muaddib-scanner 2.11.140 → 2.11.142

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.140",
+  "version": "2.11.142",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.140.json → self-scan-v2.11.142.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-01T20:47:08.448Z",
+  "timestamp": "2026-07-01T21:20:16.682Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/scanner/ast-detectors/handle-call-expression.js

@@ -38,6 +38,50 @@ const {
   ETHEREUM_PACKAGES,
   SOLANA_PACKAGES
 } = require('./constants.js');
+
+// -----------------------------------------------------------------------------
+// SECURITY (E3 — audit 2026-07): ReDoS mitigation for static `.replace()`-chain resolution.
+// The resolver (Blue Team v8, below) statically re-applies `.replace(/regex/, str)` calls
+// taken from the SCANNED package to reconstruct obfuscated strings. On the CLI path this
+// runs synchronously on the main thread, so executing an attacker-authored regex that
+// catastrophically backtracks would wedge it. Note: the subject-length cap does NOT bound
+// this — exponential backtracking blows up on ~30 chars regardless of cap.
+//
+// Defense in depth (this is layer 1 of 2):
+//   Layer 1 (here): a BLOCKLIST of common catastrophic shapes + length caps, so the
+//     frequent cases fast-fail without running the regex. It is NOT exhaustive — a crafted
+//     pattern (e.g. nested groups like `((a+)x)+`) can slip past it.
+//   Layer 2 (hard bound): the monitor runs every scan in a Worker with a 45s
+//     STATIC_SCAN_TIMEOUT_MS -> worker.terminate() (src/monitor/queue.js). V8 TerminateExecution
+//     interrupts even a running regex — verified empirically that terminate() returns
+//     mid-backtrack on BOTH the dev box (Node 24 / V8 13.6: ~6ms) and the production VPS
+//     (Node 20.20.0: ~8ms). So a layer-1 bypass is bounded to <=45s and the worker is killed.
+//     The CLI runs the pipeline inline (src/index.js) and has no such backstop — one-shot,
+//     Ctrl-C-able, lower severity.
+//
+// A refused pattern only leaves the chain "unresolved" (still flagged by the depth>=4
+// fallback) — never a false negative by crash.
+// -----------------------------------------------------------------------------
+const MAX_REPLACE_REGEX_LEN = 200;    // reject absurdly long attacker regex sources
+const MAX_REPLACE_SUBJECT_LEN = 4000; // caps LINEAR/polynomial blowup on huge subjects (not exponential)
+
+// BLOCKLIST (non-exhaustive) of common catastrophic-backtracking regex shapes. Allows any
+// pattern that does not match a known-bad shape — the hard guarantee is layer 2 above, not
+// this heuristic. Its OWN patterns are linear (negated char classes only), so it introduces
+// no ReDoS of its own.
+function isCatastrophicReplaceRegex(src) {
+  if (typeof src !== 'string') return true;
+  // Quantifier applied to a group whose body already contains a quantifier:
+  //   (a+)+  (a*)*  (a+)*  ([ab]+)+  (\w+)*
+  if (/\([^()]*[+*][^()]*\)\s*[*+]/.test(src)) return true;
+  // Quantified group whose body contains a {n,m} repetition:  (\d{1,3})+
+  if (/\([^()]*\{\d+(?:,\d*)?\}[^()]*\)\s*[*+]/.test(src)) return true;
+  // Quantified group containing alternation (possible overlap):  (a|a)*  (ab|a)+
+  if (/\([^()]*\|[^()]*\)\s*[*+]/.test(src)) return true;
+  // Unbounded {n,} repetition applied to a group:  (...)+{2,}
+  if (/\)[*+?]?\{\d+,\}/.test(src)) return true;
+  return false;
+}
 const {
   extractStringValue,
   calculateShannonEntropy,
@@ -1919,14 +1963,20 @@ function handleCallExpression(node, ctx) {
             let replacement = null;
             // Extract regex or string pattern
             if (args[0].type === 'Literal' && args[0].regex) {
-              try { pattern = new RegExp(args[0].regex.pattern, args[0].regex.flags); } catch { /* skip */ }
+              // SECURITY (E3): the pattern is attacker-controlled. Refuse catastrophic
+              // shapes / over-long sources so a ReDoS can't wedge this synchronous scanner.
+              if (args[0].regex.pattern.length <= MAX_REPLACE_REGEX_LEN &&
+                  !isCatastrophicReplaceRegex(args[0].regex.pattern)) {
+                try { pattern = new RegExp(args[0].regex.pattern, args[0].regex.flags); } catch { /* skip */ }
+              }
             } else if (args[0].type === 'Literal' && typeof args[0].value === 'string') {
               pattern = args[0].value;
             }
             if (args[1].type === 'Literal' && typeof args[1].value === 'string') {
               replacement = args[1].value;
             }
-            if (pattern !== null && replacement !== null) {
+            // SECURITY (E3): also refuse to run any pattern against an oversized subject.
+            if (pattern !== null && replacement !== null && resolved.length <= MAX_REPLACE_SUBJECT_LEN) {
               resolved = resolved.replace(pattern, replacement);
             } else {
               resolved = null;
@@ -2101,4 +2151,4 @@ function handleCallExpression(node, ctx) {
 
