muaddib-scanner 2.11.174 → 2.11.177

package/README.md

@@ -214,7 +214,7 @@ muaddib replay                     # Ground truth validation (90/94 TPR@3, v2.11
 
 ### <!--stat:rulesTotal-->277<!--/stat:rulesTotal--> detection rules
 
-All rules (<!--stat:rulesCore-->272<!--/stat:rulesCore--> RULES + <!--stat:rulesParanoid-->5<!--/stat:rulesParanoid--> PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v211139) for the complete rules reference.
+All rules (<!--stat:rulesCore-->272<!--/stat:rulesCore--> RULES + <!--stat:rulesParanoid-->5<!--/stat:rulesParanoid--> PARANOID) are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules) for the complete rules reference.
 
 ### Detected campaigns
 
@@ -345,7 +345,7 @@ npm test
 
 ### Testing
 
-- **<!--stat:tests-->4561<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
+- **<!--stat:tests-->4539<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
 - **56 fuzz tests** - Malformed inputs, ReDoS, unicode, binary
 - **Datadog 17K benchmark** - 14,587 confirmed malware samples (in-scope)
 - **Ground truth validation** - 96 real-world attacks (95.74% TPR@3, 88.30% TPR@20 — v2.11.48 full measure on 94 in-scope)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.174",
+  "version": "2.11.177",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {
@@ -14,6 +14,7 @@
     "scan": "node bin/muaddib.js scan .",
     "update": "node bin/muaddib.js update",
     "lint": "eslint src bin --ext .js",
+    "ci:local": "node scripts/check-deps-typosquats.js && node scripts/check-no-tracked-node-modules.js && npm audit --audit-level=high && npm run docs:stats:check && npm test",
     "docs:stats": "node scripts/collect-stats.js && node scripts/sync-stats.js",
     "docs:stats:tests": "node scripts/collect-stats.js --with-tests && node scripts/sync-stats.js",
     "docs:stats:check": "node scripts/collect-stats.js --check && node scripts/sync-stats.js --check",
@@ -54,8 +55,8 @@
     "@inquirer/prompts": "8.5.2",
     "acorn": "8.17.0",
     "acorn-walk": "8.3.5",
-    "adm-zip": "0.5.18",
-    "js-yaml": "5.1.0",
+    "adm-zip": "0.6.0",
+    "js-yaml": "5.2.1",
     "web-tree-sitter": "^0.26.9"
   },
   "devDependencies": {

package/{self-scan-v2.11.174.json → self-scan-v2.11.177.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-17T09:25:49.894Z",
+  "timestamp": "2026-07-22T22:32:17.558Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/commands/hooks-init.js

@@ -54,6 +54,32 @@ const HOOK_COMMANDS = {
   diff: 'npx muaddib diff HEAD --fail-on high'
 };
 
+/**
+ * Back up an existing pre-commit hook before overwriting it, keeping the 3 most recent
+ * timestamped backups. Shared by the husky and native-git hook writers so neither silently
+ * destroys a user's existing hook (lint-staged, tests, etc.).
+ * @param {string} hookPath - Absolute path to the pre-commit hook to be written
+ */
+function backupExistingHook(hookPath) {
+  if (!fs.existsSync(hookPath)) return;
+  const backup = `${hookPath}.backup.${Date.now()}`;
+  fs.copyFileSync(hookPath, backup);
+  console.log(`[INFO] Backed up existing hook to ${backup}`);
+
+  // Cleanup old backups, keep only 3 most recent
+  try {
+    const hooksDir = path.dirname(hookPath);
+    const base = path.basename(hookPath);
+    const backups = fs.readdirSync(hooksDir)
+      .filter(f => f.startsWith(base + '.backup.'))
+      .sort()
+      .reverse();
+    for (const old of backups.slice(3)) {
+      fs.unlinkSync(path.join(hooksDir, old));
+    }
+  } catch { /* ignore cleanup errors */ }
+}
+
 async function initHooks(targetPath, options = {}) {
   const resolvedPath = path.resolve(targetPath);
   const hookType = options.type || 'auto';
@@ -138,6 +164,9 @@ echo "[MUADDIB] Running security check..."
 ${command}
 `;
 
+  // Back up any existing hook before overwriting (same policy as initGitHook): a project may
+  // already have a husky pre-commit (lint-staged, tests…) — clobbering it silently loses config.
+  backupExistingHook(preCommitPath);
   fs.writeFileSync(preCommitPath, hookContent, { mode: 0o755 });
   if (process.platform !== 'win32') {
     fs.chmodSync(preCommitPath, 0o755);
@@ -219,23 +248,7 @@ exit 0
 `;
 
