muaddib-scanner 2.11.146 → 2.11.148

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.146",
+  "version": "2.11.148",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.146.json → self-scan-v2.11.148.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-02T08:08:45.257Z",
+  "timestamp": "2026-07-02T10:15:47.871Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/rules/index.js

@@ -1148,7 +1148,7 @@ const RULES = {
     severity: 'CRITICAL',
     confidence: 'high',
     domain: 'malware',
-    description: 'Reference dissimulee (charcode/base64/hex) OU enumeration de process.env cherchant un prefix marqueur MUADDIB (marker-agnostique), vers un marqueur d\'environnement d\'analyse — marqueur de sandbox MUAD\'DIB (MUADDIB_GVISOR), marqueur d\'un analyseur pair, ou nom de poison-token. Seules les formes obfusquees/enumerees sont matchees : le code de sandbox de MUAD\'DIB lui-meme et l\'outillage securite legitime referencent ces marqueurs en clair sans risque. Aucun package legitime n\'encode ni n\'enumere un check pour ces tripwires. Le marqueur est un honeytoken plante : garde public et stable pour que tout verificateur s\'auto-incrimine.',
+    description: 'Reference dissimulee (charcode/base64/hex) OU enumeration de process.env (JS) / os.environ (Python) cherchant un prefix marqueur MUADDIB (marker-agnostique), vers un marqueur d\'environnement d\'analyse — marqueur de sandbox MUAD\'DIB (MUADDIB_GVISOR), marqueur d\'un analyseur pair, ou nom de poison-token. Seules les formes obfusquees/enumerees sont matchees : le code de sandbox de MUAD\'DIB lui-meme et l\'outillage securite legitime referencent ces marqueurs en clair sans risque. Aucun package legitime n\'encode ni n\'enumere un check pour ces tripwires. Le marqueur est un honeytoken plante : garde public et stable pour que tout verificateur s\'auto-incrimine.',
     references: [
       'https://attack.mitre.org/techniques/T1497/',
       'https://attack.mitre.org/techniques/T1480/'

package/src/sandbox/index.js

@@ -195,13 +195,51 @@ function imageExists() {
 
 // ── gVisor availability check ──
 
+let _gvisorAvailableCache;          // memoized host capability (runsc does not appear mid-process)
+let _sandboxRuntimeWarned = false;  // throttle the runtime warning/refusal log to once per process
+
 function isGvisorAvailable() {
+  if (_gvisorAvailableCache !== undefined) return _gvisorAvailableCache;
   try {
     const info = execSync('docker info', { encoding: 'utf8', stdio: 'pipe', timeout: 10000 });
-    return /\brunsc\b/.test(info);
+    _gvisorAvailableCache = /\brunsc\b/.test(info);
   } catch {
-    return false;
+    _gvisorAvailableCache = false;
   }
+  return _gvisorAvailableCache;
+}
+
+// Pure runtime-selection decision (no I/O) — unit-testable without Docker, unlike
+// runSandbox() which early-returns before this point when Docker is absent.
+// Inputs: the env object + whether runsc is actually available (isGvisorAvailable()).
+// Returns { useGvisor, refuse, warn, reason }:
+//   - useGvisor: run under runsc (stronger isolation)
+//   - refuse:    caller MUST NOT run — gVisor was REQUIRED but runsc is unavailable
+//                (fail CLOSED, opt-in via MUADDIB_REQUIRE_GVISOR). Do not downgrade.
+//   - warn:      caller should emit a prominent isolation-downgrade WARNING because
+//                gVisor was requested, is unavailable, but was not required (fail OPEN).
+// Default (neither env var set) → runc, no warn, no refuse (unchanged behavior).
+// MUADDIB_REQUIRE_GVISOR implies wanting gVisor (you cannot require what you don't want).
+function resolveSandboxRuntime(env, gvisorAvailable) {
+  const wantGvisor = env.MUADDIB_SANDBOX_RUNTIME === 'gvisor';
+  const requireGvisor = env.MUADDIB_REQUIRE_GVISOR === '1' || env.MUADDIB_REQUIRE_GVISOR === 'true';
+  if (!wantGvisor && !requireGvisor) {
+    // gVisor not requested. If runsc IS available on this host, still warn: the operator
+    // installed gVisor but this scan is running on weaker runc (the exact VPS gap — runsc
+    // present, Docker default runtime is runc, env var never set). Detectable in prod.
+    if (gvisorAvailable) {
+      return { useGvisor: false, refuse: false, warn: true,
+        reason: 'sandbox running under runc although gVisor (runsc) IS available on this host — set MUADDIB_SANDBOX_RUNTIME=gvisor to use the stronger isolation' };
+    }
+    return { useGvisor: false, refuse: false, warn: false, reason: 'runc (default — gVisor neither requested nor available)' };
+  }
+  if (gvisorAvailable) {
+    return { useGvisor: true, refuse: false, warn: false, reason: 'gvisor (runsc)' };
+  }
+  if (requireGvisor) {
+    return { useGvisor: false, refuse: true, warn: false, reason: 'gVisor REQUIRED (MUADDIB_REQUIRE_GVISOR) but runsc is not available' };
+  }
+  return { useGvisor: false, refuse: false, warn: true, reason: 'gVisor requested but runsc unavailable — falling back to weaker runc isolation' };
 }
 
