muaddib-scanner 2.11.138 → 2.11.140

package/README.md

@@ -30,7 +30,7 @@
 
 npm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond.
 
-MUAD'DIB combines **20 parallel scanners** (274 detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **compound scoring** (17 compound rules), and a gVisor/Docker sandbox to detect known threats and suspicious behavioral patterns in npm and PyPI packages. An XGBoost classifier exists in the codebase but is **currently inactive** (see [Evaluation Metrics](#evaluation-metrics) → ML Classifier section).
+MUAD'DIB combines **21 parallel scanners** (274 detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **compound scoring** (20 compound rules), and a gVisor/Docker sandbox to detect known threats and suspicious behavioral patterns in npm and PyPI packages. An XGBoost classifier exists in the codebase but is **currently inactive** (see [Evaluation](#evaluation)).
 
 ---
 
@@ -45,6 +45,16 @@ MUAD'DIB is an educational tool and a free first line of defense. It detects **k
 
 ---
 
+## Scope
+
+**Detects** (npm & PyPI): known-malicious packages (name + SHA256 IOC match), typosquats, install-time RCE (lifecycle `preinstall`/`postinstall`, `curl | sh`, Python import-time, `binding.gyp`), credential read then network exfiltration (intra- and cross-file), obfuscated / high-entropy / stub-loader payloads, binary droppers (`chmod +x` + exec/spawn), and anti-analysis evasion markers.
+
+**Out of scope**: browser-only attacks (DOM/`window`, no Node.js API), the *contents* of native binaries / WASM (no binary analysis), zero-day unknown packages (the IOC feed is reactive), and non-npm/PyPI ecosystems (RubyGems, Maven, Go). Determined anti-sandbox fingerprinting and multi-stage remote payloads are known false-negative risks. Full detail: [Threat Model](docs/threat-model.md).
+
+**No telemetry.** Your code and scan results never leave your machine — MUAD'DIB only *downloads* threat-intel feeds (`muaddib update`) and, for scoring, reads public npm registry metadata. Webhook alerts are opt-in.
+
+---
+
 ## Installation
 
 ### npm (recommended)
@@ -176,7 +186,7 @@ muaddib replay                     # Ground truth validation (90/94 TPR@3, v2.11
 
 ## Features
 
-### 20 parallel scanners
+### 21 parallel scanners
 
 | Scanner | Detection |
 |---------|-----------|
@@ -201,10 +211,11 @@ muaddib replay                     # Ground truth validation (90/94 TPR@3, v2.11
 | Trusted-Dep-Diff (opt-in) | Diff against trusted dep tarballs from registry (v2.10.x) |
 | Python Source (PYSRC) | Import-time / install-time RCE patterns in `__init__.py` / `setup.py` (v2.11.41 — closes TrapDoor PyPI gap) |
 | Python AST (PYAST) | Tree-sitter-Python AST with taint-aware detectors (v2.11.42+) |
+| Anti-Scanner Injection (ASI) | Prompt-injection text in comments/strings that coerces an LLM code reviewer into a clean verdict or into skipping an obfuscated payload (ASI-001..004, Hades campaign 2026-06) |
 
 ### 274 detection rules
 
-All rules (269 RULES + 5 PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v211117) for the complete rules reference.
+All rules (269 RULES + 5 PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v211139) for the complete rules reference.
 