   // Backup existing hook (limit to 3 backups)
-  if (fs.existsSync(preCommitPath)) {
-    const backup = `${preCommitPath}.backup.${Date.now()}`;
-    fs.copyFileSync(preCommitPath, backup);
-    console.log(`[INFO] Backed up existing hook to ${backup}`);
-
-    // Cleanup old backups, keep only 3 most recent
-    try {
-      const hooksDir = path.dirname(preCommitPath);
-      const backups = fs.readdirSync(hooksDir)
-        .filter(f => f.startsWith('pre-commit.backup.'))
-        .sort()
-        .reverse();
-      for (const old of backups.slice(3)) {
-        fs.unlinkSync(path.join(hooksDir, old));
-      }
-    } catch { /* ignore cleanup errors */ }
-  }
+  backupExistingHook(preCommitPath);
 
   fs.writeFileSync(preCommitPath, hookContent, { mode: 0o755 });
   if (process.platform !== 'win32') {

package/src/commands/safe-install.js

@@ -133,31 +133,42 @@ function checkIOCs(pkg, pkgName, pkgVersion) {
   return malicious || null;
 }
 
-// Scan a package and its dependencies recursively
-async function scanPackageRecursive(pkg, depth = 0, maxDepth = 3) {
-  const indent = '  '.repeat(depth);
-
-  // Extract name and version of the package
+// Split a package spec into { pkgName, pkgVersion }.
+// Handles scoped packages (@scope/name) and version specs (@scope/name@spec or name@spec).
+// Transitive deps arrive as `name@^1.2.3` (range specs from dependency maps): the spec must
+// be split off the name even when it is not an exact version, otherwise pkgName keeps the
+// full spec and the IOC map lookup (keyed on bare names) never matches — wildcard IOCs
+// included. Range/tag specs leave pkgVersion null so only wildcard IOCs match (SFI-003).
+function parsePackageSpec(pkg) {
   let pkgName = pkg;
   let pkgVersion = null;
-
-  // Handle scoped packages (@scope/name) and versions (@scope/name@version or name@version)
   if (pkg.startsWith('@')) {
     // Scoped package
     const parts = pkg.slice(1).split('@');
-    if (parts.length >= 2 && parts[parts.length - 1].match(/^\d/)) {
-      pkgVersion = parts.pop();
+    if (parts.length >= 2) {
+      const spec = parts.pop();
       pkgName = '@' + parts.join('@');
+      if (spec.match(/^\d/)) pkgVersion = spec;
     }
   } else {
     const parts = pkg.split('@');
-    if (parts.length >= 2 && parts[parts.length - 1].match(/^\d/)) {
-      pkgVersion = parts.pop();
+    if (parts.length >= 2) {
+      const spec = parts.pop();
       pkgName = parts.join('@');
+      if (spec.match(/^\d/)) pkgVersion = spec;
     }
   }
-  
-  
+  return { pkgName, pkgVersion };
+}
+
+// Scan a package and its dependencies recursively
+async function scanPackageRecursive(pkg, depth = 0, maxDepth = 3) {
+  const indent = '  '.repeat(depth);
+
+  // Extract name and version of the package
+  const { pkgName, pkgVersion } = parsePackageSpec(pkg);
+
+
   // Avoid infinite loops
   if (scannedPackages.has(pkgName)) {
     return { safe: true };
@@ -309,4 +320,4 @@ async function safeInstall(packages, options = {}) {
   return { blocked: false };
 }
 
-module.exports = { safeInstall, scanPackageRecursive, REHABILITATED_PACKAGES, checkRehabilitated, isValidPackageName, checkIOCs };
+module.exports = { safeInstall, scanPackageRecursive, parsePackageSpec, REHABILITATED_PACKAGES, checkRehabilitated, isValidPackageName, checkIOCs };

package/src/ioc/bootstrap.js

@@ -51,6 +51,13 @@ const DOWNLOAD_TIMEOUT = 60_000;
 // Max redirects to follow
 const MAX_REDIRECTS = 5;
 
