muaddib-scanner 2.11.32 → 2.11.34

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.32",
+  "version": "2.11.34",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.32.json → self-scan-v2.11.34.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-05-24T21:02:51.381Z",
+  "timestamp": "2026-05-24T21:03:02.984Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/rules/index.js

@@ -685,6 +685,19 @@ const RULES = {
     references: ['https://attack.mitre.org/techniques/T1036/009/'],
     mitre: 'T1036.009'
   },
+  silent_stealth_process: {
+    id: 'MUADDIB-AST-092',
+    name: 'Silent Stealth Background Process',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    description: 'spawn/fork avec {detached: true, stdio: \'ignore\'} — combinaison qui detache le processus ET silence tous ses I/O. Signal de stealth specifique aux payloads installes via lifecycle (Shai-Hulud) qui doivent survivre a npm install sans laisser de trace dans les logs.',
+    references: [
+      'https://github.com/DataDog/guarddog/blob/main/guarddog/analyzer/sourcecode/npm-silent-process-execution.yml',
+      'https://attack.mitre.org/techniques/T1036/009/',
+      'https://attack.mitre.org/techniques/T1564/'
+    ],
+    mitre: 'T1564'
+  },
   dangerous_call_function: {
     id: 'MUADDIB-AST-005',
     name: 'new Function() Constructor',

package/src/scanner/ast-detectors/constants.js

@@ -16,7 +16,14 @@ const SENSITIVE_STRINGS = [
   'The Second Coming',
   'Goldox-T3chs',
   '/etc/passwd',
-  '/etc/shadow'
+  '/etc/shadow',
+  // F5 — guarddog-inspired cloud credential paths (narrow specific forms
+  // only, to keep FP rate flat: .pgpass/.netrc/.boto are NOT added here
+  // because legitimate JS DB clients reference them. Those still trigger
+  // via dataflow SENSITIVE_PATH_PATTERNS when followed by exfil sinks).
+  '.aws/credentials',
+  '.docker/config.json',
+  '.kube/config'
 ];
 
 // Env vars that are safe and should NOT be flagged (common config/runtime vars)

package/src/scanner/ast-detectors/handle-call-expression.js

@@ -491,6 +491,31 @@ function handleCallExpression(node, ctx) {
           message: `${callName}() with {detached: true} — background process survives parent exit (evasion technique).`,
           file: ctx.relFile
         });
+        // F6 — silent_stealth_process: detached + stdio:'ignore' = full I/O
+        // silence. Combo is a stronger stealth indicator (Shai-Hulud pattern).
+        // Emitted ADDITIONALLY (not replacing) so existing compounds that
+        // depend on detached_process (detached_credential_exfil, binary_dropper)
+        // continue to fire. Inspired by GuardDog's npm-silent-process-execution.yml.
+        const hasStdioIgnore = lastArg.properties.some(p => {
+          if (p.key?.type !== 'Identifier' || p.key.name !== 'stdio') return false;
+          // stdio: 'ignore'
+          if (p.value?.type === 'Literal' && p.value.value === 'ignore') return true;
+          // stdio: ['ignore', 'ignore', 'ignore'] — array form, all elements 'ignore'
+          if (p.value?.type === 'ArrayExpression' && p.value.elements.length > 0) {
+            return p.value.elements.every(el =>
+              el?.type === 'Literal' && el.value === 'ignore'
+            );
+          }
+          return false;
+        });
+        if (hasStdioIgnore) {
+          ctx.threats.push({
+            type: 'silent_stealth_process',
+            severity: 'CRITICAL',
+            message: `${callName}() with {detached: true, stdio: 'ignore'} — fully detached silent background process (stealth payload pattern).`,
+            file: ctx.relFile
+          });
+        }
       }
     }
   }

package/src/scanner/dataflow.js

@@ -1075,6 +1075,12 @@ const SENSITIVE_PATH_PATTERNS = [
   '.atomic', '.metamask', '.ledger-live', '.trezor',
   '.bitcoin', '.monero', '.gnupg',
   '_cacache', '.cache/yarn', '.cache/pip',
+  // F5 — guarddog-inspired cloud/DB/HTTP auth file coverage. Substring
+  // match means '.docker/config' catches '.docker/config.json'. Narrow
+  // patterns (.pgpass/.netrc/.boto) are unique filenames — FP-safe.
+  '.docker/config', '.kube/config',
+  '.pgpass', '.netrc', '.boto',
+  '.azure/', '.gcloud/', '.config/gcloud/',
   // P6: Removed discord, leveldb — data directories, not credential paths.
   // _cacache/.cache kept — real cache poisoning vectors (T1195.002).
   '/proc/mem', '/proc/self',  // v2.10.11: runner secret extraction from process memory (TeamPCP Trivy stealer)

package/src/scanner/temporal-ast-diff.js

@@ -16,7 +16,12 @@ const METADATA_TIMEOUT = 10_000;
 
 const SENSITIVE_PATHS = [
   '/etc/passwd', '/etc/shadow', '.env', '.npmrc', '.ssh',
-  '.aws/credentials', '.bash_history', '.gitconfig'
+  '.aws/credentials', '.bash_history', '.gitconfig',
+  // F5 — guarddog-inspired cloud/DB/HTTP auth files (newly-introduced
+  // access to any of these via a version bump is a strong temporal signal).
+  '.docker/config', '.kube/config',
+  '.pgpass', '.netrc', '.boto',
+  '.azure/credentials', '.gcloud/credentials'
 ];
 
 // Severity mapping for each pattern