 ### Detected campaigns
 
@@ -278,75 +289,30 @@ With pre-commit framework:
 ```yaml
 repos:
   - repo: https://github.com/DNSZLSK/muad-dib
-    rev: v2.11.117
+    rev: v2.11.139
     hooks:
       - id: muaddib-scan
 ```
 
 ---
 
-## Evaluation Metrics
-
-Latest measurement: **v2.11.48** (2026-05-26, Track D + PyPI download fix). Ground truth holds 96 samples (94 in-scope, 2 out-of-scope protestware). This run measures the full 94 in-scope set after the 2026-05-25 enrichment (Track C synthetic for the new PYSRC/PYAST/AST-092/AICONF-004/PKG-022 rules, Track A real-world tarballs recovered from VPS archive, Track B reconstructions from the in-house security-review benchmark).
-
-### Operational metrics (what an operator actually gets)
-
-These are the numbers a user gets when running `muaddib scan` against npm or PyPI packages. The pipeline executes scanners + FP caps only — no ML filter is applied (see ML Classifier note below).
-
-| Metric | Result | Details |
-|--------|--------|---------|
-| **Wild TPR** (Datadog 17K) | **92.8%** (13,538/14,587 in-scope) | 17,922 packages. 3,335 skipped (no JS). By category: compromised_lib 97.8%, malicious_intent 92.1% — last measurement v2.9.4, independent of GT. |
-| **TPR@3** (detection rate, v2.11.48) | **95.74%** (90/94 in-scope) | Full GT re-measurement. Threshold=3: any signal. 13 PyPI samples (was 0). 4 misses incl. 3 browser-only (lottie-player, polyfill-io, trojanized-jquery). |
-| **TPR@20** (alert rate, v2.11.48) | **88.30%** (83/94 in-scope) | Operational alert threshold=20. **+3.1pp vs v2.11.47** — Track D `recon_exfil_direct_ip` compound (MUADDIB-COMPOUND-016) closed the GT-095 gap (risk 3→50) and boosted GT-091 byvendors / GT-092 heloo131313 through `linux_fingerprint_exec`. |
-| **FPR rules** (Benign curated, v2.11.48 measure) | **1.10%** (6/545 scanned, 548 total) | **Unchanged after Track D** — the new compound + types created zero new FPs (sameFile gate + public-IP-only filter). Drop from 15.6% (v2.10.95) is attributable to FP caps F1-F14 (v2.10.97 → v2.11.31). 6 remaining FPs are real (meteor, prisma, @prisma/client, drizzle-orm, scrypt, liquid). |
-| **FPR** (Benign random, v2.11.48) | **2.50%** (5/200) | 200 random npm packages, unchanged. |
-| **FPR PyPI** (v2.11.48, first honest measurement) | **9.68%** (12/124 scanned, 132 total) | **Track D fixed the PyPI downloader** — removed `pip --no-binary :all:` flag (forced compile of wheel-only packages, timed out 38% of the time) + added `.whl` extraction via `extractArchive()`. Brought 42 previously-skipped giants (numpy/pandas/django/matplotlib/scikit-learn/...) into scope. All 12 FPs cluster at score 25-35: this is the cap-PyPI-35 artifact, not new rule misfires. Lifting the cap (Track E) would drop FPR PyPI to ≈0%. 8 residual fails are >500MB packages (torch, tensorflow, scipy, opencv-python, ansible…) hitting the 30s `PACK_TIMEOUT_MS`. |
-| **ADR** (Adversarial + Holdout, v2.11.48) | **96.26%** (103/107) | 67 adversarial + 40 holdout, global threshold=20. Stable vs v2.10.95. |
-
-**4414 tests** across 141 files. **266 rules** (261 RULES + 5 PARANOID; v2.11.67/70 Phantom Gyp added PKG-023 + COMPOUND-017).
-
-**Known issues (v2.11.48):**
-- *Cap PyPI à 35/100*: Python samples plafonnent à `riskScore=35` even when `globalRiskScore=100`. Confirmed empirically — all 12 PyPI FPs at score 25-35 (flask 32, django 35, tornado 35, bottle 30, pandas 25, matplotlib 25, plotly 25, bokeh 25, pymongo 35, coverage 32, fabric 35, websockets 35). Lifting the cap will simultaneously drop FPR PyPI to ≈0% and unblock PyPI MALWARE detection at higher thresholds. Track E target.
-
-### Operational coverage (v2.11.67-76)
-
-The static ground-truth TPR above is measured offline. Since v2.11.67 the monitor also tracks **operational** coverage on live npm/PyPI ingestion:
-- A per-scan **ledger** (`data/scan-ledger.jsonl`) records every scanned package's outcome; `computeLedgerRollup()` produces a 24h rollup (`alertRate`, per-ecosystem). Note: `alertRate` is a throughput signal, **not** detection TPR.
-- An active **GHSA poller** (~15 min; npm, pypi, crates) builds an authoritative "what should we have caught" denominator (`data/ghsa-malware.jsonl`), plus a **feed-health** alarm that fires when an IOC feed silently goes dark.
-- The Phase 5 **coverage-audit** (`scripts/coverage-audit.js`, daily 05:00 UTC) joins that denominator against ledger outcomes + the tarball archive to compute an honest GHSA-denominated **operational TPR** (`alerted / total`), and surfaces `scannedClean` misses as human-gated ground-truth candidates.
-
-This operational TPR is the real production detection rate, distinct from the static GT TPR (which has not been re-measured since v2.11.48).
-
-### ML Classifier (offline only)
-
-`src/ml/classifier.js` is **not wired into `muaddib scan`**. The XGBoost model is currently exercised only by `muaddib evaluate` (offline metric replay) and `muaddib monitor` (LOG-ONLY since 2026-04-08, model collapsed pending retrain — see `src/monitor/queue.js:628`). The v2.11.48 evaluate-time replay shows the same 1.10% FPR (no additional FPs filtered) — kept as a reference for retrain validation, but the published operational FPR is the rules-only number above.
-
-> **Static evaluation caveats:**
-> - TPR measured on the full 94 in-scope samples from the 96-sample ground truth (2 out-of-scope protestware GT-005/GT-009 with `min_threats=0`)
-> - TPR@3 = detection rate (any signal); TPR@20 = operational alert threshold
-> - FPR rules measured on 548 curated popular npm packages (not a random sample)
-> - FPR PyPI: 124/132 scanned (8 download fails on >500MB giants — torch/tensorflow/ansible/…). Smaller N than npm.
-> - ADR measured with global threshold (score >= 20) as of v2.6.5
-
-See [Evaluation Methodology](docs/EVALUATION_METHODOLOGY.md) for the full experimental protocol, holdout history, and Datadog benchmark details.
+## Evaluation
 
