muaddib-scanner 2.10.74 → 2.10.78

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.10.74",
+  "version": "2.10.78",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/src/monitor/queue.js

@@ -804,7 +804,6 @@ async function scanPackage(name, version, ecosystem, tarballUrl, registryMeta, s
         appendDetection(name, version, ecosystem, findingTypes, maxSeverity);
         recordTrainingSample(result, { name, version, ecosystem, label: 'suspect', tier, sandboxResult, registryMeta: meta, unpackedSize: meta.unpackedSize, npmRegistryMeta, fileCountTotal, hasTests });
 
-        dailyAlerts.push({ name, version, ecosystem, findingsCount: result.summary.total, tier });
         // Persist alert locally for ALL suspects (independent of webhook filtering)
         const alertData = buildAlertData(name, version, ecosystem, result, sandboxResult);
         persistAlert(name, version, ecosystem, alertData);
@@ -832,6 +831,9 @@ async function scanPackage(name, version, ecosystem, tarballUrl, registryMeta, s
         } else if (ecosystem === 'npm' && hasHighConfidenceThreat(result)) {
           console.log(`[MONITOR] REPUTATION BYPASS: ${name} has high-confidence threat — using raw score`);
         }
+
+        // Record daily alert with post-reputation score for top suspects ranking
+        dailyAlerts.push({ name, version, ecosystem, findingsCount: result.summary.total, score: adjustedResult.summary.riskScore || 0, tier });
         // LLM Detective: AI-powered analysis for T1a/T1b suspects
         let llmResult = null;
         if ((tier === '1a' || tier === '1b') && (adjustedResult.summary.riskScore || 0) >= 25) {

package/src/monitor/webhook.js

@@ -794,7 +794,7 @@ function buildDailyReportEmbed(stats, dailyAlerts) {
 
   // Prefer in-memory dailyAlerts for top suspects (richer data), fallback to disk
   const top3 = dailyAlerts.length > 0
-    ? dailyAlerts.slice().sort((a, b) => b.findingsCount - a.findingsCount).slice(0, 3)
+    ? dailyAlerts.slice().sort((a, b) => (b.score || 0) - (a.score || 0) || b.findingsCount - a.findingsCount).slice(0, 3)
     : diskTop3;
 
   const top3Text = top3.length > 0
@@ -802,7 +802,8 @@ function buildDailyReportEmbed(stats, dailyAlerts) {
         const name = a.ecosystem ? `${a.ecosystem}/${a.name || a.package}` : (a.name || a.package);
         const version = a.version || 'N/A';
         const count = a.findingsCount || (a.findings ? a.findings.length : 0);
-        return `${i + 1}. **${name}@${version}** — ${count} finding(s)`;
+        const scoreText = a.score != null ? `score ${a.score}, ` : '';
+        return `${i + 1}. **${name}@${version}** — ${scoreText}${count} finding(s)`;
       }).join('\n')
     : 'None';
 
@@ -946,7 +947,7 @@ async function sendDailyReport(stats, dailyAlerts, recentlyScanned, downloadsCac
     deferredProcessed: stats.deferredProcessed || 0,
     deferredExpired: stats.deferredExpired || 0,
     changesStreamPackages: stats.changesStreamPackages || 0,
-    topSuspects: dailyAlerts.slice().sort((a, b) => b.findingsCount - a.findingsCount).slice(0, 10)
+    topSuspects: dailyAlerts.slice().sort((a, b) => (b.score || 0) - (a.score || 0) || b.findingsCount - a.findingsCount).slice(0, 10)
   });
 
