muaddib-scanner 2.11.144 → 2.11.145

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.144",
+  "version": "2.11.145",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.144.json → self-scan-v2.11.145.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-01T21:56:09.524Z",
+  "timestamp": "2026-07-02T07:33:23.008Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/rules/index.js

@@ -1148,7 +1148,7 @@ const RULES = {
     severity: 'CRITICAL',
     confidence: 'high',
     domain: 'malware',
-    description: 'Reference DISSIMULEE en charcodes a un marqueur d\'environnement d\'analyse — marqueur de sandbox MUAD\'DIB (MUADDIB_GVISOR), marqueur d\'un analyseur pair, ou nom de poison-token. Seule la forme obfusquee est matchee : le code de sandbox de MUAD\'DIB lui-meme et l\'outillage securite legitime referencent ces marqueurs en clair sans risque. Aucun package legitime n\'encode un check pour ces tripwires. Le marqueur est un honeytoken plante : garde public et stable pour que tout verificateur s\'auto-incrimine.',
+    description: 'Reference dissimulee (charcode/base64/hex) OU enumeration de process.env cherchant un prefix marqueur MUADDIB (marker-agnostique), vers un marqueur d\'environnement d\'analyse — marqueur de sandbox MUAD\'DIB (MUADDIB_GVISOR), marqueur d\'un analyseur pair, ou nom de poison-token. Seules les formes obfusquees/enumerees sont matchees : le code de sandbox de MUAD\'DIB lui-meme et l\'outillage securite legitime referencent ces marqueurs en clair sans risque. Aucun package legitime n\'encode ni n\'enumere un check pour ces tripwires. Le marqueur est un honeytoken plante : garde public et stable pour que tout verificateur s\'auto-incrimine.',
     references: [
       'https://attack.mitre.org/techniques/T1497/',
       'https://attack.mitre.org/techniques/T1480/'

package/src/scanner/ast-detectors/anti-evasion.js

@@ -47,34 +47,95 @@ const ANALYZER_MARKERS = [
   'CHAINRADAR_'
 ];
 
-// Bound the charcode-array decode so a pathological file can't blow the CPU budget.
-const MAX_DECODE_ARRAYS = 300;
+// Bound the number of decode attempts so a pathological file can't blow the CPU budget.
+const MAX_DECODE = 300;
 // A char-code array literal: >=6 small integers, e.g. [77,85,65,68,68,73,66,...].
 const CHARCODE_ARRAY_RE = /\[\s*(\d{1,3}(?:\s*,\s*\d{1,3}){5,})\s*\]/g;
+// A base64 blob big enough to hide a marker (>=12 chars ~ a 9+ byte string).
+const BASE64_RE = /['"`]([A-Za-z0-9+/]{12,}={0,2})['"`]/g;
+// Hex-encoded string: a run of \xHH escapes, or a contiguous even-length hex literal.
+const HEX_ESCAPE_RE = /((?:\\x[0-9a-fA-F]{2}){8,})/g;
+const HEX_LITERAL_RE = /['"`]([0-9a-fA-F]{16,})['"`]/g;
+
+// Return the first planted analyzer marker contained in `decoded`, or null.
+function markerIn(decoded) {
+  if (!decoded) return null;
+  for (const m of ANALYZER_MARKERS) {
+    if (decoded.indexOf(m) !== -1) return m;
+  }
+  return null;
+}
 
