muaddib-scanner 2.11.164 → 2.11.167

package/README.md

@@ -30,7 +30,7 @@
 
 npm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond.
 
-MUAD'DIB combines **<!--stat:scanners-->21<!--/stat:scanners--> parallel scanners** (<!--stat:rulesTotal-->275<!--/stat:rulesTotal--> detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **compound scoring** (<!--stat:compound-->20<!--/stat:compound--> compound rules), and a gVisor/Docker sandbox to detect known threats and suspicious behavioral patterns in npm and PyPI packages. An XGBoost classifier exists in the codebase but is **currently inactive** (see [Evaluation](#evaluation)).
+MUAD'DIB combines **<!--stat:scanners-->22<!--/stat:scanners--> parallel scanners** (<!--stat:rulesTotal-->277<!--/stat:rulesTotal--> detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **compound scoring** (<!--stat:compound-->21<!--/stat:compound--> compound rules), and a gVisor/Docker sandbox to detect known threats and suspicious behavioral patterns in npm and PyPI packages. An XGBoost classifier exists in the codebase but is **currently inactive** (see [Evaluation](#evaluation)).
 
 ---
 
@@ -185,7 +185,7 @@ muaddib replay                     # Ground truth validation (90/94 TPR@3, v2.11
 
 ## Features
 
-### <!--stat:scanners-->21<!--/stat:scanners--> parallel scanners
+### <!--stat:scanners-->22<!--/stat:scanners--> parallel scanners
 
 | Scanner | Detection |
 |---------|-----------|
@@ -212,9 +212,9 @@ muaddib replay                     # Ground truth validation (90/94 TPR@3, v2.11
 | Python AST (PYAST) | Tree-sitter-Python AST with taint-aware detectors (v2.11.42+) |
 | Anti-Scanner Injection (ASI) | Prompt-injection text in comments/strings that coerces an LLM code reviewer into a clean verdict or into skipping an obfuscated payload (ASI-001..004, Hades campaign 2026-06) |
 
-### <!--stat:rulesTotal-->275<!--/stat:rulesTotal--> detection rules
+### <!--stat:rulesTotal-->277<!--/stat:rulesTotal--> detection rules
 
-All rules (<!--stat:rulesCore-->270<!--/stat:rulesCore--> RULES + <!--stat:rulesParanoid-->5<!--/stat:rulesParanoid--> PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v211139) for the complete rules reference.
+All rules (<!--stat:rulesCore-->272<!--/stat:rulesCore--> RULES + <!--stat:rulesParanoid-->5<!--/stat:rulesParanoid--> PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v211139) for the complete rules reference.
 
 ### Detected campaigns
 
@@ -345,7 +345,7 @@ npm test
 
 ### Testing
 
-- **<!--stat:tests-->4540<!--/stat:tests--> tests** across <!--stat:testFiles-->150<!--/stat:testFiles--> modular test files
+- **<!--stat:tests-->4559<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
 - **56 fuzz tests** - Malformed inputs, ReDoS, unicode, binary
 - **Datadog 17K benchmark** - 14,587 confirmed malware samples (in-scope)
 - **Ground truth validation** - 96 real-world attacks (95.74% TPR@3, 88.30% TPR@20 — v2.11.48 full measure on 94 in-scope)
@@ -366,7 +366,7 @@ npm test
 - [Documentation Index](docs/INDEX.md) - All documentation in one place
 - [Evaluation Methodology](docs/EVALUATION_METHODOLOGY.md) - Experimental protocol, holdout scores
 - [Threat Model](docs/threat-model.md) - What MUAD'DIB detects and doesn't detect
-- [Security Policy](SECURITY.md) - Detection rules reference (<!--stat:rulesTotal-->275<!--/stat:rulesTotal--> rules)
+- [Security Policy](SECURITY.md) - Detection rules reference (<!--stat:rulesTotal-->277<!--/stat:rulesTotal--> rules)
 - [Security Audit](docs/SECURITY_AUDIT.md) - Bypass validation report
 - [FP Analysis](docs/EVALUATION.md) - Historical false positive analysis
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.164",
+  "version": "2.11.167",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.164.json → self-scan-v2.11.167.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-10T09:30:28.827Z",
+  "timestamp": "2026-07-11T20:50:59.135Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",
@@ -1048,6 +1048,28 @@
       "playbook": "SharedArrayBuffer + Worker Thread detectes. Canal IPC memoire partagee qui contourne la surveillance. Verifier si les workers manipulent des donnees sensibles. Isoler si combine avec eval/exec.",
       "points": 3
     },
+    {
+      "type": "dangerous_exec",
+      "severity": "MEDIUM",
+      "message": "[quick-scan] exec/spawn call detected in overflow file.",
+      "file": "eslint/lib/rules/eol-last.js",
+      "degraded": true,
+      "quickScan": true,
+      "count": 1,
+      "reductions": [],
+      "originalSeverity": "MEDIUM",
+      "confidenceTier": "low",
+      "rule_id": "MUADDIB-AST-007",
+      "rule_name": "Dangerous Shell Command Execution",
+      "confidence": "high",
+      "domain": "malware",
+      "references": [
+        "https://owasp.org/www-community/attacks/Command_Injection"
+      ],
+      "mitre": "T1059.004",
+      "playbook": "CRITIQUE: Execution de commande shell dangereuse detectee. Isoler la machine. Verifier si la commande a ete executee.",
+      "points": 3
+    },
     {
       "type": "dangerous_exec",
       "severity": "MEDIUM",
@@ -2070,10 +2092,10 @@
   ],
   "python": null,
   "summary": {
-    "total": 91,
+    "total": 92,
     "critical": 7,
     "high": 9,
-    "medium": 44,
+    "medium": 45,
     "low": 31,
     "riskScore": 35,
     "riskLevel": "MEDIUM",
@@ -2486,6 +2508,12 @@
         "points": 3,
         "reason": "[quick-scan] exec/spawn call detected in overflow file."
       },
+      {
+        "rule": "MUADDIB-AST-007",
+        "type": "dangerous_exec",
+        "points": 3,
+        "reason": "[quick-scan] exec/spawn call detected in overflow file."
+      },
       {
         "rule": "MUADDIB-AST-004",
         "type": "dangerous_call_eval",
@@ -2671,7 +2699,7 @@
       "verified": 0,
       "high": 0,
       "medium": 17,
-      "low": 74
+      "low": 75
     },
     "perceivedFlagged": 0
   },

package/src/monitor/classify.js

@@ -101,7 +101,11 @@ const HIGH_CONFIDENCE_MALICE_TYPES = new Set([
   // electron_app_injection (MUADDIB-AST-097): install hook overwrites a THIRD-PARTY Electron app's
   // core/.asar with injected code (payload-in-write coupling ⇒ FP≈0). Bypasses MT-1 cap like the
   // other install-time RCE/injection markers above (node_modules_write, systemd_persistence).
-  'electron_app_injection'
+  'electron_app_injection',
+  // install_native_drop_exec (COMPOUND-020): install-time drop-and-execute of a package-
+  // BUNDLED native binary with no network fetch (jscrambler@8.14.0). Quasi-never legit;
+  // bypasses MT-1 cap + reputation attenuation like the other install-time RCE markers.
+  'install_native_drop_exec'
 ]);
 
