muaddib-scanner 2.11.156 → 2.11.158

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.156",
+  "version": "2.11.158",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.156.json → self-scan-v2.11.158.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-03T11:48:38.678Z",
+  "timestamp": "2026-07-06T12:54:44.482Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/monitor/classify.js

@@ -78,7 +78,11 @@ const HIGH_CONFIDENCE_MALICE_TYPES = new Set([
   // Phantom Gyp 2026-06: binding.gyp command-substitution = install-time RCE, quasi-never legit in benign packages
   'gyp_command_exec',
   // Phantom Gyp compound (Phase 1b): configure-time <!(node x.js) × independently-malicious invoked file
-  'gyp_phantom_exec'
+  'gyp_phantom_exec',
+  // electron_app_injection (MUADDIB-AST-097): install hook overwrites a THIRD-PARTY Electron app's
+  // core/.asar with injected code (payload-in-write coupling ⇒ FP≈0). Bypasses MT-1 cap like the
+  // other install-time RCE/injection markers above (node_modules_write, systemd_persistence).
+  'electron_app_injection'
 ]);
 
 // Lifecycle compound types that indicate real malicious intent beyond a simple postinstall

package/src/monitor/webhook.js

@@ -270,11 +270,30 @@ function buildBurstPreAlertEmbed(name, count, ecosystem = 'npm') {
   };
 }
 
+/**
+ * Burst pre-alert Discord toggle — OFF by default. Measured 2026-07: the burst
+ * heads-up fires ~700×/day and is anti-correlated with real kills/incidents, so it is
+ * pure #alerts noise. This gates ONLY the Discord POST in sendBurstPreAlert(): the
+ * burst versions are still queued + scanned (queue.js), and the `[MONITOR] BURST
+ * PRE-ALERT` console.log + the `stats.burstPreAlerts` counter (used by the daily
+ * summary) are emitted BEFORE the send at the call site, so they are unaffected.
+ * Opt back in with MUADDIB_BURST_PREALERT_WEBHOOK=1 (also accepts true/yes/on).
+ * Read at call time so a restart re-toggles it without a code change (and tests can flip it).
+ */
+function burstPreAlertWebhookEnabled() {
+  const v = (process.env.MUADDIB_BURST_PREALERT_WEBHOOK || '').trim().toLowerCase();
+  return v === '1' || v === 'true' || v === 'yes' || v === 'on';
+}
+
 /**
  * Layer 1c: Send a burst pre-alert webhook. Fire-and-forget; callers dedupe per
- * name/window so a burst pings once, not once per version.
+ * name/window so a burst pings once, not once per version. Discord POST is muted by
+ * default — see burstPreAlertWebhookEnabled(). Scoped to this sender only; the shared
+ * sendWebhook() and every other alert type (IOC/campaign pre-alerts, scan results,
+ * DEGRADED, daily report) are untouched.
  */
 async function sendBurstPreAlert(name, count, ecosystem = 'npm') {
+  if (!burstPreAlertWebhookEnabled()) return;
   const url = getWebhookUrl();
   if (!url) return;
   await sendWebhook(url, buildBurstPreAlertEmbed(name, count, ecosystem), { rawPayload: true });
@@ -1739,6 +1758,7 @@ module.exports = {
   sendCampaignPreAlert,
   buildBurstPreAlertEmbed,
   sendBurstPreAlert,
+  burstPreAlertWebhookEnabled,
   matchVersionedIOC,
   computeRiskLevel,
   computeRiskScore,

package/src/response/playbooks.js

@@ -668,6 +668,15 @@ const PLAYBOOKS = {
     'ou modifie git config init.templateDir pour la persistence globale. ' +
     'Verifier .git/hooks/ et git config --global --list. Supprimer les hooks non reconnus.',
 
