muaddib-scanner 2.11.136 → 2.11.139

package/README.md

@@ -30,7 +30,7 @@
 
 npm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond.
 
-MUAD'DIB combines **20 parallel scanners** (266 detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **compound scoring** (17 compound rules), and a gVisor/Docker sandbox to detect known threats and suspicious behavioral patterns in npm and PyPI packages. An XGBoost classifier exists in the codebase but is **currently inactive** (see [Evaluation Metrics](#evaluation-metrics) → ML Classifier section).
+MUAD'DIB combines **20 parallel scanners** (274 detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **compound scoring** (17 compound rules), and a gVisor/Docker sandbox to detect known threats and suspicious behavioral patterns in npm and PyPI packages. An XGBoost classifier exists in the codebase but is **currently inactive** (see [Evaluation Metrics](#evaluation-metrics) → ML Classifier section).
 
 ---
 
@@ -202,9 +202,9 @@ muaddib replay                     # Ground truth validation (90/94 TPR@3, v2.11
 | Python Source (PYSRC) | Import-time / install-time RCE patterns in `__init__.py` / `setup.py` (v2.11.41 — closes TrapDoor PyPI gap) |
 | Python AST (PYAST) | Tree-sitter-Python AST with taint-aware detectors (v2.11.42+) |
 
-### 266 detection rules
+### 274 detection rules
 
-All rules (261 RULES + 5 PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v211117) for the complete rules reference.
+All rules (269 RULES + 5 PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v211117) for the complete rules reference.
 
 ### Detected campaigns
 
@@ -401,7 +401,7 @@ npm test
 - [Documentation Index](docs/INDEX.md) - All documentation in one place
 - [Evaluation Methodology](docs/EVALUATION_METHODOLOGY.md) - Experimental protocol, holdout scores
 - [Threat Model](docs/threat-model.md) - What MUAD'DIB detects and doesn't detect
-- [Security Policy](SECURITY.md) - Detection rules reference (261 rules)
+- [Security Policy](SECURITY.md) - Detection rules reference (269 rules)
 - [Security Audit](docs/SECURITY_AUDIT.md) - Bypass validation report
 - [FP Analysis](docs/EVALUATION.md) - Historical false positive analysis
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.136",
+  "version": "2.11.139",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.136.json → self-scan-v2.11.139.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-06-30T19:55:27.666Z",
+  "timestamp": "2026-07-01T17:07:59.673Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/monitor/daemon.js

@@ -635,7 +635,13 @@ function handleMemoryPressure(level, ratio, rssRatio, recentlyScanned, downloads
       // first (newest survive — most likely to still exist for re-scan), protected only as
       // a last resort, and LEDGERS every drop. Closes the v2.10.88 gap where the raw
       // splice(0,n) silently dropped protected scans (CLAUDE.md "ne jamais perdre de scan").
-      const { dropped, droppedProtected, spilled } = evictFromScanQueueBulk(scanQueue, EMERGENCY_QUEUE_KEEP, 'mem_emergency');
+      // IOC-aware anti-spill: never shed a queued name already known-malicious in the IOC DB.
+      // loadCachedIOCs() is a 10s-throttled singleton the daemon keeps warm (queue.js calls it
+      // per scan), so this is a ref-return — not a fresh alloc — even inside the reclaim path.
+      // Best-effort: on any failure the index is null and eviction falls back to prior behavior.
+      let _iocIndex = null;
+      try { _iocIndex = require('../ioc/updater.js').loadCachedIOCs(); } catch { /* degrade to prior behavior */ }
+      const { dropped, droppedProtected, spilled } = evictFromScanQueueBulk(scanQueue, EMERGENCY_QUEUE_KEEP, 'mem_emergency', null, { iocIndex: _iocIndex });
       summary.queueDropped = dropped;
       summary.queueDroppedProtected = droppedProtected;
       summary.queueSpilled = spilled || 0;

package/src/monitor/scan-queue.js

@@ -32,6 +32,20 @@ function _isProtected(item) {
   return !!(item && (item.isIOCMatch || item.isBurst || item.firstPublish || item.atoSignal || item.isATOBurstExtra || item.interrupted));
 }
 