 // Lifecycle compound types that indicate real malicious intent beyond a simple postinstall

package/src/pipeline/executor.js

@@ -42,6 +42,7 @@ const { normalizePythonName } = require('../scanner/python.js');
 const { scanPythonSource } = require('../scanner/python-source.js');
 const { initPythonParser, scanPythonAST } = require('../scanner/python-ast.js');
 const { scanAntiScannerInjection } = require('../scanner/anti-scanner-injection.js');
+const { scanBinarySource } = require('../scanner/binary-source.js');
 const { Spinner, listInstalledPackages, wasFilesCapped, getOverflowFiles, debugLog } = require('../utils.js');
 const { getMaxFileSize } = require('../shared/constants.js');
 const { scanParanoid } = require('../scanner/paranoid.js');
@@ -253,7 +254,7 @@ async function execute(targetPath, options, pythonDeps, warnings) {
     'scanGitHubActions', 'matchPythonIOCs', 'checkPyPITyposquatting',
     'scanEntropy', 'scanAIConfig', 'scanIocStrings', 'scanAntiForensic',
     'scanStubPackage', 'scanMonorepo', 'scanTrustedDepDiff', 'scanPythonSource',
-    'scanPythonAST', 'scanAntiScannerInjection'
+    'scanPythonAST', 'scanAntiScannerInjection', 'scanBinarySource'
   ];
 
   // Stage 2 quick_scan subset (monitor-only, set via options.scanMode='quick'
@@ -284,7 +285,8 @@ async function execute(targetPath, options, pythonDeps, warnings) {
     'scanPythonSource',
     'scanPythonAST',
     'scanAIConfig',
-    'scanAntiScannerInjection'
+    'scanAntiScannerInjection',
+    'scanBinarySource'
   ]);
   const isQuick = options.scanMode === 'quick';
   function ifEnabled(name, fn) {
@@ -333,7 +335,10 @@ async function execute(targetPath, options, pythonDeps, warnings) {
     ifEnabled('scanPythonAST', () => yieldThen(() => scanPythonAST(targetPath))),
     // ASI-001..004 (chantier 2026-06-20). Anti-scanner prompt injection in source text
     // (comments/strings). Regex-only, cheap; the attack lives in root entry files.
-    ifEnabled('scanAntiScannerInjection', () => yieldThen(() => scanAntiScannerInjection(targetPath)))
+    ifEnabled('scanAntiScannerInjection', () => yieldThen(() => scanAntiScannerInjection(targetPath))),
+    // BINSRC-001 (Layer 2): binary masquerading as a .js/.ts source file. Scans dist/build/out
+    // (which the other text scanners exclude) reading an 8 KB prefix — catches multi-MB carriers.
+    ifEnabled('scanBinarySource', () => yieldThen(() => scanBinarySource(targetPath)))
   ]);
 
   // Extract results: use empty array for rejected scanners, log errors
@@ -366,7 +371,8 @@ async function execute(targetPath, options, pythonDeps, warnings) {
     trustedDepDiffThreats,
     pythonSourceThreats,
     pythonAstThreats,
-    antiScannerThreats
+    antiScannerThreats,
+    binarySourceThreats
   ] = scanResult;
 
   // Emit warning if file count cap was hit + quick-scan overflow files
@@ -450,6 +456,7 @@ async function execute(targetPath, options, pythonDeps, warnings) {
     ...pythonSourceThreats,
     ...pythonAstThreats,
     ...antiScannerThreats,
+    ...binarySourceThreats,
     ...crossFileFlows.filter(f => f && f.sourceFile && f.sinkFile).map(f => ({
       type: f.type,
       severity: f.severity,

package/src/pipeline/processor.js

@@ -23,6 +23,7 @@ const { getRule, getRuleDomain } = require('../rules/index.js');
 const { getPlaybook } = require('../response/playbooks.js');
 const { computeReachableFiles, computeReachableFunctions } = require('../scanner/reachability.js');
 const { correlatePhantomGyp } = require('../scanner/phantom-gyp.js');
+const { correlateInstallNativeDropExec } = require('../scanner/native-drop-exec.js');
 const { applyFPReductions, applyCompoundBoosts, calculateRiskScore, getSeverityWeights, applyContextualFPCaps, applySingleFireCriticalFloor, applyReputationFactor, applyMatureStableCap, applySandboxVerdict, applyDeltaMultiplier } = require('../scoring.js');
 const { loadPriorVersionSignatures, computeSignatures, saveCachedSignatures } = require('../scoring/delta-multiplier.js');
 const { annotateConfidenceTiers } = require('../rules/confidence-tiers.js');
@@ -481,6 +482,14 @@ async function process(threats, targetPath, options, pythonDeps, warnings, scann
   // ADDS a finding when the invoked file is independently judged malicious).
   correlatePhantomGyp(deduped, targetPath);
 
+  // install_native_drop_exec compound (COMPOUND-020): a preinstall/install/postinstall
+  // hook running `node x.js`, where x.js reads package-BUNDLED bytes (local read /
+  // decompress / inline base64), writes them to an executable file, and spawns that
+  // written path — with NO network fetch (the stealthy bundled variant, distinct from
+  // download-and-execute). The jscrambler@8.14.0 shape (Socket 2026-07-11), which trips
+  // zero per-file rules. FP≈0 by construction. Runs here on the full post-FP verdict set.
+  correlateInstallNativeDropExec(deduped, targetPath);
+
   // Intent coherence analysis: detect source→sink pairs within files
   // Pass targetPath for destination-aware SDK pattern detection
   const intentResult = buildIntentPairs(deduped, targetPath);

package/src/response/playbooks.js

@@ -1078,6 +1078,14 @@ const PLAYBOOKS = {
     'CRITIQUE (compound Phase 1b): binding.gyp lance <!(node x.js) / <!(python y.py) au configure-time via node-gyp (aucun script lifecycle requis) ET le fichier invoque est juge malveillant de facon independante par les scanners AST/dataflow/module-graph. ' +
     'Payload install-time confirme — NE PAS installer. Analyser le fichier invoque (nomme dans le message), c\'est lui qui porte la charge. node-gyp l\'execute meme avec --ignore-scripts.',
 
