muaddib-scanner 2.11.166 → 2.11.168

package/README.md

@@ -30,7 +30,7 @@
 
 npm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond.
 
-MUAD'DIB combines **<!--stat:scanners-->21<!--/stat:scanners--> parallel scanners** (<!--stat:rulesTotal-->276<!--/stat:rulesTotal--> detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **compound scoring** (<!--stat:compound-->21<!--/stat:compound--> compound rules), and a gVisor/Docker sandbox to detect known threats and suspicious behavioral patterns in npm and PyPI packages. An XGBoost classifier exists in the codebase but is **currently inactive** (see [Evaluation](#evaluation)).
+MUAD'DIB combines **<!--stat:scanners-->22<!--/stat:scanners--> parallel scanners** (<!--stat:rulesTotal-->277<!--/stat:rulesTotal--> detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **compound scoring** (<!--stat:compound-->21<!--/stat:compound--> compound rules), and a gVisor/Docker sandbox to detect known threats and suspicious behavioral patterns in npm and PyPI packages. An XGBoost classifier exists in the codebase but is **currently inactive** (see [Evaluation](#evaluation)).
 
 ---
 
@@ -185,7 +185,7 @@ muaddib replay                     # Ground truth validation (90/94 TPR@3, v2.11
 
 ## Features
 
-### <!--stat:scanners-->21<!--/stat:scanners--> parallel scanners
+### <!--stat:scanners-->22<!--/stat:scanners--> parallel scanners
 
 | Scanner | Detection |
 |---------|-----------|
@@ -212,9 +212,9 @@ muaddib replay                     # Ground truth validation (90/94 TPR@3, v2.11
 | Python AST (PYAST) | Tree-sitter-Python AST with taint-aware detectors (v2.11.42+) |
 | Anti-Scanner Injection (ASI) | Prompt-injection text in comments/strings that coerces an LLM code reviewer into a clean verdict or into skipping an obfuscated payload (ASI-001..004, Hades campaign 2026-06) |
 
-### <!--stat:rulesTotal-->276<!--/stat:rulesTotal--> detection rules
+### <!--stat:rulesTotal-->277<!--/stat:rulesTotal--> detection rules
 
-All rules (<!--stat:rulesCore-->271<!--/stat:rulesCore--> RULES + <!--stat:rulesParanoid-->5<!--/stat:rulesParanoid--> PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v211139) for the complete rules reference.
+All rules (<!--stat:rulesCore-->272<!--/stat:rulesCore--> RULES + <!--stat:rulesParanoid-->5<!--/stat:rulesParanoid--> PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v211139) for the complete rules reference.
 