+// Decompression bomb guard: cap the DECOMPRESSED byte count streamed to disk. A compromised
+// release asset (exactly this project's threat model — maintainer account takeover) could
+// otherwise fill the disk: this was the only unbounded decompressor in the repo (download.js
+// has the M4 gzip hint, scraper.js has MAX_ENTRY/TOTAL_UNCOMPRESSED). Env-tunable like the
+// scraper caps; default leaves ample headroom over the ~112-223MB iocs.json.
+const MAX_DECOMPRESSED_SIZE = parseInt(process.env.MUADDIB_BOOTSTRAP_MAX_DECOMPRESSED || '', 10) || 1024 * 1024 * 1024; // 1 GB
+
 // Allowed redirect domains (SSRF protection)
 const ALLOWED_REDIRECT_DOMAINS = [
   'github.com',
@@ -115,6 +122,19 @@ function downloadAndDecompress(url, destPath) {
         const gunzip = zlib.createGunzip();
         const fileStream = fs.createWriteStream(tmpPath);
 
+        // Decompression bomb guard: count decompressed bytes, abort past the cap.
+        let decompressedBytes = 0;
+        gunzip.on('data', (chunk) => {
+          decompressedBytes += chunk.length;
+          if (decompressedBytes > MAX_DECOMPRESSED_SIZE) {
+            res.destroy();
+            gunzip.destroy();
+            fileStream.destroy();
+            try { fs.unlinkSync(tmpPath); } catch (e) { debugLog('cleanup failed:', e.message); }
+            reject(new Error('Decompressed size exceeds cap (' + MAX_DECOMPRESSED_SIZE + ' bytes) — aborting'));
+          }
+        });
+
         gunzip.on('error', (err) => {
           fileStream.destroy();
           try { fs.unlinkSync(tmpPath); } catch (e) { debugLog('cleanup failed:', e.message); }

package/src/ioc/scraper.js

@@ -733,6 +733,7 @@ async function scrapeOSSFMaliciousPackages(knownIds) {
       fetchSpinner.start('Fetching OSSF entries... 0/' + toFetch.length);
     }
 
+    let failedFetches = 0;
     for (let i = 0; i < toFetch.length; i += BATCH_SIZE) {
       const batch = toFetch.slice(i, i + BATCH_SIZE);
       const results = await Promise.all(batch.map(function(entry) {
@@ -741,7 +742,7 @@ async function scrapeOSSFMaliciousPackages(knownIds) {
       }));
 
       for (const result of results) {
-        if (!result || result.status !== 200 || !result.data) continue;
+        if (!result || result.status !== 200 || !result.data) { failedFetches++; continue; }
         const parsed = parseOSVEntry(result.data, 'ossf-malicious');
         for (const p of parsed) packages.push(p);
       }
@@ -760,8 +761,16 @@ async function scrapeOSSFMaliciousPackages(knownIds) {
       fetchSpinner.succeed('Fetched OSSF entries: ' + packages.length + ' packages');
     }
 
-    // Save tree SHA for next incremental run
-    try { fs.writeFileSync(shaFile, treeSha); } catch {}
+    // Save tree SHA for next incremental run — only if every entry was fetched.
+    // Persisting the SHA after partial fetches (e.g. GitHub rate-limiting the raw batches)
+    // marks the failed entries as "done": subsequent runs skip everything until the next
+    // OSSF commit, silently losing IOCs. On partial failure, keep the old SHA so the next
+    // run retries the delta.
+    if (failedFetches === 0) {
+      try { fs.writeFileSync(shaFile, treeSha); } catch {}
+    } else {
+      console.log('[SCRAPER]   ' + failedFetches + ' OSSF fetches failed — tree SHA not persisted, next run will retry');
+    }
   } catch (e) {
     console.log('[SCRAPER]   Error: ' + e.message);
   }
@@ -921,65 +930,14 @@ async function scrapeOSVPyPIDataDump() {
   return packages;
 }
 