 /**
- * Return the first analyzer marker that appears CHARCODE-ENCODED in `content` (i.e. hidden
- * inside a numeric array literal that decodes to a string containing the marker), or null.
- * Plaintext references are intentionally ignored (see module doc). Bounded, side-effect-free.
+ * Return the first analyzer marker that appears OBFUSCATED in `content` — hidden inside a
+ * charcode array, a base64 blob, or a hex string that decodes to text containing the marker —
+ * or null. Plaintext references are intentionally ignored (see module doc): MUAD'DIB's own
+ * sandbox code and legit security tooling reference these markers in the clear, but no benign
+ * package *encodes* a check for one. Bounded (MAX_DECODE total decodes), side-effect-free.
  */
 function detectAnalyzerHoneytoken(content) {
-  if (!content || content.indexOf('[') === -1) return null;
-  CHARCODE_ARRAY_RE.lastIndex = 0;
-  let match, seen = 0;
-  while ((match = CHARCODE_ARRAY_RE.exec(content)) !== null) {
-    if (++seen > MAX_DECODE_ARRAYS) break;
-    const nums = match[1].split(',').map(n => parseInt(n, 10));
-    // Only decode arrays that are entirely printable ASCII codes (a real hidden string).
-    if (nums.some(n => !(n >= 9 && n <= 126))) continue;
-    let decoded;
-    try { decoded = String.fromCharCode.apply(null, nums); } catch { continue; }
-    for (const m of ANALYZER_MARKERS) {
-      if (decoded.indexOf(m) !== -1) return m;
+  if (!content) return null;
+  let seen = 0;
+
+  // (1) charcode array: e.g. [77,85,65,68,...] whose codes decode to a marker string
+  if (content.indexOf('[') !== -1) {
+    CHARCODE_ARRAY_RE.lastIndex = 0;
+    let match;
+    while ((match = CHARCODE_ARRAY_RE.exec(content)) !== null) {
+      if (++seen > MAX_DECODE) return null;
+      const nums = match[1].split(',').map(n => parseInt(n, 10));
+      if (nums.some(n => !(n >= 9 && n <= 126))) continue; // printable ASCII only
+      let decoded; try { decoded = String.fromCharCode.apply(null, nums); } catch { continue; }
+      const m = markerIn(decoded); if (m) return m;
+    }
+  }
+
+  // (2) base64 blob: e.g. Buffer.from(b64, 'base64') where b64 decodes to a marker
+  BASE64_RE.lastIndex = 0;
+  let b;
+  while ((b = BASE64_RE.exec(content)) !== null) {
+    if (++seen > MAX_DECODE) return null;
+    let decoded; try { decoded = Buffer.from(b[1], 'base64').toString('latin1'); } catch { continue; }
+    const m = markerIn(decoded); if (m) return m;
+  }
+
+  // (3) hex string: '\x4d\x55...' escapes or a contiguous '4d5541...' literal
+  for (const re of [HEX_ESCAPE_RE, HEX_LITERAL_RE]) {
+    re.lastIndex = 0;
+    let h;
+    while ((h = re.exec(content)) !== null) {
+      if (++seen > MAX_DECODE) return null;
+      const pairs = h[1].match(/[0-9a-fA-F]{2}/g);
+      if (!pairs) continue;
+      let decoded; try { decoded = pairs.map(x => String.fromCharCode(parseInt(x, 16))).join(''); } catch { continue; }
+      const m = markerIn(decoded); if (m) return m;
     }
   }
+
   return null;
 }
 
+// process.env KEY-ENUMERATION coupled with a test against an analysis-marker prefix
+//   (enumerate the env keys, then test each against the distinctive MUADDIB prefix — our own
+//   tool name, FP-safe; bare 'GVISOR' is a real runtime and is deliberately NOT matched).
+// Marker-AGNOSTIC re: the exact var name (matches any MUADDIB_* var), unlike the
+// exact-name form `process.env.MUADDIB_GVISOR`. FP-safe by coupling: a scanned package has no
+// legitimate reason to enumerate the environment looking for OUR sandbox-marker prefix
+// (verified: MUAD'DIB reads its own MUADDIB_* vars directly, never via enumerate+startsWith).
+const ENV_ENUM_RE = /Object\s*\.\s*(?:keys|entries|getOwnPropertyNames)\s*\(\s*process\s*\.\s*env|for\b[^;{}]*\bin\b\s*process\s*\.\s*env/;
+const ENV_KEY_MARKER_TEST_RE = /\.\s*(?:startsWith|includes|indexOf|search|match)\s*\(\s*['"`][^'"`]*MUADDIB|['"`][^'"`]*MUADDIB[^'"`]*['"`]\s*(?:===?|!==?)|(?:===?|!==?)\s*['"`][^'"`]*MUADDIB/;
+
+/**
+ * Detect generic `process.env` enumeration whose keys are tested for the distinctive MUADDIB
+ * prefix (case-sensitive; bare 'GVISOR' is a real runtime, deliberately not matched). Returns the matched marker family (string) or null. Marker-agnostic, FP-safe
+ * by coupling (env enumeration + our own tripwire prefix).
+ */
+function detectEnvMarkerEnumeration(content) {
+  if (!content || content.indexOf('process') === -1) return null;
+  if (!ENV_ENUM_RE.test(content)) return null;
+  return ENV_KEY_MARKER_TEST_RE.test(content) ? 'MUADDIB' : null;
+}
+
 /** Count silent `process.exit(` guards — the magnitude of the "detonation-gate wall". */
 function countExitGuards(content) {
   if (!content) return 0;
@@ -87,4 +148,4 @@ function hasHostRecon(content) {
   return !!content && /\.\s*(?:hostname|userInfo|networkInterfaces)\s*\(/.test(content);
 }
 
