muaddib-scanner 2.1.5 → 2.2.0

package/nul

@@ -1,5 +0,0 @@
-{
-  "generated_at": "2026-02-14T15:37:31.286Z",
-  "version": "2.0.0",
-  "feed": []
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.1.5",
+  "version": "2.2.0",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/src/commands/evaluate.js

@@ -0,0 +1,270 @@
+/**
+ * MUAD'DIB Evaluate — Scanner effectiveness measurement
+ *
+ * Measures TPR (Ground Truth), FPR (Benign), and ADR (Adversarial).
+ * Saves versioned metrics to metrics/v{version}.json.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { run } = require('../index.js');
+
+const ROOT = path.join(__dirname, '..', '..');
+const GT_DIR = path.join(ROOT, 'tests', 'ground-truth');
+const BENIGN_DIR = path.join(ROOT, 'datasets', 'benign');
+const ADVERSARIAL_DIR = path.join(ROOT, 'datasets', 'adversarial');
+const METRICS_DIR = path.join(ROOT, 'metrics');
+
+const GT_THRESHOLD = 3;
+const BENIGN_THRESHOLD = 20;
+
+const ADVERSARIAL_THRESHOLDS = {
+  // Vague 1 (20 samples)
+  'ci-trigger-exfil': 35,
+  'delayed-exfil': 30,
+  'docker-aware': 35,
+  'staged-fetch': 35,
+  'dns-chunk-exfil': 35,
+  'string-concat-obfuscation': 30,
+  'postinstall-download': 30,
+  'dynamic-require': 40,
+  'iife-exfil': 40,
+  'conditional-chain': 30,
+  'template-literal-obfuscation': 30,
+  'proxy-env-intercept': 40,
+  'nested-payload': 30,
+  'dynamic-import': 30,
+  'websocket-exfil': 30,
+  'bun-runtime-evasion': 30,
+  'preinstall-exec': 35,
+  'remote-dynamic-dependency': 35,
+  'github-exfil': 30,
+  'detached-background': 35,
+  // Vague 3 (5 samples)
+  'ai-agent-weaponization': 35,
+  'ai-config-injection': 30,
+  'rdd-zero-deps': 35,
+  'discord-webhook-exfil': 30,
+  'preinstall-background-fork': 35,
+  // Holdout → promoted (10 samples)
+  'silent-error-swallow': 25,
+  'double-base64-exfil': 30,
+  'crypto-wallet-harvest': 25,
+  'self-hosted-runner-backdoor': 20,
+  'dead-mans-switch': 30,
+  'fake-captcha-fingerprint': 20,
+  'pyinstaller-dropper': 35,
+  'gh-cli-token-steal': 30,
+  'triple-base64-github-push': 30,
+  'browser-api-hook': 20
+};
+
+/**
+ * Scan a directory silently and return the result
+ */
+async function silentScan(dir) {
+  try {
+    return await run(dir, { _capture: true });
+  } catch (err) {
+    return { summary: { riskScore: 0, total: 0 }, threats: [], error: err.message };
+  }
+}
+
+/**
+ * 1. Ground Truth — scan real-world attack samples
+ */
+async function evaluateGroundTruth() {
+  const attacksFile = path.join(GT_DIR, 'attacks.json');
+  const data = JSON.parse(fs.readFileSync(attacksFile, 'utf8'));
+  const attacks = data.attacks.filter(a => a.expected.min_threats > 0);
+
+  const details = [];
+  let detected = 0;
+
+  for (const attack of attacks) {
+    const sampleDir = path.join(GT_DIR, attack.sample_dir);
+    const result = await silentScan(sampleDir);
+    const score = result.summary.riskScore;
+    const isDetected = score >= GT_THRESHOLD;
+    if (isDetected) detected++;
+    details.push({
+      name: attack.name,
+      id: attack.id,
+      score,
+      detected: isDetected,
+      threshold: GT_THRESHOLD
+    });
+  }
+
+  const total = attacks.length;
+  const tpr = total > 0 ? detected / total : 0;
+  return { detected, total, tpr, details };
+}
+
+/**
+ * 2. Benign — scan popular npm packages for false positives
+ */
+async function evaluateBenign() {
+  const listFile = path.join(BENIGN_DIR, 'packages-npm.txt');
+  const packages = fs.readFileSync(listFile, 'utf8')
+    .split('\n')
+    .map(l => l.trim())
+    .filter(l => l && !l.startsWith('#'));
+
+  const details = [];
+  let flagged = 0;
+
+  for (const pkg of packages) {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'muaddib-eval-'));
+    try {
+      // Create minimal project with this package as dependency
+      const pkgJson = { name: 'eval-project', version: '1.0.0', dependencies: { [pkg]: '*' } };
+      fs.writeFileSync(path.join(tmpDir, 'package.json'), JSON.stringify(pkgJson));
+
+      // Create fake node_modules entry so dependency scanner picks it up
+      const parts = pkg.split('/');
+      const nmDir = path.join(tmpDir, 'node_modules', ...parts);
