muaddib-scanner 2.10.77 → 2.10.78

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.10.77",
+  "version": "2.10.78",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/src/monitor/queue.js

@@ -804,7 +804,6 @@ async function scanPackage(name, version, ecosystem, tarballUrl, registryMeta, s
         appendDetection(name, version, ecosystem, findingTypes, maxSeverity);
         recordTrainingSample(result, { name, version, ecosystem, label: 'suspect', tier, sandboxResult, registryMeta: meta, unpackedSize: meta.unpackedSize, npmRegistryMeta, fileCountTotal, hasTests });
 
-        dailyAlerts.push({ name, version, ecosystem, findingsCount: result.summary.total, tier });
         // Persist alert locally for ALL suspects (independent of webhook filtering)
         const alertData = buildAlertData(name, version, ecosystem, result, sandboxResult);
         persistAlert(name, version, ecosystem, alertData);
@@ -832,6 +831,9 @@ async function scanPackage(name, version, ecosystem, tarballUrl, registryMeta, s
         } else if (ecosystem === 'npm' && hasHighConfidenceThreat(result)) {
           console.log(`[MONITOR] REPUTATION BYPASS: ${name} has high-confidence threat — using raw score`);
         }
+
+        // Record daily alert with post-reputation score for top suspects ranking
+        dailyAlerts.push({ name, version, ecosystem, findingsCount: result.summary.total, score: adjustedResult.summary.riskScore || 0, tier });
         // LLM Detective: AI-powered analysis for T1a/T1b suspects
         let llmResult = null;
         if ((tier === '1a' || tier === '1b') && (adjustedResult.summary.riskScore || 0) >= 25) {

package/src/monitor/webhook.js

@@ -794,7 +794,7 @@ function buildDailyReportEmbed(stats, dailyAlerts) {
 
   // Prefer in-memory dailyAlerts for top suspects (richer data), fallback to disk
   const top3 = dailyAlerts.length > 0
-    ? dailyAlerts.slice().sort((a, b) => b.findingsCount - a.findingsCount).slice(0, 3)
+    ? dailyAlerts.slice().sort((a, b) => (b.score || 0) - (a.score || 0) || b.findingsCount - a.findingsCount).slice(0, 3)
     : diskTop3;
 
   const top3Text = top3.length > 0
@@ -802,7 +802,8 @@ function buildDailyReportEmbed(stats, dailyAlerts) {
         const name = a.ecosystem ? `${a.ecosystem}/${a.name || a.package}` : (a.name || a.package);
         const version = a.version || 'N/A';
         const count = a.findingsCount || (a.findings ? a.findings.length : 0);
-        return `${i + 1}. **${name}@${version}** — ${count} finding(s)`;
+        const scoreText = a.score != null ? `score ${a.score}, ` : '';
+        return `${i + 1}. **${name}@${version}** — ${scoreText}${count} finding(s)`;
       }).join('\n')
     : 'None';
 
@@ -946,7 +947,7 @@ async function sendDailyReport(stats, dailyAlerts, recentlyScanned, downloadsCac
     deferredProcessed: stats.deferredProcessed || 0,
     deferredExpired: stats.deferredExpired || 0,
     changesStreamPackages: stats.changesStreamPackages || 0,
-    topSuspects: dailyAlerts.slice().sort((a, b) => b.findingsCount - a.findingsCount).slice(0, 10)
+    topSuspects: dailyAlerts.slice().sort((a, b) => (b.score || 0) - (a.score || 0) || b.findingsCount - a.findingsCount).slice(0, 10)
   });
 
   // Send webhook only if configured