muaddib-scanner 2.11.135 → 2.11.138

package/README.md

@@ -30,7 +30,7 @@
 
 npm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond.
 
-MUAD'DIB combines **20 parallel scanners** (266 detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **compound scoring** (17 compound rules), and a gVisor/Docker sandbox to detect known threats and suspicious behavioral patterns in npm and PyPI packages. An XGBoost classifier exists in the codebase but is **currently inactive** (see [Evaluation Metrics](#evaluation-metrics) → ML Classifier section).
+MUAD'DIB combines **20 parallel scanners** (274 detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **compound scoring** (17 compound rules), and a gVisor/Docker sandbox to detect known threats and suspicious behavioral patterns in npm and PyPI packages. An XGBoost classifier exists in the codebase but is **currently inactive** (see [Evaluation Metrics](#evaluation-metrics) → ML Classifier section).
 
 ---
 
@@ -202,9 +202,9 @@ muaddib replay                     # Ground truth validation (90/94 TPR@3, v2.11
 | Python Source (PYSRC) | Import-time / install-time RCE patterns in `__init__.py` / `setup.py` (v2.11.41 — closes TrapDoor PyPI gap) |
 | Python AST (PYAST) | Tree-sitter-Python AST with taint-aware detectors (v2.11.42+) |
 
-### 266 detection rules
+### 274 detection rules
 
-All rules (261 RULES + 5 PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v211117) for the complete rules reference.
+All rules (269 RULES + 5 PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v211117) for the complete rules reference.
 
 ### Detected campaigns
 
@@ -401,7 +401,7 @@ npm test
 - [Documentation Index](docs/INDEX.md) - All documentation in one place
 - [Evaluation Methodology](docs/EVALUATION_METHODOLOGY.md) - Experimental protocol, holdout scores
 - [Threat Model](docs/threat-model.md) - What MUAD'DIB detects and doesn't detect
-- [Security Policy](SECURITY.md) - Detection rules reference (261 rules)
+- [Security Policy](SECURITY.md) - Detection rules reference (269 rules)
 - [Security Audit](docs/SECURITY_AUDIT.md) - Bypass validation report
 - [FP Analysis](docs/EVALUATION.md) - Historical false positive analysis
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.135",
+  "version": "2.11.138",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.135.json → self-scan-v2.11.138.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-06-28T13:42:09.849Z",
+  "timestamp": "2026-07-01T11:04:30.753Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/monitor/daemon.js

@@ -635,7 +635,13 @@ function handleMemoryPressure(level, ratio, rssRatio, recentlyScanned, downloads
       // first (newest survive — most likely to still exist for re-scan), protected only as
       // a last resort, and LEDGERS every drop. Closes the v2.10.88 gap where the raw
       // splice(0,n) silently dropped protected scans (CLAUDE.md "ne jamais perdre de scan").
-      const { dropped, droppedProtected, spilled } = evictFromScanQueueBulk(scanQueue, EMERGENCY_QUEUE_KEEP, 'mem_emergency');
+      // IOC-aware anti-spill: never shed a queued name already known-malicious in the IOC DB.
+      // loadCachedIOCs() is a 10s-throttled singleton the daemon keeps warm (queue.js calls it
+      // per scan), so this is a ref-return — not a fresh alloc — even inside the reclaim path.
+      // Best-effort: on any failure the index is null and eviction falls back to prior behavior.
+      let _iocIndex = null;
+      try { _iocIndex = require('../ioc/updater.js').loadCachedIOCs(); } catch { /* degrade to prior behavior */ }
+      const { dropped, droppedProtected, spilled } = evictFromScanQueueBulk(scanQueue, EMERGENCY_QUEUE_KEEP, 'mem_emergency', null, { iocIndex: _iocIndex });
       summary.queueDropped = dropped;
       summary.queueDroppedProtected = droppedProtected;
       summary.queueSpilled = spilled || 0;
@@ -1040,6 +1046,8 @@ async function startMonitor(options, stats, dailyAlerts, recentlyScanned, downlo
     } catch (e) {
       console.error(`[MONITOR] Shutdown in-flight spill failed: ${e.message}`);
     }
+    // Terminate the off-thread extraction worker pool (bounded-resource teardown).
+    try { await require('../shared/extract-pool.js').destroyExtractPool(); } catch { /* best-effort */ }
     // Persist remaining queue items so they survive the restart
     persistQueue(scanQueue, state);
     saveRecentlyScanned(recentlyScanned); // Persist dedup set too (avoid re-scan storm on restart)