+  install_native_drop_exec:
+    'CRITIQUE (compound COMPOUND-020): un hook preinstall/install/postinstall lance `node x.js` qui depaquette un binaire natif EMBARQUE dans le package (lecture locale / gunzip / base64), l\'ecrit executable et le spawn — au moment de npm install, sans reseau, sans import (pattern jscrambler@8.14.0, infostealer natif). ' +
+    'NE PAS installer : --ignore-scripts ne protege pas si deja installe. Le fichier nomme dans le message porte la charge. Roter les credentials accessibles aux environnements dev/CI ayant installe la version, verifier les logs d\'install pour l\'execution du loader, revenir a une version verifiee saine.',
+
+  binary_masquerading_as_source:
+    'HAUTE: un fichier a extension source (.js/.ts/.cjs/.mjs) a un contenu BINAIRE (executable / archive / conteneur custom), souvent cache dans dist/ ou l\'analyse texte ne regarde pas — porteur de charge utile deguise en source (pattern jscrambler@8.14.0 dist/intro.js, 7.8 Mo). ' +
+    'Ouvrir le fichier en hexdump, identifier le format (ELF/PE/Mach-O/gzip/CSI). Verifier quel script d\'install ou loader le lit+execute (cf. install_native_drop_exec). NE PAS installer si couple a un hook d\'install.',
+
   string_mutation_obfuscation:
     'HAUTE: Chaine de .replace() reconstruisant des noms d\'API dangereuses (leet-speak). ' +
     'Technique d\'evasion par substitution de caracteres. Decoder la chaine finale. Supprimer si malveillant.',

package/src/rules/index.js

@@ -828,6 +828,33 @@ const RULES = {
     ],
     mitre: 'T1195.002'
   },
+  install_native_drop_exec: {
+    id: 'MUADDIB-COMPOUND-020',
+    name: 'Install-Time Native Binary Drop-and-Execute',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    domain: 'malware',
+    description: 'Un hook preinstall/install/postinstall lance `node x.js`, et x.js lit des octets EMBARQUES dans le package (lecture fichier locale / decompression zlib-brotli / base64-hex inline), les ecrit dans un fichier executable (bit exec via mode 0o7xx, chmod +x, ou extension .exe) puis SPAWN ce chemin ecrit (child_process spawn/exec/execFile/fork sur un chemin calcule, pas une commande litterale) — SANS fetch reseau. Pattern jscrambler@8.14.0 (Socket, 2026-07-11): le loader depaquette un binaire natif (infostealer Rust) et l\'execute au moment de npm install, avant tout code applicatif, sans import requis. Le loader ne declenche AUCUNE regle AST/dataflow par fichier (seul lifecycle_script, cape). Compound FPR≈0 par construction: les installeurs legitimes de binaires natifs TELECHARGENT depuis une URL (reseau), COMPILENT via node-gyp/make/cc invoques par NOM (commande litterale), ou chargent un .node prebuild via require() (jamais spawn) — aucun ne depaquette+chmod+spawn un blob embarque sans reseau. Variante furtive (sans signature reseau) volontairement scopee ici; la variante download-and-execute est couverte ailleurs.',
+    references: [
+      'https://github.com/jscrambler/jscrambler/issues/322',
+      'https://attack.mitre.org/techniques/T1195/002/',
+      'https://attack.mitre.org/techniques/T1059/'
+    ],
+    mitre: 'T1195.002'
+  },
+  binary_masquerading_as_source: {
+    id: 'MUADDIB-BINSRC-001',
+    name: 'Binary Masquerading as Source',
+    severity: 'HIGH',
+    confidence: 'high',
+    domain: 'malware',
+    description: 'Un fichier avec une extension source (.js/.mjs/.cjs/.jsx/.ts/.tsx) dont le CONTENU est binaire — executable (ELF/PE/Mach-O), archive (zip/gzip/xz/7z/rar), module WebAssembly, ou conteneur custom (octet de controle en tete, ex. le header \\x1bCSI de jscrambler@8.14.0). Un fichier source est du texte par definition ; un contenu binaire = charge utile deguisee en source. Le scanner descend VOLONTAIREMENT dans dist/build/out/output (que les scanners texte AST/dataflow/entropie excluent via EXCLUDED_DIRS) et ne lit qu\'un prefixe de 8 Ko, donc il attrape un porteur de plusieurs Mo (jscrambler dist/intro.js = 7.8 Mo) que tout le reste ignore. Magic-agnostique : renommer le fichier ou changer le magic ne contourne pas (regles octet-NUL + octet de controle en tete). FP≈0 : un bundle minifie dist/*.js reste du texte imprimable. Severite HIGH (ne franchit pas seul le seuil d\'alerte) : se cumule avec le hook d\'install que COMPOUND-020 install_native_drop_exec eleve en CRITICAL.',
+    references: [
+      'https://github.com/jscrambler/jscrambler/issues/322',
+      'https://attack.mitre.org/techniques/T1027/002/'
+    ],
+    mitre: 'T1027.002'
+  },
   crypto_exfil: {
     id: 'MUADDIB-COMPOUND-019',
     name: 'Hybrid-Crypto Credential Exfiltration',

