muaddib-scanner 2.11.32 → 2.11.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.32",
+  "version": "2.11.33",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.32.json → self-scan-v2.11.33.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-05-24T21:02:51.381Z",
+  "timestamp": "2026-05-24T21:02:55.214Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/rules/index.js

@@ -685,6 +685,19 @@ const RULES = {
     references: ['https://attack.mitre.org/techniques/T1036/009/'],
     mitre: 'T1036.009'
   },
+  silent_stealth_process: {
+    id: 'MUADDIB-AST-092',
+    name: 'Silent Stealth Background Process',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    description: 'spawn/fork avec {detached: true, stdio: \'ignore\'} — combinaison qui detache le processus ET silence tous ses I/O. Signal de stealth specifique aux payloads installes via lifecycle (Shai-Hulud) qui doivent survivre a npm install sans laisser de trace dans les logs.',
+    references: [
+      'https://github.com/DataDog/guarddog/blob/main/guarddog/analyzer/sourcecode/npm-silent-process-execution.yml',
+      'https://attack.mitre.org/techniques/T1036/009/',
+      'https://attack.mitre.org/techniques/T1564/'
+    ],
+    mitre: 'T1564'
+  },
   dangerous_call_function: {
     id: 'MUADDIB-AST-005',
     name: 'new Function() Constructor',

package/src/scanner/ast-detectors/handle-call-expression.js

@@ -491,6 +491,31 @@ function handleCallExpression(node, ctx) {
           message: `${callName}() with {detached: true} — background process survives parent exit (evasion technique).`,
           file: ctx.relFile
         });
+        // F6 — silent_stealth_process: detached + stdio:'ignore' = full I/O
+        // silence. Combo is a stronger stealth indicator (Shai-Hulud pattern).
+        // Emitted ADDITIONALLY (not replacing) so existing compounds that
+        // depend on detached_process (detached_credential_exfil, binary_dropper)
+        // continue to fire. Inspired by GuardDog's npm-silent-process-execution.yml.
+        const hasStdioIgnore = lastArg.properties.some(p => {
+          if (p.key?.type !== 'Identifier' || p.key.name !== 'stdio') return false;
+          // stdio: 'ignore'
+          if (p.value?.type === 'Literal' && p.value.value === 'ignore') return true;
+          // stdio: ['ignore', 'ignore', 'ignore'] — array form, all elements 'ignore'
+          if (p.value?.type === 'ArrayExpression' && p.value.elements.length > 0) {
+            return p.value.elements.every(el =>
+              el?.type === 'Literal' && el.value === 'ignore'
+            );
+          }
+          return false;
+        });
+        if (hasStdioIgnore) {
+          ctx.threats.push({
+            type: 'silent_stealth_process',
+            severity: 'CRITICAL',
+            message: `${callName}() with {detached: true, stdio: 'ignore'} — fully detached silent background process (stealth payload pattern).`,
+            file: ctx.relFile
+          });
+        }
       }
     }
   }