muaddib-scanner 2.11.174 → 2.11.176

package/README.md

@@ -214,7 +214,7 @@ muaddib replay                     # Ground truth validation (90/94 TPR@3, v2.11
 
 ### <!--stat:rulesTotal-->277<!--/stat:rulesTotal--> detection rules
 
-All rules (<!--stat:rulesCore-->272<!--/stat:rulesCore--> RULES + <!--stat:rulesParanoid-->5<!--/stat:rulesParanoid--> PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v211139) for the complete rules reference.
+All rules (<!--stat:rulesCore-->272<!--/stat:rulesCore--> RULES + <!--stat:rulesParanoid-->5<!--/stat:rulesParanoid--> PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules) for the complete rules reference.
 
 ### Detected campaigns
 
@@ -345,7 +345,7 @@ npm test
 
 ### Testing
 
-- **<!--stat:tests-->4561<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
+- **<!--stat:tests-->4534<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
 - **56 fuzz tests** - Malformed inputs, ReDoS, unicode, binary
 - **Datadog 17K benchmark** - 14,587 confirmed malware samples (in-scope)
 - **Ground truth validation** - 96 real-world attacks (95.74% TPR@3, 88.30% TPR@20 — v2.11.48 full measure on 94 in-scope)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.174",
+  "version": "2.11.176",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {
@@ -14,6 +14,7 @@
     "scan": "node bin/muaddib.js scan .",
     "update": "node bin/muaddib.js update",
     "lint": "eslint src bin --ext .js",
+    "ci:local": "node scripts/check-deps-typosquats.js && node scripts/check-no-tracked-node-modules.js && npm audit --audit-level=high && npm run docs:stats:check && npm test",
     "docs:stats": "node scripts/collect-stats.js && node scripts/sync-stats.js",
     "docs:stats:tests": "node scripts/collect-stats.js --with-tests && node scripts/sync-stats.js",
     "docs:stats:check": "node scripts/collect-stats.js --check && node scripts/sync-stats.js --check",
@@ -54,8 +55,8 @@
     "@inquirer/prompts": "8.5.2",
     "acorn": "8.17.0",
     "acorn-walk": "8.3.5",
-    "adm-zip": "0.5.18",
-    "js-yaml": "5.1.0",
+    "adm-zip": "0.6.0",
+    "js-yaml": "5.2.1",
     "web-tree-sitter": "^0.26.9"
   },
   "devDependencies": {

package/{self-scan-v2.11.174.json → self-scan-v2.11.176.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-17T09:25:49.894Z",
+  "timestamp": "2026-07-22T15:08:41.143Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/commands/hooks-init.js

@@ -54,6 +54,32 @@ const HOOK_COMMANDS = {
   diff: 'npx muaddib diff HEAD --fail-on high'
 };
 
+/**
+ * Back up an existing pre-commit hook before overwriting it, keeping the 3 most recent
+ * timestamped backups. Shared by the husky and native-git hook writers so neither silently
+ * destroys a user's existing hook (lint-staged, tests, etc.).
+ * @param {string} hookPath - Absolute path to the pre-commit hook to be written
+ */
+function backupExistingHook(hookPath) {
+  if (!fs.existsSync(hookPath)) return;
+  const backup = `${hookPath}.backup.${Date.now()}`;
+  fs.copyFileSync(hookPath, backup);
+  console.log(`[INFO] Backed up existing hook to ${backup}`);
+
+  // Cleanup old backups, keep only 3 most recent
+  try {
+    const hooksDir = path.dirname(hookPath);
+    const base = path.basename(hookPath);
+    const backups = fs.readdirSync(hooksDir)
+      .filter(f => f.startsWith(base + '.backup.'))
+      .sort()
+      .reverse();
+    for (const old of backups.slice(3)) {
+      fs.unlinkSync(path.join(hooksDir, old));
+    }
+  } catch { /* ignore cleanup errors */ }
+}
+
 async function initHooks(targetPath, options = {}) {
   const resolvedPath = path.resolve(targetPath);
   const hookType = options.type || 'auto';
@@ -138,6 +164,9 @@ echo "[MUADDIB] Running security check..."
 ${command}
 `;
 
+  // Back up any existing hook before overwriting (same policy as initGitHook): a project may
+  // already have a husky pre-commit (lint-staged, tests…) — clobbering it silently loses config.
+  backupExistingHook(preCommitPath);
   fs.writeFileSync(preCommitPath, hookContent, { mode: 0o755 });
   if (process.platform !== 'win32') {
     fs.chmodSync(preCommitPath, 0o755);
@@ -219,23 +248,7 @@ exit 0
 `;
 
   // Backup existing hook (limit to 3 backups)
-  if (fs.existsSync(preCommitPath)) {
-    const backup = `${preCommitPath}.backup.${Date.now()}`;
-    fs.copyFileSync(preCommitPath, backup);
-    console.log(`[INFO] Backed up existing hook to ${backup}`);
-
-    // Cleanup old backups, keep only 3 most recent
-    try {
-      const hooksDir = path.dirname(preCommitPath);
-      const backups = fs.readdirSync(hooksDir)
-        .filter(f => f.startsWith('pre-commit.backup.'))
-        .sort()
-        .reverse();
-      for (const old of backups.slice(3)) {
-        fs.unlinkSync(path.join(hooksDir, old));
-      }
-    } catch { /* ignore cleanup errors */ }
-  }
+  backupExistingHook(preCommitPath);
 
   fs.writeFileSync(preCommitPath, hookContent, { mode: 0o755 });
   if (process.platform !== 'win32') {

package/src/commands/safe-install.js

@@ -133,31 +133,42 @@ function checkIOCs(pkg, pkgName, pkgVersion) {
   return malicious || null;
 }
 
-// Scan a package and its dependencies recursively
-async function scanPackageRecursive(pkg, depth = 0, maxDepth = 3) {
-  const indent = '  '.repeat(depth);
-
-  // Extract name and version of the package
+// Split a package spec into { pkgName, pkgVersion }.
+// Handles scoped packages (@scope/name) and version specs (@scope/name@spec or name@spec).
+// Transitive deps arrive as `name@^1.2.3` (range specs from dependency maps): the spec must
+// be split off the name even when it is not an exact version, otherwise pkgName keeps the
+// full spec and the IOC map lookup (keyed on bare names) never matches — wildcard IOCs
+// included. Range/tag specs leave pkgVersion null so only wildcard IOCs match (SFI-003).
+function parsePackageSpec(pkg) {
   let pkgName = pkg;
   let pkgVersion = null;
-
-  // Handle scoped packages (@scope/name) and versions (@scope/name@version or name@version)
   if (pkg.startsWith('@')) {
     // Scoped package
     const parts = pkg.slice(1).split('@');
-    if (parts.length >= 2 && parts[parts.length - 1].match(/^\d/)) {
-      pkgVersion = parts.pop();
+    if (parts.length >= 2) {
+      const spec = parts.pop();
       pkgName = '@' + parts.join('@');
+      if (spec.match(/^\d/)) pkgVersion = spec;
     }
   } else {
     const parts = pkg.split('@');
-    if (parts.length >= 2 && parts[parts.length - 1].match(/^\d/)) {
-      pkgVersion = parts.pop();
+    if (parts.length >= 2) {
+      const spec = parts.pop();
       pkgName = parts.join('@');
+      if (spec.match(/^\d/)) pkgVersion = spec;
     }
   }
-  
-  
+  return { pkgName, pkgVersion };
+}
+
+// Scan a package and its dependencies recursively
+async function scanPackageRecursive(pkg, depth = 0, maxDepth = 3) {
+  const indent = '  '.repeat(depth);
+
+  // Extract name and version of the package
+  const { pkgName, pkgVersion } = parsePackageSpec(pkg);
+
+
   // Avoid infinite loops
   if (scannedPackages.has(pkgName)) {
     return { safe: true };
@@ -309,4 +320,4 @@ async function safeInstall(packages, options = {}) {
   return { blocked: false };
 }
 