+      fs.mkdirSync(nmDir, { recursive: true });
+      fs.writeFileSync(path.join(nmDir, 'package.json'), JSON.stringify({ name: pkg, version: '999.0.0' }));
+
+      const result = await silentScan(tmpDir);
+      const score = result.summary.riskScore;
+      const isFlagged = score > BENIGN_THRESHOLD;
+      if (isFlagged) flagged++;
+      details.push({ name: pkg, score, flagged: isFlagged });
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  }
+
+  const total = packages.length;
+  const fpr = total > 0 ? flagged / total : 0;
+  return { flagged, total, fpr, details };
+}
+
+/**
+ * 3. Adversarial — scan evasive malicious samples
+ */
+async function evaluateAdversarial() {
+  const details = [];
+  let detected = 0;
+
+  const sampleNames = Object.keys(ADVERSARIAL_THRESHOLDS);
+  for (const name of sampleNames) {
+    const sampleDir = path.join(ADVERSARIAL_DIR, name);
+    if (!fs.existsSync(sampleDir)) {
+      details.push({ name, score: 0, threshold: ADVERSARIAL_THRESHOLDS[name], detected: false, error: 'directory not found' });
+      continue;
+    }
+
+    const result = await silentScan(sampleDir);
+    const score = result.summary.riskScore;
+    const threshold = ADVERSARIAL_THRESHOLDS[name];
+    const isDetected = score >= threshold;
+    if (isDetected) detected++;
+    details.push({ name, score, threshold, detected: isDetected });
+  }
+
+  const total = sampleNames.length;
+  const adr = total > 0 ? detected / total : 0;
+  return { detected, total, adr, details };
+}
+
+/**
+ * Save metrics to metrics/v{version}.json
+ */
+function saveMetrics(report) {
+  if (!fs.existsSync(METRICS_DIR)) {
+    fs.mkdirSync(METRICS_DIR, { recursive: true });
+  }
+  const filename = `v${report.version}.json`;
+  const filepath = path.join(METRICS_DIR, filename);
+  fs.writeFileSync(filepath, JSON.stringify(report, null, 2));
+  return filepath;
+}
+
+/**
+ * Main evaluate function
+ */
+async function evaluate(options = {}) {
+  const version = require('../../package.json').version;
+  const jsonMode = options.json || false;
+
+  if (!jsonMode) {
+    console.log(`\n  MUAD'DIB Evaluation (v${version})\n`);
+    console.log(`  [1/3] Ground Truth...`);
+  }
+  const groundTruth = await evaluateGroundTruth();
+
+  if (!jsonMode) {
+    console.log(`  [2/3] Benign packages...`);
+  }
+  const benign = await evaluateBenign();
+
+  if (!jsonMode) {
+    console.log(`  [3/3] Adversarial samples...`);
+  }
+  const adversarial = await evaluateAdversarial();
+
+  const report = {
+    version,
+    date: new Date().toISOString(),
+    groundTruth,
+    benign,
+    adversarial
+  };
+
+  const metricsPath = saveMetrics(report);
+
+  if (jsonMode) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    const tprPct = (groundTruth.tpr * 100).toFixed(1);
+    const fprPct = (benign.fpr * 100).toFixed(1);
+    const adrPct = (adversarial.adr * 100).toFixed(1);
+
+    console.log('');
+    console.log(`  Ground Truth (TPR):  ${groundTruth.detected}/${groundTruth.total}  ${tprPct}%`);
+    console.log(`  Benign (FPR):        ${benign.flagged}/${benign.total}  ${fprPct}%`);
+    console.log(`  Adversarial (ADR):   ${adversarial.detected}/${adversarial.total}  ${adrPct}%`);
+    console.log('');
+
+    // Show failed adversarial samples
+    const missed = adversarial.details.filter(d => !d.detected);
+    if (missed.length > 0) {
+      console.log('  Adversarial misses:');
+      for (const m of missed) {
+        console.log(`    ${m.name}: score ${m.score} < threshold ${m.threshold}`);
+      }
+      console.log('');
+    }
+
+    // Show false positives
+    const fps = benign.details.filter(d => d.flagged);
+    if (fps.length > 0) {
+      console.log('  False positives:');
+      for (const fp of fps) {
+        console.log(`    ${fp.name}: score ${fp.score}`);
+      }
+      console.log('');
+    }
+
+    console.log(`  Saved: ${path.relative(ROOT, metricsPath)}`);
+    console.log('');
+  }
+
+  return report;
+}
+
+module.exports = {
+  evaluate,
+  evaluateGroundTruth,
+  evaluateBenign,
+  evaluateAdversarial,
+  saveMetrics,
+  silentScan,
+  ADVERSARIAL_THRESHOLDS,
+  GT_THRESHOLD,
+  BENIGN_THRESHOLD
+};

