muaddib-scanner 2.1.5 → 2.2.0

package/src/scanner/dataflow.js

@@ -28,6 +28,13 @@ async function analyzeDataFlow(targetPath) {
     } catch {
       continue;
     }
+
+    // Respect // muaddib-ignore directive in first 5 lines (like eslint-disable)
+    const headerLines = content.slice(0, 1024).split('\n').slice(0, 5);
+    if (headerLines.some(line => line.includes('muaddib-ignore'))) {
+      continue;
+    }
+
     const fileThreats = analyzeFile(content, file, targetPath);
     threats.push(...fileThreats);
   }
@@ -53,14 +60,25 @@ function analyzeFile(content, filePath, basePath) {
   const sources = [];
   const sinks = [];
 
+  // Track variables assigned from sensitive path expressions
+  const sensitivePathVars = new Set();
+
   walk.simple(ast, {
+    VariableDeclarator(node) {
+      if (node.id?.type === 'Identifier' && node.init) {
+        if (containsSensitiveLiteral(node.init)) {
+          sensitivePathVars.add(node.id.name);
+        }
+      }
+    },
+
     CallExpression(node) {
       const callName = getCallName(node);
-      
+
       if (callName === 'readFileSync' || callName === 'readFile' ||
           callName === 'fs.readFileSync' || callName === 'fs.readFile') {
         const arg = node.arguments[0];
-        if (arg && isCredentialPath(arg)) {
+        if (arg && isCredentialPath(arg, sensitivePathVars)) {
           sources.push({
             type: 'credential_read',
             name: callName,
@@ -89,6 +107,65 @@ function analyzeFile(content, filePath, basePath) {
           }
         }
       }
+
+      // os.hostname(), os.networkInterfaces(), os.userInfo() as fingerprint sources
+      if (node.callee.type === 'MemberExpression') {
+        const obj = node.callee.object;
+        const prop = node.callee.property;
+        if (obj?.type === 'Identifier' && obj.name === 'os' && prop?.type === 'Identifier') {
+          if (['hostname', 'networkInterfaces', 'userInfo', 'cpus', 'totalmem', 'platform', 'arch', 'homedir'].includes(prop.name)) {
+            sources.push({
+              type: 'fingerprint_read',
+              name: `os.${prop.name}`,
+              line: node.loc?.start?.line
+            });
+          }
+        }
+      }
+
+      // fs.readdirSync as credential source when reading sensitive directories
+      if (node.callee.type === 'MemberExpression') {
+        const prop = node.callee.property;
+        if (prop?.type === 'Identifier' && (prop.name === 'readdirSync' || prop.name === 'readdir')) {
+          const arg = node.arguments[0];
+          if (arg && isCredentialPath(arg, sensitivePathVars)) {
+            sources.push({
+              type: 'credential_read',
+              name: prop.name,
+              line: node.loc?.start?.line
+            });
+          }
+        }
+      }
+
+      // MemberExpression network sinks: http.request, https.get, dns.resolve, net.connect, etc.
+      if (node.callee.type === 'MemberExpression') {
+        const obj = node.callee.object;
+        const prop = node.callee.property;
+        if (obj.type === 'Identifier' && prop.type === 'Identifier') {
+          // DNS resolution as exfiltration sink
+          if (obj.name === 'dns' && ['resolve', 'lookup', 'resolve4', 'resolve6'].includes(prop.name)) {
+            sinks.push({ type: 'network_send', name: `dns.${prop.name}`, line: node.loc?.start?.line });
+          }
+          // HTTP/HTTPS request/get as network sink
+          if ((obj.name === 'http' || obj.name === 'https') && ['request', 'get'].includes(prop.name)) {
+            sinks.push({ type: 'network_send', name: `${obj.name}.${prop.name}`, line: node.loc?.start?.line });
+          }
+          // net.connect / net.createConnection / tls.connect as network sink
+          if ((obj.name === 'net' || obj.name === 'tls') && ['connect', 'createConnection'].includes(prop.name)) {
+            sinks.push({ type: 'network_send', name: `${obj.name}.${prop.name}`, line: node.loc?.start?.line });
+          }
+        }
+      }
+
+      // Track eval calls for staged payload detection
+      if (callName === 'eval') {
+        sinks.push({
+          type: 'eval_exec',
+          name: 'eval',
+          line: node.loc?.start?.line
+        });
+      }
     },
 
     MemberExpression(node) {
@@ -108,6 +185,18 @@ function analyzeFile(content, filePath, basePath) {
     }
   });
 
+  // Detect staged payload: network fetch + eval in same file (no credential source needed)
+  const hasNetworkSink = sinks.some(s => s.type === 'network_send' || s.type === 'exec_network');
+  const hasEvalSink = sinks.some(s => s.type === 'eval_exec');
+  if (hasNetworkSink && hasEvalSink) {
+    threats.push({
+      type: 'staged_payload',
+      severity: 'CRITICAL',
+      message: 'Network fetch + eval() in same file (staged payload execution).',
+      file: path.relative(basePath, filePath)
+    });
+  }
+
   if (sources.length > 0 && sinks.length > 0) {
     // Determine severity by scope proximity: if source and sink are < 50 lines apart -> CRITICAL, else HIGH
     let severity = 'HIGH';
@@ -132,23 +221,65 @@ function analyzeFile(content, filePath, basePath) {
   return threats;
 }
 