-module.exports = { safeInstall, scanPackageRecursive, REHABILITATED_PACKAGES, checkRehabilitated, isValidPackageName, checkIOCs };
+module.exports = { safeInstall, scanPackageRecursive, parsePackageSpec, REHABILITATED_PACKAGES, checkRehabilitated, isValidPackageName, checkIOCs };

package/src/ioc/bootstrap.js

@@ -51,6 +51,13 @@ const DOWNLOAD_TIMEOUT = 60_000;
 // Max redirects to follow
 const MAX_REDIRECTS = 5;
 
+// Decompression bomb guard: cap the DECOMPRESSED byte count streamed to disk. A compromised
+// release asset (exactly this project's threat model — maintainer account takeover) could
+// otherwise fill the disk: this was the only unbounded decompressor in the repo (download.js
+// has the M4 gzip hint, scraper.js has MAX_ENTRY/TOTAL_UNCOMPRESSED). Env-tunable like the
+// scraper caps; default leaves ample headroom over the ~112-223MB iocs.json.
+const MAX_DECOMPRESSED_SIZE = parseInt(process.env.MUADDIB_BOOTSTRAP_MAX_DECOMPRESSED || '', 10) || 1024 * 1024 * 1024; // 1 GB
+
 // Allowed redirect domains (SSRF protection)
 const ALLOWED_REDIRECT_DOMAINS = [
   'github.com',
@@ -115,6 +122,19 @@ function downloadAndDecompress(url, destPath) {
         const gunzip = zlib.createGunzip();
         const fileStream = fs.createWriteStream(tmpPath);
 
+        // Decompression bomb guard: count decompressed bytes, abort past the cap.
+        let decompressedBytes = 0;
+        gunzip.on('data', (chunk) => {
+          decompressedBytes += chunk.length;
+          if (decompressedBytes > MAX_DECOMPRESSED_SIZE) {
+            res.destroy();
+            gunzip.destroy();
+            fileStream.destroy();
+            try { fs.unlinkSync(tmpPath); } catch (e) { debugLog('cleanup failed:', e.message); }
+            reject(new Error('Decompressed size exceeds cap (' + MAX_DECOMPRESSED_SIZE + ' bytes) — aborting'));
+          }
+        });
+
         gunzip.on('error', (err) => {
           fileStream.destroy();
           try { fs.unlinkSync(tmpPath); } catch (e) { debugLog('cleanup failed:', e.message); }

package/src/ioc/scraper.js

@@ -733,6 +733,7 @@ async function scrapeOSSFMaliciousPackages(knownIds) {
       fetchSpinner.start('Fetching OSSF entries... 0/' + toFetch.length);
     }
 
+    let failedFetches = 0;
     for (let i = 0; i < toFetch.length; i += BATCH_SIZE) {
       const batch = toFetch.slice(i, i + BATCH_SIZE);
       const results = await Promise.all(batch.map(function(entry) {
@@ -741,7 +742,7 @@ async function scrapeOSSFMaliciousPackages(knownIds) {
       }));
 
       for (const result of results) {
-        if (!result || result.status !== 200 || !result.data) continue;
+        if (!result || result.status !== 200 || !result.data) { failedFetches++; continue; }
         const parsed = parseOSVEntry(result.data, 'ossf-malicious');
         for (const p of parsed) packages.push(p);
       }
@@ -760,8 +761,16 @@ async function scrapeOSSFMaliciousPackages(knownIds) {
       fetchSpinner.succeed('Fetched OSSF entries: ' + packages.length + ' packages');
     }
 
-    // Save tree SHA for next incremental run
-    try { fs.writeFileSync(shaFile, treeSha); } catch {}
+    // Save tree SHA for next incremental run — only if every entry was fetched.
+    // Persisting the SHA after partial fetches (e.g. GitHub rate-limiting the raw batches)
+    // marks the failed entries as "done": subsequent runs skip everything until the next
+    // OSSF commit, silently losing IOCs. On partial failure, keep the old SHA so the next
+    // run retries the delta.
+    if (failedFetches === 0) {
+      try { fs.writeFileSync(shaFile, treeSha); } catch {}
+    } else {
+      console.log('[SCRAPER]   ' + failedFetches + ' OSSF fetches failed — tree SHA not persisted, next run will retry');
+    }
   } catch (e) {
     console.log('[SCRAPER]   Error: ' + e.message);
   }
@@ -1284,11 +1293,21 @@ async function runScraper() {
     'npm-removed'
   ];
 
-  // Save enriched (full) IOCs — atomic write via .tmp + rename
+  // Save enriched (full) IOCs — atomic write via .tmp + rename.
+  // Stringify ONCE: the pretty-printed DB is a giant string (~2x the 112MB+ file); a second
+  // stringify for the home copy used to double the peak on top of the zip buffers already in
+  // flight. The HMAC is computed here from the same string, then the string is released and
+  // the home copy reuses the file on disk (copyFileSync — no second serialization).
   const saveSpinner = new Spinner();
   saveSpinner.start('Saving IOCs...');
   const tmpIOCFile = IOC_FILE + '.tmp';
-  fs.writeFileSync(tmpIOCFile, JSON.stringify(existingIOCs, null, 2));
+  let iocHmac;
+  {
+    const iocJsonData = JSON.stringify(existingIOCs, null, 2);
+    fs.writeFileSync(tmpIOCFile, iocJsonData);
+    const { generateIOCHMAC } = require('./updater.js');
+    iocHmac = generateIOCHMAC(iocJsonData);
+  }
   fs.renameSync(tmpIOCFile, IOC_FILE);
 
   // Save compact IOCs (lightweight, shipped in npm) — atomic write
@@ -1311,12 +1330,11 @@ async function runScraper() {
   }
   try {
     const tmpHomeFile = HOME_IOC_FILE + '.tmp';
-    const homeJsonData = JSON.stringify(existingIOCs, null, 2);
-    fs.writeFileSync(tmpHomeFile, homeJsonData);
-    // Write HMAC before rename for consistency with updater.js
-    const { generateIOCHMAC } = require('./updater.js');
-    const homeHmac = generateIOCHMAC(homeJsonData);
-    fs.writeFileSync(HOME_IOC_FILE + '.hmac', homeHmac);
+    // Byte-identical copy of the file already written locally — no second stringify peak.
+    fs.copyFileSync(IOC_FILE, tmpHomeFile);
+    // Write HMAC before rename for consistency with updater.js (computed once above from
+    // the same serialized string the local file was written from).
+    fs.writeFileSync(HOME_IOC_FILE + '.hmac', iocHmac);
     fs.renameSync(tmpHomeFile, HOME_IOC_FILE);
     // Mark HMAC as initialized
     const hmacMarker = path.join(homeDir, '.hmac-initialized');

package/src/ml/llm-detective.js

@@ -46,7 +46,10 @@ const LLM_CONCURRENCY_MAX = 2; // max simultaneous API calls
 const LLM_DAILY_LIMIT_DEFAULT = 100;
 const MAX_SINGLE_FILE_BYTES = 512 * 1024; // skip individual files > 512KB
 