-### ML Classifier — R&D, currently inactive
+Last measured **v2.11.48** (2026-05-26), **rules-only** (the ML classifier is inactive — see below). Ground truth: 94 in-scope real-world attacks + 200 random npm + 124 PyPI + 107 adversarial/holdout.
 
-> **Status (2026-04-08 → present):** The XGBoost classifier (`src/ml/classifier.js`) is **not wired into `muaddib scan`** at all, and in `muaddib monitor` it runs in **LOG-ONLY mode** since 2026-04-08 — the trained model collapsed (predicts p≈0.002 for every input, including clearly malicious lifecycle+exec+staged_payload patterns) and was disabled pending retrain on balanced JSONL data. The metrics below come from offline `muaddib evaluate` replay against a frozen bench. They describe what the model *would* contribute if it worked, **not** what an operator gets today.
+| Metric | Result |
+|--------|--------|
+| Detection rate (TPR@3) | **95.74%** (90/94) |
+| Alert rate (TPR@20) | **88.30%** (83/94) |
+| FPR — curated npm (548) | **1.10%** (6/545) |
+| FPR — random npm (200) | **2.50%** (5/200) |
+| FPR — PyPI (132) | **9.68%** (12/124) |
+| ADR — adversarial + holdout | **96.26%** (103/107) |
+| Wild TPR (Datadog 17K) | **92.8%** (13,538/14,587) |
 