 ### Detected campaigns
 
@@ -345,7 +345,7 @@ npm test
 
 ### Testing
 
-- **<!--stat:tests-->4550<!--/stat:tests--> tests** across <!--stat:testFiles-->151<!--/stat:testFiles--> modular test files
+- **<!--stat:tests-->4561<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
 - **56 fuzz tests** - Malformed inputs, ReDoS, unicode, binary
 - **Datadog 17K benchmark** - 14,587 confirmed malware samples (in-scope)
 - **Ground truth validation** - 96 real-world attacks (95.74% TPR@3, 88.30% TPR@20 — v2.11.48 full measure on 94 in-scope)
@@ -366,7 +366,7 @@ npm test
 - [Documentation Index](docs/INDEX.md) - All documentation in one place
 - [Evaluation Methodology](docs/EVALUATION_METHODOLOGY.md) - Experimental protocol, holdout scores
 - [Threat Model](docs/threat-model.md) - What MUAD'DIB detects and doesn't detect
-- [Security Policy](SECURITY.md) - Detection rules reference (<!--stat:rulesTotal-->276<!--/stat:rulesTotal--> rules)
+- [Security Policy](SECURITY.md) - Detection rules reference (<!--stat:rulesTotal-->277<!--/stat:rulesTotal--> rules)
 - [Security Audit](docs/SECURITY_AUDIT.md) - Bypass validation report
 - [FP Analysis](docs/EVALUATION.md) - Historical false positive analysis
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.166",
+  "version": "2.11.168",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.166.json → self-scan-v2.11.168.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-11T19:59:54.765Z",
+  "timestamp": "2026-07-11T21:48:05.101Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",
@@ -1048,6 +1048,28 @@
       "playbook": "SharedArrayBuffer + Worker Thread detectes. Canal IPC memoire partagee qui contourne la surveillance. Verifier si les workers manipulent des donnees sensibles. Isoler si combine avec eval/exec.",
       "points": 3
     },
+    {
+      "type": "dangerous_exec",
+      "severity": "MEDIUM",
+      "message": "[quick-scan] exec/spawn call detected in overflow file.",
+      "file": "eslint/lib/rules/eol-last.js",
+      "degraded": true,
+      "quickScan": true,
+      "count": 1,
+      "reductions": [],
+      "originalSeverity": "MEDIUM",
+      "confidenceTier": "low",
+      "rule_id": "MUADDIB-AST-007",
+      "rule_name": "Dangerous Shell Command Execution",
+      "confidence": "high",
+      "domain": "malware",
+      "references": [
+        "https://owasp.org/www-community/attacks/Command_Injection"
+      ],
+      "mitre": "T1059.004",
+      "playbook": "CRITIQUE: Execution de commande shell dangereuse detectee. Isoler la machine. Verifier si la commande a ete executee.",
+      "points": 3
+    },
     {
       "type": "dangerous_exec",
       "severity": "MEDIUM",
@@ -2070,10 +2092,10 @@
   ],
   "python": null,
   "summary": {
-    "total": 91,
+    "total": 92,
     "critical": 7,
     "high": 9,
-    "medium": 44,
+    "medium": 45,
     "low": 31,
     "riskScore": 35,
     "riskLevel": "MEDIUM",
@@ -2486,6 +2508,12 @@
         "points": 3,
         "reason": "[quick-scan] exec/spawn call detected in overflow file."
       },
+      {
+        "rule": "MUADDIB-AST-007",
+        "type": "dangerous_exec",
+        "points": 3,
+        "reason": "[quick-scan] exec/spawn call detected in overflow file."
+      },
       {
         "rule": "MUADDIB-AST-004",
         "type": "dangerous_call_eval",
@@ -2671,7 +2699,7 @@
       "verified": 0,
       "high": 0,
       "medium": 17,
-      "low": 74
+      "low": 75
     },
     "perceivedFlagged": 0
   },

package/src/monitor/ingestion.js

@@ -383,6 +383,31 @@ function parsePyPIRss(xml) {
 const RECENT_PUBLISH_WINDOW_MS = 24 * 60 * 60 * 1000;
 const RECENT_PUBLISH_MAX = 5;
 