package/src/monitor/queue.js

@@ -12,7 +12,8 @@ const os = require('os');
 const { Worker } = require('worker_threads');
 const { runSandbox, tryAcquireSandboxSlot } = require('../sandbox/index.js');
 const { sendWebhook } = require('../webhook.js');
-const { downloadToFile, extractArchive, extractArchiveOffThread, sanitizePackageName } = require('../shared/download.js');
+const { downloadToFile, extractArchive, sanitizePackageName } = require('../shared/download.js');
+const { extractInPool } = require('../shared/extract-pool.js');
 const { MAX_TARBALL_SIZE, getMaxFileSize } = require('../shared/constants.js');
 const { acquireRegistrySlot, releaseRegistrySlot, awaitRateToken: awaitRateTokenForWorker, signal429: signal429ForWorker } = require('../shared/http-limiter.js');
 const { loadCachedIOCs } = require('../ioc/updater.js');
@@ -179,21 +180,25 @@ const STATIC_SCAN_TIMEOUT_MS = 45_000; // 45s for static analysis only
 const LARGE_PACKAGE_SIZE = 10 * 1024 * 1024; // 10MB
 const RECENTLY_SCANNED_MAX = 50_000; // FIFO cap for the dedup Set (P0c — bounded resource)
 
-// OOM fix (2026-06-19): archives larger than this (COMPRESSED, on-disk size) are
-// extracted off the main thread in a worker, so the synchronous extractor
-// (adm-zip extractAllTo / execFileSync tar) can no longer wedge the event loop and
-// starve the RSS breaker / memory governor / EMERGENCY purge (all main-thread
-// timers) → cgroup OOM. Confirmed culprit: data/loop-stalls.jsonl (extract:* up to
-// 148s). Small archives extract inline — a worker spawn costs more than their
-// sub-100ms extraction. Env-tunable via MUADDIB_INLINE_EXTRACT_MB.
-const INLINE_EXTRACT_MAX_BYTES = (parseInt(process.env.MUADDIB_INLINE_EXTRACT_MB, 10) || 4) * 1024 * 1024;
-
-// Extract inline for small archives, off-thread for large ones. compressedSize is
-// the on-disk tarball size (reliable, unlike the registry unpackedSize metadata).
-// Always returns a Promise so the call sites can uniformly `await`.
+// Event-loop-stall fix (2026-06-30): ALL archive extraction runs off the main
+// thread via a persistent worker pool (src/shared/extract-pool.js). The previous
+// OOM fix only offloaded archives > 4MB (spawn-per-call) and extracted everything
+// smaller INLINE — but adm-zip extractAllTo is fully synchronous and slow on
+// many-file trees regardless of size, so those inline extractions still wedged the
+// loop for seconds-to-minutes (data/loop-stalls.jsonl: extract:prework up to 229s;
+// a 2MB many-file package blocked 5s+), starving the RSS breaker / memory governor
+// / EMERGENCY purge (all main-thread timers) → restart. The pool's reusable workers
+// pay no per-package spawn cost, so there is no longer a reason to extract inline.
+// MUADDIB_INLINE_EXTRACT_MB keeps a small inline escape hatch (default 0 = always
+// pool). compressedSize is the on-disk tarball size (reliable, unlike registry
+// unpackedSize metadata).
+const INLINE_EXTRACT_MAX_BYTES = (parseInt(process.env.MUADDIB_INLINE_EXTRACT_MB, 10) || 0) * 1024 * 1024;
+
+// Always returns a Promise so call sites uniformly `await`. Pool for anything above
+// the (default 0) inline window; the tiny inline path stays available for operators.
 function extractGated(archivePath, destDir, compressedSize) {
   if (compressedSize > INLINE_EXTRACT_MAX_BYTES) {
-    return extractArchiveOffThread(archivePath, destDir);
+    return extractInPool(archivePath, destDir);
   }
   return Promise.resolve(extractArchive(archivePath, destDir));
 }

package/src/monitor/scan-queue.js

@@ -32,6 +32,20 @@ function _isProtected(item) {
   return !!(item && (item.isIOCMatch || item.isBurst || item.firstPublish || item.atoSignal || item.isATOBurstExtra || item.interrupted));
 }
 