 // _shadowClassifyMcpWrite is shared with handle-post-walk.js (the Wave-4
 // keyword-co-occurrence emitter — the third mcp_config_injection site).
-module.exports = { handleCallExpression, _shadowClassifyMcpWrite };
+module.exports = { handleCallExpression, _shadowClassifyMcpWrite, _isCatastrophicReplaceRegex: isCatastrophicReplaceRegex };

package/src/shared/constants.js

@@ -85,6 +85,10 @@ const NPM_PACKAGE_REGEX = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*
 // Download/extraction limits
 const MAX_TARBALL_SIZE = 50 * 1024 * 1024; // 50MB
 const DOWNLOAD_TIMEOUT = 30_000; // 30 seconds
+// Decompressed-size cap for tar.gz extraction (M4). PARTIAL tar-bomb mitigation only —
+// bypassable by a bomb forged to a multiple of 4GB + (<1GB), because the gzip ISIZE trailer
+// this is checked against is mod 2^32. A hard cap needs streaming decompression (separate tech debt).
+const MAX_EXTRACTED_SIZE = 1024 * 1024 * 1024; // 1GB
 
 // Shared scanner constants
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB — skip files larger than this to avoid memory issues
@@ -146,4 +150,4 @@ function clearASTCache() {
   _astCache.clear();
 }
 
-module.exports = { REHABILITATED_PACKAGES, NPM_PACKAGE_REGEX, MAX_TARBALL_SIZE, DOWNLOAD_TIMEOUT, MAX_FILE_SIZE, ACORN_OPTIONS, safeParse, clearASTCache, getMaxFileSize, setMaxFileSize, resetMaxFileSize };
+module.exports = { REHABILITATED_PACKAGES, NPM_PACKAGE_REGEX, MAX_TARBALL_SIZE, DOWNLOAD_TIMEOUT, MAX_EXTRACTED_SIZE, MAX_FILE_SIZE, ACORN_OPTIONS, safeParse, clearASTCache, getMaxFileSize, setMaxFileSize, resetMaxFileSize };

package/src/shared/download.js

@@ -3,7 +3,7 @@ const fs = require('fs');
 const path = require('path');
 const { execFileSync } = require('child_process');
 const AdmZip = require('adm-zip');
-const { MAX_TARBALL_SIZE, DOWNLOAD_TIMEOUT } = require('./constants.js');
+const { MAX_TARBALL_SIZE, DOWNLOAD_TIMEOUT, MAX_EXTRACTED_SIZE } = require('./constants.js');
 const { registryAuthHeaders } = require('./registry-auth.js');
 
 // Allowed redirect domains for tarball downloads (SSRF protection)
@@ -241,6 +241,34 @@ function detectArchiveFormat(archivePath) {
   return 'unknown';
 }
 
+// SECURITY (M4 — audit 2026-07): PARTIAL tar-bomb mitigation.
+// Reads the gzip ISIZE trailer (last 4 bytes = uncompressed size mod 2^32) in O(1) memory,
+// synchronously, so _extractTarGzImpl can reject a declared-oversize archive BEFORE spawning
+// `tar` (rejecting pre-spawn matters: worker.terminate() can orphan a running tar child that
+// keeps writing to disk). LIMITATION — this is a PARTIAL mitigation, NOT a hard cap: because
+// ISIZE is mod 2^32, a bomb forged to a multiple of 4GB + (<1GB) wraps under the cap and evades
+// this hint; that narrow residual falls back to the 60s tar timeout. A complete cap requires
+// streaming decompression, which would make extraction async and ripple to all sync callers —
+// tracked as separate tech debt, deliberately not done here.
+function readGzipUncompressedHint(tgzPath) {
+  let fd;
+  try {
+    fd = fs.openSync(tgzPath, 'r');
+    const { size } = fs.fstatSync(fd);
+    if (size < 18) return null; // too small to be a valid gzip member
+    const magic = Buffer.alloc(2);
+    fs.readSync(fd, magic, 0, 2, 0);
+    if (magic[0] !== 0x1f || magic[1] !== 0x8b) return null; // not gzip — let tar error naturally
+    const isize = Buffer.alloc(4);
+    fs.readSync(fd, isize, 0, 4, size - 4);
+    return isize.readUInt32LE(0);
+  } catch {
+    return null; // unreadable hint — never block extraction on a hint failure
+  } finally {
+    if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* ignore */ } }
+  }
+}
+
 /**
  * Extract a tar.gz tarball with the system `tar` binary. Used for npm
  * tarballs and PyPI sdists. Internal implementation — call extractArchive
@@ -248,6 +276,14 @@ function detectArchiveFormat(archivePath) {
  * scanner/temporal-ast-diff.js callsite.
  */
 function _extractTarGzImpl(tgzPath, destDir) {
+  // SECURITY (M4): reject a declared-oversize gzip before `tar` ever runs. PARTIAL mitigation
+  // (bypassable by a 4GB-multiple + <1GB forged bomb) — see readGzipUncompressedHint.
+  const uncompressedHint = readGzipUncompressedHint(tgzPath);
+  if (uncompressedHint !== null && uncompressedHint > MAX_EXTRACTED_SIZE) {
+    throw new Error(
+      `Tar extract refused: declared uncompressed size ${uncompressedHint} exceeds ${MAX_EXTRACTED_SIZE} (possible decompression bomb)`
+    );
+  }
   // Use cwd + relative paths so C: never appears in tar arguments
   // (GNU tar treats C: as remote host, bsdtar doesn't support --force-local)
   const tgzDir = path.dirname(path.resolve(tgzPath));
@@ -418,6 +454,7 @@ module.exports = {
   extractArchive,
   extractArchiveOffThread,
   detectArchiveFormat,
+  _readGzipUncompressedHint: readGzipUncompressedHint,
   sanitizePackageName,
   isAllowedDownloadRedirect,
   normalizeHostname,