+// IOC-aware anti-spill (2026-07, @longzy DPRK campaign post-mortem): a queued package whose
+// NAME is already in the IOC database is known-malicious, and confirming it is a cheap name
+// lookup — so it must never be shed under memory pressure, even when its enqueue-time
+// `isIOCMatch` flag is stale (the IOC DB refreshed while the item sat in the backlog) or was
+// version-gated. Name-level: a wildcard (all-versions-malicious) OR any specific-version entry
+// counts. Best-effort — a missing/malformed index yields false (the exact prior behavior).
+function _isIOCKnownByName(item, iocIndex) {
+  if (!item || !item.name || !iocIndex) return false;
+  const wild = iocIndex.wildcardPackages;
+  const pkgs = iocIndex.packagesMap;
+  return !!((wild && typeof wild.has === 'function' && wild.has(item.name)) ||
+            (pkgs && typeof pkgs.has === 'function' && pkgs.has(item.name)));
+}
+
 // How far from the head we scan for an unprotected victim. Protected items are a small
 // fraction of the flood, so a victim is almost always found within a few slots; the bound
 // keeps eviction O(window) under sustained overflow (CLAUDE.md §2 bounded resources).
@@ -113,18 +127,32 @@ function enqueueScan(scanQueue, item, stats, max = MAX_SCAN_QUEUE) {
  * the daemon (which holds the same array reference) sees the mutation. Best-effort ledger;
  * never throws. `ledgerFn` is injectable for tests; defaults to state.appendScanLedger.
  *
+ * `opts.iocIndex` (optional {packagesMap, wildcardPackages}) additionally protects any queued
+ * NAME already in the IOC DB from being shed — a known-malicious package must never be lost to
+ * memory pressure (IOC-aware anti-spill). Injected by the daemon (the live 10s-singleton), not
+ * auto-loaded here, so callers that omit it keep the exact prior behavior.
+ *
  * @returns {{dropped:number, droppedProtected:number}}
  */
-function evictFromScanQueueBulk(scanQueue, targetKeep, source = 'bulk_evict', ledgerFn = null) {
+function evictFromScanQueueBulk(scanQueue, targetKeep, source = 'bulk_evict', ledgerFn = null, opts = {}) {
   const before = scanQueue.length;
   const keep = Math.max(0, targetKeep | 0);
   if (before <= keep) return { dropped: 0, droppedProtected: 0 };
   const toDrop = before - keep;
 
-  // Victim set: oldest unprotected first, then (only if short) oldest protected.
+  // IOC-aware anti-spill: on top of the standard _isProtected classes, protect any queued
+  // NAME already in the IOC DB. The index is INJECTED (daemon passes the live 10s-singleton;
+  // tests pass a fabricated one) — no auto-load here, so callers that omit it keep the exact
+  // prior behavior (and unit paths don't drag in the 237MB DB).
+  const iocIndex = opts.iocIndex || null;
+  const isKept = iocIndex
+    ? (item) => _isProtected(item) || _isIOCKnownByName(item, iocIndex)
+    : _isProtected;
+
+  // Victim set: oldest unkept first, then (only if short) oldest kept item.
   const dropSet = new Set();
   for (let i = 0; i < before && dropSet.size < toDrop; i++) {
-    if (!_isProtected(scanQueue[i])) dropSet.add(i);
+    if (!isKept(scanQueue[i])) dropSet.add(i);
   }
   let droppedProtected = 0;
   if (dropSet.size < toDrop) {
@@ -172,7 +200,7 @@ function evictFromScanQueueBulk(scanQueue, targetKeep, source = 'bulk_evict', le
       appendLedger({
         name: item.name, version: item.version, ecosystem: item.ecosystem,
         outcome: spilled ? 'spilled' : 'dropped',
-        source: (_isProtected(item) ? `${source}_protected` : source) + (spilled ? '_spill' : ''),
+        source: (isKept(item) ? `${source}_protected` : source) + (spilled ? '_spill' : ''),
         // AUDIT-A1 observability: record whether a DROPPED item was a first-publish
         // (real coverage loss) vs a burst-extra (version-spam, expected). Lets us
         // measure if the memory breaker is evicting genuine new packages.

