muaddib-scanner 2.11.136 → 2.11.138

package/README.md

@@ -30,7 +30,7 @@
 
 npm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond.
 
-MUAD'DIB combines **20 parallel scanners** (266 detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **compound scoring** (17 compound rules), and a gVisor/Docker sandbox to detect known threats and suspicious behavioral patterns in npm and PyPI packages. An XGBoost classifier exists in the codebase but is **currently inactive** (see [Evaluation Metrics](#evaluation-metrics) → ML Classifier section).
+MUAD'DIB combines **20 parallel scanners** (274 detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **compound scoring** (17 compound rules), and a gVisor/Docker sandbox to detect known threats and suspicious behavioral patterns in npm and PyPI packages. An XGBoost classifier exists in the codebase but is **currently inactive** (see [Evaluation Metrics](#evaluation-metrics) → ML Classifier section).
 
 ---
 
@@ -202,9 +202,9 @@ muaddib replay                     # Ground truth validation (90/94 TPR@3, v2.11
 | Python Source (PYSRC) | Import-time / install-time RCE patterns in `__init__.py` / `setup.py` (v2.11.41 — closes TrapDoor PyPI gap) |
 | Python AST (PYAST) | Tree-sitter-Python AST with taint-aware detectors (v2.11.42+) |
 
-### 266 detection rules
+### 274 detection rules
 
-All rules (261 RULES + 5 PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v211117) for the complete rules reference.
+All rules (269 RULES + 5 PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v211117) for the complete rules reference.
 
 ### Detected campaigns
 
@@ -401,7 +401,7 @@ npm test
 - [Documentation Index](docs/INDEX.md) - All documentation in one place
 - [Evaluation Methodology](docs/EVALUATION_METHODOLOGY.md) - Experimental protocol, holdout scores
 - [Threat Model](docs/threat-model.md) - What MUAD'DIB detects and doesn't detect
-- [Security Policy](SECURITY.md) - Detection rules reference (261 rules)
+- [Security Policy](SECURITY.md) - Detection rules reference (269 rules)
 - [Security Audit](docs/SECURITY_AUDIT.md) - Bypass validation report
 - [FP Analysis](docs/EVALUATION.md) - Historical false positive analysis
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.136",
+  "version": "2.11.138",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.136.json → self-scan-v2.11.138.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-06-30T19:55:27.666Z",
+  "timestamp": "2026-07-01T11:04:30.753Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/monitor/daemon.js

@@ -635,7 +635,13 @@ function handleMemoryPressure(level, ratio, rssRatio, recentlyScanned, downloads
       // first (newest survive — most likely to still exist for re-scan), protected only as
       // a last resort, and LEDGERS every drop. Closes the v2.10.88 gap where the raw
       // splice(0,n) silently dropped protected scans (CLAUDE.md "ne jamais perdre de scan").
-      const { dropped, droppedProtected, spilled } = evictFromScanQueueBulk(scanQueue, EMERGENCY_QUEUE_KEEP, 'mem_emergency');
+      // IOC-aware anti-spill: never shed a queued name already known-malicious in the IOC DB.
+      // loadCachedIOCs() is a 10s-throttled singleton the daemon keeps warm (queue.js calls it
+      // per scan), so this is a ref-return — not a fresh alloc — even inside the reclaim path.
+      // Best-effort: on any failure the index is null and eviction falls back to prior behavior.
+      let _iocIndex = null;
+      try { _iocIndex = require('../ioc/updater.js').loadCachedIOCs(); } catch { /* degrade to prior behavior */ }
+      const { dropped, droppedProtected, spilled } = evictFromScanQueueBulk(scanQueue, EMERGENCY_QUEUE_KEEP, 'mem_emergency', null, { iocIndex: _iocIndex });
       summary.queueDropped = dropped;
       summary.queueDroppedProtected = droppedProtected;
       summary.queueSpilled = spilled || 0;

package/src/monitor/scan-queue.js

@@ -32,6 +32,20 @@ function _isProtected(item) {
   return !!(item && (item.isIOCMatch || item.isBurst || item.firstPublish || item.atoSignal || item.isATOBurstExtra || item.interrupted));
 }
 