+// IOC-aware anti-spill (2026-07, @longzy DPRK campaign post-mortem): a queued package whose
+// NAME is already in the IOC database is known-malicious, and confirming it is a cheap name
+// lookup — so it must never be shed under memory pressure, even when its enqueue-time
+// `isIOCMatch` flag is stale (the IOC DB refreshed while the item sat in the backlog) or was
+// version-gated. Name-level: a wildcard (all-versions-malicious) OR any specific-version entry
+// counts. Best-effort — a missing/malformed index yields false (the exact prior behavior).
+function _isIOCKnownByName(item, iocIndex) {
+  if (!item || !item.name || !iocIndex) return false;
+  const wild = iocIndex.wildcardPackages;
+  const pkgs = iocIndex.packagesMap;
+  return !!((wild && typeof wild.has === 'function' && wild.has(item.name)) ||
+            (pkgs && typeof pkgs.has === 'function' && pkgs.has(item.name)));
+}
+
 // How far from the head we scan for an unprotected victim. Protected items are a small
 // fraction of the flood, so a victim is almost always found within a few slots; the bound
 // keeps eviction O(window) under sustained overflow (CLAUDE.md §2 bounded resources).
@@ -113,18 +127,32 @@ function enqueueScan(scanQueue, item, stats, max = MAX_SCAN_QUEUE) {
  * the daemon (which holds the same array reference) sees the mutation. Best-effort ledger;
  * never throws. `ledgerFn` is injectable for tests; defaults to state.appendScanLedger.
  *
+ * `opts.iocIndex` (optional {packagesMap, wildcardPackages}) additionally protects any queued
+ * NAME already in the IOC DB from being shed — a known-malicious package must never be lost to
+ * memory pressure (IOC-aware anti-spill). Injected by the daemon (the live 10s-singleton), not
+ * auto-loaded here, so callers that omit it keep the exact prior behavior.
+ *
  * @returns {{dropped:number, droppedProtected:number}}
  */
-function evictFromScanQueueBulk(scanQueue, targetKeep, source = 'bulk_evict', ledgerFn = null) {
+function evictFromScanQueueBulk(scanQueue, targetKeep, source = 'bulk_evict', ledgerFn = null, opts = {}) {
   const before = scanQueue.length;
   const keep = Math.max(0, targetKeep | 0);
   if (before <= keep) return { dropped: 0, droppedProtected: 0 };
   const toDrop = before - keep;
 
-  // Victim set: oldest unprotected first, then (only if short) oldest protected.
+  // IOC-aware anti-spill: on top of the standard _isProtected classes, protect any queued
+  // NAME already in the IOC DB. The index is INJECTED (daemon passes the live 10s-singleton;
+  // tests pass a fabricated one) — no auto-load here, so callers that omit it keep the exact
+  // prior behavior (and unit paths don't drag in the 237MB DB).
+  const iocIndex = opts.iocIndex || null;
+  const isKept = iocIndex
+    ? (item) => _isProtected(item) || _isIOCKnownByName(item, iocIndex)
+    : _isProtected;
+
+  // Victim set: oldest unkept first, then (only if short) oldest kept item.
   const dropSet = new Set();
   for (let i = 0; i < before && dropSet.size < toDrop; i++) {
-    if (!_isProtected(scanQueue[i])) dropSet.add(i);
+    if (!isKept(scanQueue[i])) dropSet.add(i);
   }
   let droppedProtected = 0;
   if (dropSet.size < toDrop) {
@@ -172,7 +200,7 @@ function evictFromScanQueueBulk(scanQueue, targetKeep, source = 'bulk_evict', le
       appendLedger({
         name: item.name, version: item.version, ecosystem: item.ecosystem,
         outcome: spilled ? 'spilled' : 'dropped',
-        source: (_isProtected(item) ? `${source}_protected` : source) + (spilled ? '_spill' : ''),
+        source: (isKept(item) ? `${source}_protected` : source) + (spilled ? '_spill' : ''),
         // AUDIT-A1 observability: record whether a DROPPED item was a first-publish
         // (real coverage loss) vs a burst-extra (version-spam, expected). Lets us
         // measure if the memory breaker is evicting genuine new packages.

package/src/rules/index.js

@@ -1129,6 +1129,32 @@ const RULES = {
     references: ['https://attack.mitre.org/techniques/T1497/001/'],
     mitre: 'T1497.001'
   },
+  anti_analysis_evasion: {
+    id: 'MUADDIB-AST-095',
+    name: 'Anti-Analysis Detonation Gate',
+    severity: 'HIGH',
+    confidence: 'high',
+    domain: 'malware',
+    description: 'Mur de gardes process.exit() silencieuses (>=5) couplees a de la lecture d\'environnement (process.env) et a de l\'obfuscation charcode OU de la reconnaissance hote (hostname/userInfo/networkInterfaces) — le payload refuse de s\'executer sous analyse (sandbox/CI/honeypot). Detection STRUCTURELLE (la forme du mur), agnostique aux marqueurs, donc robuste aux marqueurs inedits. Contre-mesure durable a l\'evasion : evader => detecte en statique ; ne pas evader => detone en sandbox.',
+    references: [
+      'https://attack.mitre.org/techniques/T1497/',
+      'https://attack.mitre.org/techniques/T1497/001/'
+    ],
+    mitre: 'T1497'
+  },
+  analyzer_honeytoken_reference: {
+    id: 'MUADDIB-AST-096',
+    name: 'Analyzer Honeytoken Reference',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    domain: 'malware',
+    description: 'Reference DISSIMULEE en charcodes a un marqueur d\'environnement d\'analyse — marqueur de sandbox MUAD\'DIB (MUADDIB_GVISOR), marqueur d\'un analyseur pair, ou nom de poison-token. Seule la forme obfusquee est matchee : le code de sandbox de MUAD\'DIB lui-meme et l\'outillage securite legitime referencent ces marqueurs en clair sans risque. Aucun package legitime n\'encode un check pour ces tripwires. Le marqueur est un honeytoken plante : garde public et stable pour que tout verificateur s\'auto-incrimine.',
+    references: [
+      'https://attack.mitre.org/techniques/T1497/',
+      'https://attack.mitre.org/techniques/T1480/'
+    ],
+    mitre: 'T1497'
+  },
   detached_process: {
     id: 'MUADDIB-AST-012',
     name: 'Detached Background Process',