package/src/rules/index.js

@@ -1129,6 +1129,32 @@ const RULES = {
     references: ['https://attack.mitre.org/techniques/T1497/001/'],
     mitre: 'T1497.001'
   },
+  anti_analysis_evasion: {
+    id: 'MUADDIB-AST-095',
+    name: 'Anti-Analysis Detonation Gate',
+    severity: 'HIGH',
+    confidence: 'high',
+    domain: 'malware',
+    description: 'Mur de gardes process.exit() silencieuses (>=5) couplees a de la lecture d\'environnement (process.env) et a de l\'obfuscation charcode OU de la reconnaissance hote (hostname/userInfo/networkInterfaces) — le payload refuse de s\'executer sous analyse (sandbox/CI/honeypot). Detection STRUCTURELLE (la forme du mur), agnostique aux marqueurs, donc robuste aux marqueurs inedits. Contre-mesure durable a l\'evasion : evader => detecte en statique ; ne pas evader => detone en sandbox.',
+    references: [
+      'https://attack.mitre.org/techniques/T1497/',
+      'https://attack.mitre.org/techniques/T1497/001/'
+    ],
+    mitre: 'T1497'
+  },
+  analyzer_honeytoken_reference: {
+    id: 'MUADDIB-AST-096',
+    name: 'Analyzer Honeytoken Reference',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    domain: 'malware',
+    description: 'Reference DISSIMULEE en charcodes a un marqueur d\'environnement d\'analyse — marqueur de sandbox MUAD\'DIB (MUADDIB_GVISOR), marqueur d\'un analyseur pair, ou nom de poison-token. Seule la forme obfusquee est matchee : le code de sandbox de MUAD\'DIB lui-meme et l\'outillage securite legitime referencent ces marqueurs en clair sans risque. Aucun package legitime n\'encode un check pour ces tripwires. Le marqueur est un honeytoken plante : garde public et stable pour que tout verificateur s\'auto-incrimine.',
+    references: [
+      'https://attack.mitre.org/techniques/T1497/',
+      'https://attack.mitre.org/techniques/T1480/'
+    ],
+    mitre: 'T1497'
+  },
   detached_process: {
     id: 'MUADDIB-AST-012',
     name: 'Detached Background Process',

package/src/scanner/ast-detectors/anti-evasion.js

@@ -0,0 +1,90 @@
+'use strict';
+
+/**
+ * Anti-analysis / sandbox-evasion detection (2026, born from the @longzy "Contagious
+ * Interview" DPRK npm campaign — whose payload charcode-encodes a `MUADDIB_GVISOR` check to
+ * refuse detonation inside our sandbox).
+ *
+ * Design stance: we do NOT try to HIDE the sandbox. That is an unwinnable arms race — gVisor
+ * is detectable via /proc, syscall quirks and timing, and an attacker re-reads our public
+ * repo. Instead we detect the EVASION ITSELF, statically. That is durable and lose-lose for
+ * the attacker: evade → this convicts them (immune to any env-hiding, because it reads code);
+ * don't evade → the dynamic sandbox detonates them.
+ *
+ * Two complementary, marker-AGNOSTIC-first signals (emitted in handlePostWalk):
+ *
+ *   1. analyzer_honeytoken_reference (CRITICAL, FP~0) — the file hides, behind charcode
+ *      encoding, a reference to a known analysis-environment tripwire (our own
+ *      `MUADDIB_GVISOR`, a peer analyzer's marker, a poison-token name). We match ONLY the
+ *      obfuscated form: legitimate security tooling (incl. MUAD'DIB's own sandbox code)
+ *      references these markers in the clear, but no benign package charcode-encodes a check
+ *      for one. This deliberately weaponises our sandbox marker as a HONEYTOKEN — we keep
+ *      `MUADDIB_GVISOR` public and STABLE precisely so any package that checks for it
+ *      self-incriminates. Hiding/rotating it would throw the honeytoken away for nothing.
+ *
+ *   2. the structural "detonation-gate wall" (see countExitGuards / hasHostRecon, combined
+ *      with env-read + obfuscation in handlePostWalk) — a stack of silent process.exit()
+ *      guards that read the environment. Keys on the SHAPE, so it catches NOVEL markers a
+ *      signature list never would. FP-safe by coupling, not breadth.
+ *
+ * Both are static → immune to sandbox-hiding, and both fire regardless of whether the
+ * (secondary, LOG-ONLY) dynamic sandbox ever runs.
+ */
+
+// Analysis-environment tripwire markers with ZERO legitimate reason to be *charcode-hidden*
+// inside a package. Curated for near-zero FP: excludes AWS doc example keys
+// (AKIAIOSFODNN7EXAMPLE) which legitimately appear in tutorials/tests. Keep this list stable
+// and public — every entry is a planted honeytoken.
+const ANALYZER_MARKERS = [
+  'MUADDIB_GVISOR',        // our own sandbox marker — the primary honeytoken
+  'DetonationLogFilePath',
+  'THREAT_ANALYZER_MODEL',
+  'ASPECT_TLOG',
+  'PYPI_POISON',
+  'SANDYCLAW_',
+  'OPENCLAW_',
+  'PERMISO_',
+  'CHAINRADAR_'
+];
+
+// Bound the charcode-array decode so a pathological file can't blow the CPU budget.
+const MAX_DECODE_ARRAYS = 300;
+// A char-code array literal: >=6 small integers, e.g. [77,85,65,68,68,73,66,...].
+const CHARCODE_ARRAY_RE = /\[\s*(\d{1,3}(?:\s*,\s*\d{1,3}){5,})\s*\]/g;
+
+/**
+ * Return the first analyzer marker that appears CHARCODE-ENCODED in `content` (i.e. hidden
+ * inside a numeric array literal that decodes to a string containing the marker), or null.
+ * Plaintext references are intentionally ignored (see module doc). Bounded, side-effect-free.
+ */
+function detectAnalyzerHoneytoken(content) {
+  if (!content || content.indexOf('[') === -1) return null;
+  CHARCODE_ARRAY_RE.lastIndex = 0;
+  let match, seen = 0;
+  while ((match = CHARCODE_ARRAY_RE.exec(content)) !== null) {
+    if (++seen > MAX_DECODE_ARRAYS) break;
+    const nums = match[1].split(',').map(n => parseInt(n, 10));
+    // Only decode arrays that are entirely printable ASCII codes (a real hidden string).
+    if (nums.some(n => !(n >= 9 && n <= 126))) continue;
+    let decoded;
+    try { decoded = String.fromCharCode.apply(null, nums); } catch { continue; }
+    for (const m of ANALYZER_MARKERS) {
+      if (decoded.indexOf(m) !== -1) return m;
+    }
+  }
+  return null;
+}
+
+/** Count silent `process.exit(` guards — the magnitude of the "detonation-gate wall". */
+function countExitGuards(content) {
+  if (!content) return 0;
+  const m = content.match(/process\s*\.\s*exit\s*\(/g);
+  return m ? m.length : 0;
+}
+
+/** Host/environment reconnaissance calls (note: `os` is often aliased, e.g. `_os.hostname()`). */
+function hasHostRecon(content) {
+  return !!content && /\.\s*(?:hostname|userInfo|networkInterfaces)\s*\(/.test(content);
+}
+
+module.exports = { ANALYZER_MARKERS, detectAnalyzerHoneytoken, countExitGuards, hasHostRecon };

