muaddib-scanner 2.11.138 → 2.11.139

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.138",
+  "version": "2.11.139",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.138.json → self-scan-v2.11.139.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-01T11:04:30.753Z",
+  "timestamp": "2026-07-01T17:07:59.673Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/scanner/python-ast-detectors/handle-assignment.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { classifyTaintSource } = require('./taint-tracker.js');
+const { classifyTaintSource, isHarvestEnv } = require('./taint-tracker.js');
 
 /**
  * Visit `assignment` nodes at module level (scope_depth === 0) and populate
@@ -13,6 +13,18 @@ const { classifyTaintSource } = require('./taint-tracker.js');
  *  - reassignment to a non-source value CLEARS the taint
  */
 function handleAssignment(node, ctx, scopeDepth) {
+  // crypto_exfil harvest leg (PyPI, file-level — runs at ANY scope, unlike moduleTaint):
+  // `secret = os.environ['AWS_SECRET']` even inside a function sets the harvest flag.
+  if (!ctx.hasSensitiveHarvestPy) {
+    const rhs = node.childForFieldName('right');
+    if (rhs) {
+      const t = classifyTaintSource(rhs);
+      if (t && t.sourceType === 'env' && isHarvestEnv(t.envVarName)) {
+        ctx.hasSensitiveHarvestPy = true;
+      }
+    }
+  }
+
   if (scopeDepth !== 0) return;
   if (!ctx.moduleTaint) return; // defensive — should always be initialised per-file
 

package/src/scanner/python-ast-detectors/handle-call-expression.js

@@ -8,7 +8,7 @@ const {
   isTruthyLiteral,
   lineOf
 } = require('./helpers.js');
-const { lookupTaint, isEnvSensitive } = require('./taint-tracker.js');
+const { lookupTaint, isEnvSensitive, isCryptoEncryptCall, isSensitiveFileOpen, nodeReadsSensitiveEnv } = require('./taint-tracker.js');
 
 /**
  * Visitor for `call` nodes. Emits PYAST-003, PYAST-004, PYAST-005, PYAST-006,
@@ -121,12 +121,40 @@ function getKwargValue(callNode, kwName) {
   return null;
 }
 
+// crypto_exfil harvest helper: true if any argument (positional or kwarg value)
+// reads a sensitive env var, e.g. requests.post(url, data=os.environ['AWS_SECRET']).
+function _callHasSensitiveEnvArg(callNode) {
+  const args = callNode.childForFieldName('arguments');
+  if (!args) return false;
+  for (const child of args.children) {
+    if (child.type === 'keyword_argument') {
+      const v = child.childForFieldName('value');
+      if (v && nodeReadsSensitiveEnv(v)) return true;
+    } else if (nodeReadsSensitiveEnv(child)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 // ---------------------------------------------------------------------------
 // Main visitor
 // ---------------------------------------------------------------------------
 
 function handleCallExpression(node, ctx, scopeDepth) {
   const callee = calleeDottedName(node);
+
+  // crypto_exfil (PyPI mirror of MUADDIB-COMPOUND-019): accumulate file-level flags consumed by
+  // the post-walk same-file compound in python-ast.js. Runs for EVERY call (before the !callee
+  // early return) and at ANY scope — the compound is file-level, like the JS handle-post-walk one.
+  // AST-call based, so a string/comment that merely contains "AES.new(" cannot trip it (JS self-FP lesson).
+  if (isCryptoEncryptCall(node)) ctx.hasCryptoEncryptPy = true;
+  if (callee && NETWORK_WRITE_CALLEES.has(callee)) ctx.hasNetworkWritePy = true;
+  if (!ctx.hasSensitiveHarvestPy &&
+      (nodeReadsSensitiveEnv(node) || isSensitiveFileOpen(node) || _callHasSensitiveEnvArg(node))) {
+    ctx.hasSensitiveHarvestPy = true;
+  }
+
   if (!callee) return;
 
   // PYAST-003: exec()/eval() at module level — direct RCE on import.