package/src/index.js

@@ -18,6 +18,7 @@ const { detectPythonProject, normalizePythonName } = require('./scanner/python.j
 const { loadCachedIOCs } = require('./ioc/updater.js');
 const { ensureIOCs } = require('./ioc/bootstrap.js');
 const { scanEntropy } = require('./scanner/entropy.js');
+const { scanAIConfig } = require('./scanner/ai-config.js');
 const { detectSuddenLifecycleChange } = require('./temporal-analysis.js');
 const { detectSuddenAstChanges } = require('./temporal-ast-diff.js');
 const { detectPublishAnomaly } = require('./publish-anomaly.js');
@@ -105,7 +106,10 @@ function scanParanoid(targetPath) {
         if (stat.isSymbolicLink()) continue;
 
         if (stat.isDirectory()) {
-          if (!excluded.includes(file)) {
+          const rel = path.relative(targetPath, fullPath).replace(/\\/g, '/');
+          const isExcluded = excluded.includes(file) ||
+            excluded.some(ex => rel === ex || rel.startsWith(ex + '/'));
+          if (!isExcluded) {
             walkDir(fullPath, depth + 1);
           }
         } else if (file.endsWith('.js') || file.endsWith('.json') || file.endsWith('.sh')) {
@@ -204,7 +208,7 @@ async function run(targetPath, options = {}) {
 
   // Apply --exclude dirs for this scan
   if (options.exclude && options.exclude.length > 0) {
-    setExtraExcludes(options.exclude);
+    setExtraExcludes(options.exclude, targetPath);
   }
 
