muaddib-scanner 2.11.161 → 2.11.163

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.161",
+  "version": "2.11.163",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.161.json → self-scan-v2.11.163.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-09T09:23:51.701Z",
+  "timestamp": "2026-07-10T08:26:38.815Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/monitor/state.js

@@ -27,6 +27,18 @@ const path = require('path');
 const { isMainThread, threadId } = require('worker_threads');
 const { sanitizePackageName } = require('../shared/download.js');
 
+// Event-loop stall attribution (event-loop-monitor.js): the periodic JSONL
+// compactions below are O(file-size) SYNCHRONOUS rewrites that run on the monitor
+// main thread. At the 500K-entry scan-ledger steady state this is the leading
+// suspect for the multi-minute loop stalls that blind the RSS breaker — yet it was
+// uninstrumented, so a stall in it mis-attributed to a stale prior breadcrumb
+// (docker:rm with durationMs << lagMs). Wrapping each compaction NAMES it: a stall
+// now logs op.label='compact:*' with durationMs ~ lagMs. Guarded require so state.js
+// stays usable from the CLI / scan-worker where the sampler isn't running
+// (runInstrumented is then a transparent passthrough). Never throws.
+let _runInstrumented = (label, meta, fn) => fn();
+try { ({ runInstrumented: _runInstrumented } = require('./event-loop-monitor.js')); } catch { /* sampler unavailable — passthrough */ }
+
 // --- File path constants ---
 
 const STATE_FILE = path.join(__dirname, '..', '..', 'data', 'monitor-state.json');
@@ -761,23 +773,26 @@ function loadTemporalDetections() {
  * runStateMigrations to enforce caps after migration.
  */
 function _compactTemporalDetectionsJsonl() {
-  try {
-    const total = _countJsonlLines(TEMPORAL_DETECTIONS_FILE);
-    if (total <= MAX_TEMPORAL_DETECTIONS) return;
-    const toDrop = total - MAX_TEMPORAL_DETECTIONS;
-    let skipped = 0;
-    const kept = [];
-    _iterateJsonlSync(TEMPORAL_DETECTIONS_FILE, (entry) => {
-      if (skipped < toDrop) { skipped++; return; }
-      kept.push(JSON.stringify(entry));
-    });
-    const tmpFile = TEMPORAL_DETECTIONS_FILE + '.tmp';
-    fs.writeFileSync(tmpFile, kept.length ? kept.join('\n') + '\n' : '', 'utf8');
-    fs.renameSync(tmpFile, TEMPORAL_DETECTIONS_FILE);
-    console.log(`[MONITOR] COMPACT temporal-detections: ${total} -> ${kept.length} entries`);
-  } catch (err) {
-    console.error(`[MONITOR] Temporal detections compaction failed: ${err.message}`);
-  }
+  // Same O(file) synchronous rewrite shape as the scan-ledger/detections compactions.
+  _runInstrumented('compact:temporal-detections', { cap: MAX_TEMPORAL_DETECTIONS }, () => {
+    try {
+      const total = _countJsonlLines(TEMPORAL_DETECTIONS_FILE);
+      if (total <= MAX_TEMPORAL_DETECTIONS) return;
+      const toDrop = total - MAX_TEMPORAL_DETECTIONS;
+      let skipped = 0;
+      const kept = [];
+      _iterateJsonlSync(TEMPORAL_DETECTIONS_FILE, (entry) => {
+        if (skipped < toDrop) { skipped++; return; }
+        kept.push(JSON.stringify(entry));
+      });
+      const tmpFile = TEMPORAL_DETECTIONS_FILE + '.tmp';
+      fs.writeFileSync(tmpFile, kept.length ? kept.join('\n') + '\n' : '', 'utf8');
+      fs.renameSync(tmpFile, TEMPORAL_DETECTIONS_FILE);
+      console.log(`[MONITOR] COMPACT temporal-detections: ${total} -> ${kept.length} entries`);
+    } catch (err) {
+      console.error(`[MONITOR] Temporal detections compaction failed: ${err.message}`);
+    }
+  });
 }
 