+  electron_app_injection:
+    'CRITIQUE: Injection dans une application Electron tierce. Le package localise une app Electron installee ' +
+    '(Discord, Atomic Wallet, Slack, ...) via os.homedir()+.asar/discord_desktop_core+existsSync, puis ecrase ' +
+    'son code (index.js du core module / app.asar) avec un payload injecte (hook webContents.debugger, override ' +
+    'XMLHttpRequest.prototype.send, BrowserWindow) — le payload s\'execute avec l\'identite de l\'app cible pour ' +
+    'intercepter credentials/MFA ou detourner des adresses crypto. Verifier l\'integrite de l\'app ciblee ' +
+    '(reinstaller depuis la source officielle), rechercher le code injecte dans son core/.asar, revoquer tout ' +
+    'credential saisi dans l\'app compromise, et supprimer le package. Considerer le poste comme compromis si le hook a tourne.',
+
   env_harvesting_dynamic:
     'Collecte dynamique de variables d\'environnement via Object.entries/keys/values(process.env) ' +
     'avec filtrage par patterns sensibles. Technique de vol de credentials a grande echelle. ' +

package/src/rules/index.js

@@ -1155,6 +1155,20 @@ const RULES = {
     ],
     mitre: 'T1497'
   },
+  electron_app_injection: {
+    id: 'MUADDIB-AST-097',
+    name: 'Electron App Injection',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    domain: 'malware',
+    description: 'Un hook d\'installation localise une application Electron tierce deja installee chez la victime (Discord, Atomic Wallet, Slack, ...) — via os.homedir() + un chemin de signature Electron (.asar / discord_desktop_core / module core) + une sonde fs.existsSync — puis ecrase son code avec une charge utile JavaScript injectee, de sorte que le payload s\'execute avec l\'identite et les permissions de l\'application cible. Discriminant AST (vs proxy file-level): l\'ecriture (writeFileSync/appendFileSync) ecrit un CONTENU qui EST du code Electron injecte (BrowserWindow / webContents.debugger / *.prototype.X= / require(\'electron\')). Une app Electron legitime ecrit sa propre config JSON, jamais du code hookant les internals d\'une autre app. CRITICAL quand corrobore par le contexte de decouverte foreign-app; HIGH pour une ecriture nue ciblant un fichier .asar/core sous le home (GT-036 discord-electron-inject, GT-044 atomic-wallet-patch).',
+    references: [
+      'https://research.jfrog.com/post/duer-js-malicious-package/',
+      'https://thehackernews.com/2025/04/malicious-npm-package-targets-atomic.html',
+      'https://attack.mitre.org/techniques/T1554/'
+    ],
+    mitre: 'T1554'
+  },
   detached_process: {
     id: 'MUADDIB-AST-012',
     name: 'Detached Background Process',