   // Detect Python project (synchronous, fast file reads)
@@ -231,7 +235,8 @@ async function run(targetPath, options = {}) {
     ghActionsThreats,
     pythonThreats,
     pypiTyposquatThreats,
-    entropyThreats
+    entropyThreats,
+    aiConfigThreats
   ] = await Promise.all([
     scanPackageJson(targetPath),
     scanShellScripts(targetPath),
@@ -244,7 +249,8 @@ async function run(targetPath, options = {}) {
     Promise.resolve(scanGitHubActions(targetPath)),
     Promise.resolve(matchPythonIOCs(pythonDeps, targetPath)),
     Promise.resolve(checkPyPITyposquatting(pythonDeps, targetPath)),
-    Promise.resolve(scanEntropy(targetPath, { entropyThreshold: options.entropyThreshold || undefined }))
+    Promise.resolve(scanEntropy(targetPath, { entropyThreshold: options.entropyThreshold || undefined })),
+    Promise.resolve(scanAIConfig(targetPath))
   ]);
 
   // Stop spinner now that scanning is complete
@@ -264,7 +270,8 @@ async function run(targetPath, options = {}) {
     ...ghActionsThreats,
     ...pythonThreats,
     ...pypiTyposquatThreats,
-    ...entropyThreats
+    ...entropyThreats,
+    ...aiConfigThreats
   ];
 
   // Paranoid mode

package/src/ioc/bootstrap.js

@@ -1,3 +1,4 @@
+// muaddib-ignore — os.homedir() is used for IOC cache path, not credential access
 const https = require('https');
 const fs = require('fs');
 const path = require('path');

package/src/response/playbooks.js

@@ -56,6 +56,36 @@ const PLAYBOOKS = {
   exec_wget:
     'Execution de wget via child_process. Verifier l\'URL et les donnees.',
   
+  dynamic_require:
+    'require() avec concatenation detecte. Technique d\'obfuscation pour masquer le module charge. Analyser les variables concatenees.',
+
+  dangerous_exec:
+    'CRITIQUE: Execution de commande shell dangereuse detectee. Isoler la machine. Verifier si la commande a ete executee.',
+
+  staged_payload:
+    'CRITIQUE: Code telecharge depuis le reseau et execute via eval(). Payload distant probable. Isoler et analyser le trafic reseau.',
+
+  network_require:
+    'require(https/http) dans un script lifecycle. Le package telecharge du code lors de l\'installation. Verifier l\'URL de destination.',
+
+  node_inline_exec:
+    'node -e dans un script lifecycle. Code inline execute a l\'installation. Analyser le code inline.',
+
+  dynamic_import:
+    'import() dynamique detecte. Technique d\'evasion pour eviter la detection de require(). Verifier quel module est charge et son usage.',
+
+  env_proxy_intercept:
+    'CRITIQUE: new Proxy(process.env) intercepte tous les acces aux variables d\'environnement. Technique d\'exfiltration silencieuse. Isoler la machine, regenerer tous les secrets.',
+
+  dynamic_require_exec:
+    'CRITIQUE: exec/execSync appele sur un module charge via require() obfusque. Le module child_process est dissimule par concatenation/encodage. Isoler la machine, auditer les commandes executees.',
+
+  sandbox_evasion:
+    'Code detecte la presence d\'un sandbox/container (/.dockerenv, /proc/cgroup). Technique anti-analyse: le malware adapte son comportement selon l\'environnement. Analyser les deux branches (sandbox vs production).',
+
+  detached_process:
+    'spawn/fork avec {detached: true} detecte. Le processus enfant survit a la fin de npm install et execute le payload en arriere-plan. Verifier les processus en cours: ps aux | grep node. Tuer le processus suspect.',
+
   known_malicious_package:
     'CRITIQUE: Supprimer immediatement. rm -rf node_modules && npm cache clean --force && npm install',
 
@@ -223,6 +253,42 @@ const PLAYBOOKS = {
   new_publisher:
     'New publisher detected. Package published by a different user than before. Verify legitimacy by checking the package\'s npm page and changelog.',
 
