muaddib-scanner 2.11.176 → 2.11.178

package/README.md

@@ -345,7 +345,7 @@ npm test
 
 ### Testing
 
-- **<!--stat:tests-->4534<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
+- **<!--stat:tests-->4543<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
 - **56 fuzz tests** - Malformed inputs, ReDoS, unicode, binary
 - **Datadog 17K benchmark** - 14,587 confirmed malware samples (in-scope)
 - **Ground truth validation** - 96 real-world attacks (95.74% TPR@3, 88.30% TPR@20 — v2.11.48 full measure on 94 in-scope)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.176",
+  "version": "2.11.178",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.176.json → self-scan-v2.11.178.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-22T15:08:41.143Z",
+  "timestamp": "2026-07-23T07:53:45.520Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/ioc/scraper.js

@@ -930,65 +930,14 @@ async function scrapeOSVPyPIDataDump() {
   return packages;
 }
 
-// ============================================
-// SOURCE 4: GitHub Advisory Database (Malware)
-// ============================================
-async function scrapeGitHubAdvisory() {
-  console.log('[SCRAPER] GitHub Advisory Database (malware)...');
-  const packages = [];
-  
-  try {
-    const resp = await fetchJSON('https://api.osv.dev/v1/query', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: { package: { ecosystem: 'npm' } }
-    });
-    
-    if (resp.status === 200 && resp.data && resp.data.vulns) {
-      for (const vuln of resp.data.vulns) {
-        // Filter GHSA with malware mention
-        if (vuln.id && vuln.id.startsWith('GHSA-')) {
-          const summary = (vuln.summary || '').toLowerCase();
-          const details = (vuln.details || '').toLowerCase();
-          const isMalware = summary.includes('malware') || 
-                          summary.includes('malicious') ||
-                          details.includes('malware') ||
-                          details.includes('malicious') ||
-                          summary.includes('backdoor') ||
-                          summary.includes('trojan');
-          
-          if (isMalware) {
-            for (const affected of vuln.affected || []) {
-              if (affected.package && affected.package.ecosystem === 'npm') {
-                const versions = extractVersions(affected);
-                for (const ver of versions) {
-                  packages.push({
-                    id: vuln.id,
-                    name: affected.package.name,
-                    version: ver,
-                    severity: 'critical',
-                    confidence: 'high',
-                    source: 'github-advisory',
-                    description: (vuln.summary || 'Malicious package').slice(0, 200),
-                    references: ['https://github.com/advisories/' + vuln.id],
-                    mitre: 'T1195.002',
-                    freshness: createFreshness('github-advisory', 'high')
-                  });
-                }
-              }
-            }
-          }
-        }
-      }
-    }
-    
-    console.log(`[SCRAPER]   ${packages.length} packages`);
-  } catch (e) {
-    console.log(`[SCRAPER]   Error: ${e.message}`);
-  }
-  
-  return packages;
-}
+// SOURCE 4 (GitHub Advisory Database) removed 2026-07 (GAP-2): it POSTed
+// api.osv.dev/v1/query with `{ package: { ecosystem: 'npm' } }` — no package name,
+// which the OSV /v1/query API rejects with HTTP 400 on every call. It therefore
+// returned 0 packages permanently while logging as a normal completion (fictional
+// coverage). Empirically verified that the GHSA-malware it targeted is already
+// 100% covered by the OSV MAL- dump (153/153 pre-snapshot npm GHSA advisories
+// present in the IOC store), so its removal loses no coverage. The GHSA poller
+// (src/ioc/ghsa-poller.js) tracks the coverage denominator independently.
 
 // ============================================
 // MAIN SCRAPER
@@ -1072,7 +1021,6 @@ async function runScraper() {
     scrapeShaiHuludDetector(),
     scrapeDatadogIOCs(),
     scrapeOSSFMaliciousPackages(osvResult.knownIds),
-    scrapeGitHubAdvisory(),
     scrapeOSVPyPIDataDump(),
     scrapeAikidoMalwareFeed(),
     scrapeOSMQueryLatest()
@@ -1081,10 +1029,9 @@ async function runScraper() {
   const shaiHuludResult = results[0];
   const datadogResult = results[1];
   const ossfPackages = results[2];
-  const githubPackages = results[3];
-  const pypiPackages = results[4];
-  const aikidoResult = results[5];
-  const osmResult = results[6];
+  const pypiPackages = results[3];
+  const aikidoResult = results[4];
+  const osmResult = results[5];
 
