muaddib-scanner 2.11.169 → 2.11.170

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.169",
+  "version": "2.11.170",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.169.json → self-scan-v2.11.170.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-13T15:38:17.450Z",
+  "timestamp": "2026-07-15T11:41:29.684Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/monitor/classify.js

@@ -164,6 +164,24 @@ function hasIOCMatch(result) {
   return result.threats.some(t => IOC_MATCH_TYPES.has(t.type));
 }
 
+// Stealth-exec + obfuscation compound: a detached/silent background process
+// (silent_stealth_process AST-092 / detached_process AST-012) shipped ALONGSIDE
+// obfuscator.io-mangled code (js_obfuscation_pattern ENTROPY-003, the `_0x*` hex
+// signature). The AND is quasi-never legitimate: legit process managers (pm2,
+// Platformatic Watt, the mongodb driver) detach but do NOT obfuscate, and legit
+// obfuscated bundles do NOT silently detach a process. It is the ATO / CI-supply-
+// chain fingerprint (@asyncapi/specs Miasma 2026-07-14; @umudik/lotaru) whose raw
+// score reputation attenuation crushes to LOW on an established package.
+// Measured on the 128,429-scan production ledger (scripts/mine-fpr): exactly two
+// packages match — BOTH confirmed malicious — so wiring this as a reputation-
+// independent webhook bypass adds ZERO benign false positives (ΔFPR = 0).
+function hasStealthObfuscationCompound(result) {
+  if (!result || !result.threats) return false;
+  const types = new Set(result.threats.map(t => t.type));
+  const stealthExec = types.has('silent_stealth_process') || types.has('detached_process');
+  return stealthExec && types.has('js_obfuscation_pattern');
+}
+
 function hasTyposquat(result) {
   if (!result || !result.threats) return false;
   return result.threats.some(t => t.type === 'typosquat_detected' || t.type === 'pypi_typosquat_detected');
@@ -496,6 +514,7 @@ module.exports = {
   hasHighOrCritical,
   hasHighConfidenceThreat,
   hasIOCMatch,
+  hasStealthObfuscationCompound,
   hasTyposquat,
   hasLifecycleWithIntent,
   isSuspectClassification,

package/src/monitor/queue.js

@@ -67,6 +67,7 @@ const {
 const {
   isSuspectClassification,
   hasHighConfidenceThreat,
+  hasStealthObfuscationCompound,
   isSandboxEnabled,
   isCanaryEnabled,
   recordError,
@@ -1491,8 +1492,15 @@ async function scanPackage(name, version, ecosystem, tarballUrl, registryMeta, s
         // Adjusts score for webhook decision without mutating persisted alert data.
         // High-confidence malice types BYPASS reputation — supply-chain compromise protection.
         // Reuses npmRegistryMeta fetched earlier (ML Phase 2a) — no duplicate HTTP call.
+        // Malice bypass: don't let reputation attenuation re-crush a confirmed-malice
+        // detection (the scoring.js Track R floor already lifted it). The stealth+obf
+        // compound is included here for the SAME reason as _hasConfirmedMalice — its
+        // component types aren't individually high-confidence, so hasHighConfidenceThreat
+        // alone misses the asyncapi/specs Miasma ATO and would re-attenuate 20 → 2 for the
+        // webhook/ranking decision.
+        const _maliceBypass = hasHighConfidenceThreat(result) || hasStealthObfuscationCompound(result);
         let adjustedResult = result;
-        if (ecosystem === 'npm' && !hasHighConfidenceThreat(result)) {
+        if (ecosystem === 'npm' && !_maliceBypass) {
           try {
             const reputationFactor = computeReputationFactor(npmRegistryMeta);
             if (reputationFactor !== 1.0) {
@@ -1507,8 +1515,8 @@ async function scanPackage(name, version, ecosystem, tarballUrl, registryMeta, s
           } catch (err) {
             console.error(`[MONITOR] Reputation error for ${name}: ${err.message}`);
           }
-        } else if (ecosystem === 'npm' && hasHighConfidenceThreat(result)) {
-          console.log(`[MONITOR] REPUTATION BYPASS: ${name} has high-confidence threat — using raw score`);
+        } else if (ecosystem === 'npm' && _maliceBypass) {
+          console.log(`[MONITOR] REPUTATION BYPASS: ${name} has confirmed-malice signal — using raw score`);
         }
 
