abus curl/wget)
+Analyse un package dans un container Docker isolé avec monitoring multi-couches :
+- **Traçage système** (strace) : accès fichiers, spawn de processus, monitoring syscalls
+- **Capture réseau** (tcpdump) : résolutions DNS avec IPs résolues, requêtes HTTP (méthode, host, path, body), détection TLS SNI
+- **Diff filesystem** : snapshot avant/après install, détecte les fichiers créés dans des emplacements suspects
+- **Détection exfiltration de données** : 16 patterns sensibles (tokens, credentials, clés SSH, clés privées, .env)
+- **Moteur de scoring** : score de risque 0-100 basé sur la sévérité des comportements
 
 Utilisez `--strict` pour bloquer tout trafic réseau sortant non essentiel via iptables.
 

package/README.md

@@ -202,10 +202,12 @@ muaddib sandbox <package-name>
 muaddib sandbox <package-name> --strict
 ```
 
-Analyzes a package in an isolated Docker container. Captures:
-- Network connections (detects exfiltration to suspicious hosts)
-- File access (detects credential theft: .npmrc, .ssh, .aws, .env)
-- Process spawns (detects reverse shells, curl/wget abuse)
+Analyzes a package in an isolated Docker container with multi-layer monitoring:
+- **System tracing** (strace): file access, process spawns, syscall monitoring
+- **Network capture** (tcpdump): DNS resolutions with resolved IPs, HTTP requests (method, host, path, body), TLS SNI detection
+- **Filesystem diff**: snapshot before/after install, detects files created in suspicious locations
+- **Data exfiltration detection**: 16 sensitive patterns (tokens, credentials, SSH keys, private keys, .env)
+- **Scoring engine**: 0-100 risk score based on behavioral severity
 
 Use `--strict` to block all non-essential outbound network traffic via iptables.
 

package/bin/muaddib.js

@@ -1,5 +1,5 @@
-#!/usr/bin/env node
-const { execSync } = require('child_process');
+#!/usr/bin/env node
+const { exec } = require('child_process');
 const { run } = require('../src/index.js');
 const { updateIOCs } = require('../src/ioc/updater.js');
 const { watch } = require('../src/watch.js');
@@ -23,15 +23,28 @@ let explainMode = false;
 let failLevel = 'high';
 let webhookUrl = null;
 let paranoidMode = false;
+let excludeDirs = [];
 
 for (let i = 0; i < options.length; i++) {
   if (options[i] === '--json') {
     jsonOutput = true;
   } else if (options[i] === '--html') {
-    htmlOutput = options[i + 1] || 'muaddib-report.html';
+    const htmlPath = options[i + 1] || 'muaddib-report.html';
+    // CLI-001: Block path traversal
+    if (htmlPath.includes('..')) {
+      console.error('[ERROR] --html path must not contain path traversal (..)');
+      process.exit(1);
+    }
+    htmlOutput = htmlPath;
     i++;
   } else if (options[i] === '--sarif') {
-    sarifOutput = options[i + 1] || 'muaddib-results.sarif';
+    const sarifPath = options[i + 1] || 'muaddib-results.sarif';
+    // CLI-001: Block path traversal
+    if (sarifPath.includes('..')) {
+      console.error('[ERROR] --sarif path must not contain path traversal (..)');
+      process.exit(1);
+    }
+    sarifOutput = sarifPath;
     i++;
   } else if (options[i] === '--explain') {
     explainMode = true;
@@ -39,8 +52,32 @@ for (let i = 0; i < options.length; i++) {
     failLevel = options[i + 1] || 'high';
     i++;
   } else if (options[i] === '--webhook') {
-    webhookUrl = options[i + 1];
+    const rawUrl = options[i + 1];
+    // CLI-002: Validate webhook URL (HTTPS only, no private IPs)
+    if (rawUrl) {
+      try {