-// Extensions to collect from packages
+// Extensions to collect from packages for LLM context (NOT a detection scanner — this feeds
+// the monitor's opt-in LLM investigation). `.json` is intentionally included (manifest/config
+// context for the model); `.jsx/.tsx` are out of scope here by design. Deliberately distinct
+// from the scanner source-extension lists — do not sync.
 const SOURCE_EXTENSIONS = ['.js', '.mjs', '.cjs', '.ts', '.json', '.py'];
 
 // ── Semaphore (pattern: src/shared/http-limiter.js) ──

package/src/monitor/queue.js

@@ -31,6 +31,11 @@ const os = require('os');
 const { Worker } = require('worker_threads');
 const { runSandbox, tryAcquireSandboxSlot } = require('../sandbox/index.js');
 const { sendWebhook } = require('../webhook.js');
+// queue.js has its own destructured sendWebhook reference (IOC-fallback + temporal
+// alert sends), distinct from monitor/webhook.js. Route those sends through a
+// mutable seam so tests can intercept them, same as ingestion._deps — otherwise
+// the destructured ref is captured at load and a test stub never fires.
+const _deps = { sendWebhook };
 const { downloadToFile, extractArchive, sanitizePackageName } = require('../shared/download.js');
 const { extractInPool } = require('../shared/extract-pool.js');
 const { MAX_TARBALL_SIZE, getMaxFileSize } = require('../shared/constants.js');
@@ -145,6 +150,11 @@ function registerWorkerMessageHandler(type, fn) {
   }
   _workerMessageHandlers.set(type, fn);
 }
+function unregisterWorkerMessageHandler(type) {
+  // Inverse of registerWorkerMessageHandler — lets tests (and future governors)
+  // remove their handler instead of leaking it into the process-global registry.
+  return _workerMessageHandlers.delete(type);
+}
 
 // ─── Network-brain glue (governors phase A) ───
 // Workers proxy token acquisition and 429 signals to the main thread so the
@@ -263,6 +273,46 @@ function computeSandboxScoreThreshold(envValue) {
 }
 const SANDBOX_SCORE_THRESHOLD = computeSandboxScoreThreshold(process.env.MUADDIB_SANDBOX_SCORE_THRESHOLD);
 
+// Tier-based sandbox gate, extracted pure so tests exercise THIS function and
+// not a hand-maintained replica (audit 2026-07: sandbox-gate.test.js asserted
+// on a local copy that nothing kept in lockstep with the inline condition).
+// T1a: mandatory. T1b: score-gated. T2: score-gated AND queue must be short.
+// Availability preconditions (isSandboxEnabled, sandboxAvailable, large-package
+// skip) remain at the call site — they are environment, not tier policy.
+function computeSandboxGate(tier, riskScore, queueLen, threshold) {
+  return tier === '1a' ||
+    (tier === '1b' && riskScore >= threshold) ||
+    (tier === 2 && riskScore >= threshold && queueLen < 50);
+}
+
+// Post-sandbox label classifier, extracted pure from processQueueItem for the
+// same reason (the RELABEL tests — including the @cloudbase/cloudbase-mcp
+// regression — re-implemented this formula inline and protected nothing).
+// Returns the stat/label decision; the caller performs the side effects.
+//   'inconclusive_timeout'       sandbox timed out — keep original label
+//   'relabel_blocked_hc'         sandbox clean BUT high-confidence malice types
+//   'relabel_blocked_static'     sandbox clean BUT dormant or static score >= 70
+//   'unconfirmed'                sandbox clean, low static → relabel to unconfirmed
+//   'confirmed'                  sandbox found live behavior → confirm
+//   'inconclusive_install_error' sandbox score > 0 with 0 findings (install error)
+//   'suspect'                    no usable sandbox verdict — keep suspect
+//   null                         static-clean package: nothing to classify
+function classifySandboxOutcome({ staticClean, sandboxResult, hasHCThreats, isDormant, staticScore }) {
+  if (staticClean) return null;
+  if (sandboxResult && sandboxResult.inconclusive) return 'inconclusive_timeout';
+  if (sandboxResult && sandboxResult.score === 0) {
+    if (hasHCThreats) return 'relabel_blocked_hc';
+    if (isDormant || staticScore >= 70) return 'relabel_blocked_static';
+    return 'unconfirmed';
+  }
+  if (sandboxResult && sandboxResult.score > 0) {
+    return (sandboxResult.findings && sandboxResult.findings.length > 0)
+      ? 'confirmed'
+      : 'inconclusive_install_error';
+  }
+  return 'suspect';
+}
+
 // --- Sandbox waste-cut (v2.11.6x): skip sandbox time that yields no new verdict ---
 // Two skip paths, both detection-safe, applied BEFORE the tier sandbox decision:
 //  (1) memory match — re-sandboxing a package whose static result is equivalent to a
@@ -1286,11 +1336,8 @@ async function scanPackage(name, version, ecosystem, tarballUrl, registryMeta, s
         //       findings in 4 months of prod data (axon-enterprise was at 52).
         // T2:  conditional sandbox — same score gate AND queue < 50.
         let sandboxResult = null;
-        const shouldSandbox = !skipSandboxLargePackage && isSandboxEnabled() && sandboxAvailable && (
-          tier === '1a' ||
-          (tier === '1b' && riskScore >= SANDBOX_SCORE_THRESHOLD) ||
-          (tier === 2 && riskScore >= SANDBOX_SCORE_THRESHOLD && scanQueue.length < 50)
-        );
+        const shouldSandbox = !skipSandboxLargePackage && isSandboxEnabled() && sandboxAvailable &&
+          computeSandboxGate(tier, riskScore, scanQueue.length, SANDBOX_SCORE_THRESHOLD);
 
         // Waste-cut: skip the sandbox (run AND defer) when re-running it yields no new
         // verdict — a memory match the webhook would suppress anyway (dominant cost:
@@ -1383,7 +1430,7 @@ async function scanPackage(name, version, ecosystem, tarballUrl, registryMeta, s
                     }));
                     const payload = buildCanaryExfiltrationWebhookEmbed(name, version, exfiltrations);
                     try {
-                      await sendWebhook(url, payload, { rawPayload: true });
+                      await _deps.sendWebhook(url, payload, { rawPayload: true });
                       console.log(`[MONITOR] Canary exfiltration webhook sent for ${name}@${version}`);
                       if (previousRules) {
                         previousRules.add(canaryRuleId);
@@ -1767,7 +1814,7 @@ async function processQueueItem(item, stats, dailyAlerts, recentlyScanned, downl
               timestamp: new Date().toISOString()
             }]
           };
-          await sendWebhook(url, payload, { rawPayload: true });
+          await _deps.sendWebhook(url, payload, { rawPayload: true });
         }
       } catch (webhookErr) {
         console.error(`[MONITOR] IOC fallback webhook failed: ${webhookErr.message}`);
@@ -2241,41 +2288,47 @@ async function resolveTarballAndScan(item, stats, dailyAlerts, recentlyScanned,
   const sandboxResult = scanResult && scanResult.sandboxResult;
   const staticClean = scanResult && scanResult.staticClean;
 