+// IOC-aware anti-spill (2026-07, @longzy DPRK campaign post-mortem): a queued package whose
+// NAME is already in the IOC database is known-malicious, and confirming it is a cheap name
+// lookup — so it must never be shed under memory pressure, even when its enqueue-time
+// `isIOCMatch` flag is stale (the IOC DB refreshed while the item sat in the backlog) or was
+// version-gated. Name-level: a wildcard (all-versions-malicious) OR any specific-version entry
+// counts. Best-effort — a missing/malformed index yields false (the exact prior behavior).
+function _isIOCKnownByName(item, iocIndex) {
+  if (!item || !item.name || !iocIndex) return false;
+  const wild = iocIndex.wildcardPackages;
+  const pkgs = iocIndex.packagesMap;
+  return !!((wild && typeof wild.has === 'function' && wild.has(item.name)) ||
+            (pkgs && typeof pkgs.has === 'function' && pkgs.has(item.name)));
+}
+
 // How far from the head we scan for an unprotected victim. Protected items are a small
 // fraction of the flood, so a victim is almost always found within a few slots; the bound
 // keeps eviction O(window) under sustained overflow (CLAUDE.md §2 bounded resources).
@@ -113,18 +127,32 @@ function enqueueScan(scanQueue, item, stats, max = MAX_SCAN_QUEUE) {
  * the daemon (which holds the same array reference) sees the mutation. Best-effort ledger;
  * never throws. `ledgerFn` is injectable for tests; defaults to state.appendScanLedger.
  *
+ * `opts.iocIndex` (optional {packagesMap, wildcardPackages}) additionally protects any queued
+ * NAME already in the IOC DB from being shed — a known-malicious package must never be lost to
+ * memory pressure (IOC-aware anti-spill). Injected by the daemon (the live 10s-singleton), not
+ * auto-loaded here, so callers that omit it keep the exact prior behavior.
+ *
  * @returns {{dropped:number, droppedProtected:number}}
  */
-function evictFromScanQueueBulk(scanQueue, targetKeep, source = 'bulk_evict', ledgerFn = null) {
+function evictFromScanQueueBulk(scanQueue, targetKeep, source = 'bulk_evict', ledgerFn = null, opts = {}) {
   const before = scanQueue.length;
   const keep = Math.max(0, targetKeep | 0);
   if (before <= keep) return { dropped: 0, droppedProtected: 0 };
   const toDrop = before - keep;
 
-  // Victim set: oldest unprotected first, then (only if short) oldest protected.
+  // IOC-aware anti-spill: on top of the standard _isProtected classes, protect any queued
+  // NAME already in the IOC DB. The index is INJECTED (daemon passes the live 10s-singleton;
+  // tests pass a fabricated one) — no auto-load here, so callers that omit it keep the exact
+  // prior behavior (and unit paths don't drag in the 237MB DB).
+  const iocIndex = opts.iocIndex || null;
+  const isKept = iocIndex
+    ? (item) => _isProtected(item) || _isIOCKnownByName(item, iocIndex)
+    : _isProtected;
+
+  // Victim set: oldest unkept first, then (only if short) oldest kept item.
   const dropSet = new Set();
   for (let i = 0; i < before && dropSet.size < toDrop; i++) {
-    if (!_isProtected(scanQueue[i])) dropSet.add(i);
+    if (!isKept(scanQueue[i])) dropSet.add(i);
   }
   let droppedProtected = 0;
   if (dropSet.size < toDrop) {
@@ -172,7 +200,7 @@ function evictFromScanQueueBulk(scanQueue, targetKeep, source = 'bulk_evict', le
       appendLedger({
         name: item.name, version: item.version, ecosystem: item.ecosystem,
         outcome: spilled ? 'spilled' : 'dropped',
-        source: (_isProtected(item) ? `${source}_protected` : source) + (spilled ? '_spill' : ''),
+        source: (isKept(item) ? `${source}_protected` : source) + (spilled ? '_spill' : ''),
         // AUDIT-A1 observability: record whether a DROPPED item was a first-publish
         // (real coverage loss) vs a burst-extra (version-spam, expected). Lets us
         // measure if the memory breaker is evicting genuine new packages.