package/src/scanner/ast-detectors/handle-member-expression.js

@@ -74,6 +74,25 @@ function handleMemberExpression(node, ctx) {
       }
     }
   }
+
+  // AST-018 alias fix (@longzy): `var env = process.env; env[_decode([...])]` reaches env via
+  // an alias, so the direct `process.env[x]` match above misses it. Close ONLY the
+  // charcode-reconstruction signal for aliases (computed access + String.fromCharCode in the
+  // file) — we deliberately do NOT emit the generic env_access MEDIUM for aliases, keeping FPR
+  // flat; the HIGH signal fires only on the malicious obfuscated-key shape.
+  if (
+    node.computed &&
+    ctx.hasFromCharCode &&
+    node.object?.type === 'Identifier' &&
+    ctx.envAliases && ctx.envAliases.has(node.object.name)
+  ) {
+    ctx.threats.push({
+      type: 'env_charcode_reconstruction',
+      severity: 'HIGH',
+      message: 'process.env (accessed via an alias) reads a dynamically reconstructed key (String.fromCharCode obfuscation).',
+      file: ctx.relFile
+    });
+  }
 }
 
 

package/src/scanner/ast-detectors/handle-post-walk.js

@@ -3,6 +3,41 @@
 const { networkDestinationsAllBenign } = require('../../sdk-destination.js');
 
