muaddib-scanner 2.11.178 → 2.11.179

package/README.md

@@ -345,7 +345,7 @@ npm test
 
 ### Testing
 
-- **<!--stat:tests-->4543<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
+- **<!--stat:tests-->4545<!--/stat:tests--> tests** across <!--stat:testFiles-->152<!--/stat:testFiles--> modular test files
 - **56 fuzz tests** - Malformed inputs, ReDoS, unicode, binary
 - **Datadog 17K benchmark** - 14,587 confirmed malware samples (in-scope)
 - **Ground truth validation** - 96 real-world attacks (95.74% TPR@3, 88.30% TPR@20 — v2.11.48 full measure on 94 in-scope)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.178",
+  "version": "2.11.179",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.178.json → self-scan-v2.11.179.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-07-23T07:53:45.520Z",
+  "timestamp": "2026-07-23T09:11:36.373Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/scoring.js

@@ -1683,7 +1683,20 @@ function calculateRiskScore(deduped, intentResult) {
   // confirmed Python install-time malware reaches its true score and separates from the
   // benign 25-35 cluster (which carries no import-time-exec signal).
   const _hasPyPIImportRCE = deduped.some(t => PYPI_IMPORT_TIME_RCE_TYPES.has(t.type));
-  if (!_hasLifecycle && !_hasHC && !_hasCompound && !_hasStagedC2 && !_hasPyPIImportRCE) {
+  // Track E (PyPI unblock, phase 2): a CRITICAL string-IOC match is a campaign-unique
+  // artifact (inclusion criteria in iocs/string-iocs.yaml — unique stagers / XOR keys /
+  // C2 markers; single match = decisive by construction). The hash/name IOC matches
+  // already escape this ceiling via applySingleFireCriticalFloor, but ioc_string_match
+  // is not single-fire, so a lifecycle-less package (the PyPI shape: recon/trapdoor
+  // libs with no npm install hook) was buried at 35 even at globalRiskScore 100
+  // (GT-099 eth-security-auditor). Measured 0 ioc_string_match across 869 benign
+  // packages (545 curated + 200 random npm + 124 PyPI) — zero corpus FP cost.
+  // HIGH-severity strings (weaker, shared artifacts) deliberately do NOT void the cap.
+  const _hasCriticalStringIOC = deduped.some(t =>
+    t.type === 'ioc_string_match' && t.severity === 'CRITICAL'
+  );
+  if (!_hasLifecycle && !_hasHC && !_hasCompound && !_hasStagedC2 && !_hasPyPIImportRCE &&
+      !_hasCriticalStringIOC) {
     riskScore = Math.min(riskScore, 35);
   }
 

package/stats.json

@@ -1,6 +1,6 @@
 {
   "_comment": "GENERATED by scripts/collect-stats.js — do not edit by hand. Run `npm run docs:stats`.",
-  "version": "2.11.178",
+  "version": "2.11.179",
   "scanners": 22,
   "rulesTotal": 277,
   "rulesCore": 272,
@@ -12,5 +12,5 @@
   "moduleGraph": 9,
   "pythonAstDetectors": 6,
   "testFiles": 152,
-  "tests": 4543
+  "tests": 4545
 }