package/src/scanner/binary-source.js

@@ -0,0 +1,95 @@
+/*
+ * MUAD'DIB — Supply-chain threat detection for npm & PyPI
+ * Copyright (C) 2026 DNSZLSK
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+/**
+ * binary_masquerading_as_source scanner (MUADDIB-BINSRC-001).
+ *
+ * Flags a file with a SOURCE extension whose bytes are actually binary — an executable,
+ * archive, compressed blob, or custom container. This closes a real blind spot: the shared
+ * `findFiles` excludes `dist/`, `build/`, `out/`, `output/` (bundler output), so the AST /
+ * dataflow / entropy scanners never look there — yet that is exactly where a disguised
+ * native payload hides (jscrambler@8.14.0 shipped its 7.8 MB native-binary container as
+ * `dist/intro.js`, which every text scanner skipped). This scanner DELIBERATELY descends
+ * into those dirs and reads only an 8 KB prefix per file, so it catches a multi-MB carrier
+ * regardless of the 10 MB parse cap.
+ *
+ * FP≈0: minified/bundled `dist/*.js` is still printable text (no NUL, no leading control
+ * byte) — only genuinely binary content trips it. Severity HIGH (not single-fire): on its
+ * own it does not cross the alert threshold; it stacks with the install-hook signal, which
+ * the COMPOUND-020 `install_native_drop_exec` correlator escalates to CRITICAL.
+ */
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { findFiles } = require('../utils.js');
+const { sniffBinaryBuffer } = require('../shared/binary-sniff.js');
+
+const SOURCE_EXTS = ['.js', '.mjs', '.cjs', '.jsx', '.ts', '.tsx', '.mts', '.cts'];
+// Keep node_modules/.git out, but INCLUDE dist/build/out/output — payloads hide there and
+// the default EXCLUDED_DIRS skips them.
+const SCAN_EXCLUDED_DIRS = ['node_modules', '.git', '.muaddib-cache'];
+const SNIFF_BYTES = 8192;
+
+function scanBinarySource(targetPath) {
+  const threats = [];
+  if (!targetPath) return threats;
+
+  let files;
+  try {
+    files = findFiles(targetPath, { extensions: SOURCE_EXTS, excludedDirs: SCAN_EXCLUDED_DIRS });
+  } catch { return threats; }
+
+  for (const file of files) {
+    let buf;
+    try {
+      const fd = fs.openSync(file, 'r');
+      try {
+        const b = Buffer.alloc(SNIFF_BYTES);
+        const n = fs.readSync(fd, b, 0, SNIFF_BYTES, 0);
+        buf = b.subarray(0, n);
+      } finally {
+        fs.closeSync(fd);
+      }
+    } catch { continue; }
+
+    const verdict = sniffBinaryBuffer(buf);
+    if (!verdict.binary) continue;
+
+    const rel = path.relative(targetPath, file).replace(/\\/g, '/');
+    let sizeStr = '';
+    try {
+      const mb = fs.statSync(file).size / (1024 * 1024);
+      if (mb >= 0.1) sizeStr = ` (${mb.toFixed(1)} MB)`;
+    } catch { /* size best-effort */ }
+
+    threats.push({
+      type: 'binary_masquerading_as_source',
+      severity: 'HIGH',
+      confidence: 'high',
+      file: rel,
+      message: `File "${rel}" has a source extension but its content is ${verdict.format} — ${verdict.reason}${sizeStr}. A .js/.ts file that is actually binary is a payload carrier disguised as source (e.g. jscrambler@8.14.0 dist/intro.js) and evades text-based static analysis.`,
+      mitre: 'T1027.002'
+    });
+  }
+
+  return threats;
+}
+
+module.exports = { scanBinarySource, SOURCE_EXTS };