   // Send webhook only if configured

package/src/shared/bundle-detect.js

@@ -39,16 +39,37 @@
 //    fesm*/, esm/, esm5/, esm2015/, esm2020/, bundles/, assets/, chunks/, _app/)
 //  - Basename suffixes (.min.js, .bundle.js, .umd.js, .esm.js, .es.js,
 //    .common.js, .max.js, .prod.js, .production.js, + .cjs / .mjs variants)
+//  - Double-extension bundler outputs (index.cjs.js, index.esm.js, index.umd.js
+//    at package root — common pattern for @equinor/*, tsdx/rollup bundled libs)
 //  - Hash-suffixed chunks (esbuild/vite/rollup/webpack convention):
 //    `basename-[a-f0-9]{6,16}.js|mjs|cjs`
+//  - Tool-specific subdirectories that contain vendored bundles (v2.10.75):
+//    * `lib/[name]Bundle*/` — Playwright-style `lib/utilsBundleImpl/`
+//    * `.yarn/releases/` — vendored yarn/pnpm releases shipped in template packages
+//    * `sys/(node|browser|deno)/` — Stencil-style platform-specific bundle
+//    * `compiled/` — SWC/Stencil compiled output
+//    * `typings/` — only if matches a .d.ts file (defensive)
 const BUNDLE_PATH_RE = new RegExp(
-  // Path prefix group
+  // Path prefix group (directories that almost always contain bundled output)
   '(?:^|[/\\\\])' +
-  '(?:dist|build|out|output|browser|bundles|assets|chunks|_app|' +
+  '(?:dist|build|out|output|browser|bundles|assets|chunks|_app|compiled|' +
   'lib[/\\\\]bundled|fesm\\d*|esm|esm5|esm2015|esm2020)' +
   '[/\\\\]' +
-  // OR basename suffix group
-  '|\\.(?:min|bundle|umd|esm|es|common|max|prod|production)\\.(?:m?js|cjs)$' +
+  // OR Playwright-style lib/xxxBundle*/ (e.g. lib/utilsBundleImpl/, lib/mcpBundleImpl/,
+  // lib/transform/babelBundleImpl.js) — matches the directory form
+  // `lib/.../xxxBundleImpl/index.js` and the flat form `lib/.../xxxBundleImpl.js`
+  // at any depth under lib/.
+  '|(?:^|[/\\\\])lib[/\\\\][^\\n]*[Bb]undle[\\w-]*(?:[/\\\\]|\\.(?:m?js|cjs)$)' +
+  // OR vendored yarn/pnpm releases (@backstage/create-app templates etc.)
+  '|(?:^|[/\\\\])\\.yarn[/\\\\]releases[/\\\\]' +
+  '|(?:^|[/\\\\])\\.pnpm[/\\\\](?:releases|dist)[/\\\\]' +
+  // OR Stencil-style sys/(node|browser|deno) containing compiled platform bundles
+  '|(?:^|[/\\\\])sys[/\\\\](?:node|browser|deno)[/\\\\]' +
+  // OR basename suffix group (single extension)
+  '|\\.(?:min|bundle|umd|esm|es|cjs|common|max|prod|production|iife)\\.(?:m?js|cjs)$' +
+  // OR double-extension bundler outputs at root: index.cjs.js, index.esm.js, etc.
+  // Anchored by `^` or path separator + basename with exactly the double extension.
+  '|(?:^|[/\\\\])[\\w-]+\\.(?:cjs|esm|umd|es|iife|min)\\.js$' +
   // OR hash-suffixed chunk
   '|(?:^|[/\\\\])[\\w-]+[-.][a-f0-9]{6,16}\\.(?:m?js|cjs)$',
   'i'
@@ -131,6 +152,13 @@ function hasBundleVetoSignal(threats, targetFile) {
   if (!Array.isArray(threats) || !targetFile) return false;
   for (const t of threats) {
     if (t.file !== targetFile) continue;
+    // v2.10.75 fix: a LOW severity threat should never block the bundle downgrade
+    // of unrelated co-occurring threats. Typical regression case: a locale file
+    // (locales/fa-IR/*.js) contains `unicode_invisible_injection` at LOW (already
+    // downgraded by `isLocaleFile` in obfuscation.js) but also contains bundler
+    // helpers. Before this fix, the LOW unicode signal vetoed the bundle downgrade
+    // of the other threats, so the package scored higher than pre-v2.10.74.
+    if (t.severity === 'LOW') continue;
     if (VETO_TYPES.has(t.type)) return true;
     if (t.type === 'env_access' && t.message && SENSITIVE_ENV_RE.test(t.message)) {
       return true;