package/src/rules/index.js

@@ -1129,6 +1129,32 @@ const RULES = {
     references: ['https://attack.mitre.org/techniques/T1497/001/'],
     mitre: 'T1497.001'
   },
+  anti_analysis_evasion: {
+    id: 'MUADDIB-AST-095',
+    name: 'Anti-Analysis Detonation Gate',
+    severity: 'HIGH',
+    confidence: 'high',
+    domain: 'malware',
+    description: 'Mur de gardes process.exit() silencieuses (>=5) couplees a de la lecture d\'environnement (process.env) et a de l\'obfuscation charcode OU de la reconnaissance hote (hostname/userInfo/networkInterfaces) — le payload refuse de s\'executer sous analyse (sandbox/CI/honeypot). Detection STRUCTURELLE (la forme du mur), agnostique aux marqueurs, donc robuste aux marqueurs inedits. Contre-mesure durable a l\'evasion : evader => detecte en statique ; ne pas evader => detone en sandbox.',
+    references: [
+      'https://attack.mitre.org/techniques/T1497/',
+      'https://attack.mitre.org/techniques/T1497/001/'
+    ],
+    mitre: 'T1497'
+  },
+  analyzer_honeytoken_reference: {
+    id: 'MUADDIB-AST-096',
+    name: 'Analyzer Honeytoken Reference',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    domain: 'malware',
+    description: 'Reference DISSIMULEE en charcodes a un marqueur d\'environnement d\'analyse — marqueur de sandbox MUAD\'DIB (MUADDIB_GVISOR), marqueur d\'un analyseur pair, ou nom de poison-token. Seule la forme obfusquee est matchee : le code de sandbox de MUAD\'DIB lui-meme et l\'outillage securite legitime referencent ces marqueurs en clair sans risque. Aucun package legitime n\'encode un check pour ces tripwires. Le marqueur est un honeytoken plante : garde public et stable pour que tout verificateur s\'auto-incrimine.',
+    references: [
+      'https://attack.mitre.org/techniques/T1497/',
+      'https://attack.mitre.org/techniques/T1480/'
+    ],
+    mitre: 'T1497'
+  },
   detached_process: {
     id: 'MUADDIB-AST-012',
     name: 'Detached Background Process',

package/src/scanner/ast-detectors/anti-evasion.js

@@ -0,0 +1,90 @@
+'use strict';
+
+/**
+ * Anti-analysis / sandbox-evasion detection (2026, born from the @longzy "Contagious
+ * Interview" DPRK npm campaign — whose payload charcode-encodes a `MUADDIB_GVISOR` check to
+ * refuse detonation inside our sandbox).
+ *
+ * Design stance: we do NOT try to HIDE the sandbox. That is an unwinnable arms race — gVisor
+ * is detectable via /proc, syscall quirks and timing, and an attacker re-reads our public
+ * repo. Instead we detect the EVASION ITSELF, statically. That is durable and lose-lose for
+ * the attacker: evade → this convicts them (immune to any env-hiding, because it reads code);
+ * don't evade → the dynamic sandbox detonates them.
+ *
+ * Two complementary, marker-AGNOSTIC-first signals (emitted in handlePostWalk):
+ *
+ *   1. analyzer_honeytoken_reference (CRITICAL, FP~0) — the file hides, behind charcode
+ *      encoding, a reference to a known analysis-environment tripwire (our own
+ *      `MUADDIB_GVISOR`, a peer analyzer's marker, a poison-token name). We match ONLY the
+ *      obfuscated form: legitimate security tooling (incl. MUAD'DIB's own sandbox code)
+ *      references these markers in the clear, but no benign package charcode-encodes a check
+ *      for one. This deliberately weaponises our sandbox marker as a HONEYTOKEN — we keep
+ *      `MUADDIB_GVISOR` public and STABLE precisely so any package that checks for it
+ *      self-incriminates. Hiding/rotating it would throw the honeytoken away for nothing.
+ *
+ *   2. the structural "detonation-gate wall" (see countExitGuards / hasHostRecon, combined
+ *      with env-read + obfuscation in handlePostWalk) — a stack of silent process.exit()
+ *      guards that read the environment. Keys on the SHAPE, so it catches NOVEL markers a
+ *      signature list never would. FP-safe by coupling, not breadth.
+ *
+ * Both are static → immune to sandbox-hiding, and both fire regardless of whether the
+ * (secondary, LOG-ONLY) dynamic sandbox ever runs.
+ */
+
+// Analysis-environment tripwire markers with ZERO legitimate reason to be *charcode-hidden*
+// inside a package. Curated for near-zero FP: excludes AWS doc example keys
+// (AKIAIOSFODNN7EXAMPLE) which legitimately appear in tutorials/tests. Keep this list stable
+// and public — every entry is a planted honeytoken.
+const ANALYZER_MARKERS = [
+  'MUADDIB_GVISOR',        // our own sandbox marker — the primary honeytoken
+  'DetonationLogFilePath',
+  'THREAT_ANALYZER_MODEL',
+  'ASPECT_TLOG',
+  'PYPI_POISON',
+  'SANDYCLAW_',
+  'OPENCLAW_',
+  'PERMISO_',
+  'CHAINRADAR_'
+];
+
+// Bound the charcode-array decode so a pathological file can't blow the CPU budget.
+const MAX_DECODE_ARRAYS = 300;
+// A char-code array literal: >=6 small integers, e.g. [77,85,65,68,68,73,66,...].
+const CHARCODE_ARRAY_RE = /\[\s*(\d{1,3}(?:\s*,\s*\d{1,3}){5,})\s*\]/g;
+
+/**
+ * Return the first analyzer marker that appears CHARCODE-ENCODED in `content` (i.e. hidden
+ * inside a numeric array literal that decodes to a string containing the marker), or null.
+ * Plaintext references are intentionally ignored (see module doc). Bounded, side-effect-free.
+ */
+function detectAnalyzerHoneytoken(content) {
+  if (!content || content.indexOf('[') === -1) return null;
+  CHARCODE_ARRAY_RE.lastIndex = 0;
+  let match, seen = 0;
+  while ((match = CHARCODE_ARRAY_RE.exec(content)) !== null) {
+    if (++seen > MAX_DECODE_ARRAYS) break;
+    const nums = match[1].split(',').map(n => parseInt(n, 10));
+    // Only decode arrays that are entirely printable ASCII codes (a real hidden string).
+    if (nums.some(n => !(n >= 9 && n <= 126))) continue;
+    let decoded;
+    try { decoded = String.fromCharCode.apply(null, nums); } catch { continue; }
+    for (const m of ANALYZER_MARKERS) {
+      if (decoded.indexOf(m) !== -1) return m;
+    }
+  }
+  return null;
+}
+
+/** Count silent `process.exit(` guards — the magnitude of the "detonation-gate wall". */
+function countExitGuards(content) {
+  if (!content) return 0;
+  const m = content.match(/process\s*\.\s*exit\s*\(/g);
+  return m ? m.length : 0;
+}
+
+/** Host/environment reconnaissance calls (note: `os` is often aliased, e.g. `_os.hostname()`). */
+function hasHostRecon(content) {
+  return !!content && /\.\s*(?:hostname|userInfo|networkInterfaces)\s*\(/.test(content);
+}
+
+module.exports = { ANALYZER_MARKERS, detectAnalyzerHoneytoken, countExitGuards, hasHostRecon };