+// Burst versions beyond RECENT_PUBLISH_MAX are dropped by recency. But a buried burst
+// version that ADDS an install hook the latest lacks is exactly the "bury the payload in a
+// publish burst" evasion (jscrambler@8.14.0 added a preinstall absent from 8.13.0). We keep
+// such signal-bearing versions for scanning instead of dropping them — bounded by
+// BURST_SIGNAL_KEEP_MAX so an adversarial 1000-version burst can't blow the enqueue list.
+const INSTALL_HOOK_KEYS = ['preinstall', 'install', 'postinstall'];
+const BURST_SIGNAL_KEEP_MAX = 10;
+
+/**
+ * True when `scripts` carries an install hook (preinstall/install/postinstall) that the
+ * baseline (latest) manifest lacks or defines differently — a cheap manifest-level delta
+ * that flags a burst version worth scanning even past the recency cap.
+ * @param {Object} scripts - candidate version's package.json scripts
+ * @param {Object} baseScripts - the latest (baseline) version's scripts
+ * @returns {boolean}
+ */
+function _hasInstallHookDelta(scripts, baseScripts) {
+  const s = scripts || {};
+  const b = baseScripts || {};
+  for (const h of INSTALL_HOOK_KEYS) {
+    if (s[h] && s[h] !== b[h]) return true;
+  }
+  return false;
+}
+
 /**
  * Pure function: pick the most-recently-published version from a packument and
  * return its metadata, plus context useful for ATO detection.
@@ -460,20 +485,35 @@ function selectMostRecentVersion(packument, options = {}) {
   // so a 96-version Miasma burst is distinguishable from a legit 3-5 patch-release day (the
   // capped list alone tops out at maxRecent+1 and can't tell them apart).
   result.recentWindowCount = 1; // includes the most-recent version itself
+  let signalKeeps = 0; // burst versions kept past the recency cap for an install-hook delta
   if (versionTimes.length > 1) {
     const cutoff = versionTimes[0][1] - recentWindowMs;
     for (let i = 1; i < versionTimes.length; i++) {
       const [v, ts] = versionTimes[i];
       if (ts < cutoff) break; // sorted desc, so once we cross the cutoff we're done
       result.recentWindowCount++;
+      const vData = versions[v];
       if (result.recentVersions.length >= maxRecent) {
+        // Past the recency cap → normally a coverage loss. But KEEP a version that adds an
+        // install hook the latest lacks (the "bury the payload in a publish burst" evasion,
+        // jscrambler shape), bounded by BURST_SIGNAL_KEEP_MAX so a burst can't blow the list.
+        if (vData && signalKeeps < BURST_SIGNAL_KEEP_MAX && _hasInstallHookDelta(vData.scripts, result.scripts)) {
+          signalKeeps++;
+          result.recentVersions.push({
+            version: vData.version || v,
+            tarball: (vData.dist && vData.dist.tarball) || null,
+            unpackedSize: (vData.dist && vData.dist.unpackedSize) || 0,
+            scripts: vData.scripts || {},
+            keptForSignal: true,
+          });
+          continue;
+        }
         // Burst beyond the enqueue cap: collect the version so the caller ledgers it as a
         // coverage loss (it is never enqueued/scanned). Keeps a Miasma-style burst that
         // outruns maxRecent visible instead of vanishing silently (CLAUDE.md "no silent caps").
         result.droppedBurstVersions.push(v);
         continue; // enqueue list capped; count continues
       }
-      const vData = versions[v];
       if (!vData) continue;
       result.recentVersions.push({
         version: vData.version || v,

package/src/pipeline/executor.js

@@ -42,6 +42,7 @@ const { normalizePythonName } = require('../scanner/python.js');
 const { scanPythonSource } = require('../scanner/python-source.js');
 const { initPythonParser, scanPythonAST } = require('../scanner/python-ast.js');
 const { scanAntiScannerInjection } = require('../scanner/anti-scanner-injection.js');
+const { scanBinarySource } = require('../scanner/binary-source.js');
 const { Spinner, listInstalledPackages, wasFilesCapped, getOverflowFiles, debugLog } = require('../utils.js');
 const { getMaxFileSize } = require('../shared/constants.js');
 const { scanParanoid } = require('../scanner/paranoid.js');
@@ -253,7 +254,7 @@ async function execute(targetPath, options, pythonDeps, warnings) {
     'scanGitHubActions', 'matchPythonIOCs', 'checkPyPITyposquatting',
     'scanEntropy', 'scanAIConfig', 'scanIocStrings', 'scanAntiForensic',
     'scanStubPackage', 'scanMonorepo', 'scanTrustedDepDiff', 'scanPythonSource',
-    'scanPythonAST', 'scanAntiScannerInjection'
+    'scanPythonAST', 'scanAntiScannerInjection', 'scanBinarySource'
   ];
 
   // Stage 2 quick_scan subset (monitor-only, set via options.scanMode='quick'
@@ -284,7 +285,8 @@ async function execute(targetPath, options, pythonDeps, warnings) {
     'scanPythonSource',
     'scanPythonAST',
     'scanAIConfig',
-    'scanAntiScannerInjection'
+    'scanAntiScannerInjection',
+    'scanBinarySource'
   ]);
   const isQuick = options.scanMode === 'quick';
   function ifEnabled(name, fn) {
@@ -333,7 +335,10 @@ async function execute(targetPath, options, pythonDeps, warnings) {
     ifEnabled('scanPythonAST', () => yieldThen(() => scanPythonAST(targetPath))),
     // ASI-001..004 (chantier 2026-06-20). Anti-scanner prompt injection in source text
     // (comments/strings). Regex-only, cheap; the attack lives in root entry files.
-    ifEnabled('scanAntiScannerInjection', () => yieldThen(() => scanAntiScannerInjection(targetPath)))
+    ifEnabled('scanAntiScannerInjection', () => yieldThen(() => scanAntiScannerInjection(targetPath))),
+    // BINSRC-001 (Layer 2): binary masquerading as a .js/.ts source file. Scans dist/build/out
+    // (which the other text scanners exclude) reading an 8 KB prefix — catches multi-MB carriers.
+    ifEnabled('scanBinarySource', () => yieldThen(() => scanBinarySource(targetPath)))
   ]);
 