 function handlePostWalk(ctx) {
+  // ── Anti-analysis / sandbox evasion (2026, @longzy DPRK "Contagious Interview") ──
+  // We detect the EVASION rather than trying to hide the sandbox (an unwinnable arms race).
+  //  (1) analyzer_honeytoken_reference (CRITICAL, FP~0): the file hides — behind charcode
+  //      encoding — a check for a known analysis-environment tripwire (our own MUADDIB_GVISOR,
+  //      a peer analyzer marker, a poison-token name). Only the OBFUSCATED form is matched, so
+  //      MUAD'DIB's own sandbox code (plaintext) and legit security tooling never trip it. The
+  //      marker is a planted honeytoken: kept public+stable so any checker self-incriminates.
+  //  (2) anti_analysis_evasion (HIGH): the structural "detonation-gate wall" — >=5 silent
+  //      process.exit() guards that read the environment, plus charcode obfuscation OR host
+  //      reconnaissance. Marker-AGNOSTIC (keys on the shape → catches novel markers). FP-safe
+  //      by coupling: no benign package stacks 5+ process.exit guards with obfuscated env/host
+  //      recon. Suppressed in dist/build (minified bundles can inflate the raw counts).
+  if (ctx.analyzerHoneytokenHit) {
+    ctx.threats.push({
+      type: 'analyzer_honeytoken_reference',
+      severity: 'CRITICAL',
+      message: `Charcode-hidden reference to an analysis-environment marker ("${ctx.analyzerHoneytokenHit}") — sandbox/analyzer evasion. No legitimate package obfuscates a check for this tripwire.`,
+      file: ctx.relFile
+    });
+  } else if (
+    ctx.antiAnalysisExitCount >= 5 &&
+    ctx.hasProcessEnvRead &&
+    (ctx.hasFromCharCode || ctx.hasHostRecon)
+  ) {
+    const isDistFile = /^(?:dist|build|out|output)[/\\]/i.test(ctx.relFile) || /\.(?:bundle|min)\.js$/i.test(ctx.relFile);
+    if (!isDistFile) {
+      ctx.threats.push({
+        type: 'anti_analysis_evasion',
+        severity: 'HIGH',
+        message: `Anti-analysis detonation-gate: ${ctx.antiAnalysisExitCount} silent process.exit() guards reading the environment${ctx.hasFromCharCode ? ', charcode-obfuscated' : ''}${ctx.hasHostRecon ? ', with host reconnaissance' : ''} — payload refuses to run under analysis (sandbox/CI/honeypot evasion).`,
+        file: ctx.relFile
+      });
+    }
+  }
+
   // SANDWORM_MODE: zlib inflate + base64 decode + eval/Function/Module._compile = obfuscated payload
   if (ctx.hasZlibInflate && ctx.hasBase64Decode && ctx.hasDynamicExec) {
     // FIX 4: dist/build files get LOW severity (bundlers legitimately use zlib+base64+eval)

package/src/scanner/ast-detectors/handle-variable-declarator.js

@@ -24,6 +24,14 @@ function handleVariableDeclarator(node, ctx) {
       ctx.staticAssignments.add(node.id.name);
     }
 
+    // AST-018 alias capture (@longzy): `var env = process.env` — record the alias so a later
+    // `env[String.fromCharCode(...)]` access resolves back to process.env in the member handler.
+    if (ctx.envAliases && node.init?.type === 'MemberExpression' && !node.init.computed &&
+        node.init.object?.type === 'Identifier' && node.init.object.name === 'process' &&
+        node.init.property?.type === 'Identifier' && node.init.property.name === 'env') {
+      ctx.envAliases.add(node.id.name);
+    }
+
     // v2.10.73 P2: Track WHERE the variable's value originated — used by AST-006
     // to distinguish plugin loaders (LOW) from real obfuscation (HIGH) from
     // credential exfil vectors (CRITICAL). See src/scanner/ast-detectors/handle-call-expression.js

package/src/scanner/ast.js

@@ -13,6 +13,7 @@ const {
   handleWithStatement,
   handlePostWalk
 } = require('./ast-detectors');
+const { detectAnalyzerHoneytoken, countExitGuards, hasHostRecon } = require('./ast-detectors/anti-evasion.js');
 
 // Check if credential keywords appear INSIDE regex literals or new RegExp() patterns.
 // Only true when the keyword is part of the regex pattern itself, not just a string elsewhere in the file.
@@ -152,11 +153,19 @@ function analyzeFile(content, filePath, basePath) {
       return names;
     })(),
     evalAliases: new Map(),           // B1: variable name → 'eval'|'Function'
+    envAliases: new Set(),            // AST-018 alias fix: names bound to process.env (`var env = process.env`)
     moduleLoadDirectAliases: new Set(), // B3: destructured _load from require('module')
     objectPropertyMap: new Map(),     // B5: objName → Map<propName, stringValue>
     concatValues: new Map(),          // B2: varName → { value, operands } for concat strings with ≥3 operands
     stringVarValues: new Map(),       // Variable reassignment tracking: varName → string value
     hasFromCharCode: content.includes('fromCharCode'),
+    // Anti-analysis / sandbox evasion (2026, @longzy DPRK). Structural "detonation-gate wall"
+    // magnitude + host recon + a charcode-hidden analyzer-honeytoken reference. Aggregated in
+    // handlePostWalk. See ast-detectors/anti-evasion.js.
+    antiAnalysisExitCount: countExitGuards(content),
+    hasHostRecon: hasHostRecon(content),
+    hasProcessEnvRead: /process\s*\.\s*env\b/.test(content),
+    analyzerHoneytokenHit: detectAnalyzerHoneytoken(content),
     hasJsReverseShell: /\bnet\.Socket\b/.test(content) &&
       /\.connect\s*\(/.test(content) &&
       /\.pipe\b/.test(content) &&

package/src/scanner/python-ast-detectors/handle-assignment.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { classifyTaintSource } = require('./taint-tracker.js');
+const { classifyTaintSource, isHarvestEnv } = require('./taint-tracker.js');
 