package/src/scanner/ast-detectors/anti-evasion.js

@@ -0,0 +1,90 @@
+'use strict';
+
+/**
+ * Anti-analysis / sandbox-evasion detection (2026, born from the @longzy "Contagious
+ * Interview" DPRK npm campaign — whose payload charcode-encodes a `MUADDIB_GVISOR` check to
+ * refuse detonation inside our sandbox).
+ *
+ * Design stance: we do NOT try to HIDE the sandbox. That is an unwinnable arms race — gVisor
+ * is detectable via /proc, syscall quirks and timing, and an attacker re-reads our public
+ * repo. Instead we detect the EVASION ITSELF, statically. That is durable and lose-lose for
+ * the attacker: evade → this convicts them (immune to any env-hiding, because it reads code);
+ * don't evade → the dynamic sandbox detonates them.
+ *
+ * Two complementary, marker-AGNOSTIC-first signals (emitted in handlePostWalk):
+ *
+ *   1. analyzer_honeytoken_reference (CRITICAL, FP~0) — the file hides, behind charcode
+ *      encoding, a reference to a known analysis-environment tripwire (our own
+ *      `MUADDIB_GVISOR`, a peer analyzer's marker, a poison-token name). We match ONLY the
+ *      obfuscated form: legitimate security tooling (incl. MUAD'DIB's own sandbox code)
+ *      references these markers in the clear, but no benign package charcode-encodes a check
+ *      for one. This deliberately weaponises our sandbox marker as a HONEYTOKEN — we keep
+ *      `MUADDIB_GVISOR` public and STABLE precisely so any package that checks for it
+ *      self-incriminates. Hiding/rotating it would throw the honeytoken away for nothing.
+ *
+ *   2. the structural "detonation-gate wall" (see countExitGuards / hasHostRecon, combined
+ *      with env-read + obfuscation in handlePostWalk) — a stack of silent process.exit()
+ *      guards that read the environment. Keys on the SHAPE, so it catches NOVEL markers a
+ *      signature list never would. FP-safe by coupling, not breadth.
+ *
+ * Both are static → immune to sandbox-hiding, and both fire regardless of whether the
+ * (secondary, LOG-ONLY) dynamic sandbox ever runs.
+ */
+
+// Analysis-environment tripwire markers with ZERO legitimate reason to be *charcode-hidden*
+// inside a package. Curated for near-zero FP: excludes AWS doc example keys
+// (AKIAIOSFODNN7EXAMPLE) which legitimately appear in tutorials/tests. Keep this list stable
+// and public — every entry is a planted honeytoken.
+const ANALYZER_MARKERS = [
+  'MUADDIB_GVISOR',        // our own sandbox marker — the primary honeytoken
+  'DetonationLogFilePath',
+  'THREAT_ANALYZER_MODEL',
+  'ASPECT_TLOG',
+  'PYPI_POISON',
+  'SANDYCLAW_',
+  'OPENCLAW_',
+  'PERMISO_',
+  'CHAINRADAR_'
+];
+
+// Bound the charcode-array decode so a pathological file can't blow the CPU budget.
+const MAX_DECODE_ARRAYS = 300;
+// A char-code array literal: >=6 small integers, e.g. [77,85,65,68,68,73,66,...].
+const CHARCODE_ARRAY_RE = /\[\s*(\d{1,3}(?:\s*,\s*\d{1,3}){5,})\s*\]/g;
+
+/**
+ * Return the first analyzer marker that appears CHARCODE-ENCODED in `content` (i.e. hidden
+ * inside a numeric array literal that decodes to a string containing the marker), or null.
+ * Plaintext references are intentionally ignored (see module doc). Bounded, side-effect-free.
+ */
+function detectAnalyzerHoneytoken(content) {
+  if (!content || content.indexOf('[') === -1) return null;
+  CHARCODE_ARRAY_RE.lastIndex = 0;
+  let match, seen = 0;
+  while ((match = CHARCODE_ARRAY_RE.exec(content)) !== null) {
+    if (++seen > MAX_DECODE_ARRAYS) break;
+    const nums = match[1].split(',').map(n => parseInt(n, 10));
+    // Only decode arrays that are entirely printable ASCII codes (a real hidden string).
+    if (nums.some(n => !(n >= 9 && n <= 126))) continue;
+    let decoded;
+    try { decoded = String.fromCharCode.apply(null, nums); } catch { continue; }
+    for (const m of ANALYZER_MARKERS) {
+      if (decoded.indexOf(m) !== -1) return m;
+    }
+  }
+  return null;
+}
+
+/** Count silent `process.exit(` guards — the magnitude of the "detonation-gate wall". */
+function countExitGuards(content) {
+  if (!content) return 0;
+  const m = content.match(/process\s*\.\s*exit\s*\(/g);
+  return m ? m.length : 0;
+}
+
+/** Host/environment reconnaissance calls (note: `os` is often aliased, e.g. `_os.hostname()`). */
+function hasHostRecon(content) {
+  return !!content && /\.\s*(?:hostname|userInfo|networkInterfaces)\s*\(/.test(content);
+}
+
+module.exports = { ANALYZER_MARKERS, detectAnalyzerHoneytoken, countExitGuards, hasHostRecon };