+        const parsed = new URL(rawUrl);
+        if (parsed.protocol !== 'https:') {
+          console.error('[ERROR] --webhook URL must use HTTPS');
+          process.exit(1);
+        }
+        const host = parsed.hostname.toLowerCase();
+        if (/^(127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|0\.|169\.254\.|localhost$|::1$)/.test(host)) {
+          console.error('[ERROR] --webhook URL must not point to a private/local address');
+          process.exit(1);
+        }
+      } catch {
+        console.error('[ERROR] --webhook URL is invalid');
+        process.exit(1);
+      }
+    }
+    webhookUrl = rawUrl;
     i++;
+  } else if (options[i] === '--exclude') {
+    if (options[i + 1] && !options[i + 1].startsWith('-')) {
+      excludeDirs.push(options[i + 1]);
+      i++;
+    }
   } else if (options[i] === '--paranoid') {
     paranoidMode = true;
   } else if (options[i] === '--strict') {
@@ -50,17 +87,20 @@ for (let i = 0; i < options.length; i++) {
   }
 }
 
-// Version check (non-blocking, skip for machine-readable output)
+// Version check (truly non-blocking, skip for machine-readable output)
 if (!jsonOutput && !sarifOutput) {
   try {
     const currentVersion = require('../package.json').version;
-    const latest = execSync('npm view muaddib-scanner version', { timeout: 5000 }).toString().trim();
-    if (latest !== currentVersion) {
-      console.log(`\n[UPDATE] New version available: ${currentVersion} -> ${latest}`);
-      console.log(`  Run: npm install -g muaddib-scanner@latest\n`);
-    }
+    exec('npm view muaddib-scanner version', { timeout: 5000 }, (err, stdout) => {
+      if (err) return; // No network or npm unavailable
+      const latest = (stdout || '').toString().trim();
+      if (latest && latest !== currentVersion) {
+        console.log(`\n[UPDATE] New version available: ${currentVersion} -> ${latest}`);
+        console.log(`  Run: npm install -g muaddib-scanner@latest\n`);
+      }
+    });
   } catch {
-    // No network or npm unavailable, skip silently
+    // Skip silently
   }
 }
 
@@ -273,6 +313,7 @@ const helpText = `
     --fail-on [level]   Fail level (critical|high|medium|low)
     --webhook [url]     Discord/Slack webhook
     --paranoid          Ultra-strict mode
+    --exclude [dir]     Exclude directory from scan (repeatable)
     --save-dev, -D      Install as dev dependency
     -g, --global        Install globally
     --force             Force install despite threats
@@ -300,9 +341,13 @@ if (command === 'version' || command === '--version' || command === '-v') {
     explain: explainMode,
     failLevel: failLevel,
     webhook: webhookUrl,
-    paranoid: paranoidMode
+    paranoid: paranoidMode,
+    exclude: excludeDirs
   }).then(exitCode => {
     process.exit(exitCode);
+  }).catch(err => {
+    console.error('[ERROR]', err.message);
+    process.exit(1);
   });
 } else if (command === 'watch') {
   watch(target);
@@ -436,7 +481,7 @@ if (command === 'version' || command === '--version' || command === '-v') {
   console.log(helpText);
   process.exit(0);
 } else {
-  console.log(`Unknown command: ${command}`);
+  console.log(`Unknown command: ${String(command).replace(/[\x00-\x1f\x7f-\x9f]/g, '')}`);
   console.log('Type "muaddib help" to see available commands.');
   process.exit(1);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "1.6.8",
+  "version": "1.6.10",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {
@@ -52,7 +52,7 @@
   },
   "devDependencies": {
     "@eslint/js": "9.39.2",
-    "eslint": "9.39.2",