package/src/scanner/ast-detectors/handle-member-expression.js

@@ -74,6 +74,25 @@ function handleMemberExpression(node, ctx) {
       }
     }
   }
+
+  // AST-018 alias fix (@longzy): `var env = process.env; env[_decode([...])]` reaches env via
+  // an alias, so the direct `process.env[x]` match above misses it. Close ONLY the
+  // charcode-reconstruction signal for aliases (computed access + String.fromCharCode in the
+  // file) — we deliberately do NOT emit the generic env_access MEDIUM for aliases, keeping FPR
+  // flat; the HIGH signal fires only on the malicious obfuscated-key shape.
+  if (
+    node.computed &&
+    ctx.hasFromCharCode &&
+    node.object?.type === 'Identifier' &&
+    ctx.envAliases && ctx.envAliases.has(node.object.name)
+  ) {
+    ctx.threats.push({
+      type: 'env_charcode_reconstruction',
+      severity: 'HIGH',
+      message: 'process.env (accessed via an alias) reads a dynamically reconstructed key (String.fromCharCode obfuscation).',
+      file: ctx.relFile
+    });
+  }
 }
 
 

package/src/scanner/ast-detectors/handle-post-walk.js

@@ -3,6 +3,41 @@
 const { networkDestinationsAllBenign } = require('../../sdk-destination.js');
 