-// ============================================
-// SOURCE 4: GitHub Advisory Database (Malware)
-// ============================================
-async function scrapeGitHubAdvisory() {
-  console.log('[SCRAPER] GitHub Advisory Database (malware)...');
-  const packages = [];
-  
-  try {
-    const resp = await fetchJSON('https://api.osv.dev/v1/query', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: { package: { ecosystem: 'npm' } }
-    });
-    
-    if (resp.status === 200 && resp.data && resp.data.vulns) {
-      for (const vuln of resp.data.vulns) {
-        // Filter GHSA with malware mention
-        if (vuln.id && vuln.id.startsWith('GHSA-')) {
-          const summary = (vuln.summary || '').toLowerCase();
-          const details = (vuln.details || '').toLowerCase();
-          const isMalware = summary.includes('malware') || 
-                          summary.includes('malicious') ||
-                          details.includes('malware') ||
-                          details.includes('malicious') ||
-                          summary.includes('backdoor') ||
-                          summary.includes('trojan');
-          
-          if (isMalware) {
-            for (const affected of vuln.affected || []) {
-              if (affected.package && affected.package.ecosystem === 'npm') {
-                const versions = extractVersions(affected);
-                for (const ver of versions) {
-                  packages.push({
-                    id: vuln.id,
-                    name: affected.package.name,
-                    version: ver,
-                    severity: 'critical',
-                    confidence: 'high',
-                    source: 'github-advisory',
-                    description: (vuln.summary || 'Malicious package').slice(0, 200),
-                    references: ['https://github.com/advisories/' + vuln.id],
-                    mitre: 'T1195.002',
-                    freshness: createFreshness('github-advisory', 'high')
-                  });
-                }
-              }
-            }
-          }
-        }
-      }
-    }
-    
-    console.log(`[SCRAPER]   ${packages.length} packages`);
-  } catch (e) {
-    console.log(`[SCRAPER]   Error: ${e.message}`);
-  }
-  
-  return packages;
-}
+// SOURCE 4 (GitHub Advisory Database) removed 2026-07 (GAP-2): it POSTed
+// api.osv.dev/v1/query with `{ package: { ecosystem: 'npm' } }` — no package name,
+// which the OSV /v1/query API rejects with HTTP 400 on every call. It therefore
+// returned 0 packages permanently while logging as a normal completion (fictional
+// coverage). Empirically verified that the GHSA-malware it targeted is already
+// 100% covered by the OSV MAL- dump (153/153 pre-snapshot npm GHSA advisories
+// present in the IOC store), so its removal loses no coverage. The GHSA poller
+// (src/ioc/ghsa-poller.js) tracks the coverage denominator independently.
 
 // ============================================
 // MAIN SCRAPER
@@ -1063,7 +1021,6 @@ async function runScraper() {
     scrapeShaiHuludDetector(),
     scrapeDatadogIOCs(),
     scrapeOSSFMaliciousPackages(osvResult.knownIds),
-    scrapeGitHubAdvisory(),
     scrapeOSVPyPIDataDump(),
     scrapeAikidoMalwareFeed(),
     scrapeOSMQueryLatest()
@@ -1072,10 +1029,9 @@ async function runScraper() {
   const shaiHuludResult = results[0];
   const datadogResult = results[1];
   const ossfPackages = results[2];
-  const githubPackages = results[3];
-  const pypiPackages = results[4];
-  const aikidoResult = results[5];
-  const osmResult = results[6];
+  const pypiPackages = results[3];
+  const aikidoResult = results[4];
+  const osmResult = results[5];
 
   // Log aggregated warnings
   if (_noVersionSkipCount > 0) {
@@ -1100,7 +1056,6 @@ async function runScraper() {
     ...shaiHuludResult.packages,
     ...datadogResult.packages,
     ...ossfPackages,
-    ...githubPackages,
     ...aikidoResult.packages,
     ...osmResult.packages
   ];
@@ -1284,11 +1239,21 @@ async function runScraper() {
     'npm-removed'
   ];
 
-  // Save enriched (full) IOCs — atomic write via .tmp + rename
+  // Save enriched (full) IOCs — atomic write via .tmp + rename.
+  // Stringify ONCE: the pretty-printed DB is a giant string (~2x the 112MB+ file); a second
+  // stringify for the home copy used to double the peak on top of the zip buffers already in
+  // flight. The HMAC is computed here from the same string, then the string is released and
+  // the home copy reuses the file on disk (copyFileSync — no second serialization).
   const saveSpinner = new Spinner();
   saveSpinner.start('Saving IOCs...');
   const tmpIOCFile = IOC_FILE + '.tmp';
-  fs.writeFileSync(tmpIOCFile, JSON.stringify(existingIOCs, null, 2));
+  let iocHmac;
+  {
+    const iocJsonData = JSON.stringify(existingIOCs, null, 2);
+    fs.writeFileSync(tmpIOCFile, iocJsonData);
+    const { generateIOCHMAC } = require('./updater.js');
+    iocHmac = generateIOCHMAC(iocJsonData);
+  }
   fs.renameSync(tmpIOCFile, IOC_FILE);
 
