muaddib-scanner 2.11.131 → 2.11.134

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.131",
+  "version": "2.11.134",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.131.json → self-scan-v2.11.134.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-06-27T16:14:41.754Z",
+  "timestamp": "2026-06-28T13:13:44.321Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/monitor/classify.js

@@ -405,6 +405,17 @@ function evaluateCacheTrigger(name, docMeta, doc, opts = {}) {
     return { shouldCache: true, reason: 'first_publish', retentionDays: TARBALL_CACHE_DEFAULT_RETENTION_DAYS };
   }
 
+  // Trigger 4: account-takeover / burst -- 30-day retention (high-risk fast-takedown class).
+  // These are batch/registry-derived (published version vs dist-tags.latest; per-name recent
+  // version count), NOT knowable from name+docMeta at ingestion, so the caller
+  // (preResolveNpmBatch) computes them from _npmInfo and passes opts.{atoSignal,isBurst}.
+  // Closes the Leo Platform gap (June 2026): 20 existing packages re-published at non-latest
+  // versions matched neither typosquat nor first_publish -> never prefetched -> the malicious
+  // tarballs were 404'd before scan. ATO catches that class; burst catches Miasma-style floods.
+  if (opts.atoSignal || opts.isBurst) {
+    return { shouldCache: true, reason: opts.atoSignal ? 'ato' : 'burst', retentionDays: TARBALL_CACHE_HIGH_RISK_RETENTION_DAYS };
+  }
+
   return { shouldCache: false, reason: '', retentionDays: 0 };
 }
 

package/src/monitor/ingestion.js

@@ -598,6 +598,30 @@ function preResolveShouldShed(scanQueue) {
 // in-flight work, not all the chunks that already completed. When scanQueue
 // is omitted (unit tests, lib usage), items are only mutated in place and the
 // caller decides when to push.
+// Burst threshold for the capture-at-publish prefetch trigger. Mirrors
+// BURST_PREALERT_MIN_VERSIONS (queue.js:212) and reads the SAME env var so ops tunes
+// one knob. Per-name version count in the recent-publish window.
+const BURST_MIN_VERSIONS_PREFETCH = (() => {
+  const n = parseInt(process.env.MUADDIB_BURST_MIN_VERSIONS, 10);
+  return Number.isFinite(n) && n >= 2 ? n : 10;
+})();
+
+// A prerelease publish (1.2.0-rc.1, 2.0.0-beta, ...-dev) is EXPECTED to differ
+// from dist-tags.latest: npm semver resolution (^/~/x.y ranges) never selects a
+// prerelease unless it is requested explicitly, so an account-takeover that wants
+// victims to auto-resolve to the malicious version cannot use one. Excluding
+// prereleases from the ATO *prefetch* signal drops the dominant false positive
+// (CI/dev/rc/beta churn — ~17% of npm publishes per the 2026-06-28 backtest, which
+// would otherwise balloon the bounded tarball cache) WITHOUT weakening the
+// release-version ATO catch (Leo Platform: malicious leo-sdk@6.0.19, a plain
+// release, still fires). Prefetch-only: queue.js keeps its own (more inclusive)
+// atoSignal for fast-track / anti-eviction, and this never touches scoring.
+function isPrereleaseVersion(v) {
+  // semver: the prerelease lives after '-' in the version core, before any '+'
+  // build metadata. Strip build metadata first so '1.0.0+build-7' is NOT flagged.
+  return /-/.test(String(v == null ? '' : v).split('+')[0]);
+}
+
 async function preResolveNpmBatch(items, stats, scanQueue) {
   if (!items || items.length === 0) return;
   const start = Date.now();
@@ -644,6 +668,26 @@ async function preResolveNpmBatch(items, stats, scanQueue) {
           // weekly_downloads (from getWeeklyDownloads) so the triage block in
           // queue.js can read meta directly without re-fetching.
           item._npmInfo = npmInfo;
+          // Capture-at-publish trigger for the fast-takedown class (Leo Platform / Miasma,
+          // June 2026). ATO (published version != dist-tags.latest) and per-name burst are
+          // only knowable from the registry data fetched here, so the name-only
+          // evaluateCacheTrigger at ingestion (change.doc is null post-2025) cannot set them.
+          // Feed them in now so the burst/ATO subset is prefetched too — only when no
+          // higher-priority (ioc/typosquat) trigger already fired. queue.js still computes
+          // the same signals later for scan-queue protection + extras enqueue (idempotent).
+          if (!item._cacheTrigger) {
+            const atoSignal = !!(npmInfo.latestTagVersion && item.version &&
+              item.version !== npmInfo.latestTagVersion &&
+              !isPrereleaseVersion(item.version));
+            const burstCount = Number.isFinite(npmInfo.recentWindowCount)
+              ? npmInfo.recentWindowCount
+              : ((Array.isArray(npmInfo.recentVersions) ? npmInfo.recentVersions.length : 0) + 1);
+            const isBurst = burstCount >= BURST_MIN_VERSIONS_PREFETCH;
+            if (atoSignal || isBurst) {
+              const trig = evaluateCacheTrigger(item.name, null, null, { atoSignal, isBurst });
+              if (trig.shouldCache) item._cacheTrigger = trig;
+            }
+          }
           resolved++;
         } else {
           failed++;
@@ -1559,6 +1603,7 @@ module.exports = {
   preResolveNpmBatch,
   preResolvePyPIBatch,
   preResolveShouldShed,
+  isPrereleaseVersion,
 