package/src/scanner/python-ast-detectors/taint-tracker.js

@@ -168,6 +168,83 @@ function classifyEnvSource(node) {
   return null;
 }
 
+// ---------------------------------------------------------------------------
+// CRYPTO-ENCRYPT detection (crypto_exfil PyPI mirror of MUADDIB-COMPOUND-019)
+// ---------------------------------------------------------------------------
+
+// Construction / encrypt-function callees of the major Python crypto libs. AST
+// dotted-name match (NOT a content regex): a string or comment that merely
+// contains "AES.new(" is not a `call` node, so it cannot trip this (the JS-side
+// self-FP lesson — see scanner/ast.js hasCryptoEncipher). Matching the
+// constructor/load call is sufficient as a file-level "encryption happens here"
+// flag; the generic `.encrypt()` method is deliberately NOT matched (too many
+// non-crypto libs expose .encrypt and it would FP).
+const CRYPTO_ENCRYPT_CALLEES = new Set([
+  // pycryptodome / PyCrypto — symmetric .new() + RSA padding .new()
+  'AES.new', 'DES.new', 'DES3.new', 'ARC4.new', 'ChaCha20.new', 'Salsa20.new',
+  'Blowfish.new', 'ChaCha20_Poly1305.new',
+  'Crypto.Cipher.AES.new', 'Cryptodome.Cipher.AES.new',
+  'PKCS1_OAEP.new', 'PKCS1_v1_5.new',
+  'Crypto.Cipher.PKCS1_OAEP.new', 'Cryptodome.Cipher.PKCS1_OAEP.new',
+  // rsa library
+  'rsa.encrypt',
+  // cryptography — hazmat ciphers + fernet + attacker pubkey load
+  'Cipher', 'cryptography.hazmat.primitives.ciphers.Cipher',
+  'Fernet', 'MultiFernet', 'cryptography.fernet.Fernet',
+  'load_pem_public_key', 'serialization.load_pem_public_key',
+  // PyNaCl
+  'SealedBox', 'SecretBox', 'nacl.public.SealedBox', 'nacl.secret.SecretBox'
+]);
+
+function isCryptoEncryptCall(callNode) {
+  if (!callNode || callNode.type !== 'call') return false;
+  const name = dottedName(callNode.childForFieldName('function'));
+  return !!(name && CRYPTO_ENCRYPT_CALLEES.has(name));
+}
+
+// ---------------------------------------------------------------------------
+// Sensitive-file open detection (crypto_exfil harvest leg, beyond env vars)
+// ---------------------------------------------------------------------------
+
+// Mirror of dataflow.js SENSITIVE_PATH_PATTERNS — credential/secret stores.
+const SENSITIVE_FILE_RE = /(\.aws[/\\]credentials|\.ssh[/\\]|id_rsa|id_ed25519|\.npmrc|\.netrc|\.git-credentials|\.config[/\\]gcloud|\.docker[/\\]config|\.kube[/\\]config|\.pgpass|wallet\.dat|\.metamask|\.electrum|\.exodus|\.gnupg|\/etc\/passwd|\/etc\/shadow)/i;
+const FILE_OPEN_CALLEES = new Set(['open', 'io.open', 'codecs.open']);
+
+function isSensitiveFileOpen(callNode) {
+  if (!callNode || callNode.type !== 'call') return false;
+  const name = dottedName(callNode.childForFieldName('function'));
+  if (!name || !FILE_OPEN_CALLEES.has(name)) return false;
+  const args = callNode.childForFieldName('arguments');
+  if (!args) return false;
+  for (const child of args.children) {
+    if (['(', ')', ',', 'keyword_argument'].includes(child.type)) continue;
+    const lit = stringLiteralValue(child); // first positional arg
+    return lit !== null && SENSITIVE_FILE_RE.test(lit);
+  }
+  return false;
+}
+
+// Env names that denote a CRYPTO KEY read in order to ENCRYPT (transport config),
+// NOT a credential to be stolen. A legit Fernet/cryptography transport wrapper loads
+// its own symmetric key from env (FERNET_KEY, ENCRYPTION_KEY, APP_CIPHER_KEY, ...) then
+// encrypts+sends — without this exclusion that env read would (via the bare "KEY"
+// substring in SENSITIVE_ENV_RE) look like harvesting and FP the crypto_exfil compound.
+// The attacker gains nothing: real stolen creds use names like AWS_SECRET_ACCESS_KEY /
+// *_TOKEN which are NOT crypto-config names, so they still count as harvest.
+const CRYPTO_CONFIG_ENV_RE = /^(FERNET|ENCRYPTION|ENCRYPT|DECRYPT|CIPHER|CRYPTO|AES|MASTER|SIGNING|HMAC)_?KEY$|_(ENCRYPTION|FERNET|CIPHER|AES|CRYPTO)_KEY$/i;
+
+// Harvest = a sensitive credential name, EXCLUDING crypto-key config (above).
+function isHarvestEnv(name) {
+  return isEnvSensitive(name) && !CRYPTO_CONFIG_ENV_RE.test(name);
+}
+
+// True iff `node` reads a HARVESTABLE credential env var (os.environ['X'] /
+// os.getenv('X') / os.environ.get('X')) — sensitive name, not crypto-key config.
+function nodeReadsSensitiveEnv(node) {
+  const name = classifyEnvSource(node);
+  return name !== null && isHarvestEnv(name);
+}
+
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -200,11 +277,19 @@ module.exports = {
   classifyTaintSource,
   lookupTaint,
   isEnvSensitive,
+  // crypto_exfil (PyPI mirror of COMPOUND-019) — file-flag classifiers
+  isCryptoEncryptCall,
+  isSensitiveFileOpen,
+  nodeReadsSensitiveEnv,
+  isHarvestEnv,
   // Exposed for unit tests
   _internal: {
     isFetchSource,
     isBase64Source,
     classifyEnvSource,
-    SENSITIVE_ENV_RE
+    SENSITIVE_ENV_RE,
+    CRYPTO_ENCRYPT_CALLEES,
+    SENSITIVE_FILE_RE,
+    CRYPTO_CONFIG_ENV_RE
   }
 };