   // Save compact IOCs (lightweight, shipped in npm) — atomic write
@@ -1311,12 +1276,11 @@ async function runScraper() {
   }
   try {
     const tmpHomeFile = HOME_IOC_FILE + '.tmp';
-    const homeJsonData = JSON.stringify(existingIOCs, null, 2);
-    fs.writeFileSync(tmpHomeFile, homeJsonData);
-    // Write HMAC before rename for consistency with updater.js
-    const { generateIOCHMAC } = require('./updater.js');
-    const homeHmac = generateIOCHMAC(homeJsonData);
-    fs.writeFileSync(HOME_IOC_FILE + '.hmac', homeHmac);
+    // Byte-identical copy of the file already written locally — no second stringify peak.
+    fs.copyFileSync(IOC_FILE, tmpHomeFile);
+    // Write HMAC before rename for consistency with updater.js (computed once above from
+    // the same serialized string the local file was written from).
+    fs.writeFileSync(HOME_IOC_FILE + '.hmac', iocHmac);
     fs.renameSync(tmpHomeFile, HOME_IOC_FILE);
     // Mark HMAC as initialized
     const hmacMarker = path.join(homeDir, '.hmac-initialized');
@@ -1579,43 +1543,14 @@ async function scrapeOSMQueryLatest() {
   return { packages: npmPackages, pypi_packages: pypiPackages };
 }
 
-// ============================================
-// SOURCE 5: OSV.dev Lightweight API
-// Used by `muaddib update` (fast, no zip download)
-// ============================================
-
-/**
- * Lightweight OSV.dev query — fetches recent npm MAL-* entries via REST API.
- * Used by `muaddib update` as a fast complement to the full zip scrape.
- * @returns {Promise<Array>} Parsed IOC package entries
- */
-async function scrapeOSVLightweightAPI() {
-  console.log('[SCRAPER] OSV.dev lightweight API...');
-  const packages = [];
-
-  try {
-    const resp = await fetchJSON('https://api.osv.dev/v1/query', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: { package: { ecosystem: 'npm' } }
-    });
-
-    if (resp.status === 200 && resp.data && resp.data.vulns) {
-      for (const vuln of resp.data.vulns) {
-        if (vuln.id && vuln.id.startsWith('MAL-')) {
-          const parsed = parseOSVEntry(vuln, 'osv-api');
-          for (const p of parsed) packages.push(p);
-        }
-      }
-    }
-
-    console.log('[SCRAPER]   ' + packages.length + ' MAL-* packages from OSV API');
-  } catch (e) {
-    console.log('[SCRAPER]   OSV API error: ' + e.message);
-  }
-
-  return packages;
-}
+// SOURCE 5 (OSV.dev Lightweight API) removed 2026-07 (GAP-2): same defect as
+// SOURCE 4 — it POSTed api.osv.dev/v1/query with no package name (`{ package:
+// { ecosystem: 'npm' } }`), which OSV rejects with HTTP 400, so it returned 0
+// MAL-* packages permanently while `muaddib update` logged "+0 OSV API" as normal.
+// It was also 100% redundant with the OSV MAL- zip dump (scrapeOSVDataDump), which
+// pulls the same MAL- npm set. The `muaddib update` light path keeps its recent-
+// malware coverage via GenSecAI + DataDog + OSM; the authoritative OSV MAL- set
+// comes from the deep `muaddib scrape`.
 
 /**
  * Batch query OSV.dev for specific package names.
@@ -1700,7 +1635,7 @@ module.exports = {
   runScraper, scrapeShaiHuludDetector, scrapeDatadogIOCs,
   scrapeAikidoMalwareFeed,
   scrapeOSMQueryLatest,
-  scrapeOSVLightweightAPI, queryOSVBatch,
+  queryOSVBatch,
   getSourceConfidence,
   // Pure utility functions (exported for testing)
   parseCSVLine, parseCSV, extractVersions, parseOSVEntry,

package/src/ioc/updater.js

@@ -66,28 +66,29 @@ async function updateIOCs() {
   mergeIOCs(baseIOCs, yamlStandard);
   console.log('[2/4] YAML IOCs: ' + yamlStandard.packages.length + ' packages, ' + yamlStandard.hashes.length + ' hashes');
 