+    "eslint": "10.0.0",
     "eslint-plugin-security": "^3.0.1",
     "globals": "17.3.0"
   }

package/src/daemon.js

@@ -3,11 +3,9 @@ const path = require('path');
 const { run } = require('./index.js');
 
 let webhookUrl = null;
-let isRunning = false;
 
 async function startDaemon(options = {}) {
   webhookUrl = options.webhook || null;
-  isRunning = true;
 
   console.log(`
 ╔════════════════════════════════════════════╗
@@ -33,9 +31,8 @@ async function startDaemon(options = {}) {
 
   // Keep process alive until SIGINT
   await new Promise((resolve) => {
-    process.on('SIGINT', () => {
+    process.once('SIGINT', () => {
       console.log('\n[DAEMON] Arret...');
-      isRunning = false;
       cleanup();
       resolve();
     });
@@ -70,6 +67,10 @@ function watchDirectory(dir) {
   }
 
   // Surveille la creation de node_modules
+  if (process.platform === 'linux') {
+    console.log('[DAEMON] Note: recursive fs.watch may not work on Linux');
+  }
+
   const dirWatcher = fs.watch(dir, (eventType, filename) => {
     if (filename === 'node_modules' && eventType === 'rename') {
       const nmPath = path.join(dir, 'node_modules');
@@ -83,6 +84,9 @@ function watchDirectory(dir) {
       triggerScan(dir);
     }
   });
+  dirWatcher.on('error', (err) => {
+    console.log(`[DAEMON] Watcher error on ${dir}: ${err.message}`);
+  });
   watchers.push(dirWatcher);
 
   return watchers;
@@ -96,7 +100,7 @@ function watchFile(filePath, projectDir) {
     return null; // File deleted between existsSync and statSync
   }
 
-  return fs.watch(filePath, (eventType) => {
+  const watcher = fs.watch(filePath, (eventType) => {
     if (eventType === 'change') {
       try {
         const currentMtime = fs.statSync(filePath).mtime.getTime();
@@ -110,36 +114,52 @@ function watchFile(filePath, projectDir) {
       }
     }
   });
+  watcher.on('error', (err) => {
+    console.log(`[DAEMON] Watcher error on ${filePath}: ${err.message}`);
+  });
+  return watcher;
 }
 
 function watchNodeModules(nodeModulesPath, projectDir) {
-  return fs.watch(nodeModulesPath, { recursive: true }, (eventType, filename) => {
+  const watcher = fs.watch(nodeModulesPath, { recursive: true }, (eventType, filename) => {
     if (filename && filename.includes('package.json')) {
       console.log(`[DAEMON] Nouveau package detecte: ${filename}`);
       triggerScan(projectDir);
     }
   });
+  watcher.on('error', (err) => {
+    console.log(`[DAEMON] Watcher error on ${nodeModulesPath}: ${err.message}`);
+  });
+  return watcher;
 }
 
-let scanTimeout = null;
-let lastScanTime = 0;
+// Per-directory scan state to prevent cross-directory scan suppression
+const scanState = new Map();
+
+function getScanState(dir) {
+  if (!scanState.has(dir)) {
+    scanState.set(dir, { timeout: null, lastScanTime: 0 });
+  }
+  return scanState.get(dir);
+}
 
 function triggerScan(dir) {
   const now = Date.now();
-  
+  const state = getScanState(dir);
+
   // Debounce: attend 3 secondes avant de scanner
-  if (scanTimeout) {
-    clearTimeout(scanTimeout);
+  if (state.timeout) {
+    clearTimeout(state.timeout);
   }
 
   // Evite les scans trop frequents (minimum 10 secondes entre chaque)
-  if (now - lastScanTime < 10000) {
-    scanTimeout = setTimeout(() => triggerScan(dir), 10000 - (now - lastScanTime));
+  if (now - state.lastScanTime < 10000) {
+    state.timeout = setTimeout(() => triggerScan(dir), 10000 - (now - state.lastScanTime));
     return;
   }
 
-  scanTimeout = setTimeout(async () => {
