muaddib-scanner 2.11.159 → 2.11.160

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.159",
+  "version": "2.11.160",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.159.json → self-scan-v2.11.160.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-07T13:26:22.703Z",
+  "timestamp": "2026-07-07T14:05:05.690Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",
@@ -468,26 +468,6 @@
       "playbook": "CRITIQUE: Assignation a Module._resolveFilename/_compile/_extensions. Detournement du systeme de modules Node.js. Tous les require() sont interceptes. Supprimer le package immediatement. Auditer tous les modules charges apres installation.",
       "points": 25
     },
-    {
-      "type": "dynamic_require",
-      "severity": "HIGH",
-      "message": "Dynamic require() with computed argument (possible decode obfuscation).",
-      "file": "ajv/scripts/bundle.js",
-      "count": 2,
-      "reductions": [],
-      "originalSeverity": "HIGH",
-      "confidenceTier": "medium",
-      "rule_id": "MUADDIB-AST-006",
-      "rule_name": "Dynamic Require with Concatenation",
-      "confidence": "high",
-      "domain": "malware",
-      "references": [
-        "https://attack.mitre.org/techniques/T1027/"
-      ],
-      "mitre": "T1027",
-      "playbook": "require() avec concatenation detecte. Technique d'obfuscation pour masquer le module charge. Analyser les variables concatenees.",
-      "points": 10
-    },
     {
       "type": "env_access",
       "severity": "MEDIUM",
@@ -2090,9 +2070,9 @@
   ],
   "python": null,
   "summary": {
-    "total": 92,
+    "total": 91,
     "critical": 7,
-    "high": 10,
+    "high": 9,
     "medium": 44,
     "low": 31,
     "riskScore": 35,
@@ -2106,7 +2086,6 @@
       "web-tree-sitter/web-tree-sitter.cjs": 42,
       "web-tree-sitter/web-tree-sitter.js": 42,
       "ajv/lib/ajv.js": 25,
-      "ajv/scripts/bundle.js": 10,
       "debug/src/node.js": 3,
       "eslint/bin/eslint.js": 10,
       "fast-json-stable-stringify/benchmark/index.js": 10,
@@ -2129,7 +2108,6 @@
       "web-tree-sitter/web-tree-sitter.cjs": 165707,
       "web-tree-sitter/web-tree-sitter.js": 153666,
       "ajv/lib/ajv.js": 15837,
-      "ajv/scripts/bundle.js": 1795,
       "debug/src/node.js": 4728,
       "eslint/bin/eslint.js": 6028,
       "fast-json-stable-stringify/benchmark/index.js": 740,
@@ -2202,12 +2180,6 @@
         "points": 10,
         "reason": "Binary file reference (.png/.jpg/.wasm/etc.) + eval() in same file — possible steganographic payload execution."
       },
-      {
-        "rule": "MUADDIB-AST-006",
-        "type": "dynamic_require",
-        "points": 10,
-        "reason": "Dynamic require() with computed argument (possible decode obfuscation)."
-      },
       {
         "rule": "MUADDIB-AST-006",
         "type": "dynamic_require",
@@ -2698,7 +2670,7 @@
     "tierCounts": {
       "verified": 0,
       "high": 0,
-      "medium": 18,
+      "medium": 17,
       "low": 74
     },
     "perceivedFlagged": 0

package/src/scanner/ast-detectors/handle-call-expression.js

@@ -219,9 +219,18 @@ function handleCallExpression(node, ctx) {
         file: ctx.relFile
       });
     } else if (arg.type === 'CallExpression') {
-      const argCallName = getCallName(arg);
-      // Skip safe patterns: require(path.join(...)), require(path.resolve(...))
-      if (argCallName !== 'path.join' && argCallName !== 'path.resolve') {
+      // Skip safe path-builder patterns: require(path.join(...)), require(path.resolve(...)).
+      // NB: getCallName(arg) returns the bare method name ('join'/'resolve'), NOT 'path.join', so
+      // the previous `argCallName !== 'path.join'` guard never matched — a dead check that let the
+      // standard require(path.join(...)) idiom raise a HIGH dynamic_require FP. Inspect the
+      // MemberExpression object directly instead. Real obfuscation still fires: require(atob(...)),
+      // require(decoder.decode(...)), require(Buffer.from(...).toString()) all have object!=='path'.
+      const callee = arg.callee;
+      const isPathBuilder =
+        callee.type === 'MemberExpression' &&
+        callee.object && callee.object.name === 'path' &&
+        callee.property && (callee.property.name === 'join' || callee.property.name === 'resolve');
+      if (!isPathBuilder) {
         const hasDecode = containsDecodePattern(arg);
         ctx.threats.push({
           type: 'dynamic_require',

package/stats.json

@@ -1,6 +1,6 @@
 {
   "_comment": "GENERATED by scripts/collect-stats.js — do not edit by hand. Run `npm run docs:stats`.",
-  "version": "2.11.159",
+  "version": "2.11.160",
   "scanners": 21,
   "rulesTotal": 275,
   "rulesCore": 270,