package/src/scanner/ast-detectors/handle-member-expression.js

@@ -74,6 +74,25 @@ function handleMemberExpression(node, ctx) {
       }
     }
   }
+
+  // AST-018 alias fix (@longzy): `var env = process.env; env[_decode([...])]` reaches env via
+  // an alias, so the direct `process.env[x]` match above misses it. Close ONLY the
+  // charcode-reconstruction signal for aliases (computed access + String.fromCharCode in the
+  // file) — we deliberately do NOT emit the generic env_access MEDIUM for aliases, keeping FPR
+  // flat; the HIGH signal fires only on the malicious obfuscated-key shape.
+  if (
+    node.computed &&
+    ctx.hasFromCharCode &&
+    node.object?.type === 'Identifier' &&
+    ctx.envAliases && ctx.envAliases.has(node.object.name)
+  ) {
+    ctx.threats.push({
+      type: 'env_charcode_reconstruction',
+      severity: 'HIGH',
+      message: 'process.env (accessed via an alias) reads a dynamically reconstructed key (String.fromCharCode obfuscation).',
+      file: ctx.relFile
+    });
+  }
 }
 
 

package/src/scanner/ast-detectors/handle-post-walk.js

@@ -3,6 +3,41 @@
 const { networkDestinationsAllBenign } = require('../../sdk-destination.js');
 
 function handlePostWalk(ctx) {
+  // ── Anti-analysis / sandbox evasion (2026, @longzy DPRK "Contagious Interview") ──
+  // We detect the EVASION rather than trying to hide the sandbox (an unwinnable arms race).
+  //  (1) analyzer_honeytoken_reference (CRITICAL, FP~0): the file hides — behind charcode
+  //      encoding — a check for a known analysis-environment tripwire (our own MUADDIB_GVISOR,
+  //      a peer analyzer marker, a poison-token name). Only the OBFUSCATED form is matched, so
+  //      MUAD'DIB's own sandbox code (plaintext) and legit security tooling never trip it. The
+  //      marker is a planted honeytoken: kept public+stable so any checker self-incriminates.
+  //  (2) anti_analysis_evasion (HIGH): the structural "detonation-gate wall" — >=5 silent
+  //      process.exit() guards that read the environment, plus charcode obfuscation OR host
+  //      reconnaissance. Marker-AGNOSTIC (keys on the shape → catches novel markers). FP-safe
+  //      by coupling: no benign package stacks 5+ process.exit guards with obfuscated env/host
+  //      recon. Suppressed in dist/build (minified bundles can inflate the raw counts).
+  if (ctx.analyzerHoneytokenHit) {
+    ctx.threats.push({
+      type: 'analyzer_honeytoken_reference',
+      severity: 'CRITICAL',
+      message: `Charcode-hidden reference to an analysis-environment marker ("${ctx.analyzerHoneytokenHit}") — sandbox/analyzer evasion. No legitimate package obfuscates a check for this tripwire.`,
+      file: ctx.relFile
+    });
+  } else if (
+    ctx.antiAnalysisExitCount >= 5 &&
+    ctx.hasProcessEnvRead &&
+    (ctx.hasFromCharCode || ctx.hasHostRecon)
+  ) {
+    const isDistFile = /^(?:dist|build|out|output)[/\\]/i.test(ctx.relFile) || /\.(?:bundle|min)\.js$/i.test(ctx.relFile);
+    if (!isDistFile) {
+      ctx.threats.push({
+        type: 'anti_analysis_evasion',
+        severity: 'HIGH',
+        message: `Anti-analysis detonation-gate: ${ctx.antiAnalysisExitCount} silent process.exit() guards reading the environment${ctx.hasFromCharCode ? ', charcode-obfuscated' : ''}${ctx.hasHostRecon ? ', with host reconnaissance' : ''} — payload refuses to run under analysis (sandbox/CI/honeypot evasion).`,
+        file: ctx.relFile
+      });
+    }
+  }
+
   // SANDWORM_MODE: zlib inflate + base64 decode + eval/Function/Module._compile = obfuscated payload
   if (ctx.hasZlibInflate && ctx.hasBase64Decode && ctx.hasDynamicExec) {
     // FIX 4: dist/build files get LOW severity (bundlers legitimately use zlib+base64+eval)