 function handlePostWalk(ctx) {
+  // ── Anti-analysis / sandbox evasion (2026, @longzy DPRK "Contagious Interview") ──
+  // We detect the EVASION rather than trying to hide the sandbox (an unwinnable arms race).
+  //  (1) analyzer_honeytoken_reference (CRITICAL, FP~0): the file hides — behind charcode
+  //      encoding — a check for a known analysis-environment tripwire (our own MUADDIB_GVISOR,
+  //      a peer analyzer marker, a poison-token name). Only the OBFUSCATED form is matched, so
+  //      MUAD'DIB's own sandbox code (plaintext) and legit security tooling never trip it. The
+  //      marker is a planted honeytoken: kept public+stable so any checker self-incriminates.
+  //  (2) anti_analysis_evasion (HIGH): the structural "detonation-gate wall" — >=5 silent
+  //      process.exit() guards that read the environment, plus charcode obfuscation OR host
+  //      reconnaissance. Marker-AGNOSTIC (keys on the shape → catches novel markers). FP-safe
+  //      by coupling: no benign package stacks 5+ process.exit guards with obfuscated env/host
+  //      recon. Suppressed in dist/build (minified bundles can inflate the raw counts).
+  if (ctx.analyzerHoneytokenHit) {
+    ctx.threats.push({
+      type: 'analyzer_honeytoken_reference',
+      severity: 'CRITICAL',
+      message: `Charcode-hidden reference to an analysis-environment marker ("${ctx.analyzerHoneytokenHit}") — sandbox/analyzer evasion. No legitimate package obfuscates a check for this tripwire.`,
+      file: ctx.relFile
+    });
+  } else if (
+    ctx.antiAnalysisExitCount >= 5 &&
+    ctx.hasProcessEnvRead &&
+    (ctx.hasFromCharCode || ctx.hasHostRecon)
+  ) {
+    const isDistFile = /^(?:dist|build|out|output)[/\\]/i.test(ctx.relFile) || /\.(?:bundle|min)\.js$/i.test(ctx.relFile);
+    if (!isDistFile) {
+      ctx.threats.push({
+        type: 'anti_analysis_evasion',
+        severity: 'HIGH',
+        message: `Anti-analysis detonation-gate: ${ctx.antiAnalysisExitCount} silent process.exit() guards reading the environment${ctx.hasFromCharCode ? ', charcode-obfuscated' : ''}${ctx.hasHostRecon ? ', with host reconnaissance' : ''} — payload refuses to run under analysis (sandbox/CI/honeypot evasion).`,
+        file: ctx.relFile
+      });
+    }
+  }
+
   // SANDWORM_MODE: zlib inflate + base64 decode + eval/Function/Module._compile = obfuscated payload
   if (ctx.hasZlibInflate && ctx.hasBase64Decode && ctx.hasDynamicExec) {
     // FIX 4: dist/build files get LOW severity (bundlers legitimately use zlib+base64+eval)

package/src/scanner/ast-detectors/handle-variable-declarator.js

@@ -24,6 +24,14 @@ function handleVariableDeclarator(node, ctx) {
       ctx.staticAssignments.add(node.id.name);
     }
 
+    // AST-018 alias capture (@longzy): `var env = process.env` — record the alias so a later
+    // `env[String.fromCharCode(...)]` access resolves back to process.env in the member handler.
+    if (ctx.envAliases && node.init?.type === 'MemberExpression' && !node.init.computed &&
+        node.init.object?.type === 'Identifier' && node.init.object.name === 'process' &&
+        node.init.property?.type === 'Identifier' && node.init.property.name === 'env') {
+      ctx.envAliases.add(node.id.name);
+    }
+
     // v2.10.73 P2: Track WHERE the variable's value originated — used by AST-006
     // to distinguish plugin loaders (LOW) from real obfuscation (HIGH) from
     // credential exfil vectors (CRITICAL). See src/scanner/ast-detectors/handle-call-expression.js

package/src/scanner/ast.js

@@ -13,6 +13,7 @@ const {
   handleWithStatement,
   handlePostWalk
 } = require('./ast-detectors');
+const { detectAnalyzerHoneytoken, countExitGuards, hasHostRecon } = require('./ast-detectors/anti-evasion.js');
 
 // Check if credential keywords appear INSIDE regex literals or new RegExp() patterns.
 // Only true when the keyword is part of the regex pattern itself, not just a string elsewhere in the file.
@@ -152,11 +153,19 @@ function analyzeFile(content, filePath, basePath) {
       return names;
     })(),
     evalAliases: new Map(),           // B1: variable name → 'eval'|'Function'
+    envAliases: new Set(),            // AST-018 alias fix: names bound to process.env (`var env = process.env`)
     moduleLoadDirectAliases: new Set(), // B3: destructured _load from require('module')
     objectPropertyMap: new Map(),     // B5: objName → Map<propName, stringValue>
     concatValues: new Map(),          // B2: varName → { value, operands } for concat strings with ≥3 operands
     stringVarValues: new Map(),       // Variable reassignment tracking: varName → string value
     hasFromCharCode: content.includes('fromCharCode'),
+    // Anti-analysis / sandbox evasion (2026, @longzy DPRK). Structural "detonation-gate wall"
+    // magnitude + host recon + a charcode-hidden analyzer-honeytoken reference. Aggregated in
+    // handlePostWalk. See ast-detectors/anti-evasion.js.
+    antiAnalysisExitCount: countExitGuards(content),
+    hasHostRecon: hasHostRecon(content),
+    hasProcessEnvRead: /process\s*\.\s*env\b/.test(content),
+    analyzerHoneytokenHit: detectAnalyzerHoneytoken(content),
     hasJsReverseShell: /\bnet\.Socket\b/.test(content) &&
       /\.connect\s*\(/.test(content) &&
       /\.pipe\b/.test(content) &&