package/src/scanner/ast-detectors/electron-injection.js

@@ -0,0 +1,233 @@
+'use strict';
+
+// MUADDIB-AST-097 — electron_app_injection shared detection helpers.
+//
+// Threat model: an install-time hook LOCATES a third-party Electron desktop app already
+// installed on the victim (Discord, Atomic Wallet, Slack, ...) by resolving the user's home
+// directory, matching an Electron signature path (.asar / *_desktop_core / an electron core
+// module), and probing it with fs.existsSync — then OVERWRITES that app's code with an injected
+// JavaScript payload, so the payload runs with the target app's identity and permissions.
+//   GT-036 (discord-electron-inject): overwrites Discord's discord_desktop_core/index.js with a
+//     webContents.debugger network hook that exfiltrates login/MFA responses to bada-stealer.com.
+//   GT-044 (atomic-wallet-patch): patches Atomic Wallet's app.asar bundle with an
+//     XMLHttpRequest.prototype.send hook that swaps crypto recipient addresses.
+//
+// The DISCRIMINATOR (why this beats a file-level co-occurrence proxy): the malice is not that a
+// file *mentions* BrowserWindow/.asar — a legitimate Electron app's own main process mentions all
+// of those. The malice is that a filesystem WRITE writes CONTENT that IS injected Electron code
+// into a FOREIGN app. So we couple, at AST level:
+//   (1) the write's CONTENT resolves to injected-Electron-code markers (the payload), AND
+//   (2) module context proves foreign-app discovery: os.homedir() + Electron-sig path + existsSync.
+// A legit Electron app writes JSON *config* (settings.json), never source that hooks another app's
+// internals — so coupling the payload to the write is what separates injection from an app writing
+// its own settings, WITHOUT the evadable "is this file itself an Electron main?" heuristic.
+//
+// Consumed by: handle-call-expression.js (write-sink + fact collection), handle-variable-declarator.js
+// & handle-assignment-expression.js (injected-code variable tracking), handle-post-walk.js (emit).
+
+const { extractStringValueDeep } = require('./helpers.js');
+
+// An Electron *target path* signature: an installed app's packed archive or a native core module.
+//   app.asar / core.asar / *.asar(.unpacked)   — Electron ASAR archive
+//   discord_desktop_core / betterdiscord         — Discord's swappable core module (well-known target)
+//   modules/<x>_core / *_desktop_core            — Electron "<app>_core" native module convention
+const ELECTRON_SIG_RE = /\.asar\b|discord_desktop_core|betterdiscord|[\\/]modules[\\/][A-Za-z0-9_.-]*_core\b|_desktop_core\b/i;
+
+// Injected-Electron-code markers — tokens that make written CONTENT an injection payload, not config.
+//   HOOK markers (interception / tamper): near-zero in benign written content.
+const ELECTRON_HOOK_MARKERS =
+  /\bwebContents\b|\bdebugger\s*\.\s*(?:attach|on|sendCommand)\b|\bNetwork\s*\.\s*(?:enable|responseReceived|getResponseBody)\b|\bipcRenderer\b|\.\s*prototype\s*\.\s*[A-Za-z_$][\w$]*\s*=/;
+//   APP markers (electron surface): boilerplate-ish, weaker alone but a payload signal in write content.
+const ELECTRON_APP_MARKERS =
+  /\bBrowserWindow\b|require\s*\(\s*['"]electron['"]\s*\)|module\s*\.\s*exports\s*=\s*require\s*\(/;
+// A write's content is a payload when it carries a HOOK marker OR an APP marker.
+const ELECTRON_PAYLOAD_MARKERS = new RegExp(ELECTRON_HOOK_MARKERS.source + '|' + ELECTRON_APP_MARKERS.source);
+
+const HOME_PATH_STR_RE = /[\\/]home[\\/]|[\\/]Users[\\/]|appdata|localappdata|userprofile|[\\/]\.config[\\/]|^~[\\/]/i;
+
+// Best-effort: collect all string-literal fragments reachable from a node subtree (array
+// elements, `.join()`/`.concat()` receivers+args, `+` concatenation, template quasis, conditional
+// branches). Bounded in depth and total length. Used to test whether a write's CONTENT argument
+// (or a variable initializer) carries injected-Electron-code markers even when it is built as
+// `[ ...lines ].join("\n")` or `"...hook..." + fileContent`.
+function collectCodeString(node, depth, acc) {
+  if (!node || depth > 6 || acc.budget <= 0) return acc.s;
+  switch (node.type) {
+    case 'Literal':
+      if (typeof node.value === 'string') { acc.s += node.value + '\n'; acc.budget -= node.value.length + 1; }
+      break;
+    case 'TemplateLiteral':