   // Log aggregated warnings
   if (_noVersionSkipCount > 0) {
@@ -1109,7 +1056,6 @@ async function runScraper() {
     ...shaiHuludResult.packages,
     ...datadogResult.packages,
     ...ossfPackages,
-    ...githubPackages,
     ...aikidoResult.packages,
     ...osmResult.packages
   ];
@@ -1597,43 +1543,14 @@ async function scrapeOSMQueryLatest() {
   return { packages: npmPackages, pypi_packages: pypiPackages };
 }
 
-// ============================================
-// SOURCE 5: OSV.dev Lightweight API
-// Used by `muaddib update` (fast, no zip download)
-// ============================================
-
-/**
- * Lightweight OSV.dev query — fetches recent npm MAL-* entries via REST API.
- * Used by `muaddib update` as a fast complement to the full zip scrape.
- * @returns {Promise<Array>} Parsed IOC package entries
- */
-async function scrapeOSVLightweightAPI() {
-  console.log('[SCRAPER] OSV.dev lightweight API...');
-  const packages = [];
-
-  try {
-    const resp = await fetchJSON('https://api.osv.dev/v1/query', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: { package: { ecosystem: 'npm' } }
-    });
-
-    if (resp.status === 200 && resp.data && resp.data.vulns) {
-      for (const vuln of resp.data.vulns) {
-        if (vuln.id && vuln.id.startsWith('MAL-')) {
-          const parsed = parseOSVEntry(vuln, 'osv-api');
-          for (const p of parsed) packages.push(p);
-        }
-      }
-    }
-
-    console.log('[SCRAPER]   ' + packages.length + ' MAL-* packages from OSV API');
-  } catch (e) {
-    console.log('[SCRAPER]   OSV API error: ' + e.message);
-  }
-
-  return packages;
-}
+// SOURCE 5 (OSV.dev Lightweight API) removed 2026-07 (GAP-2): same defect as
+// SOURCE 4 — it POSTed api.osv.dev/v1/query with no package name (`{ package:
+// { ecosystem: 'npm' } }`), which OSV rejects with HTTP 400, so it returned 0
+// MAL-* packages permanently while `muaddib update` logged "+0 OSV API" as normal.
+// It was also 100% redundant with the OSV MAL- zip dump (scrapeOSVDataDump), which
+// pulls the same MAL- npm set. The `muaddib update` light path keeps its recent-
+// malware coverage via GenSecAI + DataDog + OSM; the authoritative OSV MAL- set
+// comes from the deep `muaddib scrape`.
 
 /**
  * Batch query OSV.dev for specific package names.
@@ -1718,7 +1635,7 @@ module.exports = {
   runScraper, scrapeShaiHuludDetector, scrapeDatadogIOCs,
   scrapeAikidoMalwareFeed,
   scrapeOSMQueryLatest,
-  scrapeOSVLightweightAPI, queryOSVBatch,
+  queryOSVBatch,
   getSourceConfidence,
   // Pure utility functions (exported for testing)
   parseCSVLine, parseCSV, extractVersions, parseOSVEntry,

package/src/ioc/updater.js

@@ -66,28 +66,29 @@ async function updateIOCs() {
   mergeIOCs(baseIOCs, yamlStandard);
   console.log('[2/4] YAML IOCs: ' + yamlStandard.packages.length + ' packages, ' + yamlStandard.hashes.length + ' hashes');
 
-  // Step 3: Download additional IOCs from GitHub + OSV API (GenSecAI + DataDog + OSV lightweight + OSM)
+  // Step 3: Download additional IOCs (GenSecAI + DataDog + OSM)
   // Light path: JSON/REST only, NO heavy zip dumps. Designed to be safe at 15min cadence.
-  // For the deep refresh (OSV zip dumps + OSSF + Aikido + GitHub Advisory), use `muaddib scrape` (~5min).
-  const { scrapeShaiHuludDetector, scrapeDatadogIOCs, scrapeOSVLightweightAPI, scrapeOSMQueryLatest } = require('./scraper.js');
-  console.log('[3/4] Downloading GitHub + OSV API + OSM IOCs...');
+  // The OSV MAL- set comes from the deep refresh (`muaddib scrape`, OSV zip dumps + OSSF +
+  // Aikido). The former OSV lightweight source was removed 2026-07 (GAP-2): it POSTed a
+  // nameless OSV /v1/query (HTTP 400 → always 0) and was redundant with the OSV zip dump.
+  const { scrapeShaiHuludDetector, scrapeDatadogIOCs, scrapeOSMQueryLatest } = require('./scraper.js');
+  console.log('[3/4] Downloading GenSecAI + DataDog + OSM IOCs...');
 