package/src/scanner/native-drop-exec.js

@@ -0,0 +1,458 @@
+/*
+ * MUAD'DIB — Supply-chain threat detection for npm & PyPI
+ * Copyright (C) 2026 DNSZLSK
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+/**
+ * install_native_drop_exec compound correlator (MUADDIB-COMPOUND-020).
+ *
+ * Threat model — the jscrambler@8.14.0 shape (Socket, 2026-07-11): a `preinstall`
+ * hook (`node dist/setup.js`) reads a package-BUNDLED blob (`readFileSync(intro.js)`),
+ * decompresses it (`gunzipSync`), writes it to a hidden temp file with an EXECUTABLE
+ * mode (`writeFileSync(…, {mode: 0o755})`), and spawns THAT written path detached
+ * (`spawn(target, [], {detached:true, stdio:'ignore', windowsHide:true}); unref()`).
+ * A native infostealer runs on `npm install` before any application code — and the
+ * loader itself trips ZERO existing AST/dataflow rules (only PKG-001 `lifecycle_script`
+ * fires, capped as base behavior). This closes that gap.
+ *
+ * Why a compound and not a lone detector: the invariant we key on is
+ *   (BUNDLED_SOURCE) the executable's bytes originate from WITHIN the package —
+ *                    a local fs read, a zlib/brotli decompress, or an inline
+ *                    base64/hex Buffer — NOT from the network; AND
+ *   (DROP_EXEC)      a file is written with an exec bit / chmod +x / an .exe-class
+ *                    name; AND
+ *   (EXEC_COMPUTED)  child_process spawn/exec/execFile/fork runs a COMPUTED path
+ *                    (a variable/expression, not a bare "git"/"node" literal).
+ * Any one of these alone is legitimate somewhere. The three together, reached from an
+ * install hook, is the "drop-and-run a bundled native binary at install time" pattern,
+ * which legitimate native-module installers never do: they DOWNLOAD prebuilt binaries
+ * from a URL (network, not bundled — so BUNDLED_SOURCE is absent), COMPILE via
+ * `node-gyp`/`make`/`cc` invoked by NAME (a literal command — EXEC_COMPUTED absent), or
+ * ship a prebuilt `.node` addon loaded with `require()` (never spawned). Gating on the
+ * install hook + requiring all three signals ⇒ FP≈0 by construction.
+ *
+ * Variant-robust, not a jscrambler signature: renaming the carrier, changing the custom
+ * container magic, swapping gzip→brotli/base64, `spawn`→`exec`/`fork`, tmpdir→cache, or
+ * dropping the `.exe` obfuscation all preserve the three invariants and still fire. The
+ * one evasion this does NOT cover — fetching the binary from a URL at install — is a
+ * different, noisier pattern (network egress + URL IOC surface) detected elsewhere.
+ *
+ * Runs as a post-processor (like phantom-gyp.js): it re-reads package.json and the
+ * invoked loader directly rather than relying on any per-file finding, so a benign
+ * package carries no intermediate signal and gains zero findings.
+ */
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+let acorn = null;
+let walk = null;
+try {
+  acorn = require('acorn');
+  walk = require('acorn-walk');
+} catch { /* acorn unavailable → correlator is a no-op */ }
+
+// Install hooks that npm runs on the CONSUMER from a published registry tarball.
+// Same set package.js escalates on (preinstall/install/postinstall). `prepare` is
+// intentionally excluded: it runs only for git/directory installs, not registry
+// tarballs, and would widen the surface without the coupling gaining precision.
+const INSTALL_HOOKS = ['preinstall', 'install', 'postinstall'];
+
+// child_process execution sinks.
+const EXEC_MEMBERS = new Set(['spawn', 'spawnSync', 'exec', 'execSync', 'execFile', 'execFileSync', 'fork']);
+// zlib decompression of a bundled payload.
+const DECOMPRESS_MEMBERS = new Set(['gunzipSync', 'gunzip', 'brotliDecompressSync', 'brotliDecompress', 'inflateSync', 'inflate', 'inflateRawSync', 'inflateRaw', 'unzipSync', 'unzip']);
+// fs reads / writes / chmod.
+const READ_MEMBERS = new Set(['readFileSync', 'readFile']);
+const WRITE_MEMBERS = new Set(['writeFileSync', 'writeFile']);
+const CHMOD_MEMBERS = new Set(['chmodSync', 'chmod', 'fchmodSync', 'fchmod', 'lchmodSync', 'lchmod']);
+
+const MODULE_CP = new Set(['child_process', 'node:child_process']);
+const MODULE_ZLIB = new Set(['zlib', 'node:zlib']);
+const MODULE_FS = new Set(['fs', 'node:fs', 'fs/promises', 'node:fs/promises']);
+// HTTP download modules. Their presence means the loader FETCHES its bytes — the
+// download-and-execute pattern (network egress + URL IOC surface), handled by other
+// detectors. This compound is intentionally scoped to the STEALTHY no-network variant
+// where the payload is bundled inside the package, so we suppress when any appears.
+const NETWORK_MODULES = new Set([
+  'http', 'https', 'node:http', 'node:https', 'http2', 'node:http2',
+  'axios', 'node-fetch', 'got', 'undici', 'request', 'follow-redirects',
+  'needle', 'superagent', 'phin', 'bent', 'cross-fetch', 'isomorphic-fetch',
+  'make-fetch-happen', 'minipass-fetch'
+]);
+
+const EXEC_EXT_RE = /\.(?:exe|cmd|bat|com|scr|ps1|msi)$/i;
+const ENCODINGS = new Set(['base64', 'base64url', 'hex']);
+
+// Loaders are tiny. Skip pathological files (a huge minified index is never an
+// install loader) to bound parse cost.
+const MAX_SCRIPT_BYTES = 1024 * 1024;
+
+/** Normalize a relative path for comparison: backslashes→/, strip leading ./ and /. */
+function _normRel(f) {
+  return String(f || '').replace(/\\/g, '/').replace(/^\.\//, '').replace(/^\/+/, '');
+}
+
+/**
+ * Extract the local .js/.cjs/.mjs files invoked by `node <file>` in a lifecycle
+ * command line. Splits on shell separators so `node a.js && echo ok` yields a.js.
+ * Inline-eval forms (`node -e "…"`) and non-node commands yield nothing.
+ * @param {string} cmd - raw script command from package.json scripts[hook]
+ * @returns {string[]} invoked script file paths (as written in the command)
+ */
+function extractInvokedScriptFiles(cmd) {
+  const out = [];
+  if (!cmd || typeof cmd !== 'string') return out;
+  const segments = cmd.split(/&&|\|\||[;&|\n]/);
+  for (const seg of segments) {
+    const toks = seg.trim().split(/\s+/).filter(Boolean);
+    if (!toks.length) continue;
+    const bin = toks[0].replace(/^.*[/\\]/, '').toLowerCase();
+    if (bin !== 'node' && bin !== 'nodejs') continue;
+    for (let i = 1; i < toks.length; i++) {
+      const tok = toks[i];
+      if (tok.startsWith('-')) {
+        // An inline-eval flag means there is no script file in this invocation.
+        if (/^--?(?:e|p|c|eval|print|require)$/i.test(tok)) break;
+        continue; // some other flag (e.g. --experimental-*) — keep scanning
+      }
+      const clean = tok.replace(/^['"]+|['"]+$/g, '');
+      if (/\.(?:c|m)?js$/i.test(clean)) { out.push(clean); break; }
+      break; // first non-flag token is not a script file → nothing to analyze
+    }
+  }
+  return out;
+}
+
+/** Try module then script source type. Returns AST or null (obfuscated/non-JS). */
+function _parse(code) {
+  if (!acorn) return null;
+  for (const sourceType of ['module', 'script']) {
+    try {
+      return acorn.parse(code, {
+        ecmaVersion: 'latest',
+        sourceType,
+        allowHashBang: true,
+        allowReturnOutsideFunction: true,
+        allowAwaitOutsideFunction: true
+      });