-  // FP rate tracking + ML label refinement
+  // FP rate tracking + ML label refinement — the decision itself lives in
+  // classifySandboxOutcome (pure, exported); this block performs the side effects.
   if (scanResult) {
-    if (!staticClean) {
-      if (sandboxResult && sandboxResult.inconclusive) {
+    const outcome = classifySandboxOutcome({
+      staticClean,
+      sandboxResult,
+      hasHCThreats: scanResult.hasHCThreats || false,
+      isDormant: scanResult.isDormant || false,
+      staticScore: scanResult.staticScore || 0
+    });
+    switch (outcome) {
+      case 'inconclusive_timeout':
         // Sandbox timeout: cannot conclude — do NOT relabel (neither fp nor confirmed)
         updateScanStats('sandbox_inconclusive');
         console.log(`[MONITOR] SANDBOX INCONCLUSIVE (timeout): ${item.name} — keeping original label`);
-      } else if (sandboxResult && sandboxResult.score === 0) {
-        const hasHC = scanResult.hasHCThreats || false;
-        const isDormant = scanResult.isDormant || false;
-        const staticScore = scanResult.staticScore || 0;
-
-        if (hasHC) {
-          updateScanStats('sandbox_inconclusive');
-          console.log(`[MONITOR] RELABEL BLOCKED (HC threats): ${item.name} — sandbox clean but has high-confidence malice types, keeping suspect label`);
-        } else if (isDormant || staticScore >= 70) {
-          updateScanStats('sandbox_inconclusive');
-          console.log(`[MONITOR] RELABEL BLOCKED (high static): ${item.name} — static score=${staticScore}, keeping suspect label`);
-        } else {
-          updateScanStats('sandbox_unconfirmed');
-          relabelRecords(item.name, 'unconfirmed');
-        }
-      } else if (sandboxResult && sandboxResult.score > 0) {
-        const hasSandboxFindings = sandboxResult.findings && sandboxResult.findings.length > 0;
-        if (hasSandboxFindings) {
-          updateScanStats('confirmed');
-          relabelRecords(item.name, 'confirmed', sandboxResult.findings.length);
-        } else {
-          // Sandbox score > 0 but no detailed findings = install error
-          updateScanStats('sandbox_inconclusive');
-          console.log(`[MONITOR] SANDBOX INCONCLUSIVE: ${item.name} score=${sandboxResult.score} but 0 findings — probable install error`);
-        }
-      } else {
+        break;
+      case 'relabel_blocked_hc':
+        updateScanStats('sandbox_inconclusive');
+        console.log(`[MONITOR] RELABEL BLOCKED (HC threats): ${item.name} — sandbox clean but has high-confidence malice types, keeping suspect label`);
+        break;
+      case 'relabel_blocked_static':
+        updateScanStats('sandbox_inconclusive');
+        console.log(`[MONITOR] RELABEL BLOCKED (high static): ${item.name} — static score=${scanResult.staticScore || 0}, keeping suspect label`);
+        break;
+      case 'unconfirmed':
+        updateScanStats('sandbox_unconfirmed');
+        relabelRecords(item.name, 'unconfirmed');
+        break;
+      case 'confirmed':
+        updateScanStats('confirmed');
+        relabelRecords(item.name, 'confirmed', sandboxResult.findings.length);
+        break;
+      case 'inconclusive_install_error':
+        // Sandbox score > 0 but no detailed findings = install error
+        updateScanStats('sandbox_inconclusive');
+        console.log(`[MONITOR] SANDBOX INCONCLUSIVE: ${item.name} score=${sandboxResult.score} but 0 findings — probable install error`);
+        break;
+      case 'suspect':
         updateScanStats('suspect');
-      }
+        break;
+      // null: static-clean package — nothing to classify
     }
   }
 
@@ -2363,7 +2416,11 @@ module.exports = {
   classifyNativeShard,
   shouldSkipSandbox,
   runScanInWorker,
+  _deps,
   registerWorkerMessageHandler,
+  unregisterWorkerMessageHandler,
+  computeSandboxGate,
+  classifySandboxOutcome,
   getInFlightItems,
   computeInterruptDisposition,
   capWorkersForDegradation,

package/src/monitor/webhook.js

@@ -29,6 +29,14 @@ const path = require('path');
 
 const { sendWebhook } = require('../webhook.js');
 const { sendIngest, isIngestConfigured } = require('../integrations/api-ingest.js');
+
+// Outbound-delivery seam. Destructuring `sendWebhook` above captures the
+// reference at load time, so a test that patches `require('../webhook.js').exports`
+// afterwards never intercepts anything (audit 2026-07: four monitor tests were
+// doing real HTTPS POSTs through a "stubbed" sendWebhook). All call sites below
+// go through `_deps.*` so tests can swap the delivery function directly —
+// same pattern as ingestion._deps.
+const _deps = { sendWebhook, sendIngest };
 const {
   atomicWriteFileSync,
   ALERTS_LOG_DIR,
@@ -231,7 +239,7 @@ function buildIOCPreAlertEmbed(name, version, ecosystem = 'npm') {
 async function sendIOCPreAlert(name, version, ecosystem = 'npm') {
   const url = getWebhookUrl();
   if (!url) return;
-  await sendWebhook(url, buildIOCPreAlertEmbed(name, version, ecosystem), { rawPayload: true });
+  await _deps.sendWebhook(url, buildIOCPreAlertEmbed(name, version, ecosystem), { rawPayload: true });
 }
 
 /**
@@ -271,7 +279,7 @@ function buildCampaignPreAlertEmbed(name, campaign, ecosystem = 'npm') {
 async function sendCampaignPreAlert(name, campaign, ecosystem = 'npm') {
   const url = getWebhookUrl();
   if (!url) return;
-  await sendWebhook(url, buildCampaignPreAlertEmbed(name, campaign, ecosystem), { rawPayload: true });
+  await _deps.sendWebhook(url, buildCampaignPreAlertEmbed(name, campaign, ecosystem), { rawPayload: true });
 }
 
 /**
@@ -327,7 +335,7 @@ async function sendBurstPreAlert(name, count, ecosystem = 'npm') {
   if (!burstPreAlertWebhookEnabled()) return;
   const url = getWebhookUrl();
   if (!url) return;
-  await sendWebhook(url, buildBurstPreAlertEmbed(name, count, ecosystem), { rawPayload: true });
+  await _deps.sendWebhook(url, buildBurstPreAlertEmbed(name, count, ecosystem), { rawPayload: true });
 }
 