-| Metric (offline `evaluate` replay) | Result | Details |
-|--------|--------|---------|
-| **ML FPR** | **2.85%** (239/8,393 holdout) | XGBoost retrained on 56,564 samples, 64 features, threshold=0.710 |
-| **ML TPR** | **99.93%** (2,918/2,920 holdout) | 377 confirmed_malicious via OSSF/GHSA/npm correlation |
-| **FPR after ML T1** (offline replay, v2.11.48) | **1.10%** (6/545 scanned) | Classifier filters 0/6 raw FPs in this run (filtered 1 at v2.11.47). Not applied during real scans — `muaddib scan` never invokes the classifier. |
+**ML classifier: inactive.** An XGBoost model lives in `src/ml/` but is never wired into `muaddib scan`, and runs LOG-ONLY in the monitor since 2026-04-08 (the trained model collapsed, pending retrain). All numbers above are rules-only.
 
-> **Retrain methodology (v2.10.51):**
-> - Ground truth: 377 confirmed_malicious via auto-labeler (OSSF malicious-packages, GitHub Advisory Database, npm registry takedown correlation)
-> - Dataset: 56,564 samples (14,602 malicious, 41,962 clean). Stratified 80/20 split
-> - Grid search: depth=4, estimators=300, lr=0.05. AUC-ROC=0.999, F1=0.960
-> - Leaky feature filter: 23 dead/leaky features removed (source-identity proxies)
->
-> The shadow model continues to log predictions in `muaddib monitor` for retraining validation. When the next model passes shadow validation, the LOG-ONLY guard in `src/monitor/queue.js:660` will be flipped and the metrics above will move back into the operational table.
+Full protocol, per-track history, the PyPI cap-35 caveat, operational (GHSA-denominated) coverage, and the ML retrain methodology: [Evaluation Methodology](docs/EVALUATION_METHODOLOGY.md).
 
 ---
 
@@ -380,7 +346,7 @@ npm test
 
 ### Testing
 
-- **4414 tests** across 141 modular test files
+- **4500 tests** across 147 modular test files
 - **56 fuzz tests** - Malformed inputs, ReDoS, unicode, binary
 - **Datadog 17K benchmark** - 14,587 confirmed malware samples (in-scope)
 - **Ground truth validation** - 96 real-world attacks (95.74% TPR@3, 88.30% TPR@20 — v2.11.48 full measure on 94 in-scope)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.138",
+  "version": "2.11.140",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {
@@ -48,16 +48,16 @@
   },
   "dependencies": {
     "@inquirer/prompts": "8.5.2",
-    "acorn": "8.16.0",
+    "acorn": "8.17.0",
     "acorn-walk": "8.3.5",
     "adm-zip": "0.5.17",
-    "js-yaml": "4.2.0",
+    "js-yaml": "5.1.0",
     "web-tree-sitter": "^0.26.9"
   },
   "devDependencies": {
     "@eslint/js": "10.0.1",
-    "eslint": "10.4.1",
+    "eslint": "10.5.0",
     "eslint-plugin-security": "^4.0.0",
-    "globals": "17.6.0"
+    "globals": "17.7.0"
   }
 }