+    } catch { /* try next */ }
+  }
+  return null;
+}
+
+/** True when a spawn/exec first argument is a COMPUTED path (not a bare command literal). */
+function _isComputedArg(arg) {
+  if (!arg) return false;
+  if (arg.type === 'Literal') return typeof arg.value !== 'string' ? false : false; // literal command → not our pattern
+  if (arg.type === 'TemplateLiteral') return (arg.expressions && arg.expressions.length > 0);
+  // Identifier / MemberExpression / CallExpression / BinaryExpression / ConditionalExpression …
+  return true;
+}
+
+/** True when the read source is an explicit http(s) URL literal (network, not bundled). */
+function _isUrlArg(arg) {
+  if (!arg) return false;
+  if (arg.type === 'Literal' && typeof arg.value === 'string') return /^https?:\/\//i.test(arg.value);
+  if (arg.type === 'TemplateLiteral' && arg.quasis && arg.quasis[0]) {
+    return /^https?:\/\//i.test(arg.quasis[0].value.cooked || arg.quasis[0].value.raw || '');
+  }
+  // `new URL('./x', import.meta.url)` is the canonical ESM LOCAL-file idiom — only an
+  // http(s) first argument makes it a network URL.
+  if (arg.type === 'NewExpression' && arg.callee && arg.callee.name === 'URL') {
+    const u = arg.arguments && arg.arguments[0];
+    return !!(u && u.type === 'Literal' && typeof u.value === 'string' && /^https?:\/\//i.test(u.value));
+  }
+  return false;
+}
+
+/** True when a numeric/string/ternary mode value carries any exec bit (0o111 mask). */
+function _modeHasExecBit(node) {
+  if (!node) return false;
+  if (node.type === 'Literal') {
+    if (typeof node.value === 'number') return (node.value & 0o111) !== 0;
+    if (typeof node.value === 'string') {
+      const v = parseInt(node.value, 8);
+      return Number.isInteger(v) && (v & 0o111) !== 0;
+    }
+    return false;
+  }
+  // { mode: platform === 1 ? 0o644 : 0o755 } — check both branches.
+  if (node.type === 'ConditionalExpression') {
+    return _modeHasExecBit(node.consequent) || _modeHasExecBit(node.alternate);
+  }
+  return false;
+}
+
+/** writeFile(file, data, options?): executable if options.mode has an exec bit, or the target is an .exe-class literal. */
+function _writeIsExecutable(callNode) {
+  const args = callNode.arguments || [];
+  const opts = args[2];
+  if (opts && opts.type === 'ObjectExpression') {
+    for (const p of opts.properties) {
+      if (p.type === 'Property' && !p.computed && p.key &&
+          (p.key.name === 'mode' || p.key.value === 'mode') && _modeHasExecBit(p.value)) {
+        return true;
+      }
+    }
+  }
+  const target = args[0];
+  if (target && target.type === 'Literal' && typeof target.value === 'string' && EXEC_EXT_RE.test(target.value)) {
+    return true;
+  }
+  return false;
+}
+
+/** Buffer.from(<string literal>, 'base64'|'hex') — an inline-encoded payload. */
+function _isEncodingArg(arg) {
+  return !!(arg && arg.type === 'Literal' && typeof arg.value === 'string' && ENCODINGS.has(arg.value.toLowerCase()));
+}
+
+/** True when `node` is `require('<module in set>')`. */
+function _isRequireOf(node, moduleSet) {
+  return !!(node && node.type === 'CallExpression' && node.callee && node.callee.type === 'Identifier' &&
+    node.callee.name === 'require' && node.arguments && node.arguments[0] &&
+    node.arguments[0].type === 'Literal' && moduleSet.has(node.arguments[0].value));
+}
+
+/**
+ * Collect local binding names imported/required from child_process, zlib and fs.
+ * Handles ESM named/namespace imports and CJS require destructuring/namespace, plus
+ * `const spawn = require('child_process').spawn`.
+ */
+function _collectBindings(ast) {
+  const b = {
+    execFns: new Set(), cpNs: new Set(),
+    decompressFns: new Set(), zlibNs: new Set(),
+    readFns: new Set(), writeFns: new Set(), chmodFns: new Set(), fsNs: new Set(),
+    network: false
+  };
+  const addNamed = (src, importedName, localName) => {
+    if (MODULE_CP.has(src)) {
+      if (EXEC_MEMBERS.has(importedName)) b.execFns.add(localName);
+    } else if (MODULE_ZLIB.has(src)) {
+      if (DECOMPRESS_MEMBERS.has(importedName)) b.decompressFns.add(localName);
+    } else if (MODULE_FS.has(src)) {
+      if (READ_MEMBERS.has(importedName)) b.readFns.add(localName);
+      else if (WRITE_MEMBERS.has(importedName)) b.writeFns.add(localName);
+      else if (CHMOD_MEMBERS.has(importedName)) b.chmodFns.add(localName);
+    }
+  };
+  const addNs = (src, localName) => {
+    if (MODULE_CP.has(src)) b.cpNs.add(localName);
+    else if (MODULE_ZLIB.has(src)) b.zlibNs.add(localName);
+    else if (MODULE_FS.has(src)) b.fsNs.add(localName);
+  };
+
+  walk.simple(ast, {
+    ImportDeclaration(node) {
+      const src = node.source && node.source.value;
+      if (!src) return;
+      if (NETWORK_MODULES.has(src)) b.network = true;
+      for (const spec of node.specifiers || []) {
+        if (spec.type === 'ImportSpecifier') addNamed(src, spec.imported.name, spec.local.name);
+        else if (spec.type === 'ImportNamespaceSpecifier' || spec.type === 'ImportDefaultSpecifier') addNs(src, spec.local.name);
+      }
+    },
+    VariableDeclarator(node) {
+      const init = node.init;
+      if (!init) return;
+      // const X = require('mod')  |  const {a,b} = require('mod')
+      if (init.type === 'CallExpression' && init.callee && init.callee.type === 'Identifier' &&
+          init.callee.name === 'require' && init.arguments[0] && init.arguments[0].type === 'Literal') {
+        const src = init.arguments[0].value;
+        if (NETWORK_MODULES.has(src)) b.network = true;
+        if (node.id.type === 'Identifier') addNs(src, node.id.name);
+        else if (node.id.type === 'ObjectPattern') {
+          for (const p of node.id.properties) {
+            if (p.type === 'Property' && p.key && p.value && p.value.type === 'Identifier') {
+              addNamed(src, p.key.name || p.key.value, p.value.name);
+            }
+          }
+        }
+        return;
+      }
+      // const spawn = require('child_process').spawn
+      if (init.type === 'MemberExpression' && !init.computed && init.property.type === 'Identifier' &&
+          node.id.type === 'Identifier') {
+        const prop = init.property.name;
+        if (_isRequireOf(init.object, MODULE_CP) && EXEC_MEMBERS.has(prop)) b.execFns.add(node.id.name);
+        else if (_isRequireOf(init.object, MODULE_ZLIB) && DECOMPRESS_MEMBERS.has(prop)) b.decompressFns.add(node.id.name);
+        else if (_isRequireOf(init.object, MODULE_FS) && READ_MEMBERS.has(prop)) b.readFns.add(node.id.name);
+        else if (_isRequireOf(init.object, MODULE_FS) && WRITE_MEMBERS.has(prop)) b.writeFns.add(node.id.name);
+        else if (_isRequireOf(init.object, MODULE_FS) && CHMOD_MEMBERS.has(prop)) b.chmodFns.add(node.id.name);
+      }
+    }
+  });
+  return b;
+}
+
+/** Record spawn/exec option boosters (not required for firing — they enrich the message). */
+function _spawnBoosters(callNode, sig) {
+  const opts = (callNode.arguments || []).find(a => a && a.type === 'ObjectExpression');
+  if (!opts) return;
+  for (const p of opts.properties) {
+    if (p.type !== 'Property' || p.computed || !p.key) continue;
+    const k = p.key.name || p.key.value;
