muaddib-scanner 2.11.154 → 2.11.157

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.154",
+  "version": "2.11.157",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.154.json → self-scan-v2.11.157.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-03T10:24:28.029Z",
+  "timestamp": "2026-07-05T10:19:55.521Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/monitor/webhook.js

@@ -270,11 +270,30 @@ function buildBurstPreAlertEmbed(name, count, ecosystem = 'npm') {
   };
 }
 
+/**
+ * Burst pre-alert Discord toggle — OFF by default. Measured 2026-07: the burst
+ * heads-up fires ~700×/day and is anti-correlated with real kills/incidents, so it is
+ * pure #alerts noise. This gates ONLY the Discord POST in sendBurstPreAlert(): the
+ * burst versions are still queued + scanned (queue.js), and the `[MONITOR] BURST
+ * PRE-ALERT` console.log + the `stats.burstPreAlerts` counter (used by the daily
+ * summary) are emitted BEFORE the send at the call site, so they are unaffected.
+ * Opt back in with MUADDIB_BURST_PREALERT_WEBHOOK=1 (also accepts true/yes/on).
+ * Read at call time so a restart re-toggles it without a code change (and tests can flip it).
+ */
+function burstPreAlertWebhookEnabled() {
+  const v = (process.env.MUADDIB_BURST_PREALERT_WEBHOOK || '').trim().toLowerCase();
+  return v === '1' || v === 'true' || v === 'yes' || v === 'on';
+}
+
 /**
  * Layer 1c: Send a burst pre-alert webhook. Fire-and-forget; callers dedupe per
- * name/window so a burst pings once, not once per version.
+ * name/window so a burst pings once, not once per version. Discord POST is muted by
+ * default — see burstPreAlertWebhookEnabled(). Scoped to this sender only; the shared
+ * sendWebhook() and every other alert type (IOC/campaign pre-alerts, scan results,
+ * DEGRADED, daily report) are untouched.
  */
 async function sendBurstPreAlert(name, count, ecosystem = 'npm') {
+  if (!burstPreAlertWebhookEnabled()) return;
   const url = getWebhookUrl();
   if (!url) return;
   await sendWebhook(url, buildBurstPreAlertEmbed(name, count, ecosystem), { rawPayload: true });
@@ -1739,6 +1758,7 @@ module.exports = {
   sendCampaignPreAlert,
   buildBurstPreAlertEmbed,
   sendBurstPreAlert,
+  burstPreAlertWebhookEnabled,
   matchVersionedIOC,
   computeRiskLevel,
   computeRiskScore,

package/src/scanner/anti-scanner-injection.js

@@ -54,8 +54,13 @@ const FAMILIES = [
       // directives + an instruction/prompt noun. Pathognomonic; legitimate source never
       // carries it. (Deliberately excludes the rule/guideline noun to avoid lint-config FPs.)
       /\b(?:ignore|disregard|forget|override|bypass)\b[\s\S]{0,40}\b(?:all\s+|any\s+)?(?:previous|prior|above|earlier|preceding|the\s+(?:above|following))\b[\s\S]{0,30}\b(?:instruction|prompt|system[\s-]?prompt)s?\b/i,
-      // Explicitly addressing the AI/scanner/reviewer + a command verb.
-      /\b(?:as\s+(?:an?\s+)?(?:ai|a\.i\.|llm|language\s+model|gpt|claude|copilot|security\s+(?:scanner|analyzer|analyst|auditor|reviewer|model)|automated\s+(?:scanner|analyzer|reviewer)|code[\s-]review(?:er)?)|attention[,:!\s]+(?:ai|llm|scanner|analyzer|reviewer)|(?:dear|hello|hey|note\s+to|message\s+to|to)\s+(?:the\s+)?(?:ai|llm|scanner|analyzer|reviewer|model|assistant|auditor)\b)[\s\S]{0,100}\b(?:you\s+(?:must|should|are|will|need\s+to)|do\s+not|please\s+(?:do|treat|classify|mark|report|ignore|skip)|classify|treat|mark|report|consider|ignore|skip|disregard)\b/i
+      // Explicitly addressing the AI/scanner/reviewer + a command verb. Bare "to <target>" is
+      // restricted to REVIEW-SPECIFIC targets (scanner/analyzer/reviewer/auditor); the generic
+      // "to ai|llm|model|assistant" branch was dropped 2026-07-03 — it collided with agent-skill
+      // runtime prose like "move to AI <status> … Do NOT <step>" (see asi-fp-agent-skills). Full
+      // salutations (dear/hello/hey/note to/message to) keep all targets; a real "to the AI: mark
+      // safe / ignore previous" attack still trips family 2 / family-1-pattern-0 independently.
+      /\b(?:as\s+(?:an?\s+)?(?:ai|a\.i\.|llm|language\s+model|gpt|claude|copilot|security\s+(?:scanner|analyzer|analyst|auditor|reviewer|model)|automated\s+(?:scanner|analyzer|reviewer)|code[\s-]review(?:er)?)|attention[,:!\s]+(?:ai|llm|scanner|analyzer|reviewer)|(?:dear|hello|hey|note\s+to|message\s+to)\s+(?:the\s+)?(?:ai|llm|scanner|analyzer|reviewer|model|assistant|auditor)\b|to\s+(?:the\s+)?(?:scanner|analyzer|reviewer|auditor)\b)[\s\S]{0,100}\b(?:you\s+(?:must|should|are|will|need\s+to)|do\s+not|please\s+(?:do|treat|classify|mark|report|ignore|skip)|classify|treat|mark|report|consider|ignore|skip|disregard)\b/i
     ]
   },
   {
@@ -86,14 +91,20 @@ const FAMILIES = [
 
 // Same-file payload signal → escalates a directive to CRITICAL (the Hades shape: the directive
 // and the payload it guards are co-located). Computed locally — NO cross-scanner dependency.
+// Each signal must indicate an OBFUSCATED and/or DYNAMICALLY-EXECUTED payload — NOT a bare data
+// decode. The decode-only signals `atob(` and `Buffer.from(x,'base64')` were removed 2026-07-03:
+// decoding an API field / attachment (e.g. GitHub/Jira `content`, `Buffer.from(a.content,'base64')`)
+// is ubiquitous benign data handling, not an obfuscated payload — it was the sole "payload" behind
+// a false antiscanner_injection_with_payload on @zibby/skills 0.1.60 (see asi-fp-agent-skills).
+// When a decode genuinely guards malware it is accompanied by an execution sink (eval/Function/vm)
+// or a long encoded blob — both still matched below, so no real Hades / ToxicSkills / TrapDoor
+// payload is lost.
 const PAYLOAD_SIGNALS = [
-  /[A-Za-z0-9+/]{200,}={0,2}/,                                  // long base64 blob
-  /\beval\s*\(/i,
+  /[A-Za-z0-9+/]{200,}={0,2}/,                                  // long base64 blob (the payload itself)
+  /\beval\s*\(/i,                                               // dynamic-code execution sink
   /\bnew\s+Function\s*\(/i,
-  /\batob\s*\(/i,
-  /\bBuffer\.from\s*\([^)]*['"]base64['"]/i,
   /\bvm\.(?:runInContext|runInNewContext|compileFunction)\s*\(/i,
-  /\bbase64\s+(?:--decode|-d)\b/i
+  /\bbase64\s+(?:--decode|-d)\b/i                               // shell base64 decode (typically piped to sh)
 ];
 const INVISIBLE_UNICODE_PAYLOAD_THRESHOLD = 8;