 // ── Build image (with cache) ──
@@ -725,15 +763,37 @@ async function runSandbox(packageName, options = {}) {
     return cleanResult;
   }
 
-  // Detect sandbox runtime (gVisor or default Docker/runc)
-  let useGvisor = process.env.MUADDIB_SANDBOX_RUNTIME === 'gvisor';
-  if (useGvisor) {
-    if (isGvisorAvailable()) {
-      console.log('[SANDBOX] Runtime: gvisor (runsc)');
-    } else {
-      console.log('[SANDBOX] Runtime: gvisor requested but runsc not configured in Docker. Falling back to Docker standard.');
-      useGvisor = false;
+  // Detect sandbox runtime (gVisor or default Docker/runc). The decision is a pure,
+  // unit-tested function (resolveSandboxRuntime); here we act on it. isGvisorAvailable()
+  // is memoized, so this is a per-process `docker info`, not a per-scan one.
+  const rt = resolveSandboxRuntime(process.env, isGvisorAvailable());
+  const useGvisor = rt.useGvisor;
+  if (rt.refuse) {
+    // Fail CLOSED: operator set MUADDIB_REQUIRE_GVISOR but runsc is unavailable. Do NOT
+    // silently downgrade to weaker runc isolation — return INCONCLUSIVE (score -1) so the
+    // package is never cleared on weaker isolation than was demanded. Each blocked scan is
+    // ledgered (sandbox_inconclusive); the console warning is throttled to once/process.
+    if (!_sandboxRuntimeWarned) {
+      _sandboxRuntimeWarned = true;
+      console.warn(`[SANDBOX] SECURITY: refusing to run — ${rt.reason}. Install gVisor (scripts/install-gvisor.sh) or unset MUADDIB_REQUIRE_GVISOR to allow runc.`);
     }
+    return {
+      score: -1,
+      severity: 'INCONCLUSIVE',
+      findings: [{ type: 'gvisor_required_unavailable', severity: 'MEDIUM', detail: rt.reason, evidence: rt.reason }],
+      raw_report: null,
+      suspicious: false,
+      inconclusive: true
+    };
+  }
+  if (rt.warn && !_sandboxRuntimeWarned) {
+    // Fail OPEN but LOUD (was a plain console.log before, or nothing when the env var was
+    // simply unset on a gVisor-capable host): surface the weaker-than-possible isolation
+    // once per process so it is detectable in production logs.
+    _sandboxRuntimeWarned = true;
+    console.warn(`[SANDBOX] WARNING: ${rt.reason}. Set MUADDIB_REQUIRE_GVISOR=1 to fail closed instead of running on runc.`);
+  } else if (useGvisor) {
+    console.log('[SANDBOX] Runtime: gvisor (runsc)');
   }
 
   // Generate canary tokens for this sandbox session
@@ -1177,4 +1237,4 @@ function displayResults(result) {
   }
 }
 
-module.exports = { buildSandboxImage, runSandbox, runSingleSandbox, buildDockerArgs, generateFakeHostname, scoreFindings, generateNetworkReport, EXFIL_PATTERNS, SAFE_DOMAINS, getSeverity, displayResults, isDockerAvailable, imageExists, isGvisorAvailable, STATIC_CANARY_TOKENS, detectStaticCanaryExfiltration, analyzePreloadLog, TIME_OFFSETS, SAFE_SANDBOX_CMDS, SANDBOX_CONCURRENCY_MAX, acquireSandboxSlot, tryAcquireSandboxSlot, releaseSandboxSlot, resetSandboxLimiter, getSandboxSemaphore, killAllSandboxContainers };
+module.exports = { buildSandboxImage, runSandbox, runSingleSandbox, buildDockerArgs, generateFakeHostname, scoreFindings, generateNetworkReport, EXFIL_PATTERNS, SAFE_DOMAINS, getSeverity, displayResults, isDockerAvailable, imageExists, isGvisorAvailable, resolveSandboxRuntime, STATIC_CANARY_TOKENS, detectStaticCanaryExfiltration, analyzePreloadLog, TIME_OFFSETS, SAFE_SANDBOX_CMDS, SANDBOX_CONCURRENCY_MAX, acquireSandboxSlot, tryAcquireSandboxSlot, releaseSandboxSlot, resetSandboxLimiter, getSandboxSemaphore, killAllSandboxContainers };

package/src/scanner/python-source.js

@@ -31,6 +31,7 @@
 const fs = require('fs');
 const path = require('path');
 const { countInvisibleUnicode, stripInvisibleUnicode } = require('../shared/unicode-invisibles.js');
+const { detectAnalyzerHoneytoken } = require('./ast-detectors/anti-evasion.js');
 
 const MAX_FILE_SIZE = 1024 * 1024; // 1 MB cap, cohérent avec ai-config.js
 
@@ -216,6 +217,38 @@ function detectForkExecInlineInterpreter(content) {
   return FORK_EXEC_INLINE_INTERPRETER_RE.test(content);
 }
 