+    if (k === 'detached' && p.value.type === 'Literal' && p.value.value === true) sig.boosters.add('detached');
+    else if (k === 'stdio' && p.value.type === 'Literal' && p.value.value === 'ignore') sig.boosters.add("stdio:'ignore'");
+    else if (k === 'windowsHide' && p.value.type === 'Literal' && p.value.value === true) sig.boosters.add('windowsHide');
+  }
+}
+
+/** Classify one CallExpression against the module bindings, updating the signal set. */
+function _classifyCall(node, b, sig) {
+  const callee = node.callee;
+  const args = node.arguments || [];
+  if (!callee) return;
+
+  if (callee.type === 'Identifier') {
+    const n = callee.name;
+    if (n === 'fetch') { sig.network = true; return; }
+    if (b.execFns.has(n)) { if (_isComputedArg(args[0])) { sig.exec = true; _spawnBoosters(node, sig); } }
+    else if (b.decompressFns.has(n)) sig.boosters.add('decompress');
+    else if (b.readFns.has(n)) { if (!_isUrlArg(args[0])) sig.source = true; }
+    else if (b.writeFns.has(n)) { if (_writeIsExecutable(node)) sig.drop = true; }
+    else if (b.chmodFns.has(n)) { if (_modeHasExecBit(args[1])) sig.drop = true; }
+    return;
+  }
+
+  if (callee.type === 'MemberExpression' && !callee.computed && callee.property.type === 'Identifier') {
+    const prop = callee.property.name;
+    const obj = callee.object;
+    const objName = obj.type === 'Identifier' ? obj.name : null;
+    if (objName === 'Buffer' && prop === 'from' && _isEncodingArg(args[1])) { sig.source = true; return; }
+    if (prop === 'unref') { sig.boosters.add('unref'); return; }
+
+    const objIsCP = (objName && b.cpNs.has(objName)) || _isRequireOf(obj, MODULE_CP);
+    const objIsZ = (objName && b.zlibNs.has(objName)) || _isRequireOf(obj, MODULE_ZLIB);
+    const objIsFS = (objName && b.fsNs.has(objName)) || _isRequireOf(obj, MODULE_FS);
+
+    if (objIsCP && EXEC_MEMBERS.has(prop)) { if (_isComputedArg(args[0])) { sig.exec = true; _spawnBoosters(node, sig); } }
+    else if (objIsZ && DECOMPRESS_MEMBERS.has(prop)) sig.boosters.add('decompress');
+    else if (objIsFS && READ_MEMBERS.has(prop)) { if (!_isUrlArg(args[0])) sig.source = true; }
+    else if (objIsFS && WRITE_MEMBERS.has(prop)) { if (_writeIsExecutable(node)) sig.drop = true; }
+    else if (objIsFS && CHMOD_MEMBERS.has(prop)) { if (_modeHasExecBit(args[1])) sig.drop = true; }
+  }
+}
+
+/** Conservative textual scan — only reached when the loader does not parse as JS. */
+function _textualFallback(code) {
+  // Network present → download-exec pattern, not our bundled variant. Suppress.
+  if (/\bhttps?\b|\bfetch\s*\(|\b(?:axios|node-fetch|got|undici|follow-redirects)\b/.test(code)) {
+    return { fired: false, reason: '' };
+  }
+  const hasCP = /(?:require\(\s*['"](?:node:)?child_process['"]\s*\)|from\s+['"](?:node:)?child_process['"])/.test(code);
+  const hasExec = /\b(?:spawn|spawnSync|execFile|execFileSync|fork)\s*\(/.test(code);
+  // Bundled source = local file read or inline base64/hex (a bare decompress could be on
+  // a network stream, so it is a booster, not a source qualifier).
+  const hasSource = /\breadFileSync?\s*\(|Buffer\.from\([^)]*['"](?:base64|hex)['"]/.test(code);
+  const hasDrop = /\bchmod\w*\s*\(|mode\s*:\s*0o?[0-7]*[1357]|['"][^'"]*\.exe['"]/.test(code);
+  const fired = hasCP && hasExec && hasSource && hasDrop;
+  return { fired, reason: fired ? 'reads bundled bytes, writes an executable file and spawns it (textual match on an unparsable loader)' : '' };
+}
+
+/** Compose a static human-readable reason from the fired signals + boosters. */
+function _buildReason(sig) {
+  const boosters = sig.boosters.size ? ` (${Array.from(sig.boosters).join(', ')})` : '';
+  return 'reads package-bundled bytes (local read / decompress / inline base64), writes them to an executable file ' +
+    '(exec-bit mode, chmod +x, or .exe) and spawns that written path' + boosters;
+}
+
+/**
+ * Analyze one install-hook-invoked loader for the drop-exec conjunction.
+ * @returns {{fired:boolean, reason?:string}|null} null when the file can't be read/resolved
+ */
+function analyzeScriptForDropExec(targetPath, file) {
+  const rel = _normRel(file);
+  const root = path.resolve(targetPath);
+  const abs = path.resolve(root, rel);
+  // Contain within the package (no ../ traversal out of the scan root).
+  if (abs !== root && !abs.startsWith(root + path.sep)) return null;
+
+  let code;
+  try {
+    const st = fs.statSync(abs);
+    if (!st.isFile() || st.size > MAX_SCRIPT_BYTES) return null;
+    code = fs.readFileSync(abs, 'utf8');
+  } catch { return null; }
+
+  const ast = _parse(code);
+  if (!ast) return _textualFallback(code);
+
+  const bindings = _collectBindings(ast);
+  const sig = { exec: false, drop: false, source: false, network: false, boosters: new Set() };
+  walk.simple(ast, { CallExpression(node) { _classifyCall(node, bindings, sig); } });
+
+  // Suppress when the loader fetches its bytes from the network: that is the
+  // download-and-execute pattern (network egress + URL IOC surface, handled by other
+  // detectors), not the stealthy bundled variant this compound targets.
+  if (bindings.network || sig.network) return { fired: false };
+  if (!(sig.exec && sig.drop && sig.source)) return { fired: false };
+  return { fired: true, reason: _buildReason(sig) };
+}
+
+/**
+ * install_native_drop_exec compound: for each preinstall/install/postinstall that runs
+ * `node x.js`, if x.js bundles+drops+executes a native binary, push one CRITICAL threat.
+ * Mutates `threats` in place; idempotent; no-op (no findings added) on benign packages.
+ *
+ * @param {Array<object>} threats - deduplicated, post-scan threats array
+ * @param {string} targetPath - scan target directory (where package.json lives)
+ * @returns {object|null} the pushed compound threat, or null if nothing fired
+ */
+function correlateInstallNativeDropExec(threats, targetPath) {
+  if (!Array.isArray(threats) || !targetPath || !acorn) return null;
+  if (threats.some(t => t && t.type === 'install_native_drop_exec')) return null; // idempotent
+
+  let pkg;
+  try {
+    const p = path.join(targetPath, 'package.json');
+    if (!fs.existsSync(p)) return null;
+    pkg = JSON.parse(fs.readFileSync(p, 'utf8'));
+  } catch { return null; }
+
+  const scripts = pkg && pkg.scripts;
+  if (!scripts || typeof scripts !== 'object') return null;
+
+  for (const hook of INSTALL_HOOKS) {
+    for (const file of extractInvokedScriptFiles(scripts[hook])) {
+      const analysis = analyzeScriptForDropExec(targetPath, file);
+      if (analysis && analysis.fired) {
+        const compound = {
+          type: 'install_native_drop_exec',
+          severity: 'CRITICAL',
+          message: `package.json "${hook}" runs \`node ${file}\`, which ${analysis.reason} — install-time native-binary drop-and-execute: the payload runs on \`npm install\` before any application code, no import required (compound).`,
+          file: _normRel(file),
+          compound: true,
+          count: 1
+        };
+        threats.push(compound);
+        return compound; // one compound per package is enough
+      }
+    }
+  }
+  return null;
+}
+
+module.exports = {
+  correlateInstallNativeDropExec,
+  extractInvokedScriptFiles,
+  analyzeScriptForDropExec,
+  _normRel
+};

