muaddib-scanner 2.11.131 → 2.11.132

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.131",
+  "version": "2.11.132",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.131.json → self-scan-v2.11.132.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-06-27T16:14:41.754Z",
+  "timestamp": "2026-06-28T11:47:00.100Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/monitor/classify.js

@@ -405,6 +405,17 @@ function evaluateCacheTrigger(name, docMeta, doc, opts = {}) {
     return { shouldCache: true, reason: 'first_publish', retentionDays: TARBALL_CACHE_DEFAULT_RETENTION_DAYS };
   }
 
+  // Trigger 4: account-takeover / burst -- 30-day retention (high-risk fast-takedown class).
+  // These are batch/registry-derived (published version vs dist-tags.latest; per-name recent
+  // version count), NOT knowable from name+docMeta at ingestion, so the caller
+  // (preResolveNpmBatch) computes them from _npmInfo and passes opts.{atoSignal,isBurst}.
+  // Closes the Leo Platform gap (June 2026): 20 existing packages re-published at non-latest
+  // versions matched neither typosquat nor first_publish -> never prefetched -> the malicious
+  // tarballs were 404'd before scan. ATO catches that class; burst catches Miasma-style floods.
+  if (opts.atoSignal || opts.isBurst) {
+    return { shouldCache: true, reason: opts.atoSignal ? 'ato' : 'burst', retentionDays: TARBALL_CACHE_HIGH_RISK_RETENTION_DAYS };
+  }
+
   return { shouldCache: false, reason: '', retentionDays: 0 };
 }
 

package/src/monitor/ingestion.js

@@ -598,6 +598,14 @@ function preResolveShouldShed(scanQueue) {
 // in-flight work, not all the chunks that already completed. When scanQueue
 // is omitted (unit tests, lib usage), items are only mutated in place and the
 // caller decides when to push.
+// Burst threshold for the capture-at-publish prefetch trigger. Mirrors
+// BURST_PREALERT_MIN_VERSIONS (queue.js:212) and reads the SAME env var so ops tunes
+// one knob. Per-name version count in the recent-publish window.
+const BURST_MIN_VERSIONS_PREFETCH = (() => {
+  const n = parseInt(process.env.MUADDIB_BURST_MIN_VERSIONS, 10);
+  return Number.isFinite(n) && n >= 2 ? n : 10;
+})();
+
 async function preResolveNpmBatch(items, stats, scanQueue) {
   if (!items || items.length === 0) return;
   const start = Date.now();
@@ -644,6 +652,25 @@ async function preResolveNpmBatch(items, stats, scanQueue) {
           // weekly_downloads (from getWeeklyDownloads) so the triage block in
           // queue.js can read meta directly without re-fetching.
           item._npmInfo = npmInfo;
+          // Capture-at-publish trigger for the fast-takedown class (Leo Platform / Miasma,
+          // June 2026). ATO (published version != dist-tags.latest) and per-name burst are
+          // only knowable from the registry data fetched here, so the name-only
+          // evaluateCacheTrigger at ingestion (change.doc is null post-2025) cannot set them.
+          // Feed them in now so the burst/ATO subset is prefetched too — only when no
+          // higher-priority (ioc/typosquat) trigger already fired. queue.js still computes
+          // the same signals later for scan-queue protection + extras enqueue (idempotent).
+          if (!item._cacheTrigger) {
+            const atoSignal = !!(npmInfo.latestTagVersion && item.version &&
+              item.version !== npmInfo.latestTagVersion);
+            const burstCount = Number.isFinite(npmInfo.recentWindowCount)
+              ? npmInfo.recentWindowCount
+              : ((Array.isArray(npmInfo.recentVersions) ? npmInfo.recentVersions.length : 0) + 1);
+            const isBurst = burstCount >= BURST_MIN_VERSIONS_PREFETCH;
+            if (atoSignal || isBurst) {
+              const trig = evaluateCacheTrigger(item.name, null, null, { atoSignal, isBurst });
+              if (trig.shouldCache) item._cacheTrigger = trig;
+            }
+          }
           resolved++;
         } else {
           failed++;