+      for (const q of node.quasis || []) { const raw = q.value.raw; acc.s += raw + '\n'; acc.budget -= raw.length + 1; }
+      for (const e of node.expressions || []) collectCodeString(e, depth + 1, acc);
+      break;
+    case 'BinaryExpression':
+      if (node.operator === '+') { collectCodeString(node.left, depth + 1, acc); collectCodeString(node.right, depth + 1, acc); }
+      break;
+    case 'ArrayExpression':
+      for (const el of node.elements || []) collectCodeString(el, depth + 1, acc);
+      break;
+    case 'CallExpression': {
+      const m = node.callee && node.callee.type === 'MemberExpression' && node.callee.property
+        ? node.callee.property.name : null;
+      if (m === 'join' || m === 'concat') {
+        collectCodeString(node.callee.object, depth + 1, acc);
+        for (const a of node.arguments || []) collectCodeString(a, depth + 1, acc);
+      }
+      break;
+    }
+    case 'ConditionalExpression':
+      collectCodeString(node.consequent, depth + 1, acc);
+      collectCodeString(node.alternate, depth + 1, acc);
+      break;
+    default:
+      break;
+  }
+  return acc.s;
+}
+
+function resolveCodeString(node) {
+  return collectCodeString(node, 0, { s: '', budget: 20000 });
+}
+
+// Does this subtree reference a variable already known to hold injected Electron code?
+// Handles `hook + "\n" + fileContent` (BinaryExpression), templates, and array joins.
+function referencesInjectedVar(node, ctx, depth) {
+  if (!node || depth > 6 || !ctx.injectedCodeVars) return false;
+  switch (node.type) {
+    case 'Identifier':
+      return ctx.injectedCodeVars.has(node.name);
+    case 'BinaryExpression':
+      return node.operator === '+' &&
+        (referencesInjectedVar(node.left, ctx, depth + 1) || referencesInjectedVar(node.right, ctx, depth + 1));
+    case 'TemplateLiteral':
+      return (node.expressions || []).some(e => referencesInjectedVar(e, ctx, depth + 1));
+    case 'ConditionalExpression':
+      return referencesInjectedVar(node.consequent, ctx, depth + 1) || referencesInjectedVar(node.alternate, ctx, depth + 1);
+    case 'CallExpression': {
+      const m = node.callee && node.callee.type === 'MemberExpression' && node.callee.property
+        ? node.callee.property.name : null;
+      if (m === 'join' || m === 'concat') {
+        return referencesInjectedVar(node.callee.object, ctx, depth + 1) ||
+          (node.arguments || []).some(a => referencesInjectedVar(a, ctx, depth + 1));
+      }
+      return false;
+    }
+    default:
+      return false;
+  }
+}
+
+// True if a node (a variable initializer or a write's content arg) carries an injected payload:
+// it references a tracked injected-code variable, or it statically resolves to code with markers.
+function carriesInjectedPayload(node, ctx) {
+  if (!node) return false;
+  if (node.type === 'Identifier') return !!(ctx.injectedCodeVars && ctx.injectedCodeVars.has(node.name));
+  if (referencesInjectedVar(node, ctx, 0)) return true;
+  return ELECTRON_PAYLOAD_MARKERS.test(resolveCodeString(node));
+}
+
+// An argument that roots a path in the user's HOME (where a victim's apps are installed):
+//   os.homedir() | process.env.{HOME,APPDATA,LOCALAPPDATA,USERPROFILE,XDG_CONFIG_HOME}
+//   | "~"/"~/..." | absolute "/home/..", "/Users/..", "C:\Users\.." literal
+function isHomeRootArg(node) {
+  if (!node) return false;
+  if (node.type === 'CallExpression' && node.callee && node.callee.type === 'MemberExpression' &&
+      node.callee.object && node.callee.object.type === 'Identifier' && node.callee.object.name === 'os' &&
+      node.callee.property && node.callee.property.type === 'Identifier' && node.callee.property.name === 'homedir') {
+    return true;
+  }
+  if (node.type === 'MemberExpression' &&
+      node.object && node.object.type === 'MemberExpression' &&
+      node.object.object && node.object.object.type === 'Identifier' && node.object.object.name === 'process' &&
+      node.object.property && node.object.property.type === 'Identifier' && node.object.property.name === 'env' &&
+      node.property && node.property.type === 'Identifier' &&
+      ['HOME', 'APPDATA', 'LOCALAPPDATA', 'USERPROFILE', 'XDG_CONFIG_HOME'].includes(node.property.name)) {
+    return true;
+  }
+  if (node.type === 'Literal' && typeof node.value === 'string') {