package/{self-scan-v2.11.138.json → self-scan-v2.11.140.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-01T11:04:30.753Z",
+  "timestamp": "2026-07-01T20:47:08.448Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",
@@ -1068,28 +1068,6 @@
       "playbook": "SharedArrayBuffer + Worker Thread detectes. Canal IPC memoire partagee qui contourne la surveillance. Verifier si les workers manipulent des donnees sensibles. Isoler si combine avec eval/exec.",
       "points": 3
     },
-    {
-      "type": "dangerous_exec",
-      "severity": "MEDIUM",
-      "message": "[quick-scan] exec/spawn call detected in overflow file.",
-      "file": "eslint/lib/rules/eol-last.js",
-      "degraded": true,
-      "quickScan": true,
-      "count": 1,
-      "reductions": [],
-      "originalSeverity": "MEDIUM",
-      "confidenceTier": "low",
-      "rule_id": "MUADDIB-AST-007",
-      "rule_name": "Dangerous Shell Command Execution",
-      "confidence": "high",
-      "domain": "malware",
-      "references": [
-        "https://owasp.org/www-community/attacks/Command_Injection"
-      ],
-      "mitre": "T1059.004",
-      "playbook": "CRITIQUE: Execution de commande shell dangereuse detectee. Isoler la machine. Verifier si la commande a ete executee.",
-      "points": 3
-    },
     {
       "type": "dangerous_exec",
       "severity": "MEDIUM",
@@ -1468,7 +1446,29 @@
       "type": "dangerous_exec",
       "severity": "MEDIUM",
       "message": "[quick-scan] exec/spawn call detected in overflow file.",
-      "file": "js-yaml/lib/type/timestamp.js",
+      "file": "js-yaml/dist/browser/js-yaml.esm.min.mjs",
+      "degraded": true,
+      "quickScan": true,
+      "count": 1,
+      "reductions": [],
+      "originalSeverity": "MEDIUM",
+      "confidenceTier": "low",
+      "rule_id": "MUADDIB-AST-007",
+      "rule_name": "Dangerous Shell Command Execution",
+      "confidence": "high",
+      "domain": "malware",
+      "references": [
+        "https://owasp.org/www-community/attacks/Command_Injection"
+      ],
+      "mitre": "T1059.004",
+      "playbook": "CRITIQUE: Execution de commande shell dangereuse detectee. Isoler la machine. Verifier si la commande a ete executee.",
+      "points": 3
+    },
+    {
+      "type": "dangerous_exec",
+      "severity": "MEDIUM",
+      "message": "[quick-scan] exec/spawn call detected in overflow file.",
+      "file": "js-yaml/dist/browser/js-yaml.umd.min.js",
       "degraded": true,
       "quickScan": true,
       "count": 1,

package/src/scanner/python-ast-detectors/handle-assignment.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { classifyTaintSource } = require('./taint-tracker.js');
+const { classifyTaintSource, isHarvestEnv } = require('./taint-tracker.js');
 
 /**
  * Visit `assignment` nodes at module level (scope_depth === 0) and populate
@@ -13,6 +13,18 @@ const { classifyTaintSource } = require('./taint-tracker.js');
  *  - reassignment to a non-source value CLEARS the taint
  */
 function handleAssignment(node, ctx, scopeDepth) {
+  // crypto_exfil harvest leg (PyPI, file-level — runs at ANY scope, unlike moduleTaint):
+  // `secret = os.environ['AWS_SECRET']` even inside a function sets the harvest flag.
+  if (!ctx.hasSensitiveHarvestPy) {
+    const rhs = node.childForFieldName('right');
+    if (rhs) {
+      const t = classifyTaintSource(rhs);
+      if (t && t.sourceType === 'env' && isHarvestEnv(t.envVarName)) {
+        ctx.hasSensitiveHarvestPy = true;
+      }
+    }
+  }
+
   if (scopeDepth !== 0) return;
   if (!ctx.moduleTaint) return; // defensive — should always be initialised per-file
 

package/src/scanner/python-ast-detectors/handle-call-expression.js

@@ -8,7 +8,7 @@ const {
   isTruthyLiteral,
   lineOf
 } = require('./helpers.js');
-const { lookupTaint, isEnvSensitive } = require('./taint-tracker.js');
+const { lookupTaint, isEnvSensitive, isCryptoEncryptCall, isSensitiveFileOpen, nodeReadsSensitiveEnv } = require('./taint-tracker.js');
 
 /**
  * Visitor for `call` nodes. Emits PYAST-003, PYAST-004, PYAST-005, PYAST-006,
@@ -121,12 +121,40 @@ function getKwargValue(callNode, kwName) {
   return null;
 }
 