 /**
  * Visit `assignment` nodes at module level (scope_depth === 0) and populate
@@ -13,6 +13,18 @@ const { classifyTaintSource } = require('./taint-tracker.js');
  *  - reassignment to a non-source value CLEARS the taint
  */
 function handleAssignment(node, ctx, scopeDepth) {
+  // crypto_exfil harvest leg (PyPI, file-level — runs at ANY scope, unlike moduleTaint):
+  // `secret = os.environ['AWS_SECRET']` even inside a function sets the harvest flag.
+  if (!ctx.hasSensitiveHarvestPy) {
+    const rhs = node.childForFieldName('right');
+    if (rhs) {
+      const t = classifyTaintSource(rhs);
+      if (t && t.sourceType === 'env' && isHarvestEnv(t.envVarName)) {
+        ctx.hasSensitiveHarvestPy = true;
+      }
+    }
+  }
+
   if (scopeDepth !== 0) return;
   if (!ctx.moduleTaint) return; // defensive — should always be initialised per-file
 

package/src/scanner/python-ast-detectors/handle-call-expression.js

@@ -8,7 +8,7 @@ const {
   isTruthyLiteral,
   lineOf
 } = require('./helpers.js');
-const { lookupTaint, isEnvSensitive } = require('./taint-tracker.js');
+const { lookupTaint, isEnvSensitive, isCryptoEncryptCall, isSensitiveFileOpen, nodeReadsSensitiveEnv } = require('./taint-tracker.js');
 
 /**
  * Visitor for `call` nodes. Emits PYAST-003, PYAST-004, PYAST-005, PYAST-006,
@@ -121,12 +121,40 @@ function getKwargValue(callNode, kwName) {
   return null;
 }
 
+// crypto_exfil harvest helper: true if any argument (positional or kwarg value)
+// reads a sensitive env var, e.g. requests.post(url, data=os.environ['AWS_SECRET']).
+function _callHasSensitiveEnvArg(callNode) {
+  const args = callNode.childForFieldName('arguments');
+  if (!args) return false;
+  for (const child of args.children) {
+    if (child.type === 'keyword_argument') {
+      const v = child.childForFieldName('value');
+      if (v && nodeReadsSensitiveEnv(v)) return true;
+    } else if (nodeReadsSensitiveEnv(child)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 // ---------------------------------------------------------------------------
 // Main visitor
 // ---------------------------------------------------------------------------
 
 function handleCallExpression(node, ctx, scopeDepth) {
   const callee = calleeDottedName(node);
+
+  // crypto_exfil (PyPI mirror of MUADDIB-COMPOUND-019): accumulate file-level flags consumed by
+  // the post-walk same-file compound in python-ast.js. Runs for EVERY call (before the !callee
+  // early return) and at ANY scope — the compound is file-level, like the JS handle-post-walk one.
+  // AST-call based, so a string/comment that merely contains "AES.new(" cannot trip it (JS self-FP lesson).
+  if (isCryptoEncryptCall(node)) ctx.hasCryptoEncryptPy = true;
+  if (callee && NETWORK_WRITE_CALLEES.has(callee)) ctx.hasNetworkWritePy = true;
+  if (!ctx.hasSensitiveHarvestPy &&
+      (nodeReadsSensitiveEnv(node) || isSensitiveFileOpen(node) || _callHasSensitiveEnvArg(node))) {
+    ctx.hasSensitiveHarvestPy = true;
+  }
+
   if (!callee) return;
 
   // PYAST-003: exec()/eval() at module level — direct RCE on import.