   // Extract results: use empty array for rejected scanners, log errors
@@ -366,7 +371,8 @@ async function execute(targetPath, options, pythonDeps, warnings) {
     trustedDepDiffThreats,
     pythonSourceThreats,
     pythonAstThreats,
-    antiScannerThreats
+    antiScannerThreats,
+    binarySourceThreats
   ] = scanResult;
 
   // Emit warning if file count cap was hit + quick-scan overflow files
@@ -450,6 +456,7 @@ async function execute(targetPath, options, pythonDeps, warnings) {
     ...pythonSourceThreats,
     ...pythonAstThreats,
     ...antiScannerThreats,
+    ...binarySourceThreats,
     ...crossFileFlows.filter(f => f && f.sourceFile && f.sinkFile).map(f => ({
       type: f.type,
       severity: f.severity,

package/src/response/playbooks.js

@@ -1082,6 +1082,10 @@ const PLAYBOOKS = {
     'CRITIQUE (compound COMPOUND-020): un hook preinstall/install/postinstall lance `node x.js` qui depaquette un binaire natif EMBARQUE dans le package (lecture locale / gunzip / base64), l\'ecrit executable et le spawn — au moment de npm install, sans reseau, sans import (pattern jscrambler@8.14.0, infostealer natif). ' +
     'NE PAS installer : --ignore-scripts ne protege pas si deja installe. Le fichier nomme dans le message porte la charge. Roter les credentials accessibles aux environnements dev/CI ayant installe la version, verifier les logs d\'install pour l\'execution du loader, revenir a une version verifiee saine.',
 
+  binary_masquerading_as_source:
+    'HAUTE: un fichier a extension source (.js/.ts/.cjs/.mjs) a un contenu BINAIRE (executable / archive / conteneur custom), souvent cache dans dist/ ou l\'analyse texte ne regarde pas — porteur de charge utile deguise en source (pattern jscrambler@8.14.0 dist/intro.js, 7.8 Mo). ' +
+    'Ouvrir le fichier en hexdump, identifier le format (ELF/PE/Mach-O/gzip/CSI). Verifier quel script d\'install ou loader le lit+execute (cf. install_native_drop_exec). NE PAS installer si couple a un hook d\'install.',
+
   string_mutation_obfuscation:
     'HAUTE: Chaine de .replace() reconstruisant des noms d\'API dangereuses (leet-speak). ' +
     'Technique d\'evasion par substitution de caracteres. Decoder la chaine finale. Supprimer si malveillant.',

package/src/rules/index.js

@@ -842,6 +842,19 @@ const RULES = {
     ],
     mitre: 'T1195.002'
   },
+  binary_masquerading_as_source: {
+    id: 'MUADDIB-BINSRC-001',
+    name: 'Binary Masquerading as Source',
+    severity: 'HIGH',
+    confidence: 'high',
+    domain: 'malware',
+    description: 'Un fichier avec une extension source (.js/.mjs/.cjs/.jsx/.ts/.tsx) dont le CONTENU est binaire — executable (ELF/PE/Mach-O), archive (zip/gzip/xz/7z/rar), module WebAssembly, ou conteneur custom (octet de controle en tete, ex. le header \\x1bCSI de jscrambler@8.14.0). Un fichier source est du texte par definition ; un contenu binaire = charge utile deguisee en source. Le scanner descend VOLONTAIREMENT dans dist/build/out/output (que les scanners texte AST/dataflow/entropie excluent via EXCLUDED_DIRS) et ne lit qu\'un prefixe de 8 Ko, donc il attrape un porteur de plusieurs Mo (jscrambler dist/intro.js = 7.8 Mo) que tout le reste ignore. Magic-agnostique : renommer le fichier ou changer le magic ne contourne pas (regles octet-NUL + octet de controle en tete). FP≈0 : un bundle minifie dist/*.js reste du texte imprimable. Severite HIGH (ne franchit pas seul le seuil d\'alerte) : se cumule avec le hook d\'install que COMPOUND-020 install_native_drop_exec eleve en CRITICAL.',
+    references: [
+      'https://github.com/jscrambler/jscrambler/issues/322',
+      'https://attack.mitre.org/techniques/T1027/002/'
+    ],
+    mitre: 'T1027.002'
+  },
   crypto_exfil: {
     id: 'MUADDIB-COMPOUND-019',
     name: 'Hybrid-Crypto Credential Exfiltration',