package/src/scanner/python-ast.js

@@ -49,6 +49,7 @@ const WASM_PATH = path.join(__dirname, '..', 'vendor', 'tree-sitter-python.wasm'
 // findTargetPythonFiles() from python-source.js below.
 const { _internal: pysrcInternal } = require('./python-source.js');
 const { findTargetPythonFiles } = pysrcInternal;
+const { networkDestinationsAllBenign } = require('../sdk-destination.js');
 
 // ---------------------------------------------------------------------------
 // Async tree-sitter init (lazy, cached).
@@ -151,10 +152,30 @@ function scanPythonAST(targetPath) {
       // Per-file taint map populated by handle-assignment.js at scope_depth==0
       // and read by handle-call-expression.js for compound detections
       // (PYAST-005/006/009/010). See python-ast-detectors/taint-tracker.js.
-      moduleTaint: new Map()
+      moduleTaint: new Map(),
+      // crypto_exfil (PyPI mirror of MUADDIB-COMPOUND-019) file-level flags, set during the
+      // walk by handle-call-expression.js / handle-assignment.js, read in the finalize below.
+      hasCryptoEncryptPy: false,
+      hasNetworkWritePy: false,
+      hasSensitiveHarvestPy: false
     };
 
     walk(tree.rootNode, ctx, visitors);
+
+    // crypto_exfil finalize (same-file compound): secret harvest + encryption (RSA/AES) +
+    // network write, to a destination that is NOT entirely first-party/trusted. Mirror of the
+    // JS handle-post-walk compound; emits the SAME 'crypto_exfil' type (MUADDIB-COMPOUND-019),
+    // inheriting its rule/playbook/HIGH_CONFIDENCE_MALICE plumbing. destAllBenign reuses the
+    // shared host-reputation engine on the .py source (suppresses SDKs posting to their own API).
+    if (ctx.hasCryptoEncryptPy && ctx.hasNetworkWritePy && ctx.hasSensitiveHarvestPy &&
+        !networkDestinationsAllBenign(source)) {
+      threats.push({
+        type: 'crypto_exfil',
+        severity: 'CRITICAL',
+        message: `${ctx.relFile}: hybrid-crypto exfiltration (PyPI) — secret harvesting (env var / credential file) + encryption (RSA/AES via pycryptodome/cryptography/rsa/nacl) + network write in the same file, to a non-first-party destination. Stolen secrets are encrypted before exfil to evade DLP/taint inspection (litellm/Hades pattern).`,
+        file: ctx.relFile
+      });
+    }
   }
 
   return threats;

package/src/scoring.js

@@ -166,7 +166,12 @@ const SINGLE_FIRE_CRITICAL_TYPES = new Set([
   // Phantom Gyp compound (Phase 1b): only fires when the invoked configure-time script
   // is INDEPENDENTLY judged malicious, so it carries the same unambiguous-malware weight
   // as the IOC/hash matches above — FP≈0 by construction justifies the single-fire floor.
-  'gyp_phantom_exec'
+  'gyp_phantom_exec',
+  // crypto_exfil (COMPOUND-019): harvest + RSA/AES encryption + network to a non-benign
+  // dest in the same file (FP≈0 by construction). Floors a lone CRITICAL to 75 so it is
+  // not buried at 25 on PyPI, where a single CRITICAL does not stack co-signals the way
+  // the npm side does (env_access + credential_regex_harvest + ... → 100).
+  'crypto_exfil'
 ]);
 const SINGLE_FIRE_CRITICAL_FLOOR = 75;
 const SINGLE_FIRE_MIN_SEVERITY_RANK = 2; // HIGH