 /**
@@ -575,7 +583,7 @@ async function resendDailyReport(date) {
   const payload = report.data && report.data.embed;
   if (!payload) return { sent: false, message: `Report ${report.date} has no embed payload`, date: report.date };
   try {
-    await sendWebhook(url, payload, { rawPayload: true });
+    await _deps.sendWebhook(url, payload, { rawPayload: true });
   } catch (err) {
     return { sent: false, message: `Webhook failed: ${err.message}`, date: report.date };
   }
@@ -724,7 +732,7 @@ async function trySendWebhook(name, version, ecosystem, result, sandboxResult, m
   // independent of Discord dedup. The API's ON CONFLICT DO UPDATE absorbs duplicates;
   // dedup downstream is a Discord noise filter, not a data filter.
   if (isIngestConfigured()) {
-    sendIngest(name, version, result).catch(() => {});
+    _deps.sendIngest(name, version, result).catch(() => {});
   }
 
   // Persist periodically (throttled to every 10 scans to avoid disk I/O overhead)
@@ -775,7 +783,7 @@ async function trySendWebhook(name, version, ecosystem, result, sandboxResult, m
   const url = getWebhookUrl();
   const webhookData = buildAlertData(name, version, ecosystem, result, sandboxResult, llmResult);
   try {
-    await sendWebhook(url, webhookData);
+    await _deps.sendWebhook(url, webhookData);
     console.log(`[MONITOR] Webhook sent for ${name}@${version}`);
   } catch (err) {
     console.error(`[MONITOR] Webhook failed for ${name}@${version}: ${err.message}`);
@@ -848,7 +856,7 @@ async function flushScopeGroup(scope) {
     };
     const webhookData = buildAlertData(pkg.name, pkg.version, group.ecosystem, result, pkg.sandboxResult, pkg.llmResult);
     try {
-      await sendWebhook(url, webhookData);
+      await _deps.sendWebhook(url, webhookData);
       console.log(`[MONITOR] Webhook sent for ${pkg.name}@${pkg.version} (scope group flush, single)`);
     } catch (err) {
       console.error(`[MONITOR] Webhook failed for ${pkg.name}@${pkg.version}: ${err.message}`);
@@ -892,7 +900,7 @@ async function flushScopeGroup(scope) {
   };
 
   try {
-    await sendWebhook(url, payload, { rawPayload: true });
+    await _deps.sendWebhook(url, payload, { rawPayload: true });
     console.log(`[MONITOR] Grouped webhook sent for ${scope} (${group.packages.length} packages, max=${group.maxScore})`);
   } catch (err) {
     console.error(`[MONITOR] Grouped webhook failed for ${scope}: ${err.message}`);
@@ -1601,7 +1609,7 @@ async function sendDailyReport(stats, dailyAlerts, recentlyScanned, downloadsCac
   const url = getWebhookUrl();
   if (url) {
     try {
-      await sendWebhook(url, payload, { rawPayload: true });
+      await _deps.sendWebhook(url, payload, { rawPayload: true });
       console.log('[MONITOR] Daily report sent');
       // Confirm delivery on the just-persisted file so boot redelivery won't resend it.
       const persisted = loadPersistedReport(today);
@@ -1704,7 +1712,7 @@ async function sendReportNow(stats) {
   }
 
   try {
-    await sendWebhook(url, payload, { rawPayload: true });
+    await _deps.sendWebhook(url, payload, { rawPayload: true });
   } catch (err) {
     return { sent: false, message: `Webhook failed: ${err.message}` };
   }
@@ -1767,6 +1775,9 @@ function getReportStatus() {
 }
 
 module.exports = {
+  // Test seam — swap _deps.sendWebhook/_deps.sendIngest to intercept outbound delivery
+  _deps,
+
   // Mutable state
   alertedPackageRules,
   SCOPE_GROUP_WINDOW_MS,

package/src/pipeline/executor.js

@@ -133,6 +133,50 @@ function checkPyPITyposquatting(deps, targetPath) {
  * @param {string[]} warnings - Warnings array (mutated: may push module graph warnings)
  * @returns {Promise<{threats: Array, scannerErrors: Array}>}
  */
+
+const SCANNER_NAMES = [
+  'scanPackageJson', 'scanShellScripts', 'analyzeAST', 'detectObfuscation',
+  'scanDependencies', 'scanHashes', 'analyzeDataFlow', 'scanTyposquatting',
+  'scanGitHubActions', 'matchPythonIOCs', 'checkPyPITyposquatting',
+  'scanEntropy', 'scanAIConfig', 'scanIocStrings', 'scanAntiForensic',
+  'scanStubPackage', 'scanMonorepo', 'scanTrustedDepDiff', 'scanPythonSource',
+  'scanPythonAST', 'scanAntiScannerInjection', 'scanBinarySource'
+];
+
+// Stage 2 quick_scan subset (monitor-only, set via options.scanMode='quick'
+// by queue.js when MUADDIB_TRIAGE_MODE=enforce). The subset keeps the heavy
+// detectors that anchor TPR on the 96-sample GT (analyzeAST covers 70/96,
+// analyzeDataFlow covers 31/96 — non-negotiable), the cheap high-signal
+// lifecycle/IOC scanners, and the Python detectors (PyPI samples need them;
+// npm exit immediately on a depth-1 readdir, so the cost is negligible).
+// Excluded: scanAntiForensic (45s timeout, never the unique trigger on GT),
+// scanHashes (cheap but GT samples are rebuilt — hashes drift), scanAIConfig,
+// scanStubPackage, scanMonorepo, scanTrustedDepDiff (opt-in registry diff),
+// checkPyPITyposquatting (subsumed by scanTyposquatting for npm; PyPI
+// typosquats already get full via triage signals). CLI mode and shadow mode
+// never set scanMode so the default branch runs all 20 scanners — fully
+// backwards-compatible.
+// Module-level + exported so tests assert THIS set, not a copy (audit 2026-07:
+// triage-gt.test.js compared two hand-maintained replicas of it).
+const QUICK_SCAN_ALLOWLIST = new Set([
+  'scanPackageJson',
+  'scanShellScripts',
+  'analyzeAST',
+  'detectObfuscation',
+  'scanDependencies',
+  'analyzeDataFlow',
+  'scanTyposquatting',
+  'scanGitHubActions',
+  'matchPythonIOCs',
+  'scanEntropy',
+  'scanIocStrings',
+  'scanPythonSource',
+  'scanPythonAST',
+  'scanAIConfig',
+  'scanAntiScannerInjection',
+  'scanBinarySource'
+]);
+
 async function execute(targetPath, options, pythonDeps, warnings) {
   // Show spinner during scan (TTY only; piped/CI output keeps static message)
   const useTTYSpinner = !options._capture && process.stdout.isTTY;
@@ -248,46 +292,6 @@ async function execute(targetPath, options, pythonDeps, warnings) {
     });
   }
 