-  // Step 3: Download additional IOCs from GitHub + OSV API (GenSecAI + DataDog + OSV lightweight + OSM)
+  // Step 3: Download additional IOCs (GenSecAI + DataDog + OSM)
   // Light path: JSON/REST only, NO heavy zip dumps. Designed to be safe at 15min cadence.
-  // For the deep refresh (OSV zip dumps + OSSF + Aikido + GitHub Advisory), use `muaddib scrape` (~5min).
-  const { scrapeShaiHuludDetector, scrapeDatadogIOCs, scrapeOSVLightweightAPI, scrapeOSMQueryLatest } = require('./scraper.js');
-  console.log('[3/4] Downloading GitHub + OSV API + OSM IOCs...');
+  // The OSV MAL- set comes from the deep refresh (`muaddib scrape`, OSV zip dumps + OSSF +
+  // Aikido). The former OSV lightweight source was removed 2026-07 (GAP-2): it POSTed a
+  // nameless OSV /v1/query (HTTP 400 → always 0) and was redundant with the OSV zip dump.
+  const { scrapeShaiHuludDetector, scrapeDatadogIOCs, scrapeOSMQueryLatest } = require('./scraper.js');
+  console.log('[3/4] Downloading GenSecAI + DataDog + OSM IOCs...');
 
-  const [shaiHulud, datadog, osvApi, osmResult] = await Promise.all([
+  const [shaiHulud, datadog, osmResult] = await Promise.all([
     scrapeShaiHuludDetector(),
     scrapeDatadogIOCs(),
-    scrapeOSVLightweightAPI(),
     scrapeOSMQueryLatest()
   ]);
 
   const githubIOCs = {
-    packages: [].concat(shaiHulud.packages, datadog.packages, osvApi, osmResult.packages),
+    packages: [].concat(shaiHulud.packages, datadog.packages, osmResult.packages),
     pypi_packages: (osmResult.pypi_packages || []).slice(),
     hashes: [].concat(shaiHulud.hashes || [], datadog.hashes || []),
     markers: [],
     files: []
   };
   mergeIOCs(baseIOCs, githubIOCs);
-  console.log('     +' + shaiHulud.packages.length + ' GenSecAI, +' + datadog.packages.length + ' DataDog, +' + osvApi.length + ' OSV API, +' + osmResult.packages.length + ' OSM npm, +' + (osmResult.pypi_packages || []).length + ' OSM PyPI');
+  console.log('     +' + shaiHulud.packages.length + ' GenSecAI, +' + datadog.packages.length + ' DataDog, +' + osmResult.packages.length + ' OSM npm, +' + (osmResult.pypi_packages || []).length + ' OSM PyPI');
 
   // Phase 2c (feed health): a feed that previously returned data but now returns 0 is the
   // silent failure mode that froze the OSM feed and collapsed coverage. Raise a one-shot
@@ -95,13 +96,11 @@ async function updateIOCs() {
   // Only feeds that were actually ATTEMPTED are health-checked: OSM is token-gated, so without
   // OSM_API_TOKEN it is SKIPPED (not down) — counting it would raise a false "OSM went dark"
   // alarm in any no-token context (e.g. an ad-hoc `muaddib update`) against the monitor-seeded
-  // baseline. OSV-API is public and volatile; its small counts rarely cross MIN_HEALTHY_BASELINE,
-  // so the engine naturally never establishes an alarm-able baseline for it.
+  // baseline.
   try {
     const feedCounts = {
       'GenSecAI': shaiHulud.packages.length,
-      'DataDog': datadog.packages.length,
-      'OSV-API': osvApi.length
+      'DataDog': datadog.packages.length
     };
     if (process.env.OSM_API_TOKEN) {
       feedCounts['OSM'] = osmResult.packages.length + (osmResult.pypi_packages || []).length;

package/src/ml/llm-detective.js

@@ -46,7 +46,10 @@ const LLM_CONCURRENCY_MAX = 2; // max simultaneous API calls
 const LLM_DAILY_LIMIT_DEFAULT = 100;
 const MAX_SINGLE_FILE_BYTES = 512 * 1024; // skip individual files > 512KB
 
-// Extensions to collect from packages
+// Extensions to collect from packages for LLM context (NOT a detection scanner — this feeds
+// the monitor's opt-in LLM investigation). `.json` is intentionally included (manifest/config
+// context for the model); `.jsx/.tsx` are out of scope here by design. Deliberately distinct
+// from the scanner source-extension lists — do not sync.
 const SOURCE_EXTENSIONS = ['.js', '.mjs', '.cjs', '.ts', '.json', '.py'];
 
 // ── Semaphore (pattern: src/shared/http-limiter.js) ──