   // RSS parsing
   parseNpmRss,

package/src/monitor/state.js

@@ -118,7 +118,7 @@ const MEMORY_SCORE_TOLERANCE = 0.15; // ±15% score tolerance
 
 // --- Tarball cache constants ---
 
-const TARBALL_CACHE_DIR = path.join(__dirname, '..', '..', 'data', 'tarball-cache');
+const TARBALL_CACHE_DIR = process.env.MUADDIB_TARBALL_CACHE_DIR || path.join(__dirname, '..', '..', 'data', 'tarball-cache');
 const TARBALL_CACHE_INDEX_FILE = path.join(TARBALL_CACHE_DIR, 'cache-index.json');
 const TARBALL_CACHE_DEFAULT_RETENTION_DAYS = 7;
 const TARBALL_CACHE_HIGH_RISK_RETENTION_DAYS = 30;
@@ -495,6 +495,34 @@ function cacheTarball(name, version, sourcePath, reason, retentionDays) {
   console.log(`[MONITOR] TARBALL CACHE: cached ${name}@${version} (${reason}, ${retentionDays}d, ${(fileSize / 1024).toFixed(0)}KB)`);
 }
 
+/**
+ * Reclaim orphaned tarball-cache files: `.tgz` present in `dir` with no entry in
+ * `entries` and an mtime older than `cutoffMs`. Returns { files, bytes } reclaimed.
+ * Pure w.r.t. the index (orphans are untracked) so callers need not re-save it.
+ * Extracted as a seam so it is unit-testable against a temp dir without touching the
+ * production cache. See purgeTarballCache Phase 3 for the leak this addresses.
+ */
+function gcOrphanTarballFiles(dir, entries, now, cutoffMs) {
+  let files = 0;
+  let bytes = 0;
+  let names;
+  try { names = fs.readdirSync(dir); } catch { return { files, bytes }; }
+  for (const file of names) {
+    if (!file.endsWith('.tgz')) continue;
+    const key = file.slice(0, -4);
+    if (entries && entries[key]) continue; // tracked -> Phase 1/2 owns it
+    const filePath = path.join(dir, file);
+    try {
+      const st = fs.statSync(filePath);
+      if (now - st.mtimeMs <= cutoffMs) continue; // too fresh -> may be in-flight / cache-hittable
+      fs.unlinkSync(filePath);
+      files++;
+      bytes += st.size || 0;
+    } catch { /* per-file stat/unlink errors non-fatal */ }
+  }
+  return { files, bytes };
+}
+
 /**
  * Purge expired entries and enforce size budget.
  * Called at startup and hourly.
@@ -538,10 +566,23 @@ function purgeTarballCache() {
     }
   }
 
-  if (purgedExpired > 0 || purgedBudget > 0) {
-    saveTarballCacheIndex();
+  // Phase 3: orphan-file GC — reclaim .tgz on disk with no index entry. The index is a
+  // process singleton rebuilt from cache-index.json; a single corrupt/truncated index
+  // (crash mid-atomicWriteFileSync, OOM) makes loadTarballCacheIndex fall back to an empty
+  // index, then saveTarballCacheIndex persists it — orphaning every .tgz already cached.
+  // Phase 1/2 are index-driven and can NEVER reclaim those files -> unbounded disk leak
+  // (measured 5.4GB / 8905 files, 2026-06-28). The mtime>retention bound keeps an in-flight
+  // cacheTarball (copyFileSync precedes the index save) and any still-cache-hittable recent
+  // file safe; only clearly-stale orphans are removed.
+  const orphan = gcOrphanTarballFiles(
+    TARBALL_CACHE_DIR, index.entries, now,
+    TARBALL_CACHE_HIGH_RISK_RETENTION_DAYS * 24 * 60 * 60 * 1000
+  );
+
+  if (purgedExpired > 0 || purgedBudget > 0 || orphan.files > 0) {
+    if (purgedExpired > 0 || purgedBudget > 0) saveTarballCacheIndex();
     const remaining = Object.keys(index.entries).length;
-    console.log(`[MONITOR] TARBALL CACHE: purged ${purgedExpired} expired + ${purgedBudget} budget entries (${remaining} remaining, ${(totalSize / 1024 / 1024).toFixed(1)}MB)`);
+    console.log(`[MONITOR] TARBALL CACHE: purged ${purgedExpired} expired + ${purgedBudget} budget entries + ${orphan.files} orphan files (${(orphan.bytes / 1024 / 1024).toFixed(1)}MB reclaimed, ${remaining} remaining, ${(totalSize / 1024 / 1024).toFixed(1)}MB)`);
   }
 }
 
@@ -1784,6 +1825,7 @@ module.exports = {
   tarballCachePath,
   cacheTarball,
   purgeTarballCache,
+  gcOrphanTarballFiles,
   appendTemporalDetection,
   loadTemporalDetections,
   loadState,