muaddib-scanner 2.11.177 → 2.11.179

package/README.md

@@ -345,7 +345,7 @@ npm test
 
 ### Testing
 
-- **<!--stat:tests-->4539<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
+- **<!--stat:tests-->4545<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
 - **56 fuzz tests** - Malformed inputs, ReDoS, unicode, binary
 - **Datadog 17K benchmark** - 14,587 confirmed malware samples (in-scope)
 - **Ground truth validation** - 96 real-world attacks (95.74% TPR@3, 88.30% TPR@20 — v2.11.48 full measure on 94 in-scope)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.177",
+  "version": "2.11.179",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.177.json → self-scan-v2.11.179.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-22T22:32:17.558Z",
+  "timestamp": "2026-07-23T09:11:36.373Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/scanner/dataflow.js

@@ -474,6 +474,29 @@ function analyzeFile(content, filePath, basePath) {
         }
       }
 
+      // Stream-based credential read: fs.createReadStream(<sensitive path>) is the
+      // stream equivalent of readFileSync. Registering it as a credential_read source
+      // closes the .pipe() exfil gap — createReadStream('/.ssh/id_rsa').pipe(net.connect(...))
+      // now scores the same as the readFileSync + socket.write form (the co-occurring
+      // network sink from the .pipe() argument — net.connect/http.request — is already
+      // detected by the MemberExpression sink handler below). Strictly gated on
+      // isCredentialPath: FP-measured 0/745 benign packages (createReadStream of a
+      // sensitive path is absent from legitimate code; the benign servers'
+      // createReadStream('public/index.html').pipe(res) is not sensitive-sourced, and
+      // the .pipe(res)/.pipe(createWriteStream) sinks are not network sinks). Deliberately
+      // NOT added to MODULE_SOURCE_METHODS to avoid the alias path, which does not
+      // re-check the path and would flag a non-sensitive aliased read.
+      if (callName === 'createReadStream' || callName === 'fs.createReadStream') {
+        const arg = node.arguments[0];
+        if (arg && isCredentialPath(arg, sensitivePathVars)) {
+          sources.push({
+            type: 'credential_read',
+            name: callName,
+            line: node.loc?.start?.line
+          });
+        }
+      }
+
       // fs.promises.readFile(path) — 3-level member chain
       if (node.callee.type === 'MemberExpression' &&
           node.callee.object?.type === 'MemberExpression') {

package/src/scoring.js

@@ -1683,7 +1683,20 @@ function calculateRiskScore(deduped, intentResult) {
   // confirmed Python install-time malware reaches its true score and separates from the
   // benign 25-35 cluster (which carries no import-time-exec signal).
   const _hasPyPIImportRCE = deduped.some(t => PYPI_IMPORT_TIME_RCE_TYPES.has(t.type));
-  if (!_hasLifecycle && !_hasHC && !_hasCompound && !_hasStagedC2 && !_hasPyPIImportRCE) {
+  // Track E (PyPI unblock, phase 2): a CRITICAL string-IOC match is a campaign-unique
+  // artifact (inclusion criteria in iocs/string-iocs.yaml — unique stagers / XOR keys /
+  // C2 markers; single match = decisive by construction). The hash/name IOC matches
+  // already escape this ceiling via applySingleFireCriticalFloor, but ioc_string_match
+  // is not single-fire, so a lifecycle-less package (the PyPI shape: recon/trapdoor
+  // libs with no npm install hook) was buried at 35 even at globalRiskScore 100
+  // (GT-099 eth-security-auditor). Measured 0 ioc_string_match across 869 benign
+  // packages (545 curated + 200 random npm + 124 PyPI) — zero corpus FP cost.
+  // HIGH-severity strings (weaker, shared artifacts) deliberately do NOT void the cap.
+  const _hasCriticalStringIOC = deduped.some(t =>
+    t.type === 'ioc_string_match' && t.severity === 'CRITICAL'
+  );
+  if (!_hasLifecycle && !_hasHC && !_hasCompound && !_hasStagedC2 && !_hasPyPIImportRCE &&
+      !_hasCriticalStringIOC) {
     riskScore = Math.min(riskScore, 35);
   }
 

package/stats.json

@@ -1,6 +1,6 @@
 {
   "_comment": "GENERATED by scripts/collect-stats.js — do not edit by hand. Run `npm run docs:stats`.",
-  "version": "2.11.177",
+  "version": "2.11.179",
   "scanners": 22,
   "rulesTotal": 277,
   "rulesCore": 272,
@@ -12,5 +12,5 @@
   "moduleGraph": 9,
   "pythonAstDetectors": 6,
   "testFiles": 152,
-  "tests": 4539
+  "tests": 4545
 }