+  credential_command_exec:
+    'CRITIQUE: Le code utilise un outil CLI legitime (gh, gcloud, aws, az) pour voler des tokens. ' +
+    'Verifier: gh auth status, gcloud auth list, aws sts get-caller-identity. ' +
+    'Regenerer tous les tokens des outils concernes. Revoquer les sessions actives.',
+
+  workflow_write:
+    'Le code cree un fichier dans .github/workflows/ — injection de workflow GitHub Actions. ' +
+    'Supprimer le fichier cree. Auditer les workflows existants. ' +
+    'Verifier les GitHub Actions runs recents pour des executions non autorisees.',
+
+  binary_dropper:
+    'CRITIQUE: Pattern dropper detecte — fichier telecharge, rendu executable (chmod), et execute. ' +
+    'Verifier /tmp pour des binaires suspects. Tuer les processus inconnus. ' +
+    'Considerer la machine compromise si le binaire a ete execute.',
+
+  prototype_hook:
+    'Prototype de fonction native modifie (fetch, XMLHttpRequest, http.request). ' +
+    'Technique d\'interception de trafic pour voler des donnees en transit. ' +
+    'Supprimer le package. Auditer le trafic reseau recent.',
+
+  ai_config_injection:
+    'Fichier de config d\'agent IA contient des instructions malveillantes. ' +
+    'NE PAS ouvrir le projet avec un agent IA sans verifier les fichiers .cursorrules, CLAUDE.md, copilot-instructions.md. ' +
+    'Supprimer ou nettoyer ces fichiers avant toute utilisation. Technique ToxicSkills/Clinejection.',
+
+  ai_config_injection_critical:
+    'CRITIQUE: Fichier de config d\'agent IA contient des commandes d\'exfiltration ou un combo shell + credential access. ' +
+    'NE PAS ouvrir ce projet avec un agent IA. Supprimer les fichiers de config compromis. ' +
+    'Si deja ouvert avec un agent IA, considerer la machine compromise. Regenerer tous les secrets.',
+
+  ai_agent_abuse:
+    'CRITIQUE: Un agent IA (Claude, Gemini, Q) est invoque avec des flags de bypass de securite ' +
+    '(--dangerously-skip-permissions, --yolo, --trust-all-tools). Technique s1ngularity/Nx. ' +
+    'NE PAS installer. Verifier si l\'agent a ete execute. Si oui, considerer la machine compromise. ' +
+    'Auditer les fichiers sensibles (.ssh, .aws, .env) pour des acces non autorises.',
+
   canary_exfiltration:
     'CRITIQUE: Le package a tente de voler des credentials (honey tokens). Comportement malveillant confirme. ' +
     'NE PAS installer. Signaler immediatement sur npm/PyPI. ' +