package/src/scanner/ast-detectors/handle-variable-declarator.js

@@ -24,6 +24,14 @@ function handleVariableDeclarator(node, ctx) {
       ctx.staticAssignments.add(node.id.name);
     }
 
+    // AST-018 alias capture (@longzy): `var env = process.env` — record the alias so a later
+    // `env[String.fromCharCode(...)]` access resolves back to process.env in the member handler.
+    if (ctx.envAliases && node.init?.type === 'MemberExpression' && !node.init.computed &&
+        node.init.object?.type === 'Identifier' && node.init.object.name === 'process' &&
+        node.init.property?.type === 'Identifier' && node.init.property.name === 'env') {
+      ctx.envAliases.add(node.id.name);
+    }
+
     // v2.10.73 P2: Track WHERE the variable's value originated — used by AST-006
     // to distinguish plugin loaders (LOW) from real obfuscation (HIGH) from
     // credential exfil vectors (CRITICAL). See src/scanner/ast-detectors/handle-call-expression.js

package/src/scanner/ast.js

@@ -13,6 +13,7 @@ const {
   handleWithStatement,
   handlePostWalk
 } = require('./ast-detectors');
+const { detectAnalyzerHoneytoken, countExitGuards, hasHostRecon } = require('./ast-detectors/anti-evasion.js');
 
 // Check if credential keywords appear INSIDE regex literals or new RegExp() patterns.
 // Only true when the keyword is part of the regex pattern itself, not just a string elsewhere in the file.
@@ -152,11 +153,19 @@ function analyzeFile(content, filePath, basePath) {
       return names;
     })(),
     evalAliases: new Map(),           // B1: variable name → 'eval'|'Function'
+    envAliases: new Set(),            // AST-018 alias fix: names bound to process.env (`var env = process.env`)
     moduleLoadDirectAliases: new Set(), // B3: destructured _load from require('module')
     objectPropertyMap: new Map(),     // B5: objName → Map<propName, stringValue>
     concatValues: new Map(),          // B2: varName → { value, operands } for concat strings with ≥3 operands
     stringVarValues: new Map(),       // Variable reassignment tracking: varName → string value
     hasFromCharCode: content.includes('fromCharCode'),
+    // Anti-analysis / sandbox evasion (2026, @longzy DPRK). Structural "detonation-gate wall"
+    // magnitude + host recon + a charcode-hidden analyzer-honeytoken reference. Aggregated in
+    // handlePostWalk. See ast-detectors/anti-evasion.js.
+    antiAnalysisExitCount: countExitGuards(content),
+    hasHostRecon: hasHostRecon(content),
+    hasProcessEnvRead: /process\s*\.\s*env\b/.test(content),
+    analyzerHoneytokenHit: detectAnalyzerHoneytoken(content),
     hasJsReverseShell: /\bnet\.Socket\b/.test(content) &&
       /\.connect\s*\(/.test(content) &&
       /\.pipe\b/.test(content) &&

package/src/shared/extract-pool-worker.js

@@ -0,0 +1,30 @@
+'use strict';
+
+/**
+ * Persistent worker for the extraction pool (src/shared/extract-pool.js).
+ *
+ * Unlike extract-worker.js (one-shot, used by download.js extractArchiveOffThread),
+ * this worker stays alive and serves a request/response loop: one extraction per
+ * message, reusing the loaded extractArchive + adm-zip across packages so the pool
+ * pays no per-package Worker-spawn cost. All extraction hardening (zip-slip,
+ * zip-bomb uncompressed-size cap) lives in extractArchive and runs HERE, off the
+ * parent's event loop. Each reply echoes the job id so the pool matches it to the
+ * caller. Never throws to the thread — failures come back as { ok:false, error }.
+ *
+ * Message in:  { id, archivePath, destDir, format? }
+ * Message out: { id, ok:true, dir } | { id, ok:false, error }
+ */
+
+const { parentPort } = require('worker_threads');
+const { extractArchive } = require('./download.js');
+
+parentPort.on('message', (job) => {
+  if (!job || typeof job.id === 'undefined') return;
+  try {
+    const opts = job.format ? { format: job.format } : {};
+    const dir = extractArchive(job.archivePath, job.destDir, opts);
+    parentPort.postMessage({ id: job.id, ok: true, dir });
+  } catch (err) {
+    parentPort.postMessage({ id: job.id, ok: false, error: err && err.message ? err.message : String(err) });
+  }
+});