package/src/scanner/python-ast-detectors/taint-tracker.js

@@ -168,6 +168,83 @@ function classifyEnvSource(node) {
   return null;
 }
 
+// ---------------------------------------------------------------------------
+// CRYPTO-ENCRYPT detection (crypto_exfil PyPI mirror of MUADDIB-COMPOUND-019)
+// ---------------------------------------------------------------------------
+
+// Construction / encrypt-function callees of the major Python crypto libs. AST
+// dotted-name match (NOT a content regex): a string or comment that merely
+// contains "AES.new(" is not a `call` node, so it cannot trip this (the JS-side
+// self-FP lesson — see scanner/ast.js hasCryptoEncipher). Matching the
+// constructor/load call is sufficient as a file-level "encryption happens here"
+// flag; the generic `.encrypt()` method is deliberately NOT matched (too many
+// non-crypto libs expose .encrypt and it would FP).
+const CRYPTO_ENCRYPT_CALLEES = new Set([
+  // pycryptodome / PyCrypto — symmetric .new() + RSA padding .new()
+  'AES.new', 'DES.new', 'DES3.new', 'ARC4.new', 'ChaCha20.new', 'Salsa20.new',
+  'Blowfish.new', 'ChaCha20_Poly1305.new',
+  'Crypto.Cipher.AES.new', 'Cryptodome.Cipher.AES.new',
+  'PKCS1_OAEP.new', 'PKCS1_v1_5.new',
+  'Crypto.Cipher.PKCS1_OAEP.new', 'Cryptodome.Cipher.PKCS1_OAEP.new',
+  // rsa library
+  'rsa.encrypt',
+  // cryptography — hazmat ciphers + fernet + attacker pubkey load
+  'Cipher', 'cryptography.hazmat.primitives.ciphers.Cipher',
+  'Fernet', 'MultiFernet', 'cryptography.fernet.Fernet',
+  'load_pem_public_key', 'serialization.load_pem_public_key',
+  // PyNaCl
+  'SealedBox', 'SecretBox', 'nacl.public.SealedBox', 'nacl.secret.SecretBox'
+]);
+
+function isCryptoEncryptCall(callNode) {
+  if (!callNode || callNode.type !== 'call') return false;
+  const name = dottedName(callNode.childForFieldName('function'));
+  return !!(name && CRYPTO_ENCRYPT_CALLEES.has(name));
+}
+
+// ---------------------------------------------------------------------------
+// Sensitive-file open detection (crypto_exfil harvest leg, beyond env vars)
+// ---------------------------------------------------------------------------
+
+// Mirror of dataflow.js SENSITIVE_PATH_PATTERNS — credential/secret stores.
+const SENSITIVE_FILE_RE = /(\.aws[/\\]credentials|\.ssh[/\\]|id_rsa|id_ed25519|\.npmrc|\.netrc|\.git-credentials|\.config[/\\]gcloud|\.docker[/\\]config|\.kube[/\\]config|\.pgpass|wallet\.dat|\.metamask|\.electrum|\.exodus|\.gnupg|\/etc\/passwd|\/etc\/shadow)/i;
+const FILE_OPEN_CALLEES = new Set(['open', 'io.open', 'codecs.open']);
+
+function isSensitiveFileOpen(callNode) {
+  if (!callNode || callNode.type !== 'call') return false;
+  const name = dottedName(callNode.childForFieldName('function'));
+  if (!name || !FILE_OPEN_CALLEES.has(name)) return false;
+  const args = callNode.childForFieldName('arguments');
+  if (!args) return false;
+  for (const child of args.children) {
+    if (['(', ')', ',', 'keyword_argument'].includes(child.type)) continue;
+    const lit = stringLiteralValue(child); // first positional arg
+    return lit !== null && SENSITIVE_FILE_RE.test(lit);
+  }
+  return false;
+}
+
+// Env names that denote a CRYPTO KEY read in order to ENCRYPT (transport config),
+// NOT a credential to be stolen. A legit Fernet/cryptography transport wrapper loads
+// its own symmetric key from env (FERNET_KEY, ENCRYPTION_KEY, APP_CIPHER_KEY, ...) then
+// encrypts+sends — without this exclusion that env read would (via the bare "KEY"
+// substring in SENSITIVE_ENV_RE) look like harvesting and FP the crypto_exfil compound.
+// The attacker gains nothing: real stolen creds use names like AWS_SECRET_ACCESS_KEY /
+// *_TOKEN which are NOT crypto-config names, so they still count as harvest.
+const CRYPTO_CONFIG_ENV_RE = /^(FERNET|ENCRYPTION|ENCRYPT|DECRYPT|CIPHER|CRYPTO|AES|MASTER|SIGNING|HMAC)_?KEY$|_(ENCRYPTION|FERNET|CIPHER|AES|CRYPTO)_KEY$/i;
+
+// Harvest = a sensitive credential name, EXCLUDING crypto-key config (above).
+function isHarvestEnv(name) {
+  return isEnvSensitive(name) && !CRYPTO_CONFIG_ENV_RE.test(name);
+}
+
+// True iff `node` reads a HARVESTABLE credential env var (os.environ['X'] /
+// os.getenv('X') / os.environ.get('X')) — sensitive name, not crypto-key config.
+function nodeReadsSensitiveEnv(node) {
+  const name = classifyEnvSource(node);
+  return name !== null && isHarvestEnv(name);
+}
+
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -200,11 +277,19 @@ module.exports = {
   classifyTaintSource,
   lookupTaint,
   isEnvSensitive,
+  // crypto_exfil (PyPI mirror of COMPOUND-019) — file-flag classifiers
+  isCryptoEncryptCall,
+  isSensitiveFileOpen,
+  nodeReadsSensitiveEnv,
+  isHarvestEnv,
   // Exposed for unit tests
   _internal: {
     isFetchSource,
     isBase64Source,
     classifyEnvSource,
-    SENSITIVE_ENV_RE
+    SENSITIVE_ENV_RE,
+    CRYPTO_ENCRYPT_CALLEES,
+    SENSITIVE_FILE_RE,
+    CRYPTO_CONFIG_ENV_RE
   }
 };