package/src/rules/index.js

@@ -385,6 +385,96 @@ const RULES = {
     references: ['https://attack.mitre.org/techniques/T1027/'],
     mitre: 'T1027'
   },
+  dynamic_require: {
+    id: 'MUADDIB-AST-006',
+    name: 'Dynamic Require with Concatenation',
+    severity: 'HIGH',
+    confidence: 'high',
+    description: 'require() avec concatenation de chaines — technique d\'obfuscation pour masquer le nom du module',
+    references: ['https://attack.mitre.org/techniques/T1027/'],
+    mitre: 'T1027'
+  },
+  dangerous_exec: {
+    id: 'MUADDIB-AST-007',
+    name: 'Dangerous Shell Command Execution',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    description: 'exec() avec commande shell dangereuse (pipe to shell, reverse shell, netcat)',
+    references: ['https://owasp.org/www-community/attacks/Command_Injection'],
+    mitre: 'T1059.004'
+  },
+  staged_payload: {
+    id: 'MUADDIB-FLOW-002',
+    name: 'Staged Payload Execution',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    description: 'Telechargement reseau + eval() dans le meme fichier — execution de payload distant',
+    references: ['https://attack.mitre.org/techniques/T1105/'],
+    mitre: 'T1105'
+  },
+  network_require: {
+    id: 'MUADDIB-PKG-006',
+    name: 'Network Module in Lifecycle Script',
+    severity: 'HIGH',
+    confidence: 'high',
+    description: 'require(https/http) dans un script lifecycle — telechargement au moment de l\'installation',
+    references: ['https://blog.phylum.io/shai-hulud-npm-worm'],
+    mitre: 'T1105'
+  },
+  node_inline_exec: {
+    id: 'MUADDIB-PKG-007',
+    name: 'Node Inline Execution in Lifecycle Script',
+    severity: 'HIGH',
+    confidence: 'high',
+    description: 'node -e dans un script lifecycle — execution de code inline au moment de l\'installation',
+    references: ['https://owasp.org/www-community/attacks/Command_Injection'],
+    mitre: 'T1059.007'
+  },
+  dynamic_import: {
+    id: 'MUADDIB-AST-008',
+    name: 'Dynamic import() of Dangerous Module',
+    severity: 'HIGH',
+    confidence: 'high',
+    description: 'import() dynamique pour charger un module dangereux ou avec argument calcule — technique d\'evasion pour eviter la detection de require()',
+    references: ['https://attack.mitre.org/techniques/T1027/'],
+    mitre: 'T1027'
+  },
+  env_proxy_intercept: {
+    id: 'MUADDIB-AST-009',
+    name: 'Environment Variable Proxy Interception',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    description: 'new Proxy(process.env) detecte — intercepte silencieusement tous les acces aux variables d\'environnement pour exfiltration',
+    references: ['https://attack.mitre.org/techniques/T1552/001/'],
+    mitre: 'T1552.001'
+  },
+  dynamic_require_exec: {
+    id: 'MUADDIB-AST-010',
+    name: 'Command Execution via Dynamic Require',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    description: 'exec/execSync appele sur un module charge dynamiquement (require obfusque) — execution de commandes dissimulees',
+    references: ['https://attack.mitre.org/techniques/T1059/007/'],
+    mitre: 'T1059.007'
+  },
+  sandbox_evasion: {
+    id: 'MUADDIB-AST-011',
+    name: 'Sandbox/Container Evasion',
+    severity: 'HIGH',
+    confidence: 'high',
+    description: 'Detection de sandbox/container (/.dockerenv, /proc/cgroup) — technique anti-analyse pour eviter la detection en environnement controle',
+    references: ['https://attack.mitre.org/techniques/T1497/001/'],
+    mitre: 'T1497.001'
+  },
+  detached_process: {
+    id: 'MUADDIB-AST-012',
+    name: 'Detached Background Process',
+    severity: 'HIGH',
+    confidence: 'high',
+    description: 'spawn/fork avec {detached: true} — le processus survit a la fin de npm install et execute le payload en arriere-plan',
+    references: ['https://attack.mitre.org/techniques/T1036/009/'],
+    mitre: 'T1036.009'
+  },
   dangerous_call_function: {
     id: 'MUADDIB-AST-005',
     name: 'new Function() Constructor',
@@ -395,6 +485,97 @@ const RULES = {
     mitre: 'T1059.007'
   },
 