+    if (/^~(?:[\\/]|$)/.test(node.value)) return true;
+    if (/^\/home\/|^\/Users\/|:[\\/]Users[\\/]/i.test(node.value)) return true;
+  }
+  return false;
+}
+
+function _scanPathArgForSig(arg, ctx) {
+  if (!arg) return;
+  const s = extractStringValueDeep(arg);
+  if (s && ELECTRON_SIG_RE.test(s)) ctx.hasElectronAppSig = true;
+  if (arg.type === 'CallExpression' && arg.callee && arg.callee.type === 'MemberExpression' &&
+      arg.callee.object && arg.callee.object.type === 'Identifier' && arg.callee.object.name === 'path' &&
+      arg.callee.property && arg.callee.property.type === 'Identifier' &&
+      (arg.callee.property.name === 'join' || arg.callee.property.name === 'resolve')) {
+    const joined = (arg.arguments || []).map(a => extractStringValueDeep(a) || '').join('/');
+    if (ELECTRON_SIG_RE.test(joined)) ctx.hasElectronAppSig = true;
+    if ((arg.arguments || []).some(isHomeRootArg)) ctx.hasHomedirResolve = true;
+  }
+}
+
+// Collect the foreign-app-discovery corroboration facts from a CallExpression:
+//   os.homedir()                                → hasHomedirResolve
+//   fs.existsSync/accessSync/statSync/lstatSync → hasFsExistsProbe (+ sig/home from the probed path)
+//   path.join/path.resolve                      → hasElectronAppSig / hasHomedirResolve
+//   app.whenReady/app.getPath/.loadURL/.loadFile → hasOwnElectronMain (the file IS an Electron main;
+//                                                   gates the HIGH tier so a real app's self-writes
+//                                                   are not flagged as tampering).
+function scanElectronFacts(node, ctx) {
+  const callee = node.callee;
+  if (!callee || callee.type !== 'MemberExpression' || !callee.property || callee.property.type !== 'Identifier') return;
+  const prop = callee.property.name;
+  const objName = callee.object && callee.object.type === 'Identifier' ? callee.object.name : null;
+
+  if (objName === 'os' && prop === 'homedir') ctx.hasHomedirResolve = true;
+
+  if (prop === 'existsSync' || prop === 'accessSync' || prop === 'statSync' || prop === 'lstatSync') {
+    ctx.hasFsExistsProbe = true;
+    _scanPathArgForSig(node.arguments && node.arguments[0], ctx);
+  }
+
+  if (objName === 'path' && (prop === 'join' || prop === 'resolve')) {
+    const joined = (node.arguments || []).map(a => extractStringValueDeep(a) || '').join('/');
+    if (ELECTRON_SIG_RE.test(joined)) ctx.hasElectronAppSig = true;
+    if ((node.arguments || []).some(isHomeRootArg)) ctx.hasHomedirResolve = true;
+  }
+
+  if ((prop === 'whenReady' && (objName === 'app' || objName === 'electron')) ||
+      (prop === 'getPath' && objName === 'app') ||
+      prop === 'loadURL' || prop === 'loadFile') {
+    ctx.hasOwnElectronMain = true;
+  }
+}
+
+// For the HIGH tier: does a write TARGET resolve to a home-rooted Electron file? Handles an inline
+// path.join/path.resolve, a bare literal, or an Identifier bound to a tracked path.join result
+// (ctx.electronTargetVars — the common `const target = path.join(os.homedir(), ..., 'app.asar')`).
+function resolveElectronTarget(node, ctx) {
+  if (node && node.type === 'Identifier' && ctx && ctx.electronTargetVars && ctx.electronTargetVars.has(node.name)) {
+    return ctx.electronTargetVars.get(node.name);
+  }
+  let pathStr = '';
+  let home = false;
+  if (node && node.type === 'CallExpression' && node.callee && node.callee.type === 'MemberExpression' &&
+      node.callee.object && node.callee.object.type === 'Identifier' && node.callee.object.name === 'path' &&
+      node.callee.property && node.callee.property.type === 'Identifier' &&
+      (node.callee.property.name === 'join' || node.callee.property.name === 'resolve')) {
+    pathStr = (node.arguments || []).map(a => extractStringValueDeep(a) || '').join('/');
+    if ((node.arguments || []).some(isHomeRootArg)) home = true;
+  } else {
+    pathStr = extractStringValueDeep(node) || '';
+  }
+  if (HOME_PATH_STR_RE.test(pathStr)) home = true;
+  return { sig: ELECTRON_SIG_RE.test(pathStr), home, pathStr: pathStr.slice(0, 120) };
+}
+
+module.exports = {
+  ELECTRON_SIG_RE,
+  ELECTRON_PAYLOAD_MARKERS,
+  ELECTRON_HOOK_MARKERS,
+  resolveCodeString,
+  carriesInjectedPayload,
+  referencesInjectedVar,
+  isHomeRootArg,
+  scanElectronFacts,
+  resolveElectronTarget
+};

