muaddib-scanner 2.11.168 → 2.11.169

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.168",
+  "version": "2.11.169",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.168.json → self-scan-v2.11.169.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-11T21:48:05.101Z",
+  "timestamp": "2026-07-13T15:38:17.450Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/scanner/binary-source.js

@@ -29,8 +29,9 @@
  * into those dirs and reads only an 8 KB prefix per file, so it catches a multi-MB carrier
  * regardless of the 10 MB parse cap.
  *
- * FP≈0: minified/bundled `dist/*.js` is still printable text (no NUL, no leading control
- * byte) — only genuinely binary content trips it. Severity HIGH (not single-fire): on its
+ * FP≈0: minified/bundled `dist/*.js` is still printable text (low control-byte ratio, no leading
+ * control byte); a lone NUL delimiter is tolerated — only dense binary content trips it. Severity
+ * HIGH (not single-fire): on its
  * own it does not cross the alert threshold; it stacks with the install-hook signal, which
  * the COMPOUND-020 `install_native_drop_exec` correlator escalates to CRITICAL.
  */

package/stats.json

@@ -1,6 +1,6 @@
 {
   "_comment": "GENERATED by scripts/collect-stats.js — do not edit by hand. Run `npm run docs:stats`.",
-  "version": "2.11.168",
+  "version": "2.11.169",
   "scanners": 22,
   "rulesTotal": 277,
   "rulesCore": 272,