+  credential_command_exec: {
+    id: 'MUADDIB-AST-014',
+    name: 'Credential Theft via CLI Tool',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    description: 'exec/execSync appelle un outil CLI legitime pour voler des tokens d\'authentification (gh auth token, gcloud auth, aws sts). Technique s1ngularity/Nx.',
+    references: [
+      'https://snyk.io/blog/malicious-npm-packages-abuse-ai-agents/',
+      'https://attack.mitre.org/techniques/T1059/'
+    ],
+    mitre: 'T1059'
+  },
+  workflow_write: {
+    id: 'MUADDIB-AST-015',
+    name: 'GitHub Actions Workflow Write',
+    severity: 'HIGH',
+    confidence: 'high',
+    description: 'fs.writeFileSync cree un fichier dans .github/workflows — injection de workflow GitHub Actions pour persistence. Technique Shai-Hulud 2.0.',
+    references: [
+      'https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack',
+      'https://attack.mitre.org/techniques/T1195/002/'
+    ],
+    mitre: 'T1195.002'
+  },
+  binary_dropper: {
+    id: 'MUADDIB-AST-016',
+    name: 'Binary Dropper Pattern',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    description: 'fs.chmodSync avec permissions executables (0o755/0o777) — pattern de dropper binaire: telecharge, ecrit, chmod, execute.',
+    references: [
+      'https://www.sonatype.com/blog/phantomraven-supply-chain-attack',
+      'https://attack.mitre.org/techniques/T1105/'
+    ],
+    mitre: 'T1105'
+  },
+  prototype_hook: {
+    id: 'MUADDIB-AST-017',
+    name: 'Native API Prototype Hooking',
+    severity: 'HIGH',
+    confidence: 'high',
+    description: 'Modification du prototype ou remplacement de fonctions natives du navigateur/Node.js (fetch, XMLHttpRequest, http.request). Technique chalk/debug (Sygnia, sept 2025) pour intercepter du trafic.',
+    references: [
+      'https://www.sygnia.co/blog/malicious-chalk-debug-npm-packages/',
+      'https://attack.mitre.org/techniques/T1557/'
+    ],
+    mitre: 'T1557'
+  },
+
+  ai_config_injection: {
+    id: 'MUADDIB-AICONF-001',
+    name: 'AI Config Prompt Injection',
+    severity: 'HIGH',
+    confidence: 'high',
+    description: 'Fichier de configuration d\'agent IA (.cursorrules, CLAUDE.md, copilot-instructions.md) contient des instructions d\'execution de commandes shell ou d\'acces a des credentials. Technique ToxicSkills/Clinejection.',
+    references: [
+      'https://snyk.io/blog/toxicskills-prompt-injection-ai-agents/',
+      'https://snyk.io/blog/clinejection-ai-config-prompt-injection/',
+      'https://arxiv.org/abs/2601.17548'
+    ],
+    mitre: 'T1059'
+  },
+  ai_config_injection_critical: {
+    id: 'MUADDIB-AICONF-002',
+    name: 'AI Config Prompt Injection (Critical)',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    description: 'Fichier de configuration d\'agent IA contient des commandes d\'exfiltration (curl POST vers un domaine externe, pipe vers shell) ou une combinaison commande shell + acces credentials. Attaque confirmee.',
+    references: [
+      'https://snyk.io/blog/toxicskills-prompt-injection-ai-agents/',
+      'https://snyk.io/blog/clinejection-ai-config-prompt-injection/',
+      'https://arxiv.org/abs/2601.17548',
+      'https://developer.nvidia.com/blog/ai-agent-security-guidance/'
+    ],
+    mitre: 'T1059'
+  },
+
+  ai_agent_abuse: {
+    id: 'MUADDIB-AST-013',
+    name: 'AI Agent Weaponization',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    description: 'Invocation d\'un agent IA (Claude, Gemini, Q, Aider) avec des flags qui desactivent les controles de securite (--dangerously-skip-permissions, --yolo, --trust-all-tools). Technique s1ngularity/Nx (aout 2025).',
+    references: [
+      'https://snyk.io/blog/malicious-npm-packages-abuse-ai-agents/',
+      'https://stepsecurity.io/blog/ai-agent-weaponization-supply-chain',
+      'https://attack.mitre.org/techniques/T1059/'
+    ],
+    mitre: 'T1059'
+  },
+
   // GitHub Actions patterns
   shai_hulud_backdoor: {
     id: 'MUADDIB-GHA-001',