-function isCredentialPath(arg) {
+const SENSITIVE_PATH_PATTERNS = [
+  '.npmrc', '.ssh', '.aws', '.gitconfig', '.env',
+  '/etc/passwd', '/etc/shadow', '/etc/hosts',
+  '.ethereum', '.electrum', '.config/solana', '.exodus',
+  '.atomic', '.metamask', '.ledger-live', '.trezor',
+  '.bitcoin', '.monero', '.gnupg'
+];
+
+function isSensitivePath(val) {
+  const lower = val.toLowerCase();
+  return SENSITIVE_PATH_PATTERNS.some(p => lower.includes(p));
+}
+
+/**
+ * Checks if an expression tree contains any sensitive path literal.
+ * Used to determine if a variable assignment should be tracked.
+ */
+function containsSensitiveLiteral(node) {
+  if (!node || typeof node !== 'object') return false;
+  if (node.type === 'Literal' && typeof node.value === 'string') {
+    return isSensitivePath(node.value);
+  }
+  if (node.type === 'TemplateLiteral') {
+    const quasiText = (node.quasis || []).map(q => q.value.raw).join('');
+    return isSensitivePath(quasiText);
+  }
+  if (node.type === 'BinaryExpression' && node.operator === '+') {
+    return containsSensitiveLiteral(node.left) || containsSensitiveLiteral(node.right);
+  }
+  if (node.type === 'CallExpression' && node.arguments) {
+    return node.arguments.some(a => containsSensitiveLiteral(a));
+  }
+  return false;
+}
+
+function isCredentialPath(arg, sensitivePathVars) {
   if (arg.type === 'Literal' && typeof arg.value === 'string') {
-    const val = arg.value.toLowerCase();
-    return val.includes('.npmrc') ||
-           val.includes('.ssh') ||
-           val.includes('.aws') ||
-           val.includes('.gitconfig') ||
-           val.includes('.env');
+    return isSensitivePath(arg.value);
   }
   if (arg.type === 'TemplateLiteral') {
-    // Check quasis (string parts) of template literal
-    const quasiText = (arg.quasis || []).map(q => q.value.raw).join('').toLowerCase();
-    return quasiText.includes('.npmrc') ||
-           quasiText.includes('.ssh') ||
-           quasiText.includes('.aws') ||
-           quasiText.includes('.gitconfig') ||
-           quasiText.includes('.env');
+    const quasiText = (arg.quasis || []).map(q => q.value.raw).join('');
+    return isSensitivePath(quasiText);
+  }
+  // Handle string concatenation: homedir() + '/.npmrc'
+  if (arg.type === 'BinaryExpression' && arg.operator === '+') {
+    return isCredentialPath(arg.left, sensitivePathVars) || isCredentialPath(arg.right, sensitivePathVars);
+  }
+  // Handle variable references: fs.readFileSync(npmrcPath) where npmrcPath was assigned a sensitive path
+  if (arg.type === 'Identifier' && sensitivePathVars && sensitivePathVars.has(arg.name)) {
+    return true;
+  }
+  // Handle path.join(dir, '.npmrc') or path.join(sshDir, 'id_rsa') where sshDir is tracked
+  if (arg.type === 'CallExpression' && arg.callee.type === 'MemberExpression') {
+    const obj = arg.callee.object;
+    const prop = arg.callee.property;
+    if (obj.type === 'Identifier' && obj.name === 'path' &&
+        prop.type === 'Identifier' && (prop.name === 'join' || prop.name === 'resolve')) {
+      return arg.arguments.some(a => isCredentialPath(a, sensitivePathVars));
+    }
   }
   return false;
 }

package/src/scanner/package.js

@@ -19,7 +19,9 @@ const DANGEROUS_PATTERNS = [
   { pattern: /\.npmrc/, name: 'npmrc_access' },
   { pattern: /GITHUB_TOKEN/, name: 'github_token_access' },
   { pattern: /AWS_/, name: 'aws_credential_access' },
-  { pattern: /base64/, name: 'base64_encoding' }
+  { pattern: /base64/, name: 'base64_encoding' },
+  { pattern: /require\s*\(\s*['"]https?['"]\)/, name: 'network_require' },
+  { pattern: /node\s+-e\s/, name: 'node_inline_exec' }
 ];
 
 const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype', 'toString', 'valueOf']);

package/src/utils.js

@@ -12,9 +12,11 @@ const EXCLUDED_DIRS = ['node_modules', '.git', '.muaddib-cache'];
  * Merged into every findFiles() call on top of the caller's excludedDirs.
  */
 let _extraExcludedDirs = [];
+let _scanRoot = '';
 
-function setExtraExcludes(dirs) {
+function setExtraExcludes(dirs, scanRoot) {
   _extraExcludedDirs = Array.isArray(dirs) ? dirs : [];
+  _scanRoot = scanRoot || '';
 }
 
 function getExtraExcludes() {
@@ -91,10 +93,15 @@ function findFiles(dir, options = {}) {
   }
 
   for (const item of items) {
-    if (allExcludedDirs.includes(item)) continue;
-
     const fullPath = path.join(dir, item);
 
+    // Check both bare name ("tests") and relative path ("src/scanner")
+    if (allExcludedDirs.includes(item)) continue;
+    if (_extraExcludedDirs.length > 0 && _scanRoot) {
+      const rel = path.relative(_scanRoot, fullPath).replace(/\\/g, '/');
+      if (_extraExcludedDirs.some(ex => rel === ex || rel.startsWith(ex + '/'))) continue;
+    }
+
     try {
       const lstat = fs.lstatSync(fullPath);