package/src/scoring.js

@@ -190,7 +190,13 @@ const SINGLE_FIRE_CRITICAL_TYPES = new Set([
   // dest in the same file (FP≈0 by construction). Floors a lone CRITICAL to 75 so it is
   // not buried at 25 on PyPI, where a single CRITICAL does not stack co-signals the way
   // the npm side does (env_access + credential_regex_harvest + ... → 100).
-  'crypto_exfil'
+  'crypto_exfil',
+  // install_native_drop_exec (COMPOUND-020): an install hook drops a package-bundled
+  // native binary (exec-bit write / chmod +x) and spawns it, with no network fetch
+  // (jscrambler@8.14.0). FP≈0 by construction, so it carries the same single-fire weight
+  // as the IOC/hash matches and gyp_phantom_exec above — a lone verdict must not be
+  // buried at 25 (the loader trips no other rule to stack with).
+  'install_native_drop_exec'
 ]);
 const SINGLE_FIRE_CRITICAL_FLOOR = 75;
 const SINGLE_FIRE_MIN_SEVERITY_RANK = 2; // HIGH
@@ -452,7 +458,11 @@ const DIST_EXEMPT_TYPES = new Set([
   'lifecycle_file_exec',  // B6: lifecycle → malicious file compound
   'lifecycle_dataflow', 'lifecycle_dangerous_exec', 'obfuscated_lifecycle_env',
   // RT-C1: Boundary-squat compound is never coincidental (dep declared AND require()d)
-  'dependency_typosquat_require'
+  'dependency_typosquat_require',
+  // BINSRC-001: a binary file disguised as .js SPECIFICALLY hides in dist/ (that is why the
+  // scanner descends there). The dist/ downgrade assumes benign bundler output — a genuinely
+  // binary file never is, so it must never be reduced.
+  'binary_masquerading_as_source'
   // P6: remote_code_load and proxy_data_intercept removed — in bundled dist/ files,
   // fetch + eval co-occurrence is coincidental (bundler combines HTTP client + template compilation).
   // fetch_decrypt_exec (fetch+decrypt+eval triple) remains exempt — never coincidental.
@@ -535,7 +545,10 @@ const REACHABILITY_EXEMPT_TYPES = new Set([
   // no legitimate code reconstructs env var names from character codes. Injected files
   // (router_init.js) are unreachable via require/import but execute via lifecycle hooks
   // or optionalDependencies with prepare scripts.
-  'env_charcode_reconstruction'    // AST-018 — fromCharCode + process.env[computed]
+  'env_charcode_reconstruction',   // AST-018 — fromCharCode + process.env[computed]
+  // BINSRC-001: a binary blob disguised as .js is read as bytes, never require()d, so it is
+  // always "unreachable" via the import graph — the wrong lens for a non-JS carrier.
+  'binary_masquerading_as_source'
 ]);
 
 // ============================================

package/src/shared/analyze-helper.js

@@ -19,6 +19,7 @@
 
 const path = require('path');
 const { isDevFile, findJsFiles, forEachSafeFile } = require('../utils.js');
+const { looksBinaryString } = require('./binary-sniff.js');
 
 /**
  * Shared scanner wrapper: iterates JS files, runs analyzeFileFn on original + deobfuscated code,
@@ -56,6 +57,12 @@ function analyzeWithDeobfuscation(targetPath, analyzeFileFn, options = {}) {
       }).join('\n');
     }
 
+    // Ingestion guard: a source-extension file whose bytes are actually binary (a payload
+    // carrier disguised as source) is not JS — skip the parse instead of handing acorn
+    // megabytes of binary that yield no AST and burn the parse budget. binary-source.js
+    // reports the finding (it also reaches dist/ where this shared path does not).
+    if (looksBinaryString(effectiveContent)) return;
+
     // Analyze original code first (preserves obfuscation-detection rules)
     const fileThreats = analyzeFileFn(effectiveContent, file, targetPath);
     threats.push(...fileThreats);

package/stats.json

@@ -1,16 +1,16 @@
 {
   "_comment": "GENERATED by scripts/collect-stats.js — do not edit by hand. Run `npm run docs:stats`.",
-  "version": "2.11.164",
-  "scanners": 21,
-  "rulesTotal": 275,
-  "rulesCore": 270,
+  "version": "2.11.167",
+  "scanners": 22,
+  "rulesTotal": 277,
+  "rulesCore": 272,
   "rulesParanoid": 5,
-  "compound": 20,
+  "compound": 21,
   "astRules": 97,
-  "scannerFiles": 34,
+  "scannerFiles": 36,
   "astDetectors": 15,
   "moduleGraph": 9,
   "pythonAstDetectors": 6,
-  "testFiles": 150,
-  "tests": 4540
+  "testFiles": 152,
+  "tests": 4559
 }