package/src/scanner/ast-detectors/handle-assignment-expression.js

@@ -11,10 +11,18 @@ const {
   resolveStringConcat,
   extractStringValueDeep
 } = require('./helpers.js');
+const { carriesInjectedPayload } = require('./electron-injection.js');
 
 function handleAssignmentExpression(node, ctx) {
   // Variable reassignment: x += 'process' or x = x + 'process'
   if (node.left?.type === 'Identifier') {
+    // MUADDIB-AST-097: propagate injected-Electron-code taint across reassignment. Covers
+    // `content = hook + "\n" + content` where `hook` is a payload array-join, so the subsequent
+    // writeFileSync(target, content) is recognised as writing an injected payload.
+    if ((node.operator === '=' || node.operator === '+=') &&
+        carriesInjectedPayload(node.right, ctx)) {
+      ctx.injectedCodeVars.add(node.left.name);
+    }
     if (node.operator === '+=' && ctx.stringVarValues.has(node.left.name)) {
       const rightVal = extractStringValueDeep(node.right);
       if (rightVal !== null) {

package/src/scanner/ast-detectors/handle-call-expression.js

@@ -96,6 +96,11 @@ const {
 const { countInvisibleUnicode } = require('../../shared/unicode-invisibles.js');
 const { classifyMcpWrite } = require('./mcp-write-classifier.js');
 const { isShadowEnabled, recordShadowDivergence } = require('../../shared/shadow.js');
+const {
+  carriesInjectedPayload,
+  scanElectronFacts,
+  resolveElectronTarget
+} = require('./electron-injection.js');
 
 /**
  * SHADOW 3-tier classification for mcp_config_injection emissions (R5 + R5b).
@@ -172,6 +177,11 @@ function _isUserLevelPathArg(node, depth = 0) {
 function handleCallExpression(node, ctx) {
   const callName = getCallName(node);
 
+  // MUADDIB-AST-097: collect foreign-Electron-app-discovery facts (os.homedir / existsSync /
+  // .asar-electron-core path.join / own-app markers). Correlated with the payload-write in
+  // handlePostWalk to emit electron_app_injection.
+  scanElectronFacts(node, ctx);
+
   // Detect require() with non-literal argument (obfuscation)
   if (callName === 'require' && node.arguments.length > 0) {
     const arg = node.arguments[0];
@@ -967,6 +977,28 @@ function handleCallExpression(node, ctx) {
   }
 