-module.exports = { ANALYZER_MARKERS, detectAnalyzerHoneytoken, countExitGuards, hasHostRecon };
+module.exports = { ANALYZER_MARKERS, detectAnalyzerHoneytoken, detectEnvMarkerEnumeration, countExitGuards, hasHostRecon };

package/src/scanner/ast-detectors/handle-post-walk.js

@@ -5,8 +5,8 @@ const { networkDestinationsAllBenign } = require('../../sdk-destination.js');
 function handlePostWalk(ctx) {
   // ── Anti-analysis / sandbox evasion (2026, @longzy DPRK "Contagious Interview") ──
   // We detect the EVASION rather than trying to hide the sandbox (an unwinnable arms race).
-  //  (1) analyzer_honeytoken_reference (CRITICAL, FP~0): the file hides — behind charcode
-  //      encoding — a check for a known analysis-environment tripwire (our own MUADDIB_GVISOR,
+  //  (1) analyzer_honeytoken_reference (CRITICAL, FP~0): the file hides — behind charcode/base64/hex
+  //      encoding, OR via process.env key-enumeration — a check for a known tripwire (our own MUADDIB_GVISOR,
   //      a peer analyzer marker, a poison-token name). Only the OBFUSCATED form is matched, so
   //      MUAD'DIB's own sandbox code (plaintext) and legit security tooling never trip it. The
   //      marker is a planted honeytoken: kept public+stable so any checker self-incriminates.
@@ -19,7 +19,14 @@ function handlePostWalk(ctx) {
     ctx.threats.push({
       type: 'analyzer_honeytoken_reference',
       severity: 'CRITICAL',
-      message: `Charcode-hidden reference to an analysis-environment marker ("${ctx.analyzerHoneytokenHit}") — sandbox/analyzer evasion. No legitimate package obfuscates a check for this tripwire.`,
+      message: `Obfuscated (charcode/base64/hex-encoded) reference to an analysis-environment marker ("${ctx.analyzerHoneytokenHit}") — sandbox/analyzer evasion. No legitimate package encodes a check for this tripwire.`,
+      file: ctx.relFile
+    });
+  } else if (ctx.envMarkerEnumHit) {
+    ctx.threats.push({
+      type: 'analyzer_honeytoken_reference',
+      severity: 'CRITICAL',
+      message: `Enumerates process.env keys and tests them against an analyzer-marker prefix (${ctx.envMarkerEnumHit}) — marker-agnostic sandbox/analyzer evasion (matches any MUADDIB_* var, not a fixed name). No legitimate package scans the environment for this tripwire.`,
       file: ctx.relFile
     });
   } else if (

package/src/scanner/ast.js

@@ -13,7 +13,7 @@ const {
   handleWithStatement,
   handlePostWalk
 } = require('./ast-detectors');
-const { detectAnalyzerHoneytoken, countExitGuards, hasHostRecon } = require('./ast-detectors/anti-evasion.js');
+const { detectAnalyzerHoneytoken, detectEnvMarkerEnumeration, countExitGuards, hasHostRecon } = require('./ast-detectors/anti-evasion.js');
 
 // Check if credential keywords appear INSIDE regex literals or new RegExp() patterns.
 // Only true when the keyword is part of the regex pattern itself, not just a string elsewhere in the file.
@@ -166,6 +166,7 @@ function analyzeFile(content, filePath, basePath) {
     hasHostRecon: hasHostRecon(content),
     hasProcessEnvRead: /process\s*\.\s*env\b/.test(content),
     analyzerHoneytokenHit: detectAnalyzerHoneytoken(content),
+    envMarkerEnumHit: detectEnvMarkerEnumeration(content),
     hasJsReverseShell: /\bnet\.Socket\b/.test(content) &&
       /\.connect\s*\(/.test(content) &&
       /\.pipe\b/.test(content) &&