-  const SCANNER_NAMES = [
-    'scanPackageJson', 'scanShellScripts', 'analyzeAST', 'detectObfuscation',
-    'scanDependencies', 'scanHashes', 'analyzeDataFlow', 'scanTyposquatting',
-    'scanGitHubActions', 'matchPythonIOCs', 'checkPyPITyposquatting',
-    'scanEntropy', 'scanAIConfig', 'scanIocStrings', 'scanAntiForensic',
-    'scanStubPackage', 'scanMonorepo', 'scanTrustedDepDiff', 'scanPythonSource',
-    'scanPythonAST', 'scanAntiScannerInjection', 'scanBinarySource'
-  ];
-
-  // Stage 2 quick_scan subset (monitor-only, set via options.scanMode='quick'
-  // by queue.js when MUADDIB_TRIAGE_MODE=enforce). The subset keeps the heavy
-  // detectors that anchor TPR on the 96-sample GT (analyzeAST covers 70/96,
-  // analyzeDataFlow covers 31/96 — non-negotiable), the cheap high-signal
-  // lifecycle/IOC scanners, and the Python detectors (PyPI samples need them;
-  // npm exit immediately on a depth-1 readdir, so the cost is negligible).
-  // Excluded: scanAntiForensic (45s timeout, never the unique trigger on GT),
-  // scanHashes (cheap but GT samples are rebuilt — hashes drift), scanAIConfig,
-  // scanStubPackage, scanMonorepo, scanTrustedDepDiff (opt-in registry diff),
-  // checkPyPITyposquatting (subsumed by scanTyposquatting for npm; PyPI
-  // typosquats already get full via triage signals). CLI mode and shadow mode
-  // never set scanMode so the default branch runs all 20 scanners — fully
-  // backwards-compatible.
-  const QUICK_SCAN_ALLOWLIST = new Set([
-    'scanPackageJson',
-    'scanShellScripts',
-    'analyzeAST',
-    'detectObfuscation',
-    'scanDependencies',
-    'analyzeDataFlow',
-    'scanTyposquatting',
-    'scanGitHubActions',
-    'matchPythonIOCs',
-    'scanEntropy',
-    'scanIocStrings',
-    'scanPythonSource',
-    'scanPythonAST',
-    'scanAIConfig',
-    'scanAntiScannerInjection',
-    'scanBinarySource'
-  ]);
   const isQuick = options.scanMode === 'quick';
   function ifEnabled(name, fn) {
     if (isQuick && !QUICK_SCAN_ALLOWLIST.has(name)) return Promise.resolve([]);
@@ -488,4 +492,4 @@ async function execute(targetPath, options, pythonDeps, warnings) {
   }
 }
 
-module.exports = { execute, matchPythonIOCs, checkPyPITyposquatting };
+module.exports = { execute, matchPythonIOCs, checkPyPITyposquatting, QUICK_SCAN_ALLOWLIST, SCANNER_NAMES };

package/src/runtime/serve.js

@@ -21,6 +21,7 @@
 
 const http = require('http');
 const url = require('url');
+const crypto = require('crypto');
 const { getFeed } = require('../threat-feed.js');
 // Monitor-feed routes : optional out-of-tree dependency. Lazy-load so the
 // /feed and /health routes still work when the file is absent. Missing-file
@@ -68,6 +69,19 @@ const SECURITY_HEADERS = {
 const RATE_LIMIT_MAX = 60;
 const RATE_LIMIT_WINDOW_MS = 60_000;
 const rateLimitMap = new Map();
+// Sweep the map when it grows past this many keys, evicting entries whose window has fully
+// expired. Bind is localhost-only so this is bounded in practice, but without a sweep the Map
+// grows unbounded if the server is ever bound wider (one dead key per distinct client IP).
+const RATE_LIMIT_MAX_KEYS = 10_000;
+
+function sweepRateLimitMap(now) {
+  const windowStart = now - RATE_LIMIT_WINDOW_MS;
+  for (const [ip, timestamps] of rateLimitMap) {
+    if (timestamps.length === 0 || timestamps[timestamps.length - 1] < windowStart) {
+      rateLimitMap.delete(ip);
+    }
+  }
+}
 
 function sendJson(res, statusCode, data) {
   res.writeHead(statusCode, SECURITY_HEADERS);
@@ -92,7 +106,12 @@ function checkAuth(req) {
   if (parts.length !== 2 || parts[0] !== 'Bearer') {
     return { ok: false, error: 'Invalid Authorization format. Use: Bearer <token>' };
   }
-  if (parts[1] !== token) {
+  // Constant-time comparison to avoid a timing oracle on the token. Compare fixed-length
+  // SHA-256 digests so timingSafeEqual never sees mismatched buffer lengths (which would
+  // throw and leak length via the exception path).
+  const a = crypto.createHash('sha256').update(parts[1]).digest();
+  const b = crypto.createHash('sha256').update(token).digest();
+  if (!crypto.timingSafeEqual(a, b)) {
     return { ok: false, error: 'Invalid token' };
   }
   return { ok: true };
@@ -105,6 +124,10 @@ function checkAuth(req) {
  */
 function checkRateLimit(ip) {
   const now = Date.now();
+  // Opportunistic bounded sweep: only when the map is oversized, so the common path stays O(1).
+  if (rateLimitMap.size > RATE_LIMIT_MAX_KEYS) {
+    sweepRateLimitMap(now);
+  }
   if (!rateLimitMap.has(ip)) {
     rateLimitMap.set(ip, [now]);
     return { ok: true, remaining: RATE_LIMIT_MAX - 1 };
@@ -165,7 +188,10 @@ function startServer(options = {}) {
       try {
         sendJson(res, 200, buildMonitorDaily());
       } catch (err) {
-        sendJson(res, 500, { error: 'monitor_daily_failed', message: err.message });
+        // Don't leak err.message to the client — it can expose internal filesystem paths.
+        // Log server-side, return a generic error.
+        console.error('[SERVE] /monitor/daily failed:', err.message);
+        sendJson(res, 500, { error: 'monitor_daily_failed' });
       }
     } else if (pathname === '/monitor/window') {
       const range = (parsed.query && parsed.query.range) ? String(parsed.query.range) : '7d';
@@ -176,13 +202,15 @@ function startServer(options = {}) {
       try {
         sendJson(res, 200, buildMonitorWindow(range));
       } catch (err) {
-        sendJson(res, 500, { error: 'monitor_window_failed', message: err.message });
+        console.error('[SERVE] /monitor/window failed:', err.message);
+        sendJson(res, 500, { error: 'monitor_window_failed' });
       }
     } else if (pathname === '/monitor/stats') {
       try {
         sendJson(res, 200, buildMonitorAll());
       } catch (err) {
-        sendJson(res, 500, { error: 'monitor_stats_failed', message: err.message });
+        console.error('[SERVE] /monitor/stats failed:', err.message);
+        sendJson(res, 500, { error: 'monitor_stats_failed' });
       }
     } else if (pathname === '/health') {
       sendJson(res, 200, { status: 'ok', version: pkg.version });

package/src/scanner/ai-config.js

@@ -385,6 +385,10 @@ function analyzeAIConfigFile(content, relPath, invisibleCount) {
     threats.push({
       type: 'ai_config_injection_critical',
       severity: 'CRITICAL',
+      // Structural marker (like GHA-006): the compound escalation shares its type
+      // with single-pattern criticals — tests and consumers must not have to
+      // sniff the message wording to tell them apart.
+      compound: true,
       message: `AI config compound attack: shell commands + ${hasExfiltration ? 'exfiltration' : 'credential access'} in ${relPath} — ToxicSkills/Clinejection pattern.`,
       file: relPath
     });

package/src/scanner/anti-scanner-injection.js

@@ -46,6 +46,10 @@ const { countInvisibleUnicode, stripInvisibleUnicode } = require('../shared/unic
  * the self-scan canary (`npm run scan .`) must stay at 0 antiscanner_* findings.
  */
 