 
+  // MUADDIB-AST-097: electron_app_injection — a filesystem write whose CONTENT resolves to
+  // injected Electron code (BrowserWindow / webContents-debugger hook / prototype override /
+  // require('electron')). The payload-in-write coupling is the AST discriminator vs a legit
+  // Electron app writing JSON config. The foreign-app-discovery corroboration (os.homedir +
+  // .asar/electron-core sig + existsSync) and the final verdict are assembled in handlePostWalk.
+  // A home-rooted .asar/electron-core *target* write (payload not statically resolvable) is
+  // recorded separately for the HIGH tier.
+  if (node.callee.type === 'MemberExpression' && node.callee.property?.type === 'Identifier') {
+    const eaiMethod = node.callee.property.name;
+    if (['writeFileSync', 'writeFile', 'appendFileSync', 'appendFile'].includes(eaiMethod) &&
+        node.arguments.length >= 2) {
+      if (carriesInjectedPayload(node.arguments[1], ctx)) {
+        ctx.electronPayloadWrites.push({ method: eaiMethod });
+      } else {
+        const tgt = resolveElectronTarget(node.arguments[0], ctx);
+        if (tgt.sig && tgt.home) {
+          ctx.electronAsarTargetWrites.push({ method: eaiMethod, pathStr: tgt.pathStr });
+        }
+      }
+    }
+  }
+
   // Detect fs.chmodSync with executable permissions (deferred to postWalk for compound check)
   if (node.callee.type === 'MemberExpression' && node.callee.property?.type === 'Identifier') {
     const chmodMethod = node.callee.property.name;

package/src/scanner/ast-detectors/handle-post-walk.js

@@ -640,6 +640,39 @@ function handlePostWalk(ctx) {
       });
     }
   }
+
+  // MUADDIB-AST-097: electron_app_injection — an install hook overwrites a THIRD-PARTY Electron
+  // app's core/.asar with injected code (GT-036 Discord debugger-hook stealer → bada-stealer.com;
+  // GT-044 Atomic Wallet XMLHttpRequest.prototype.send address-swap). The discriminating AST
+  // coupling (assembled here from facts collected during the walk): a writeFileSync whose CONTENT
+  // resolves to injected Electron code (electronPayloadWrites), corroborated by the foreign-app
+  // discovery context — os.homedir() + a .asar/electron-core signature path + an existsSync probe.
+  // A legit Electron app writes JSON *config*, never source that hooks another app's internals, so
+  // the payload-in-write coupling is what separates injection from an app writing its own settings
+  // (no need for the evadable "is this file itself an Electron main?" exclusion). dist/bundled
+  // files are suppressed: an app's own minified main naturally carries these tokens.
+  const _eaiDist = /^(?:dist|build|out|output|vendor)[/\\]/i.test(ctx.relFile) ||
+                   /\.(?:bundle|min)\.js$/i.test(ctx.relFile);
+  if (!_eaiDist) {
+    const foreignAppDiscovery = ctx.hasHomedirResolve && ctx.hasElectronAppSig && ctx.hasFsExistsProbe;
+    if ((ctx.electronPayloadWrites?.length || 0) > 0 && foreignAppDiscovery) {
+      const w = ctx.electronPayloadWrites[0];
+      ctx.threats.push({
+        type: 'electron_app_injection',
+        severity: 'CRITICAL',
+        message: `Electron app injection: ${w.method}() overwrites a foreign Electron app — located via os.homedir()+.asar/electron-core+existsSync — with injected code (BrowserWindow/webContents-debugger/prototype-override/require('electron')). Third-party desktop-app code injection (Discord/Atomic-Wallet class): the payload runs with the target app's identity.`,
+        file: ctx.relFile
+      });
+    } else if ((ctx.electronAsarTargetWrites?.length || 0) > 0 && !ctx.hasOwnElectronMain) {
+      const w = ctx.electronAsarTargetWrites[0];
+      ctx.threats.push({
+        type: 'electron_app_injection',
+        severity: 'HIGH',
+        message: `Electron app tampering: ${w.method}() overwrites a user-home Electron app file "${w.pathStr}" (.asar/electron-core). Writing into an installed desktop app is an injection/patching technique; the injected payload was not statically resolvable.`,
+        file: ctx.relFile
+      });
+    }
+  }
 }
 