package/src/shared/extract-pool.js

@@ -0,0 +1,217 @@
+'use strict';
+
+/**
+ * Persistent worker-thread pool for off-main-thread archive extraction.
+ *
+ * Why a pool, not download.js extractArchiveOffThread (spawn-per-call): the
+ * monitor extracts thousands of small packages on its main thread. The
+ * spawn-per-call offloader pays a fresh Worker (V8 isolate + module load,
+ * ~10-40ms) every time, which is why queue.js gated it to archives > 4MB and
+ * ran everything smaller INLINE (synchronous extractArchive). Those inline
+ * extractions are exactly what wedge the event loop: adm-zip `extractAllTo` is
+ * fully synchronous and slow on many-file trees regardless of total size
+ * (data/loop-stalls.jsonl: `extract:prework` up to 229s; a 2MB many-file
+ * package blocks 5s+). A wedged loop starves the RSS breaker / memory governor /
+ * EMERGENCY purge (all main-thread timers) → restart.
+ *
+ * A pool of N reusable workers removes BOTH costs: no extraction ever runs on
+ * the main thread (at any size), and there is no per-package spawn. The size
+ * gate in queue.js then becomes unnecessary (its inline window defaults to 0).
+ *
+ * Each worker runs extract-pool-worker.js — a request/response loop that calls
+ * the SAME extractArchive, so all hardening (zip-slip, zip-bomb uncompressed
+ * cap) stays centralized there and runs in the worker.
+ *
+ * Bounded + crash-resilient (CLAUDE.md "Production Engineering"):
+ *  - POOL_SIZE workers max, spawned lazily on demand; idle workers are `unref`'d
+ *    so the pool never keeps the process alive on its own.
+ *  - One job per worker; excess jobs wait in a FIFO bounded to MAX_PENDING —
+ *    past the cap a job rejects immediately (the caller treats it as an extract
+ *    failure → size_skip, ledgered) so a slow extractor cannot grow memory
+ *    without bound.
+ *  - Per-job timeout terminates and drops a wedged worker and rejects that job —
+ *    a pathological archive cannot pin a slot forever.
+ *  - A worker that errors or exits mid-job rejects its in-flight job and is
+ *    removed; the next dispatch lazily respawns up to POOL_SIZE.
+ */
+
+const path = require('path');
+
+const POOL_SIZE = (() => {
+  const v = parseInt(process.env.MUADDIB_EXTRACT_POOL_SIZE, 10);
+  if (Number.isFinite(v) && v >= 1) return v;
+  let cores = 4;
+  try { cores = require('os').cpus().length || 4; } catch { /* default 4 */ }
+  return Math.max(2, Math.min(4, cores - 2));
+})();
+
+const JOB_TIMEOUT_MS = (() => {
+  const v = parseInt(process.env.MUADDIB_EXTRACT_POOL_TIMEOUT_MS, 10);
+  return Number.isFinite(v) && v > 0 ? v : 120_000;
+})();
+
+const MAX_PENDING = (() => {
+  const v = parseInt(process.env.MUADDIB_EXTRACT_POOL_MAX_PENDING, 10);
+  return Number.isFinite(v) && v > 0 ? v : 512;
+})();
+
+const WORKER_FILE = path.join(__dirname, 'extract-pool-worker.js');
+
+// Pool state (lazy-init on first extractInPool). Each worker entry:
+// { worker, busy, job }. `pending` is the FIFO of jobs waiting for a free slot.
+let workers = [];
+let pending = [];
+let jobSeq = 0;
+let destroyed = false;
+
+function _settle(job, err, dir) {
+  if (job.settled) return;
+  job.settled = true;
+  if (job.timer) { clearTimeout(job.timer); job.timer = null; }
+  if (err) job.reject(err);
+  else job.resolve(dir);
+}
+
+function _removeWorker(entry) {
+  const i = workers.indexOf(entry);
+  if (i !== -1) workers.splice(i, 1);
+}
+
+function _spawnWorker() {
+  const { Worker } = require('worker_threads');
+  const entry = { worker: null, busy: false, job: null };
+  const w = new Worker(WORKER_FILE);
+  entry.worker = w;
+  // Idle workers must not keep the process alive; an in-flight job is kept alive
+  // by the caller's awaited Promise, not by the worker handle.
+  if (typeof w.unref === 'function') w.unref();
+  w.on('message', (msg) => _onMessage(entry, msg));
+  w.on('error', (err) => _onWorkerError(entry, err));
+  w.on('exit', (code) => _onWorkerExit(entry, code));
+  workers.push(entry);
+  return entry;
+}
+
+function _onMessage(entry, msg) {