-    lastScanTime = Date.now();
+  state.timeout = setTimeout(async () => {
+    state.lastScanTime = Date.now();
     console.log(`\n[DAEMON] ========== SCAN AUTOMATIQUE ==========`);
     console.log(`[DAEMON] Cible: ${dir}`);
     console.log(`[DAEMON] Heure: ${new Date().toLocaleTimeString()}\n`);

package/src/diff.js

@@ -1,24 +1,24 @@
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 const { run } = require('./index.js');
 const path = require('path');
 const fs = require('fs');
 const os = require('os');
 
 // Only allow safe characters in git refs (prevents command injection)
-const SAFE_REF_REGEX = /^[a-zA-Z0-9._\-/~^@{}:]+$/;
+const SAFE_REF_REGEX = /^[a-zA-Z0-9._\-/~^@{}]+$/;
 
 /**
  * Get the list of commits/tags for comparison suggestions
  */
 function getRecentRefs(targetPath, limit = 10) {
   try {
-    const tags = execSync('git tag --sort=-creatordate', {
+    const tags = execFileSync('git', ['tag', '--sort=-creatordate'], {
       cwd: targetPath,
       encoding: 'utf8',
       stdio: ['pipe', 'pipe', 'pipe']
     }).trim().split('\n').filter(Boolean).slice(0, 5);
 
-    const commits = execSync(`git log --oneline -${limit}`, {
+    const commits = execFileSync('git', ['log', '--oneline', `-${Number(limit) || 10}`], {
       cwd: targetPath,
       encoding: 'utf8',
       stdio: ['pipe', 'pipe', 'pipe']
@@ -35,7 +35,7 @@ function getRecentRefs(targetPath, limit = 10) {
  */
 function isGitRepo(targetPath) {
   try {
-    execSync('git rev-parse --git-dir', {
+    execFileSync('git', ['rev-parse', '--git-dir'], {
       cwd: targetPath,
       stdio: ['pipe', 'pipe', 'pipe']
     });
@@ -50,7 +50,7 @@ function isGitRepo(targetPath) {
  */
 function getCurrentCommit(targetPath) {
   try {
-    return execSync('git rev-parse HEAD', {
+    return execFileSync('git', ['rev-parse', 'HEAD'], {
       cwd: targetPath,
       encoding: 'utf8',
       stdio: ['pipe', 'pipe', 'pipe']
@@ -68,7 +68,7 @@ function resolveRef(targetPath, ref) {
     return null;
   }
   try {
-    return execSync(`git rev-parse ${ref}`, {
+    return execFileSync('git', ['rev-parse', ref], {
       cwd: targetPath,
       encoding: 'utf8',
       stdio: ['pipe', 'pipe', 'pipe']
@@ -83,7 +83,7 @@ function resolveRef(targetPath, ref) {
  */
 function hasUncommittedChanges(targetPath) {
   try {
-    const status = execSync('git status --porcelain', {
+    const status = execFileSync('git', ['status', '--porcelain'], {
       cwd: targetPath,
       encoding: 'utf8',
       stdio: ['pipe', 'pipe', 'pipe']
@@ -106,13 +106,13 @@ function createTempCopyAtCommit(targetPath, commitHash) {
   const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'muaddib-diff-'));
 
   try {
-    // Clone the repo to temp directory (use -- to separate paths from options)
-    execSync(`git clone --quiet -- "${targetPath}" "${tempDir}"`, {
+    // Clone the repo to temp directory (use execFileSync to prevent injection)
+    execFileSync('git', ['clone', '--quiet', '--', targetPath, tempDir], {
       stdio: ['pipe', 'pipe', 'pipe']
     });
 
     // Checkout the specific commit
-    execSync(`git checkout --quiet ${commitHash}`, {
+    execFileSync('git', ['checkout', '--quiet', commitHash], {
       cwd: tempDir,
       stdio: ['pipe', 'pipe', 'pipe']
     });
@@ -122,7 +122,7 @@ function createTempCopyAtCommit(targetPath, commitHash) {
     const packageJsonPath = path.join(tempDir, 'package.json');
     if (fs.existsSync(packageJsonPath)) {
       try {
-        execSync('npm install --quiet --no-audit --no-fund --ignore-scripts', {