 

package/src/scanner/ast-detectors/handle-variable-declarator.js

@@ -16,6 +16,7 @@ const {
   extractStringValueDeep,
   isStaticValue
 } = require('./helpers.js');
+const { carriesInjectedPayload, resolveElectronTarget } = require('./electron-injection.js');
 
 function handleVariableDeclarator(node, ctx) {
   if (node.id?.type === 'Identifier') {
@@ -24,6 +25,24 @@ function handleVariableDeclarator(node, ctx) {
       ctx.staticAssignments.add(node.id.name);
     }
 
+    // MUADDIB-AST-097: track variables whose value is injected Electron code (the write payload).
+    // Covers `var injectedPayload = [ "...BrowserWindow...", ... ].join("\n")` and any concat /
+    // template / literal carrying payload markers. Consumed by the write-sink check + post-walk.
+    if (node.init && carriesInjectedPayload(node.init, ctx)) {
+      ctx.injectedCodeVars.add(node.id.name);
+    }
+
+    // MUADDIB-AST-097: track variables bound to a path.join/resolve that builds an Electron app
+    // file path (for the HIGH-tier bare-.asar-target write, where the write target is a variable,
+    // e.g. `const target = path.join(os.homedir(), '.config', 'discord', 'app.asar')`).
+    if (node.init && node.init.type === 'CallExpression' && node.init.callee?.type === 'MemberExpression' &&
+        node.init.callee.object?.type === 'Identifier' && node.init.callee.object.name === 'path' &&
+        node.init.callee.property?.type === 'Identifier' &&
+        (node.init.callee.property.name === 'join' || node.init.callee.property.name === 'resolve')) {
+      const eaiTgt = resolveElectronTarget(node.init);
+      if (eaiTgt.sig) ctx.electronTargetVars.set(node.id.name, eaiTgt);
+    }
+
     // AST-018 alias capture (@longzy): `var env = process.env` — record the alias so a later
     // `env[String.fromCharCode(...)]` access resolves back to process.env in the member handler.
     if (ctx.envAliases && node.init?.type === 'MemberExpression' && !node.init.computed &&

package/src/scanner/ast.js

@@ -158,6 +158,16 @@ function analyzeFile(content, filePath, basePath) {
     objectPropertyMap: new Map(),     // B5: objName → Map<propName, stringValue>
     concatValues: new Map(),          // B2: varName → { value, operands } for concat strings with ≥3 operands
     stringVarValues: new Map(),       // Variable reassignment tracking: varName → string value
+    // MUADDIB-AST-097 electron_app_injection: injected-code variable taint + write-sink records +
+    // foreign-Electron-app-discovery facts (os.homedir + .asar/electron-core sig + existsSync probe).
+    injectedCodeVars: new Set(),      // vars whose value is injected Electron code (write payload)
+    electronTargetVars: new Map(),    // varName → {sig,home,pathStr} for a path.join Electron target
+    electronPayloadWrites: [],        // writeFile* calls whose CONTENT is an injected payload
+    electronAsarTargetWrites: [],     // writeFile* calls whose TARGET is a home-rooted .asar/core file
+    hasHomedirResolve: false,         // os.homedir() / process.env.{HOME,APPDATA,...} resolved
+    hasElectronAppSig: false,         // a .asar / *_desktop_core / electron-core path constructed
+    hasFsExistsProbe: false,          // fs.existsSync/accessSync/statSync (probe the victim install)
+    hasOwnElectronMain: false,        // file IS an Electron main (app.whenReady/loadURL/...) — gates HIGH
     hasFromCharCode: content.includes('fromCharCode'),
     // Anti-analysis / sandbox evasion (2026, @longzy DPRK). Structural "detonation-gate wall"
     // magnitude + host recon + a charcode-hidden analyzer-honeytoken reference. Aggregated in