+// ── Python anti-evasion (M2 follow-up, 2026-07): PyPI parity for AST-096 ──
+// analyzer_honeytoken_reference. Two FP-safe forms mirroring the JS side
+// (ast-detectors/anti-evasion.js), BOTH reusing the existing CRITICAL AST-096
+// rule (no new rule → rule count unchanged):
+//   1. os.environ ENUMERATION (for-in / .keys() / .items()) coupled with a
+//      MUADDIB-prefix key test (.startswith / == / in). NOT a direct read:
+//      MUAD'DIB tooling reads specific MUADDIB_* config vars directly (verified
+//      across the repo), while evasion enumerates the whole env looking for our
+//      sandbox tripwire prefix. FP-safe by the distinctive marker + enumeration.
+//   2. base64 / hex / charcode-encoded analyzer marker — handled by REUSING the
+//      shared detectAnalyzerHoneytoken() (language-agnostic decoder; it already
+//      matches Python byte-array, base64 and hex-escape encodings of the marker).
+// Deliberately NOT covered (honest blind spots): plaintext direct reads of the
+// honeytoken (legit security tooling references markers in the clear — same
+// stance as the JS side); /proc fingerprinting such as reading the kernel
+// version file (legit container-detection reads it — the Python equivalent of
+// the gVisor FP); and shell/bash install hooks (this scanner only reads .py).
+const PY_ENV_ENUM_RE = /\bfor\s+\w+\s+in\s+os\.environ\b|\bos\.environ\.(?:keys|items)\s*\(\s*\)/;
+const PY_ENV_MARKER_TEST_RE = /\.startswith\s*\(\s*['"]MUADDIB|['"]MUADDIB\w*['"]\s*(?:==|!=)|(?:==|!=)\s*['"]MUADDIB|['"]MUADDIB\w*['"]\s+in\b/;
+
+/**
+ * Python parity for the JS detectEnvMarkerEnumeration. Returns 'MUADDIB' if the
+ * file enumerates os.environ AND tests keys against the distinctive MUADDIB
+ * prefix, else null. FP-safe: MUAD'DIB reads its own MUADDIB_* vars directly
+ * (os.environ.get), never via enumerate+startswith (verified across the repo).
+ */
+function detectPythonEnvMarkerEnumeration(content) {
+  if (!content || content.indexOf('os.environ') === -1) return null;
+  if (!PY_ENV_ENUM_RE.test(content)) return null;
+  return PY_ENV_MARKER_TEST_RE.test(content) ? 'MUADDIB' : null;
+}
+
 /**
  * Scan Python source files under targetPath for import-time / install-time RCE.
  *
@@ -347,6 +380,21 @@ function scanPythonSource(targetPath) {
         file: relPath
       });
     }
+
+    // Anti-evasion (AST-096 reused) — Python parity. Runs on cleaned content so
+    // a base64 example inside a stripped docstring/comment cannot fire.
+    const honeytokenMarker = detectAnalyzerHoneytoken(cleaned);
+    const envEnumMarker = honeytokenMarker ? null : detectPythonEnvMarkerEnumeration(cleaned);
+    if (honeytokenMarker || envEnumMarker) {
+      threats.push({
+        type: 'analyzer_honeytoken_reference',
+        severity: 'CRITICAL',
+        message: honeytokenMarker
+          ? `${relPath}: obfuscated (base64/hex/charcode) reference to the analysis-environment honeytoken '${honeytokenMarker}' — sandbox-evasion reconnaissance. No legitimate PyPI package encodes a check for this tripwire.`
+          : `${relPath}: os.environ enumeration testing keys against a MUADDIB prefix (marker-agnostic) — sandbox/analyzer evasion. No legitimate package scans the environment for this tripwire.`,
+        file: relPath
+      });
+    }
   }
 
   return threats;
@@ -366,6 +414,7 @@ module.exports = {
     detectBase64Decode,
     detectDeserialization,
     detectDynamicDangerousImport,
-    detectForkExecInlineInterpreter
+    detectForkExecInlineInterpreter,
+    detectPythonEnvMarkerEnumeration
   }
 };