package/src/scanner/python-ast.js

@@ -49,6 +49,7 @@ const WASM_PATH = path.join(__dirname, '..', 'vendor', 'tree-sitter-python.wasm'
 // findTargetPythonFiles() from python-source.js below.
 const { _internal: pysrcInternal } = require('./python-source.js');
 const { findTargetPythonFiles } = pysrcInternal;
+const { networkDestinationsAllBenign } = require('../sdk-destination.js');
 
 // ---------------------------------------------------------------------------
 // Async tree-sitter init (lazy, cached).
@@ -151,10 +152,30 @@ function scanPythonAST(targetPath) {
       // Per-file taint map populated by handle-assignment.js at scope_depth==0
       // and read by handle-call-expression.js for compound detections
       // (PYAST-005/006/009/010). See python-ast-detectors/taint-tracker.js.
-      moduleTaint: new Map()
+      moduleTaint: new Map(),
+      // crypto_exfil (PyPI mirror of MUADDIB-COMPOUND-019) file-level flags, set during the
+      // walk by handle-call-expression.js / handle-assignment.js, read in the finalize below.
+      hasCryptoEncryptPy: false,
+      hasNetworkWritePy: false,
+      hasSensitiveHarvestPy: false
     };
 
     walk(tree.rootNode, ctx, visitors);
+
+    // crypto_exfil finalize (same-file compound): secret harvest + encryption (RSA/AES) +
+    // network write, to a destination that is NOT entirely first-party/trusted. Mirror of the
+    // JS handle-post-walk compound; emits the SAME 'crypto_exfil' type (MUADDIB-COMPOUND-019),
+    // inheriting its rule/playbook/HIGH_CONFIDENCE_MALICE plumbing. destAllBenign reuses the
+    // shared host-reputation engine on the .py source (suppresses SDKs posting to their own API).
+    if (ctx.hasCryptoEncryptPy && ctx.hasNetworkWritePy && ctx.hasSensitiveHarvestPy &&
+        !networkDestinationsAllBenign(source)) {
+      threats.push({
+        type: 'crypto_exfil',
+        severity: 'CRITICAL',
+        message: `${ctx.relFile}: hybrid-crypto exfiltration (PyPI) — secret harvesting (env var / credential file) + encryption (RSA/AES via pycryptodome/cryptography/rsa/nacl) + network write in the same file, to a non-first-party destination. Stolen secrets are encrypted before exfil to evade DLP/taint inspection (litellm/Hades pattern).`,
+        file: ctx.relFile
+      });
+    }
   }
 
   return threats;

package/src/scoring.js

@@ -166,7 +166,12 @@ const SINGLE_FIRE_CRITICAL_TYPES = new Set([
   // Phantom Gyp compound (Phase 1b): only fires when the invoked configure-time script
   // is INDEPENDENTLY judged malicious, so it carries the same unambiguous-malware weight
   // as the IOC/hash matches above — FP≈0 by construction justifies the single-fire floor.
-  'gyp_phantom_exec'
+  'gyp_phantom_exec',
+  // crypto_exfil (COMPOUND-019): harvest + RSA/AES encryption + network to a non-benign
+  // dest in the same file (FP≈0 by construction). Floors a lone CRITICAL to 75 so it is
+  // not buried at 25 on PyPI, where a single CRITICAL does not stack co-signals the way
+  // the npm side does (env_access + credential_regex_harvest + ... → 100).
+  'crypto_exfil'
 ]);
 const SINGLE_FIRE_CRITICAL_FLOOR = 75;
 const SINGLE_FIRE_MIN_SEVERITY_RANK = 2; // HIGH