muaddib-scanner 2.11.128 → 2.11.129

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.128",
+  "version": "2.11.129",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.128.json → self-scan-v2.11.129.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-06-20T10:44:00.296Z",
+  "timestamp": "2026-06-24T09:39:17.849Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/monitor/classify.js

@@ -44,6 +44,7 @@ const HIGH_CONFIDENCE_MALICE_TYPES = new Set([
   'download_exec_binary',                  // download+chmod+exec
   'reverse_shell',                         // reverse shell (always malicious)
   'crypto_staged_payload',                 // decrypt->eval staged payload chain
+  'crypto_exfil',                          // harvest + encrypt(RSA/AES) + network to non-benign dest (litellm/Hades)
   'intent_credential_exfil',               // intra-file credential->network
   'intent_command_exfil',                  // intra-file command->network
   'cross_file_dataflow',                   // proven taint cross-modules

package/src/response/playbooks.js

@@ -693,6 +693,12 @@ const PLAYBOOKS = {
     'puis execute le resultat via eval/Function. Pattern buildrunner-dev: payload malveillant cache dans une image PNG. ' +
     'Isoler immediatement. Analyser le payload dechiffre. Supprimer le package.',
 
+  crypto_exfil:
+    'CRITIQUE: Exfiltration chiffree de secrets. Le code aspire des credentials/env, les chiffre (RSA publicEncrypt / AES createCipheriv, ' +
+    'souvent une enveloppe hybride avec cle publique embarquee) puis les envoie sur le reseau vers une destination non first-party. ' +
+    'Le chiffrement masque le payload aux inspections DLP/taint (pattern litellm/Hades). Isoler immediatement. Identifier la cle publique ' +
+    'et le host de destination (C2). Revoquer les secrets potentiellement exposes. Supprimer le package.',
+
   download_exec_binary:
     'CRITIQUE: Pattern download-execute detecte. Le code telecharge un binaire, le rend executable (chmod 755), ' +
     'puis l\'execute via execSync. Dropper deguise en compilation native addon (NeoShadow pattern). ' +

package/src/rules/index.js

@@ -809,6 +809,20 @@ const RULES = {
     ],
     mitre: 'T1195.002'
   },
+  crypto_exfil: {
+    id: 'MUADDIB-COMPOUND-019',
+    name: 'Hybrid-Crypto Credential Exfiltration',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    domain: 'malware',
+    description: 'Harvesting de secrets (env/credentials) + primitive de chiffrement (RSA publicEncrypt / AES createCipheriv) + envoi reseau dans le MEME fichier, vers une destination qui n\'est PAS entierement first-party/de confiance (destAllBenign faux). Les secrets voles sont chiffres AVANT exfil pour echapper a l\'inspection DLP et au taint statique — pattern litellm / Hades (juin 2026). Les libs E2E/licence/telemetry legitimes chiffrent+envoient mais n\'aspirent pas des credentials dans le blob et ne postent que vers leur propre provider (supprime par destAllBenign). Miroir cote chiffrement de fetch_decrypt_exec.',
+    references: [
+      'https://attack.mitre.org/techniques/T1560/',
+      'https://attack.mitre.org/techniques/T1041/',
+      'https://attack.mitre.org/techniques/T1552/'
+    ],
+    mitre: 'T1560'
+  },
 
   // Package.json script patterns
   curl_pipe_sh: {

package/src/scanner/ast-detectors/handle-call-expression.js

@@ -1502,6 +1502,20 @@ function handleCallExpression(node, ctx) {
         file: ctx.relFile
       });
     }
+    // crypto_exfil (encrypt side): a REAL call to an encryption primitive sets the file flag
+    // consumed by the same-file crypto_exfil compound (handle-post-walk.js). AST-based — a string
+    // or regex literal that merely contains "createCipheriv(" is not a CallExpression and won't trip it.
+    if (propName === 'createCipher' || propName === 'createCipheriv' || propName === 'publicEncrypt') {
+      ctx.hasCryptoEncipher = true;
+    } else if (propName === 'encrypt') {
+      // WebCrypto: crypto.subtle.encrypt(...) — gate on the `.subtle.` receiver so a generic
+      // foo.encrypt() (ORMs, mailers, many libs expose .encrypt) does not set the flag.
+      const obj = node.callee.object;
+      if (obj && obj.type === 'MemberExpression' && obj.property &&
+          (obj.property.name === 'subtle' || obj.property.value === 'subtle')) {
+        ctx.hasCryptoEncipher = true;
+      }
+    }
     if (propName === '_compile') {
       // Context-aware gating: only flag _compile when the Module API is plausibly in scope.
       // Custom class methods (e.g. blessed's Tput.prototype._compile) are not malware.