+// crypto_exfil harvest helper: true if any argument (positional or kwarg value)
+// reads a sensitive env var, e.g. requests.post(url, data=os.environ['AWS_SECRET']).
+function _callHasSensitiveEnvArg(callNode) {
+  const args = callNode.childForFieldName('arguments');
+  if (!args) return false;
+  for (const child of args.children) {
+    if (child.type === 'keyword_argument') {
+      const v = child.childForFieldName('value');
+      if (v && nodeReadsSensitiveEnv(v)) return true;
+    } else if (nodeReadsSensitiveEnv(child)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 // ---------------------------------------------------------------------------
 // Main visitor
 // ---------------------------------------------------------------------------
 
 function handleCallExpression(node, ctx, scopeDepth) {
   const callee = calleeDottedName(node);
+
+  // crypto_exfil (PyPI mirror of MUADDIB-COMPOUND-019): accumulate file-level flags consumed by
+  // the post-walk same-file compound in python-ast.js. Runs for EVERY call (before the !callee
+  // early return) and at ANY scope — the compound is file-level, like the JS handle-post-walk one.
+  // AST-call based, so a string/comment that merely contains "AES.new(" cannot trip it (JS self-FP lesson).
+  if (isCryptoEncryptCall(node)) ctx.hasCryptoEncryptPy = true;
+  if (callee && NETWORK_WRITE_CALLEES.has(callee)) ctx.hasNetworkWritePy = true;
+  if (!ctx.hasSensitiveHarvestPy &&
+      (nodeReadsSensitiveEnv(node) || isSensitiveFileOpen(node) || _callHasSensitiveEnvArg(node))) {
+    ctx.hasSensitiveHarvestPy = true;
+  }
+
   if (!callee) return;
 
   // PYAST-003: exec()/eval() at module level — direct RCE on import.

