muaddib-scanner 2.11.177 → 2.11.178

package/README.md

@@ -345,7 +345,7 @@ npm test
 
 ### Testing
 
-- **<!--stat:tests-->4539<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
+- **<!--stat:tests-->4543<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
 - **56 fuzz tests** - Malformed inputs, ReDoS, unicode, binary
 - **Datadog 17K benchmark** - 14,587 confirmed malware samples (in-scope)
 - **Ground truth validation** - 96 real-world attacks (95.74% TPR@3, 88.30% TPR@20 — v2.11.48 full measure on 94 in-scope)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.177",
+  "version": "2.11.178",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.177.json → self-scan-v2.11.178.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-22T22:32:17.558Z",
+  "timestamp": "2026-07-23T07:53:45.520Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/scanner/dataflow.js

@@ -474,6 +474,29 @@ function analyzeFile(content, filePath, basePath) {
         }
       }
 
+      // Stream-based credential read: fs.createReadStream(<sensitive path>) is the
+      // stream equivalent of readFileSync. Registering it as a credential_read source
+      // closes the .pipe() exfil gap — createReadStream('/.ssh/id_rsa').pipe(net.connect(...))
+      // now scores the same as the readFileSync + socket.write form (the co-occurring
+      // network sink from the .pipe() argument — net.connect/http.request — is already
+      // detected by the MemberExpression sink handler below). Strictly gated on
+      // isCredentialPath: FP-measured 0/745 benign packages (createReadStream of a
+      // sensitive path is absent from legitimate code; the benign servers'
+      // createReadStream('public/index.html').pipe(res) is not sensitive-sourced, and
+      // the .pipe(res)/.pipe(createWriteStream) sinks are not network sinks). Deliberately
+      // NOT added to MODULE_SOURCE_METHODS to avoid the alias path, which does not
+      // re-check the path and would flag a non-sensitive aliased read.
+      if (callName === 'createReadStream' || callName === 'fs.createReadStream') {
+        const arg = node.arguments[0];
+        if (arg && isCredentialPath(arg, sensitivePathVars)) {
+          sources.push({
+            type: 'credential_read',
+            name: callName,
+            line: node.loc?.start?.line
+          });
+        }
+      }
+
       // fs.promises.readFile(path) — 3-level member chain
       if (node.callee.type === 'MemberExpression' &&
           node.callee.object?.type === 'MemberExpression') {

package/stats.json

@@ -1,6 +1,6 @@
 {
   "_comment": "GENERATED by scripts/collect-stats.js — do not edit by hand. Run `npm run docs:stats`.",
-  "version": "2.11.177",
+  "version": "2.11.178",
   "scanners": 22,
   "rulesTotal": 277,
   "rulesCore": 272,
@@ -12,5 +12,5 @@
   "moduleGraph": 9,
   "pythonAstDetectors": 6,
   "testFiles": 152,
-  "tests": 4539
+  "tests": 4543
 }