-  const [shaiHulud, datadog, osvApi, osmResult] = await Promise.all([
+  const [shaiHulud, datadog, osmResult] = await Promise.all([
     scrapeShaiHuludDetector(),
     scrapeDatadogIOCs(),
-    scrapeOSVLightweightAPI(),
     scrapeOSMQueryLatest()
   ]);
 
   const githubIOCs = {
-    packages: [].concat(shaiHulud.packages, datadog.packages, osvApi, osmResult.packages),
+    packages: [].concat(shaiHulud.packages, datadog.packages, osmResult.packages),
     pypi_packages: (osmResult.pypi_packages || []).slice(),
     hashes: [].concat(shaiHulud.hashes || [], datadog.hashes || []),
     markers: [],
     files: []
   };
   mergeIOCs(baseIOCs, githubIOCs);
-  console.log('     +' + shaiHulud.packages.length + ' GenSecAI, +' + datadog.packages.length + ' DataDog, +' + osvApi.length + ' OSV API, +' + osmResult.packages.length + ' OSM npm, +' + (osmResult.pypi_packages || []).length + ' OSM PyPI');
+  console.log('     +' + shaiHulud.packages.length + ' GenSecAI, +' + datadog.packages.length + ' DataDog, +' + osmResult.packages.length + ' OSM npm, +' + (osmResult.pypi_packages || []).length + ' OSM PyPI');
 
   // Phase 2c (feed health): a feed that previously returned data but now returns 0 is the
   // silent failure mode that froze the OSM feed and collapsed coverage. Raise a one-shot
@@ -95,13 +96,11 @@ async function updateIOCs() {
   // Only feeds that were actually ATTEMPTED are health-checked: OSM is token-gated, so without
   // OSM_API_TOKEN it is SKIPPED (not down) — counting it would raise a false "OSM went dark"
   // alarm in any no-token context (e.g. an ad-hoc `muaddib update`) against the monitor-seeded
-  // baseline. OSV-API is public and volatile; its small counts rarely cross MIN_HEALTHY_BASELINE,
-  // so the engine naturally never establishes an alarm-able baseline for it.
+  // baseline.
   try {
     const feedCounts = {
       'GenSecAI': shaiHulud.packages.length,
-      'DataDog': datadog.packages.length,
-      'OSV-API': osvApi.length
+      'DataDog': datadog.packages.length
     };
     if (process.env.OSM_API_TOKEN) {
       feedCounts['OSM'] = osmResult.packages.length + (osmResult.pypi_packages || []).length;

package/src/scanner/dataflow.js

@@ -474,6 +474,29 @@ function analyzeFile(content, filePath, basePath) {
         }
       }
 
+      // Stream-based credential read: fs.createReadStream(<sensitive path>) is the
+      // stream equivalent of readFileSync. Registering it as a credential_read source
+      // closes the .pipe() exfil gap — createReadStream('/.ssh/id_rsa').pipe(net.connect(...))
+      // now scores the same as the readFileSync + socket.write form (the co-occurring
+      // network sink from the .pipe() argument — net.connect/http.request — is already
+      // detected by the MemberExpression sink handler below). Strictly gated on
+      // isCredentialPath: FP-measured 0/745 benign packages (createReadStream of a
+      // sensitive path is absent from legitimate code; the benign servers'
+      // createReadStream('public/index.html').pipe(res) is not sensitive-sourced, and
+      // the .pipe(res)/.pipe(createWriteStream) sinks are not network sinks). Deliberately
+      // NOT added to MODULE_SOURCE_METHODS to avoid the alias path, which does not
+      // re-check the path and would flag a non-sensitive aliased read.
+      if (callName === 'createReadStream' || callName === 'fs.createReadStream') {
+        const arg = node.arguments[0];
+        if (arg && isCredentialPath(arg, sensitivePathVars)) {
+          sources.push({
+            type: 'credential_read',
+            name: callName,
+            line: node.loc?.start?.line
+          });
+        }
+      }
+
       // fs.promises.readFile(path) — 3-level member chain
       if (node.callee.type === 'MemberExpression' &&
           node.callee.object?.type === 'MemberExpression') {

package/stats.json

@@ -1,6 +1,6 @@
 {
   "_comment": "GENERATED by scripts/collect-stats.js — do not edit by hand. Run `npm run docs:stats`.",
-  "version": "2.11.176",
+  "version": "2.11.178",
   "scanners": 22,
   "rulesTotal": 277,
   "rulesCore": 272,
@@ -12,5 +12,5 @@
   "moduleGraph": 9,
   "pythonAstDetectors": 6,
   "testFiles": 152,
-  "tests": 4534
+  "tests": 4543
 }