package/src/scanner/python-ast-detectors/taint-tracker.js

@@ -168,6 +168,83 @@ function classifyEnvSource(node) {
   return null;
 }
 
+// ---------------------------------------------------------------------------
+// CRYPTO-ENCRYPT detection (crypto_exfil PyPI mirror of MUADDIB-COMPOUND-019)
+// ---------------------------------------------------------------------------
+
+// Construction / encrypt-function callees of the major Python crypto libs. AST
+// dotted-name match (NOT a content regex): a string or comment that merely
+// contains "AES.new(" is not a `call` node, so it cannot trip this (the JS-side
+// self-FP lesson — see scanner/ast.js hasCryptoEncipher). Matching the
+// constructor/load call is sufficient as a file-level "encryption happens here"
+// flag; the generic `.encrypt()` method is deliberately NOT matched (too many
+// non-crypto libs expose .encrypt and it would FP).
+const CRYPTO_ENCRYPT_CALLEES = new Set([
+  // pycryptodome / PyCrypto — symmetric .new() + RSA padding .new()
+  'AES.new', 'DES.new', 'DES3.new', 'ARC4.new', 'ChaCha20.new', 'Salsa20.new',
+  'Blowfish.new', 'ChaCha20_Poly1305.new',
+  'Crypto.Cipher.AES.new', 'Cryptodome.Cipher.AES.new',
+  'PKCS1_OAEP.new', 'PKCS1_v1_5.new',
+  'Crypto.Cipher.PKCS1_OAEP.new', 'Cryptodome.Cipher.PKCS1_OAEP.new',
+  // rsa library
+  'rsa.encrypt',
+  // cryptography — hazmat ciphers + fernet + attacker pubkey load
+  'Cipher', 'cryptography.hazmat.primitives.ciphers.Cipher',
+  'Fernet', 'MultiFernet', 'cryptography.fernet.Fernet',
+  'load_pem_public_key', 'serialization.load_pem_public_key',
+  // PyNaCl
+  'SealedBox', 'SecretBox', 'nacl.public.SealedBox', 'nacl.secret.SecretBox'
+]);
+
+function isCryptoEncryptCall(callNode) {
+  if (!callNode || callNode.type !== 'call') return false;
+  const name = dottedName(callNode.childForFieldName('function'));
+  return !!(name && CRYPTO_ENCRYPT_CALLEES.has(name));
+}
+
+// ---------------------------------------------------------------------------
+// Sensitive-file open detection (crypto_exfil harvest leg, beyond env vars)
+// ---------------------------------------------------------------------------
+
+// Mirror of dataflow.js SENSITIVE_PATH_PATTERNS — credential/secret stores.
+const SENSITIVE_FILE_RE = /(\.aws[/\\]credentials|\.ssh[/\\]|id_rsa|id_ed25519|\.npmrc|\.netrc|\.git-credentials|\.config[/\\]gcloud|\.docker[/\\]config|\.kube[/\\]config|\.pgpass|wallet\.dat|\.metamask|\.electrum|\.exodus|\.gnupg|\/etc\/passwd|\/etc\/shadow)/i;
+const FILE_OPEN_CALLEES = new Set(['open', 'io.open', 'codecs.open']);
+
+function isSensitiveFileOpen(callNode) {
+  if (!callNode || callNode.type !== 'call') return false;
+  const name = dottedName(callNode.childForFieldName('function'));
+  if (!name || !FILE_OPEN_CALLEES.has(name)) return false;
+  const args = callNode.childForFieldName('arguments');
+  if (!args) return false;
+  for (const child of args.children) {
+    if (['(', ')', ',', 'keyword_argument'].includes(child.type)) continue;
+    const lit = stringLiteralValue(child); // first positional arg
+    return lit !== null && SENSITIVE_FILE_RE.test(lit);
+  }
+  return false;
+}
+
+// Env names that denote a CRYPTO KEY read in order to ENCRYPT (transport config),
+// NOT a credential to be stolen. A legit Fernet/cryptography transport wrapper loads
+// its own symmetric key from env (FERNET_KEY, ENCRYPTION_KEY, APP_CIPHER_KEY, ...) then
+// encrypts+sends — without this exclusion that env read would (via the bare "KEY"
+// substring in SENSITIVE_ENV_RE) look like harvesting and FP the crypto_exfil compound.
+// The attacker gains nothing: real stolen creds use names like AWS_SECRET_ACCESS_KEY /
+// *_TOKEN which are NOT crypto-config names, so they still count as harvest.
+const CRYPTO_CONFIG_ENV_RE = /^(FERNET|ENCRYPTION|ENCRYPT|DECRYPT|CIPHER|CRYPTO|AES|MASTER|SIGNING|HMAC)_?KEY$|_(ENCRYPTION|FERNET|CIPHER|AES|CRYPTO)_KEY$/i;
+
+// Harvest = a sensitive credential name, EXCLUDING crypto-key config (above).
+function isHarvestEnv(name) {
+  return isEnvSensitive(name) && !CRYPTO_CONFIG_ENV_RE.test(name);
+}
+
+// True iff `node` reads a HARVESTABLE credential env var (os.environ['X'] /
+// os.getenv('X') / os.environ.get('X')) — sensitive name, not crypto-key config.
+function nodeReadsSensitiveEnv(node) {
+  const name = classifyEnvSource(node);
+  return name !== null && isHarvestEnv(name);
+}
+
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -200,11 +277,19 @@ module.exports = {
   classifyTaintSource,
   lookupTaint,
   isEnvSensitive,
+  // crypto_exfil (PyPI mirror of COMPOUND-019) — file-flag classifiers
+  isCryptoEncryptCall,
+  isSensitiveFileOpen,
+  nodeReadsSensitiveEnv,
+  isHarvestEnv,
   // Exposed for unit tests
   _internal: {
     isFetchSource,
     isBase64Source,
     classifyEnvSource,
-    SENSITIVE_ENV_RE
+    SENSITIVE_ENV_RE,
+    CRYPTO_ENCRYPT_CALLEES,
+    SENSITIVE_FILE_RE,
+    CRYPTO_CONFIG_ENV_RE
   }
 };