 // --- State persistence ---
@@ -996,28 +1011,32 @@ function getDetectionStats() {
  * stays consistent. No-op when the file is already under cap.
  */
 function _compactDetectionsJsonl() {
-  try {
-    const total = _countJsonlLines(DETECTIONS_FILE);
-    if (total <= MAX_DETECTIONS) return;
-    const toDrop = total - MAX_DETECTIONS;
-    let skipped = 0;
-    const kept = [];
-    const newDedup = new Set();
-    _iterateJsonlSync(DETECTIONS_FILE, (entry) => {
-      if (skipped < toDrop) { skipped++; return; }
-      kept.push(JSON.stringify(entry));
-      if (entry && entry.package && entry.version) {
-        newDedup.add(`${entry.package}@${entry.version}`);
-      }
-    });
-    const tmpFile = DETECTIONS_FILE + '.tmp';
-    fs.writeFileSync(tmpFile, kept.length ? kept.join('\n') + '\n' : '', 'utf8');
-    fs.renameSync(tmpFile, DETECTIONS_FILE);
-    _detectionDedupSet = newDedup;
-    console.log(`[MONITOR] COMPACT detections: ${total} -> ${kept.length} entries`);
-  } catch (err) {
-    console.error(`[MONITOR] Detections compaction failed: ${err.message}`);
-  }
+  // Same O(file) synchronous rewrite as the scan-ledger (smaller cap, but same
+  // main-thread blocking shape). Named so a stall here can't hide behind a stale crumb.
+  _runInstrumented('compact:detections', { cap: MAX_DETECTIONS }, () => {
+    try {
+      const total = _countJsonlLines(DETECTIONS_FILE);
+      if (total <= MAX_DETECTIONS) return;
+      const toDrop = total - MAX_DETECTIONS;
+      let skipped = 0;
+      const kept = [];
+      const newDedup = new Set();
+      _iterateJsonlSync(DETECTIONS_FILE, (entry) => {
+        if (skipped < toDrop) { skipped++; return; }
+        kept.push(JSON.stringify(entry));
+        if (entry && entry.package && entry.version) {
+          newDedup.add(`${entry.package}@${entry.version}`);
+        }
+      });
+      const tmpFile = DETECTIONS_FILE + '.tmp';
+      fs.writeFileSync(tmpFile, kept.length ? kept.join('\n') + '\n' : '', 'utf8');
+      fs.renameSync(tmpFile, DETECTIONS_FILE);
+      _detectionDedupSet = newDedup;
+      console.log(`[MONITOR] COMPACT detections: ${total} -> ${kept.length} entries`);
+    } catch (err) {
+      console.error(`[MONITOR] Detections compaction failed: ${err.message}`);
+    }
+  });
 }
 
 // --- Per-scan ledger (Phase 0a: operational coverage observability) ---
@@ -1122,23 +1141,28 @@ function appendScanLedger(e) {
  * No-op when already under cap. Streams (never loads the whole file at once).
  */
 function _compactScanLedgerJsonl() {
-  try {
-    const total = _countJsonlLines(SCAN_LEDGER_FILE);
-    if (total <= MAX_SCAN_LEDGER) return;
-    const toDrop = total - MAX_SCAN_LEDGER;
-    let skipped = 0;
-    const kept = [];
-    _iterateJsonlSync(SCAN_LEDGER_FILE, (entry) => {
-      if (skipped < toDrop) { skipped++; return; }
-      kept.push(JSON.stringify(entry));
-    });
-    const tmpFile = SCAN_LEDGER_FILE + '.tmp';
-    fs.writeFileSync(tmpFile, kept.length ? kept.join('\n') + '\n' : '', 'utf8');
-    fs.renameSync(tmpFile, SCAN_LEDGER_FILE);
-    console.log(`[MONITOR] COMPACT scan-ledger: ${total} -> ${kept.length} entries`);
-  } catch (err) {
-    console.error(`[MONITOR] Scan-ledger compaction failed: ${err.message}`);
-  }
+  // Leading loop-stall suspect (see require note above): count + parse + re-stringify
+  // + join + 127MB write + rename, all synchronous over ~500K entries. Instrument the
+  // whole body (the count pass can block too) so a stall NAMES 'compact:scan-ledger'.
+  _runInstrumented('compact:scan-ledger', { cap: MAX_SCAN_LEDGER }, () => {
+    try {
+      const total = _countJsonlLines(SCAN_LEDGER_FILE);
+      if (total <= MAX_SCAN_LEDGER) return;
+      const toDrop = total - MAX_SCAN_LEDGER;
+      let skipped = 0;
+      const kept = [];
+      _iterateJsonlSync(SCAN_LEDGER_FILE, (entry) => {
+        if (skipped < toDrop) { skipped++; return; }
+        kept.push(JSON.stringify(entry));
+      });
+      const tmpFile = SCAN_LEDGER_FILE + '.tmp';
+      fs.writeFileSync(tmpFile, kept.length ? kept.join('\n') + '\n' : '', 'utf8');
+      fs.renameSync(tmpFile, SCAN_LEDGER_FILE);
+      console.log(`[MONITOR] COMPACT scan-ledger: ${total} -> ${kept.length} entries`);
+    } catch (err) {
+      console.error(`[MONITOR] Scan-ledger compaction failed: ${err.message}`);
+    }
+  });
 }
 