+        execFileSync('npm', ['install', '--quiet', '--no-audit', '--no-fund', '--ignore-scripts'], {
           cwd: tempDir,
           stdio: ['pipe', 'pipe', 'pipe'],
           timeout: 60000
@@ -204,21 +204,11 @@ function compareThreats(oldThreats, newThreats) {
  * Run scan and capture results (without console output)
  */
 async function runSilentScan(targetPath, options = {}) {
-  const originalLog = console.log;
-  const logs = [];
-  try {
-    console.log = (...args) => logs.push(args.join(' '));
-    await run(targetPath, { ...options, json: true });
-  } finally {
-    console.log = originalLog;
-  }
-
-  const jsonOutput = logs.join('\n');
-  try {
-    return JSON.parse(jsonOutput);
-  } catch {
-    return { threats: [], summary: { total: 0 } };
+  const result = await run(targetPath, { ...options, _capture: true });
+  if (result && typeof result === 'object' && result.threats) {
+    return result;
   }
+  return { threats: [], summary: { total: 0 } };
 }
 
 /**

package/src/hooks-init.js

@@ -1,4 +1,4 @@
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 
@@ -29,10 +29,16 @@ function detectHookSystem(targetPath) {
 /**
  * Initialize hooks for a project
  */
+const VALID_MODES = ['scan', 'diff'];
+const HOOK_COMMANDS = {
+  scan: 'npx muaddib scan . --fail-on high',
+  diff: 'npx muaddib diff HEAD --fail-on high'
+};
+
 async function initHooks(targetPath, options = {}) {
   const resolvedPath = path.resolve(targetPath);
   const hookType = options.type || 'auto';
-  const mode = options.mode || 'scan'; // 'scan' or 'diff'
+  const mode = VALID_MODES.includes(options.mode) ? options.mode : 'scan';
 
   console.log('\n[MUADDIB] Initializing git hooks...\n');
 
@@ -92,9 +98,10 @@ async function initHusky(targetPath, mode) {
   if (!fs.existsSync(huskyDir)) {
     console.log('[INFO] Husky not detected. Installing...');
     try {
-      execSync('npx husky install', {
+      execFileSync('npx', ['husky', 'install'], {
         cwd: targetPath,
-        stdio: 'inherit'
+        stdio: 'inherit',
+        shell: false
       });
     } catch {
       throw new Error('Failed to install husky. Run: npm install -D husky && npx husky install');
@@ -103,9 +110,7 @@ async function initHusky(targetPath, mode) {
 
   // Create pre-commit hook
   const preCommitPath = path.join(huskyDir, 'pre-commit');
-  const command = mode === 'diff'
-    ? 'npx muaddib diff HEAD --fail-on high'
-    : 'npx muaddib scan . --fail-on high';
+  const command = HOOK_COMMANDS[mode];
 
   const hookContent = `#!/usr/bin/env sh
 . "$(dirname -- "$0")/_/husky.sh"
@@ -169,9 +174,7 @@ async function initGitHook(targetPath, mode) {
   }
 
   const preCommitPath = path.join(gitHooksDir, 'pre-commit');
-  const command = mode === 'diff'
-    ? 'npx muaddib diff HEAD --fail-on high'
-    : 'npx muaddib scan . --fail-on high';
+  const command = HOOK_COMMANDS[mode];
 
   const hookContent = `#!/bin/sh
 # MUAD'DIB pre-commit hook
@@ -193,11 +196,23 @@ fi
 exit 0
 `;
 
-  // Backup existing hook
+  // Backup existing hook (limit to 3 backups)
   if (fs.existsSync(preCommitPath)) {
     const backup = `${preCommitPath}.backup.${Date.now()}`;
     fs.copyFileSync(preCommitPath, backup);
     console.log(`[INFO] Backed up existing hook to ${backup}`);
+
+    // Cleanup old backups, keep only 3 most recent
+    try {
+      const hooksDir = path.dirname(preCommitPath);
+      const backups = fs.readdirSync(hooksDir)
+        .filter(f => f.startsWith('pre-commit.backup.'))