package/src/scanner/binary-source.js

@@ -0,0 +1,95 @@
+/*
+ * MUAD'DIB — Supply-chain threat detection for npm & PyPI
+ * Copyright (C) 2026 DNSZLSK
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+/**
+ * binary_masquerading_as_source scanner (MUADDIB-BINSRC-001).
+ *
+ * Flags a file with a SOURCE extension whose bytes are actually binary — an executable,
+ * archive, compressed blob, or custom container. This closes a real blind spot: the shared
+ * `findFiles` excludes `dist/`, `build/`, `out/`, `output/` (bundler output), so the AST /
+ * dataflow / entropy scanners never look there — yet that is exactly where a disguised
+ * native payload hides (jscrambler@8.14.0 shipped its 7.8 MB native-binary container as
+ * `dist/intro.js`, which every text scanner skipped). This scanner DELIBERATELY descends
+ * into those dirs and reads only an 8 KB prefix per file, so it catches a multi-MB carrier
+ * regardless of the 10 MB parse cap.
+ *
+ * FP≈0: minified/bundled `dist/*.js` is still printable text (no NUL, no leading control
+ * byte) — only genuinely binary content trips it. Severity HIGH (not single-fire): on its
+ * own it does not cross the alert threshold; it stacks with the install-hook signal, which
+ * the COMPOUND-020 `install_native_drop_exec` correlator escalates to CRITICAL.
+ */
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { findFiles } = require('../utils.js');
+const { sniffBinaryBuffer } = require('../shared/binary-sniff.js');
+
+const SOURCE_EXTS = ['.js', '.mjs', '.cjs', '.jsx', '.ts', '.tsx', '.mts', '.cts'];
+// Keep node_modules/.git out, but INCLUDE dist/build/out/output — payloads hide there and
+// the default EXCLUDED_DIRS skips them.
+const SCAN_EXCLUDED_DIRS = ['node_modules', '.git', '.muaddib-cache'];
+const SNIFF_BYTES = 8192;
+
+function scanBinarySource(targetPath) {
+  const threats = [];
+  if (!targetPath) return threats;
+
+  let files;
+  try {
+    files = findFiles(targetPath, { extensions: SOURCE_EXTS, excludedDirs: SCAN_EXCLUDED_DIRS });
+  } catch { return threats; }
+
+  for (const file of files) {
+    let buf;
+    try {
+      const fd = fs.openSync(file, 'r');
+      try {
+        const b = Buffer.alloc(SNIFF_BYTES);
+        const n = fs.readSync(fd, b, 0, SNIFF_BYTES, 0);
+        buf = b.subarray(0, n);
+      } finally {
+        fs.closeSync(fd);
+      }
+    } catch { continue; }
+
+    const verdict = sniffBinaryBuffer(buf);
+    if (!verdict.binary) continue;
+
+    const rel = path.relative(targetPath, file).replace(/\\/g, '/');
+    let sizeStr = '';
+    try {
+      const mb = fs.statSync(file).size / (1024 * 1024);
+      if (mb >= 0.1) sizeStr = ` (${mb.toFixed(1)} MB)`;
+    } catch { /* size best-effort */ }
+
+    threats.push({
+      type: 'binary_masquerading_as_source',
+      severity: 'HIGH',
+      confidence: 'high',
+      file: rel,
+      message: `File "${rel}" has a source extension but its content is ${verdict.format} — ${verdict.reason}${sizeStr}. A .js/.ts file that is actually binary is a payload carrier disguised as source (e.g. jscrambler@8.14.0 dist/intro.js) and evades text-based static analysis.`,
+      mitre: 'T1027.002'
+    });
+  }
+
+  return threats;
+}
+
+module.exports = { scanBinarySource, SOURCE_EXTS };