 /** Stream the scan-ledger into an array (tests + Phase 0b rollup). */

package/src/sandbox/index.js

@@ -59,6 +59,18 @@ function dockerSync(label, meta, fn) {
   try { return fn(); } finally { _endOp(_crumb); }
 }
 
+// Same breadcrumb mechanism as dockerSync, for the SYNCHRONOUS post-container
+// result-handling that also runs on the main thread (the deferred sandbox worker is a
+// setInterval on the main loop — deferred-sandbox.js): JSON.parse of container stdout,
+// gVisor kernel-log parse/cleanup, preload-log analysis. Uninstrumented today, so a
+// multi-minute stall in any of them mis-attributes to the last docker:* crumb (the
+// docker:rm-leurre seen in data/loop-stalls.jsonl with durationMs << lagMs). Leaf-only:
+// the wrapped fn must NOT nest another beginOp/dockerSync (single-slot model).
+function syncStep(label, meta, fn) {
+  const _crumb = _beginOp(label, meta || null);
+  try { return fn(); } finally { _endOp(_crumb); }
+}
+
 const DOCKER_IMAGE = 'muaddib-sandbox';
 const CONTAINER_TIMEOUT = 120000; // 120 seconds
 const SINGLE_RUN_TIMEOUT = 90000; // 90 seconds per run in multi-run mode (gVisor ~30% I/O overhead)
@@ -595,7 +607,7 @@ async function runSingleSandbox(packageName, options = {}) {
           }
           jsonStr = stdout.substring(jsonStart, jsonEnd + 1);
         }
-        report = JSON.parse(jsonStr);
+        report = syncStep('sandbox:parse-report', { bytes: jsonStr.length }, () => JSON.parse(jsonStr));
         if (local && report) {
           report.package = displayName;
         }
@@ -636,7 +648,7 @@ async function runSingleSandbox(packageName, options = {}) {
       // connections, and process data come from gVisor's kernel-level tracing.
       if (gvisorMode && gvisorContainerId) {
         const gvisorLogDir = process.env.MUADDIB_GVISOR_LOG_DIR || '/tmp/runsc';
-        const gvisorData = parseGvisorLogs(gvisorContainerId, gvisorLogDir);
+        const gvisorData = syncStep('sandbox:gvisor-parse', { container: gvisorContainerId }, () => parseGvisorLogs(gvisorContainerId, gvisorLogDir));
 
         // Merge gVisor findings into report without duplicating
         if (!report.sensitive_files) report.sensitive_files = { read: [], written: [] };
@@ -665,14 +677,14 @@ async function runSingleSandbox(packageName, options = {}) {
         }
 
         // Cleanup gVisor logs to prevent disk fill
-        cleanupGvisorLogs(gvisorContainerId, gvisorLogDir);
+        syncStep('sandbox:gvisor-cleanup', { container: gvisorContainerId }, () => cleanupGvisorLogs(gvisorContainerId, gvisorLogDir));
       }
 
       const { score, findings } = scoreFindings(report);
 
       // Analyze preload log for behavioral findings
       if (report.preload_log) {
-        const preloadResult = analyzePreloadLog(report.preload_log);
+        const preloadResult = syncStep('sandbox:preload-analyze', null, () => analyzePreloadLog(report.preload_log));
         for (const finding of preloadResult.findings) {
           findings.push(finding);
         }

package/stats.json

@@ -1,6 +1,6 @@
 {
   "_comment": "GENERATED by scripts/collect-stats.js — do not edit by hand. Run `npm run docs:stats`.",
-  "version": "2.11.161",
+  "version": "2.11.163",
   "scanners": 21,
   "rulesTotal": 275,
   "rulesCore": 270,

package/zizmor.yml

@@ -0,0 +1,18 @@
+# zizmor configuration — https://docs.zizmor.sh/configuration/
+#
+# Suppress a finding ONLY when it is a confirmed false positive, and keep the
+# rationale on the same line. Schema:
+#
+#   rules:
+#     <audit-id>:                 # e.g. template-injection, artipacked, cache-poisoning
+#       ignore:
+#         - <workflow>.yml         # ignore the whole file
+#         - <workflow>.yml:LINE    # ignore one line
+#         - <workflow>.yml:LINE:COL# ignore one exact finding
+#
+# Policy for this repo: prefer FIXING findings over ignoring them. As of the first
+# run every finding is real (template-injection in publish.yml, artipacked on the
+# checkout steps, cache-poisoning, adhoc-packages), so nothing is suppressed here.
+# Add an entry below only after confirming a genuine false positive.
+
+rules: {}