package/src/scanner/ast-detectors/handle-post-walk.js

@@ -366,6 +366,35 @@ function handlePostWalk(ctx) {
     }
   }
 
+  // crypto_exfil (RSA+AES hybrid exfil — litellm/Hades 2026): secret harvesting + an encryption
+  // primitive (RSA publicEncrypt / AES createCipheriv) + a network send, in the SAME file, to a
+  // destination that is NOT entirely first-party/trusted. The encrypt step wraps the stolen
+  // secrets so DLP and static taint miss the payload. Legit E2E/license/telemetry SDKs encrypt
+  // and send, but do not also harvest credentials/env into the blob, and the benign ones post
+  // only to their own provider (suppressed by destAllBenign). Requires a non-LOW harvest threat
+  // already emitted in this file — mirror of fetch_decrypt_exec (decrypt-side loader).
+  // destAllBenign is computed once above, at the credential_regex_harvest emission site.
+  const CRYPTO_EXFIL_HARVEST_TYPES = new Set([
+    'env_access', 'env_charcode_reconstruction', 'env_harvesting_dynamic',
+    'sensitive_string', 'suspicious_dataflow', 'credential_regex_harvest',
+    'credential_command_exec', 'npm_token_steal'
+  ]);
+  if (ctx.hasCryptoEncipher && ctx.hasNetworkCallInFile && !destAllBenign) {
+    const cryptoExfilHarvest = ctx.threats.some(t =>
+      t.file === ctx.relFile && t.severity !== 'LOW' && CRYPTO_EXFIL_HARVEST_TYPES.has(t.type)
+    );
+    if (cryptoExfilHarvest) {
+      ctx.threats.push({
+        type: 'crypto_exfil',
+        severity: 'CRITICAL',
+        message: 'Hybrid-crypto exfiltration: secret harvesting + ' +
+          (ctx.hasEmbeddedPublicKey ? 'embedded RSA/EC public key + ' : '') +
+          'encryption (RSA/AES) + network send in same file — harvested secrets are encrypted before exfil to evade DLP/taint inspection (litellm/Hades pattern).',
+        file: ctx.relFile
+      });
+    }
+  }
+
   // GlassWorm: Unicode variation selector decoder = .codePointAt + variation selector constants
   // CRITICAL if combined with eval/exec (GlassWorm always uses dynamic execution),
   // MEDIUM otherwise (.codePointAt + 0xFE00 is legitimate Unicode processing in fonts/text libs)

package/src/scanner/ast.js

@@ -208,6 +208,17 @@ function analyzeFile(content, filePath, basePath) {
     // Safe domain exclusion: if ALL URLs in file are from known registries, suppress download_exec_binary
     fetchOnlySafeDomains: false, // computed below after URL extraction
     hasCryptoDecipher: /\bcreateDecipher(iv)?\s*\(/.test(content),
+    // crypto_exfil (RSA+AES hybrid exfil — litellm/Hades 2026): encrypt-side mirror of
+    // hasCryptoDecipher. Set TRUE in handle-call-expression.js on a REAL call to an encryption
+    // primitive (createCipher(iv) = AES, publicEncrypt = RSA pubkey-wrap, subtle.encrypt =
+    // WebCrypto). AST-based on purpose, NOT a content regex: a detector/linter/doc that merely
+    // contains the STRING "createCipheriv(" must not trip it (self-scan & meta-tooling FP).
+    // Feeds the same-file crypto_exfil compound in handle-post-walk.js.
+    hasCryptoEncipher: false,
+    // Embedded RSA/EC public key (PEM SPKI/PKCS1) — an attacker's hardcoded recipient key for
+    // the exfil envelope. Enrichment signal only (a PEM public key alone — JWT/JWK verify,
+    // signature checks — is benign and extremely common, so it is never flagged on its own).
+    hasEmbeddedPublicKey: /-----BEGIN (?:RSA |EC )?PUBLIC KEY-----/.test(content),
     // Wave 4: native addon camouflage signals
     hasRequireNodeFile: false,
     hasExecSyncCall: false,