package/src/scanner/python-ast.js

@@ -49,6 +49,7 @@ const WASM_PATH = path.join(__dirname, '..', 'vendor', 'tree-sitter-python.wasm'
 // findTargetPythonFiles() from python-source.js below.
 const { _internal: pysrcInternal } = require('./python-source.js');
 const { findTargetPythonFiles } = pysrcInternal;
+const { networkDestinationsAllBenign } = require('../sdk-destination.js');
 
 // ---------------------------------------------------------------------------
 // Async tree-sitter init (lazy, cached).
@@ -151,10 +152,30 @@ function scanPythonAST(targetPath) {
       // Per-file taint map populated by handle-assignment.js at scope_depth==0
       // and read by handle-call-expression.js for compound detections
       // (PYAST-005/006/009/010). See python-ast-detectors/taint-tracker.js.
-      moduleTaint: new Map()
+      moduleTaint: new Map(),
+      // crypto_exfil (PyPI mirror of MUADDIB-COMPOUND-019) file-level flags, set during the
+      // walk by handle-call-expression.js / handle-assignment.js, read in the finalize below.
+      hasCryptoEncryptPy: false,
+      hasNetworkWritePy: false,
+      hasSensitiveHarvestPy: false
     };
 
     walk(tree.rootNode, ctx, visitors);
+
+    // crypto_exfil finalize (same-file compound): secret harvest + encryption (RSA/AES) +
+    // network write, to a destination that is NOT entirely first-party/trusted. Mirror of the
+    // JS handle-post-walk compound; emits the SAME 'crypto_exfil' type (MUADDIB-COMPOUND-019),
+    // inheriting its rule/playbook/HIGH_CONFIDENCE_MALICE plumbing. destAllBenign reuses the
+    // shared host-reputation engine on the .py source (suppresses SDKs posting to their own API).
+    if (ctx.hasCryptoEncryptPy && ctx.hasNetworkWritePy && ctx.hasSensitiveHarvestPy &&
+        !networkDestinationsAllBenign(source)) {
+      threats.push({
+        type: 'crypto_exfil',
+        severity: 'CRITICAL',
+        message: `${ctx.relFile}: hybrid-crypto exfiltration (PyPI) — secret harvesting (env var / credential file) + encryption (RSA/AES via pycryptodome/cryptography/rsa/nacl) + network write in the same file, to a non-first-party destination. Stolen secrets are encrypted before exfil to evade DLP/taint inspection (litellm/Hades pattern).`,
+        file: ctx.relFile
+      });
+    }
   }
 
   return threats;

package/src/scoring.js

@@ -166,7 +166,12 @@ const SINGLE_FIRE_CRITICAL_TYPES = new Set([
   // Phantom Gyp compound (Phase 1b): only fires when the invoked configure-time script
   // is INDEPENDENTLY judged malicious, so it carries the same unambiguous-malware weight
   // as the IOC/hash matches above — FP≈0 by construction justifies the single-fire floor.
-  'gyp_phantom_exec'
+  'gyp_phantom_exec',
+  // crypto_exfil (COMPOUND-019): harvest + RSA/AES encryption + network to a non-benign
+  // dest in the same file (FP≈0 by construction). Floors a lone CRITICAL to 75 so it is
+  // not buried at 25 on PyPI, where a single CRITICAL does not stack co-signals the way
+  // the npm side does (env_access + credential_regex_harvest + ... → 100).
+  'crypto_exfil'
 ]);
 const SINGLE_FIRE_CRITICAL_FLOOR = 75;
 const SINGLE_FIRE_MIN_SEVERITY_RANK = 2; // HIGH