package/src/scoring.js

@@ -458,7 +458,11 @@ const DIST_EXEMPT_TYPES = new Set([
   'lifecycle_file_exec',  // B6: lifecycle → malicious file compound
   'lifecycle_dataflow', 'lifecycle_dangerous_exec', 'obfuscated_lifecycle_env',
   // RT-C1: Boundary-squat compound is never coincidental (dep declared AND require()d)
-  'dependency_typosquat_require'
+  'dependency_typosquat_require',
+  // BINSRC-001: a binary file disguised as .js SPECIFICALLY hides in dist/ (that is why the
+  // scanner descends there). The dist/ downgrade assumes benign bundler output — a genuinely
+  // binary file never is, so it must never be reduced.
+  'binary_masquerading_as_source'
   // P6: remote_code_load and proxy_data_intercept removed — in bundled dist/ files,
   // fetch + eval co-occurrence is coincidental (bundler combines HTTP client + template compilation).
   // fetch_decrypt_exec (fetch+decrypt+eval triple) remains exempt — never coincidental.
@@ -541,7 +545,10 @@ const REACHABILITY_EXEMPT_TYPES = new Set([
   // no legitimate code reconstructs env var names from character codes. Injected files
   // (router_init.js) are unreachable via require/import but execute via lifecycle hooks
   // or optionalDependencies with prepare scripts.
-  'env_charcode_reconstruction'    // AST-018 — fromCharCode + process.env[computed]
+  'env_charcode_reconstruction',   // AST-018 — fromCharCode + process.env[computed]
+  // BINSRC-001: a binary blob disguised as .js is read as bytes, never require()d, so it is
+  // always "unreachable" via the import graph — the wrong lens for a non-JS carrier.
+  'binary_masquerading_as_source'
 ]);
 
 // ============================================

package/src/shared/analyze-helper.js

@@ -19,6 +19,7 @@
 
 const path = require('path');
 const { isDevFile, findJsFiles, forEachSafeFile } = require('../utils.js');
+const { looksBinaryString } = require('./binary-sniff.js');
 
 /**
  * Shared scanner wrapper: iterates JS files, runs analyzeFileFn on original + deobfuscated code,
@@ -56,6 +57,12 @@ function analyzeWithDeobfuscation(targetPath, analyzeFileFn, options = {}) {
       }).join('\n');
     }
 
+    // Ingestion guard: a source-extension file whose bytes are actually binary (a payload
+    // carrier disguised as source) is not JS — skip the parse instead of handing acorn
+    // megabytes of binary that yield no AST and burn the parse budget. binary-source.js
+    // reports the finding (it also reaches dist/ where this shared path does not).
+    if (looksBinaryString(effectiveContent)) return;
+
     // Analyze original code first (preserves obfuscation-detection rules)
     const fileThreats = analyzeFileFn(effectiveContent, file, targetPath);
     threats.push(...fileThreats);

package/stats.json

@@ -1,16 +1,16 @@
 {
   "_comment": "GENERATED by scripts/collect-stats.js — do not edit by hand. Run `npm run docs:stats`.",
-  "version": "2.11.166",
-  "scanners": 21,
-  "rulesTotal": 276,
-  "rulesCore": 271,
+  "version": "2.11.168",
+  "scanners": 22,
+  "rulesTotal": 277,
+  "rulesCore": 272,
   "rulesParanoid": 5,
   "compound": 21,
   "astRules": 97,
-  "scannerFiles": 35,
+  "scannerFiles": 36,
   "astDetectors": 15,
   "moduleGraph": 9,
   "pythonAstDetectors": 6,
-  "testFiles": 151,
-  "tests": 4550
+  "testFiles": 152,
+  "tests": 4561
 }