+        .sort()
+        .reverse();
+      for (const old of backups.slice(3)) {
+        fs.unlinkSync(path.join(hooksDir, old));
+      }
+    } catch { /* ignore cleanup errors */ }
   }
 
   fs.writeFileSync(preCommitPath, hookContent, { mode: 0o755 });

package/src/index.js

@@ -16,6 +16,7 @@ const path = require('path');
 const { scanGitHubActions } = require('./scanner/github-actions.js');
 const { detectPythonProject, normalizePythonName } = require('./scanner/python.js');
 const { loadCachedIOCs } = require('./ioc/updater.js');
+const { setExtraExcludes, getExtraExcludes } = require('./utils.js');
 
 // ============================================
 // SCORING CONSTANTS
@@ -52,12 +53,16 @@ const RISK_THRESHOLDS = {
 // Maximum score (capped)
 const MAX_RISK_SCORE = 100;
 
+const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
+
 // Paranoid mode scanner
 function scanParanoid(targetPath) {
   const threats = [];
 
   function scanFile(filePath) {
     try {
+      const stat = fs.statSync(filePath);
+      if (stat.size > MAX_FILE_SIZE) return;
       const content = fs.readFileSync(filePath, 'utf8');
 
       // Ignore URLs (they often contain patterns like .git)
@@ -81,8 +86,9 @@ function scanParanoid(targetPath) {
     }
   }
 
-  function walkDir(dir) {
-    const excluded = ['node_modules', '.git', 'test', 'tests', 'src', 'vscode-extension', '.muaddib-cache', 'data', 'iocs', 'docker'];
+  function walkDir(dir, depth) {
+    if (depth > 50) return; // Max depth guard (IDX-06)
+    const excluded = ['node_modules', '.git', '.muaddib-cache', ...getExtraExcludes()];
     try {
       const files = fs.readdirSync(dir);
       for (const file of files) {
@@ -94,7 +100,7 @@ function scanParanoid(targetPath) {
 
         if (stat.isDirectory()) {
           if (!excluded.includes(file)) {
-            walkDir(fullPath);
+            walkDir(fullPath, depth + 1);
           }
         } else if (file.endsWith('.js') || file.endsWith('.json') || file.endsWith('.sh')) {
           scanFile(fullPath);
@@ -105,7 +111,7 @@ function scanParanoid(targetPath) {
     }
   }
 
-  walkDir(targetPath);
+  walkDir(targetPath, 0);
   return threats;
 }
 
@@ -187,6 +193,11 @@ function checkPyPITyposquatting(deps, targetPath) {
 }
 
 async function run(targetPath, options = {}) {
+  // Apply --exclude dirs for this scan
+  if (options.exclude && options.exclude.length > 0) {
+    setExtraExcludes(options.exclude);
+  }
+
   // Detect Python project (synchronous, fast file reads)
   const pythonDeps = detectPythonProject(targetPath);
 
@@ -240,7 +251,7 @@ async function run(targetPath, options = {}) {
 
   // Sandbox integration
   let sandboxData = null;
-  if (options.sandboxResult && options.sandboxResult.findings) {
+  if (options.sandboxResult && Array.isArray(options.sandboxResult.findings)) {
     const sr = options.sandboxResult;
     const pkg = sr.raw_report?.package || 'unknown';
     sandboxData = {
@@ -331,6 +342,12 @@ async function run(targetPath, options = {}) {
     sandbox: sandboxData
   };
 
+  // _capture mode: return result directly without printing (used by diff.js)
+  if (options._capture) {
+    setExtraExcludes([]);
+    return result;
+  }
+
   // JSON output
   if (options.json) {
     console.log(JSON.stringify(result, null, 2));
@@ -451,7 +468,7 @@ async function run(targetPath, options = {}) {
   }
 
   // Send webhook if configured
-  if (options.webhook && threats.length > 0) {
+  if (options.webhook && enrichedThreats.length > 0) {
     try {
       await sendWebhook(options.webhook, result);
       console.log(`[OK] Alert sent to webhook`);
@@ -472,7 +489,10 @@ async function run(targetPath, options = {}) {
   const levelsToCheck = severityLevels[failLevel] || severityLevels.high;
   const failingThreats = deduped.filter(t => levelsToCheck.includes(t.severity));
 
-  return failingThreats.length;
+  // Clear runtime excludes
+  setExtraExcludes([]);
+
+  return Math.min(failingThreats.length, 125);
 }
 
 module.exports = { run };