+// Intentional deviations from utils.EXCLUDED_DIRS / the common source-extension lists:
+//  - `.py` is included: TrapDoor/eth-security-auditor PyPI campaigns target Python reviewers.
+//  - dist/build/out are NOT excluded: the Hades prompt-injection sits atop a bundle, so the
+//    bundled output in dist/ must be scanned. Do not align on the common lists.
 const SCAN_EXTENSIONS = ['.js', '.cjs', '.mjs', '.ts', '.tsx', '.jsx', '.py'];
 const EXCLUDED_DIRS = ['node_modules', '.git', '.muaddib-cache'];
 

package/src/scanner/ast-detectors/helpers.js

@@ -63,25 +63,9 @@ function extractStringValue(node) {
   return null;
 }
 
-/**
- * Audit v3 B2: Shannon entropy calculation for split-entropy detection.
- * Replicates the algorithm from entropy.js for inline use in AST scanner.
- */
-function calculateShannonEntropy(str) {
-  if (!str || str.length === 0) return 0;
-  const freq = Object.create(null);
-  for (let i = 0; i < str.length; i++) {
-    const ch = str[i];
-    freq[ch] = (freq[ch] || 0) + 1;
-  }
-  let entropy = 0;
-  const len = str.length;
-  for (const ch in freq) {
-    const p = freq[ch] / len;
-    entropy -= p * Math.log2(p);
-  }
-  return entropy;
-}
+// Audit v3 B2: Shannon entropy for split-entropy detection — single implementation in
+// src/shared/entropy.js (re-exported below for handle-call-expression.js).
+const { calculateShannonEntropy } = require('../../shared/entropy.js');
 
 /**
  * Audit v3 B2: Count the number of leaf string operands in a BinaryExpression chain.

package/src/scanner/ast.js

@@ -33,6 +33,7 @@ const {
   handlePostWalk
 } = require('./ast-detectors');
 const { detectAnalyzerHoneytoken, detectEnvMarkerEnumeration, countExitGuards, hasHostRecon } = require('./ast-detectors/anti-evasion.js');
+const { SAFE_FETCH_DOMAINS } = require('./ast-detectors/constants.js');
 
 // Check if credential keywords appear INSIDE regex literals or new RegExp() patterns.
 // Only true when the keyword is part of the regex pattern itself, not just a string elsewhere in the file.
@@ -349,12 +350,6 @@ function analyzeFile(content, filePath, basePath) {
   // Compute fetchOnlySafeDomains: check if ALL URLs in file point to known registries
   if (ctx.hasRemoteFetch) {
     const urlMatches = content.match(/https?:\/\/[^\s'"`)]+/g) || [];
-    const SAFE_FETCH_DOMAINS = [
-      'registry.npmjs.org', 'npmjs.com',
-      'github.com', 'objects.githubusercontent.com', 'raw.githubusercontent.com',
-      'nodejs.org', 'yarnpkg.com',
-      'pypi.org', 'files.pythonhosted.org'
-    ];
     if (urlMatches.length > 0 && urlMatches.every(u => {
       try {
         const hostname = new URL(u).hostname;

package/src/scanner/dependencies.js

@@ -238,6 +238,11 @@ function getPackageVersion(pkgPath) {
 module.exports = {
   scanDependencies,
   checkRehabilitatedPackage,
+  // Pure fs helpers, exported so tests assert their actual behaviour (scoped
+  // name resolution, hidden/non-dir skipping, version fallback) instead of
+  // only Array.isArray on scanDependencies' output.
+  listPackages,
+  getPackageVersion,
   TRUSTED_PACKAGES,
   SAFE_FILES
 };

package/src/scanner/entropy.js

@@ -78,31 +78,9 @@ function isWhitelistedString(str, filePath) {
   return false;
 }
 
-/**
- * Calculate Shannon entropy of a string.
- * @param {string} str - Input string
- * @returns {number} Entropy in bits (0-8)
- */
-function calculateShannonEntropy(str) {
-  if (!str || str.length === 0) return 0;
-
-  const freq = {};
-  for (let i = 0; i < str.length; i++) {
-    const ch = str[i];
-    freq[ch] = (freq[ch] || 0) + 1;
-  }
-
-  const len = str.length;
-  let entropy = 0;
-  for (const ch in freq) {
-    const p = freq[ch] / len;
-    if (p > 0) {
-      entropy -= p * Math.log2(p);
-    }
-  }
-
-  return entropy;
-}
+// Shannon entropy: single implementation in src/shared/entropy.js (re-exported below —
+// tests and callers import it from this module).
+const { calculateShannonEntropy } = require('../shared/entropy.js');
 
 /**
  * Extract string literals from JS source code via regex.
@@ -219,6 +197,12 @@ function detectObfuscationPatterns(content, relativePath) {
   return threats;
 }
 
+// Bounded resources: cap high_entropy_string emissions per file. A dense ≤10MB file could
+// otherwise emit thousands of threat objects (distinct messages survive dedup). Must stay
+// well above the FP_COUNT_THRESHOLDS maxCount=5 for high_entropy_string (scoring.js) so the
+// anti-flood downgrade still triggers; scoring decay saturates long before 50.
+const MAX_ENTROPY_THREATS_PER_FILE = 50;
+
 /**
  * Scan JavaScript files for high-entropy strings and JS obfuscation patterns.
  * @param {string} targetPath - Directory to scan
@@ -244,7 +228,9 @@ function scanEntropy(targetPath, options = {}) {
 
     // String-level entropy check (MUADDIB-ENTROPY-001)
     const strings = extractStringLiterals(content);
+    let entropyThreatCount = 0;
     for (const str of strings) {
+      if (entropyThreatCount >= MAX_ENTROPY_THREATS_PER_FILE) break;
       if (str.length < MIN_STRING_LENGTH) continue;
 
       // B12: Windowed analysis for strings > MAX_STRING_LENGTH
@@ -261,6 +247,7 @@ function scanEntropy(targetPath, options = {}) {
               message: `High entropy window in long string (${str.length} chars, offset ${i}) — possible padded payload`,
               file: relativePath
             });
+            entropyThreatCount++;
             break;
           }
         }
@@ -280,6 +267,7 @@ function scanEntropy(targetPath, options = {}) {
           message: `High entropy string (${strEntropy.toFixed(2)} bits, ${str.length} chars) — possible base64/hex/encrypted payload`,
           file: relativePath
         });
+        entropyThreatCount++;
       }
     }
 

package/src/scanner/paranoid.js

@@ -213,6 +213,10 @@ function scanParanoid(targetPath) {
     }
   }
 
+  // Paranoid mode is opt-in maximal coverage: this walker deliberately does NOT use
+  // utils.EXCLUDED_DIRS — it scans dist/build/out (bundled payloads) and .json/.sh in addition
+  // to JS. Do not "align" it on findFiles/EXCLUDED_DIRS: that would drop coverage this mode
+  // exists to provide. Symlink-safe (lstat skip) + depth guard 50 (IDX-06).
   function walkDir(dir, depth) {
     if (depth > 50) return; // Max depth guard (IDX-06)
     const excluded = ['node_modules', '.git', '.muaddib-cache', ...getExtraExcludes()];

package/src/scanner/python.js

@@ -19,6 +19,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { getMaxFileSize } = require('../shared/constants.js');
 