+  const job = entry.job;
+  entry.busy = false;
+  entry.job = null;
+  if (job && msg && msg.id === job.id) {
+    if (msg.ok) _settle(job, null, msg.dir);
+    else _settle(job, new Error(msg.error || 'extract-pool: worker reported failure'));
+  }
+  _dispatch();
+}
+
+function _onWorkerError(entry, err) {
+  const job = entry.job;
+  entry.busy = false;
+  entry.job = null;
+  _removeWorker(entry);
+  if (job) _settle(job, err instanceof Error ? err : new Error(String(err)));
+  _dispatch();
+}
+
+function _onWorkerExit(entry, code) {
+  const job = entry.job;
+  entry.busy = false;
+  entry.job = null;
+  _removeWorker(entry);
+  if (job) _settle(job, new Error(`extract-pool: worker exited (${code}) mid-job`));
+  _dispatch();
+}
+
+function _assign(entry, job) {
+  entry.busy = true;
+  entry.job = job;
+  job.timer = setTimeout(() => {
+    // Worker is wedged on a pathological archive: terminate it (best-effort) and
+    // drop it from the pool, reject the job, let _dispatch respawn lazily.
+    entry.busy = false;
+    entry.job = null;
+    _removeWorker(entry);
+    try { entry.worker.terminate(); } catch { /* already gone */ }
+    _settle(job, new Error(`extract-pool: timeout after ${JOB_TIMEOUT_MS}ms: ${path.basename(job.archivePath)}`));
+    _dispatch();
+  }, JOB_TIMEOUT_MS);
+  if (job.timer && typeof job.timer.unref === 'function') job.timer.unref();
+  entry.worker.postMessage({ id: job.id, archivePath: job.archivePath, destDir: job.destDir, format: job.format });
+}
+
+function _dispatch() {
+  if (destroyed) return;
+  while (pending.length > 0) {
+    let entry = workers.find((e) => !e.busy);
+    if (!entry) {
+      if (workers.length < POOL_SIZE) entry = _spawnWorker();
+      else break; // all workers busy and at cap — wait for a completion
+    }
+    _assign(entry, pending.shift());
+  }
+}
+
+/**
+ * Extract an archive off the main thread via the pool. Same contract as
+ * download.js extractArchive (resolves to the extracted package root) but never
+ * blocks the caller's event loop.
+ *
+ * @param {string} archivePath
+ * @param {string} destDir  - must already exist
+ * @param {Object} [options]
+ * @param {'targz'|'zip'} [options.format] - override auto-detection
+ * @returns {Promise<string>} extracted package root
+ */
+function extractInPool(archivePath, destDir, options = {}) {
+  return new Promise((resolve, reject) => {
+    if (destroyed) { reject(new Error('extract-pool: pool destroyed')); return; }
+    if (pending.length >= MAX_PENDING) {
+      reject(new Error(`extract-pool: pending queue full (${MAX_PENDING}) — extraction is not keeping up`));
+      return;
+    }
+    const job = {
+      id: ++jobSeq,
+      archivePath,
+      destDir,
+      format: (options && options.format) || null,
+      resolve,
+      reject,
+      settled: false,
+      timer: null,
+    };
+    pending.push(job);
+    _dispatch();
+  });
+}
+
+/**
+ * Terminate all workers and reject any in-flight / pending jobs. Idempotent and
+ * reusable: after it resolves the pool lazily re-inits on the next extractInPool
+ * (the daemon calls this once during gracefulShutdown; tests call it between
+ * cases).
+ * @returns {Promise<void>}
+ */
+async function destroyExtractPool() {
+  destroyed = true;
+  const inflight = workers.slice();
+  const queued = pending.slice();
+  workers = [];
+  pending = [];
+  for (const job of queued) _settle(job, new Error('extract-pool: pool destroyed'));
+  await Promise.all(inflight.map((entry) => {
+    if (entry.job) _settle(entry.job, new Error('extract-pool: pool destroyed'));
+    try { return entry.worker.terminate(); } catch { return Promise.resolve(); }
+  }));
+  destroyed = false;
+}
+
+/** Observability snapshot (live workers / busy / pending), all bounded. */
+function getPoolStats() {
+  return {
+    size: workers.length,
+    max: POOL_SIZE,
+    busy: workers.filter((e) => e.busy).length,
+    pending: pending.length,
+  };
+}
+
+module.exports = { extractInPool, destroyExtractPool, getPoolStats, POOL_SIZE };