muaddib-scanner 2.11.167 → 2.11.169

package/README.md

@@ -345,7 +345,7 @@ npm test
 
 ### Testing
 
-- **<!--stat:tests-->4559<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
+- **<!--stat:tests-->4561<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
 - **56 fuzz tests** - Malformed inputs, ReDoS, unicode, binary
 - **Datadog 17K benchmark** - 14,587 confirmed malware samples (in-scope)
 - **Ground truth validation** - 96 real-world attacks (95.74% TPR@3, 88.30% TPR@20 — v2.11.48 full measure on 94 in-scope)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.167",
+  "version": "2.11.169",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.167.json → self-scan-v2.11.169.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-11T20:50:59.135Z",
+  "timestamp": "2026-07-13T15:38:17.450Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/monitor/ingestion.js

@@ -383,6 +383,31 @@ function parsePyPIRss(xml) {
 const RECENT_PUBLISH_WINDOW_MS = 24 * 60 * 60 * 1000;
 const RECENT_PUBLISH_MAX = 5;
 
+// Burst versions beyond RECENT_PUBLISH_MAX are dropped by recency. But a buried burst
+// version that ADDS an install hook the latest lacks is exactly the "bury the payload in a
+// publish burst" evasion (jscrambler@8.14.0 added a preinstall absent from 8.13.0). We keep
+// such signal-bearing versions for scanning instead of dropping them — bounded by
+// BURST_SIGNAL_KEEP_MAX so an adversarial 1000-version burst can't blow the enqueue list.
+const INSTALL_HOOK_KEYS = ['preinstall', 'install', 'postinstall'];
+const BURST_SIGNAL_KEEP_MAX = 10;
+
+/**
+ * True when `scripts` carries an install hook (preinstall/install/postinstall) that the
+ * baseline (latest) manifest lacks or defines differently — a cheap manifest-level delta
+ * that flags a burst version worth scanning even past the recency cap.
+ * @param {Object} scripts - candidate version's package.json scripts
+ * @param {Object} baseScripts - the latest (baseline) version's scripts
+ * @returns {boolean}
+ */
+function _hasInstallHookDelta(scripts, baseScripts) {
+  const s = scripts || {};
+  const b = baseScripts || {};
+  for (const h of INSTALL_HOOK_KEYS) {
+    if (s[h] && s[h] !== b[h]) return true;
+  }
+  return false;
+}
+
 /**
  * Pure function: pick the most-recently-published version from a packument and
  * return its metadata, plus context useful for ATO detection.
@@ -460,20 +485,35 @@ function selectMostRecentVersion(packument, options = {}) {
   // so a 96-version Miasma burst is distinguishable from a legit 3-5 patch-release day (the
   // capped list alone tops out at maxRecent+1 and can't tell them apart).
   result.recentWindowCount = 1; // includes the most-recent version itself
+  let signalKeeps = 0; // burst versions kept past the recency cap for an install-hook delta
   if (versionTimes.length > 1) {
     const cutoff = versionTimes[0][1] - recentWindowMs;
     for (let i = 1; i < versionTimes.length; i++) {
       const [v, ts] = versionTimes[i];
       if (ts < cutoff) break; // sorted desc, so once we cross the cutoff we're done
       result.recentWindowCount++;
+      const vData = versions[v];
       if (result.recentVersions.length >= maxRecent) {
+        // Past the recency cap → normally a coverage loss. But KEEP a version that adds an
+        // install hook the latest lacks (the "bury the payload in a publish burst" evasion,
+        // jscrambler shape), bounded by BURST_SIGNAL_KEEP_MAX so a burst can't blow the list.
+        if (vData && signalKeeps < BURST_SIGNAL_KEEP_MAX && _hasInstallHookDelta(vData.scripts, result.scripts)) {
+          signalKeeps++;
+          result.recentVersions.push({
+            version: vData.version || v,
+            tarball: (vData.dist && vData.dist.tarball) || null,
+            unpackedSize: (vData.dist && vData.dist.unpackedSize) || 0,
+            scripts: vData.scripts || {},
+            keptForSignal: true,
+          });
+          continue;
+        }
         // Burst beyond the enqueue cap: collect the version so the caller ledgers it as a
         // coverage loss (it is never enqueued/scanned). Keeps a Miasma-style burst that
         // outruns maxRecent visible instead of vanishing silently (CLAUDE.md "no silent caps").
         result.droppedBurstVersions.push(v);
         continue; // enqueue list capped; count continues
       }
-      const vData = versions[v];
       if (!vData) continue;
       result.recentVersions.push({
         version: vData.version || v,

package/src/scanner/binary-source.js

@@ -29,8 +29,9 @@
  * into those dirs and reads only an 8 KB prefix per file, so it catches a multi-MB carrier
  * regardless of the 10 MB parse cap.
  *
- * FP≈0: minified/bundled `dist/*.js` is still printable text (no NUL, no leading control
- * byte) — only genuinely binary content trips it. Severity HIGH (not single-fire): on its
+ * FP≈0: minified/bundled `dist/*.js` is still printable text (low control-byte ratio, no leading
+ * control byte); a lone NUL delimiter is tolerated — only dense binary content trips it. Severity
+ * HIGH (not single-fire): on its
  * own it does not cross the alert threshold; it stacks with the install-hook signal, which
  * the COMPOUND-020 `install_native_drop_exec` correlator escalates to CRITICAL.
  */

package/stats.json

@@ -1,6 +1,6 @@
 {
   "_comment": "GENERATED by scripts/collect-stats.js — do not edit by hand. Run `npm run docs:stats`.",
-  "version": "2.11.167",
+  "version": "2.11.169",
   "scanners": 22,
   "rulesTotal": 277,
   "rulesCore": 272,
@@ -12,5 +12,5 @@
   "moduleGraph": 9,
   "pythonAstDetectors": 6,
   "testFiles": 152,
-  "tests": 4559
+  "tests": 4561
 }