         // Record daily alert with post-reputation score for top suspects ranking.

package/src/monitor/webhook.js

@@ -55,6 +55,7 @@ const {
 const {
   HIGH_CONFIDENCE_MALICE_TYPES,
   hasIOCMatch,
+  hasStealthObfuscationCompound,
   hasHighOrCritical,
   formatErrorBreakdown
 } = require('./classify.js');
@@ -128,6 +129,17 @@ function shouldSendWebhook(result, sandboxResult, mlResult) {
   if (mlResult && mlResult.prediction !== 'clean' && mlResult.probability >= 0.90
       && hasHighOrCritical(result)) return true;
 
+  // 1c. Stealth-exec + obfuscation compound — reputation-independent bypass.
+  // A detached/silent background process shipped with obfuscator.io-mangled code
+  // is the account-takeover / CI-supply-chain fingerprint. On an established
+  // package the reputationFactor (0.1x) crushes the raw score below `threshold`
+  // and silences the webhook: @asyncapi/specs@6.11.2 (Miasma, 2026-07-14) scored
+  // globalRiskScore 49 → riskScore 4/LOW → suppressed, despite a CRITICAL
+  // silent_stealth_process finding. This compound is quasi-never benign (measured
+  // ΔFPR=0 on the 128K-scan production ledger), so it fires regardless of
+  // reputation attenuation — same rationale as the IOC bypass above.
+  if (hasStealthObfuscationCompound(result)) return true;
+
   // 2. Real sandbox detection (> 30) — always send
   if (sandboxScore > 30) return true;
 

package/src/scoring.js

@@ -18,7 +18,7 @@
  */
 
 const { getRule } = require('./rules/index.js');
-const { HIGH_CONFIDENCE_MALICE_TYPES } = require('./monitor/classify.js');
+const { HIGH_CONFIDENCE_MALICE_TYPES, hasStealthObfuscationCompound } = require('./monitor/classify.js');
 // v2.10.73 P1: bundle detection helpers — extended bundle path regex + veto check
 const { BUNDLE_PATH_RE, hasBundleVetoSignal } = require('./shared/bundle-detect.js');
 
@@ -1982,7 +1982,15 @@ function _hasConfirmedMalice(threats) {
   const hasCompound = threats.some(t => t.compound === true);
   const hasStagedC2 = threats.some(t => t.type === 'staged_payload') &&
     threats.some(t => t.type === 'suspicious_domain' && t.severity === 'HIGH');
-  return hasHC || hasCompound || hasStagedC2;
+  // Stealth-exec + obfuscation compound (asyncapi/specs Miasma ATO 2026-07-14): a
+  // detached/silent background process (silent_stealth_process / detached_process) shipped
+  // with obfuscator.io-mangled code (js_obfuscation_pattern). Quasi-never benign, BUT the
+  // component types are individually NOT in HIGH_CONFIDENCE_MALICE_TYPES (they fire on
+  // pm2 / mongodb / anti-piracy bundles) so only the COMBINATION is confirmed-malice.
+  // Measured ΔFPR=0 on the 130K-scan production ledger (2 matches, both malicious). Shared
+  // predicate with the monitor webhook + reputation bypass (classify.hasStealthObfuscationCompound).
+  const hasStealthObf = hasStealthObfuscationCompound({ threats });
+  return hasHC || hasCompound || hasStagedC2 || hasStealthObf;
 }
 
 // P3 (TeamPCP / Mini Shai-Hulud hardening): broader malice predicate used to

package/stats.json

@@ -1,6 +1,6 @@
 {
   "_comment": "GENERATED by scripts/collect-stats.js — do not edit by hand. Run `npm run docs:stats`.",
-  "version": "2.11.169",
+  "version": "2.11.170",
   "scanners": 22,
   "rulesTotal": 277,
   "rulesCore": 272,