 // ============================================
 // REQUIREMENTS.TXT PARSER
@@ -41,7 +42,17 @@ function parseRequirementsTxt(filePath, visited, projectRoot) {
   if (visited.has(resolved)) return [];
   visited.add(resolved);
 
-  const content = fs.readFileSync(filePath, 'utf8');
+  // Guarded read (aligned on parseSetupPy/parsePyprojectToml): attacker-controlled input —
+  // a `-r <dir>` include resolves to a directory (EISDIR) and would otherwise abort the
+  // whole scan (denial-of-detection); oversized files are skipped like everywhere else.
+  let content;
+  try {
+    const stat = fs.statSync(filePath);
+    if (!stat.isFile() || stat.size > getMaxFileSize()) return [];
+    content = fs.readFileSync(filePath, 'utf8');
+  } catch {
+    return [];
+  }
   const lines = content.split(/\r?\n/);
   const deps = [];
   const relFile = filePath;
@@ -56,13 +67,13 @@ function parseRequirementsTxt(filePath, visited, projectRoot) {
     const includeMatch = line.match(/^(?:-r|--requirement)\s+(.+)$/);
     if (includeMatch) {
       const includePath = path.resolve(path.dirname(filePath), includeMatch[1].trim());
-      // Path traversal guard: ensure included file stays within the project root
-      // Use case-insensitive comparison on Windows (PY-01)
-      // PY-001: Derive rootDir once at top-level, pass it down for all recursive calls
+      // Path traversal guard: ensure included file stays within the project root.
+      // PY-001: Derive rootDir once at top-level, pass it down for all recursive calls.
+      // path.relative enforces a separator boundary (a raw startsWith prefix check let
+      // /scan/pkg-evil pass as "within" /scan/pkg) and handles per-OS case/separator rules.
       const rootDir = projectRoot || path.resolve(path.dirname(filePath));
-      const isWithin = process.platform === 'win32'
-        ? includePath.toLowerCase().startsWith(rootDir.toLowerCase())
-        : includePath.startsWith(rootDir);
+      const rel = path.relative(rootDir, includePath);
+      const isWithin = rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
       if (!isWithin) continue;
       const included = parseRequirementsTxt(includePath, visited, rootDir);
       deps.push(...included);

package/src/scoring/delta-multiplier.js

@@ -46,7 +46,10 @@ const crypto = require('crypto');
 
 const { HIGH_CONFIDENCE_MALICE_TYPES } = require('../monitor/classify.js');
 
-const CACHE_DIR = path.join(process.cwd(), '.muaddib-cache', 'version-deltas');
+// Env override so tests write to a mkdtemp instead of littering the
+// production cache (unset in prod → unchanged behavior).
+const CACHE_DIR = process.env.MUADDIB_DELTA_CACHE_DIR
+  || path.join(process.cwd(), '.muaddib-cache', 'version-deltas');
 const CACHE_TTL_MS = 90 * 24 * 60 * 60 * 1000;
 const CACHE_MAX_ENTRIES = 50000;
 const MIN_PRIOR_VERSIONS_FOR_DECAY = 3;

package/src/shared/entropy.js

@@ -0,0 +1,45 @@
+/*
+ * MUAD'DIB — Supply-chain threat detection for npm & PyPI
+ * Copyright (C) 2026 DNSZLSK
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+// Single source of truth for Shannon entropy — consumed by the entropy scanner
+// (src/scanner/entropy.js) and the AST split-entropy detector
+// (src/scanner/ast-detectors/helpers.js). Leaf module: keep it dependency-free.
+
+/**
+ * Calculate Shannon entropy of a string.
+ * @param {string} str - Input string
+ * @returns {number} Entropy in bits (0-8)
+ */
+function calculateShannonEntropy(str) {
+  if (!str || str.length === 0) return 0;
+  const freq = Object.create(null);
+  for (let i = 0; i < str.length; i++) {
+    const ch = str[i];
+    freq[ch] = (freq[ch] || 0) + 1;
+  }
+  let entropy = 0;
+  const len = str.length;
+  for (const ch in freq) {
+    const p = freq[ch] / len;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+
+module.exports = { calculateShannonEntropy };

package/src/shared/registry-auth.js

@@ -49,8 +49,11 @@ let _token = null;
 let _source = null;
 
 function _fromNpmrc() {
-  const files = [
-    process.env.MUADDIB_NPMRC,
+  // An explicit MUADDIB_NPMRC wins EXCLUSIVELY — no fallback to cwd/HOME/VPS
+  // paths. Explicit config falling through to ambient files was surprising in
+  // prod and made tests non-hermetic (a token in the runner's cwd .npmrc
+  // leaked into "no token" assertions).
+  const files = process.env.MUADDIB_NPMRC ? [process.env.MUADDIB_NPMRC] : [
     path.join(process.cwd(), '.npmrc'),
     process.env.HOME ? path.join(process.env.HOME, '.npmrc') : null,
     '/home/muaddib/.npmrc',

package/src/utils.js

@@ -25,7 +25,14 @@ const { getMaxFileSize, clearASTCache } = require('./shared/constants.js');
  * Directories excluded from scanning.
  * Skips dependency/VCS/cache dirs and bundled output (dist/build/out).
  * Bundled output is minified, huge, and produces FPs without security value.
- * Obfuscation scanner uses its own OBF_EXCLUDED_DIRS to intentionally scan these.
+ *
+ * Per-scanner deviations are intentional (do NOT unify blindly — each is FPR-gated):
+ *  - obfuscation.js OBF_EXCLUDED_DIRS: also excludes dist/build/out but does NOT exclude
+ *    node_modules (it deliberately scans dependencies for obfuscation).
+ *  - binary-source.js / shell.js / anti-scanner-injection.js: deliberately DO scan dist/
+ *    (bundled payloads — jscrambler dist/intro.js gap, revshells in bundles, Hades directive
+ *    atop a bundle).
+ *  - paranoid.js: opt-in maximal coverage, scans dist/build/out and .json/.sh.
  */
 const EXCLUDED_DIRS = ['node_modules', '.git', '.muaddib-cache', 'dist', 'build', 'out', 'output'];
 
@@ -251,6 +258,12 @@ function clearFileListCache() {
   _overflowFiles = [];
 }
 
+// Test-only introspection: the _FILE_CONTENT_CACHE_MAX bound (Bounded resources
+// contract) is unobservable from outside, so its eviction was untestable.
+function _getFileContentCacheSize() {
+  return _fileContentCache.size;
+}
+
 function wasFilesCapped() {
   return _filesCapped;
 }
@@ -475,6 +488,7 @@ module.exports = {
   findFiles,
   findJsFiles,
   clearFileListCache,
+  _getFileContentCacheSize,
   wasFilesCapped,
   getOverflowFiles,
   escapeHtml,

package/stats.json

@@ -1,6 +1,6 @@
 {
   "_comment": "GENERATED by scripts/collect-stats.js — do not edit by hand. Run `npm run docs:stats`.",
-  "version": "2.11.174",
+  "version": "2.11.176",
   "scanners": 22,
   "rulesTotal": 277,
   "rulesCore": 272,
@@ -12,5 +12,5 @@
   "moduleGraph": 9,
   "pythonAstDetectors": 6,
   "testFiles": 152,
-  "tests": 4561
+  "tests": 4534
 }