muaddib-scanner 2.11.51 → 2.11.52

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.51",
+  "version": "2.11.52",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.51.json → self-scan-v2.11.52.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-05-26T20:25:43.730Z",
+  "timestamp": "2026-05-26T21:21:36.874Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/monitor/ingestion.js

@@ -141,7 +141,10 @@ async function getWeeklyDownloads(packageName) {
   }
   try {
     const url = `https://api.npmjs.org/downloads/point/last-week/${encodeURIComponent(packageName)}`;
-    const body = await httpsGet(url, 3000);
+    // Routed via _deps so tests can stub the downloads endpoint independently
+    // of the registry endpoint (Stage 2.1 added parallel-fetch from
+    // preResolveNpmBatch).
+    const body = await _deps.httpsGet(url, 3000);
     const data = JSON.parse(body);
     const downloads = typeof data.downloads === 'number' ? data.downloads : -1;
     downloadsCache.set(packageName, { downloads, fetchedAt: Date.now() });
@@ -429,8 +432,23 @@ async function getNpmLatestTarball(packageName) {
       version: '', tarball: null, unpackedSize: 0, scripts: {},
       homepage: '', description: '',
       latestTagVersion: null, recentVersions: [],
+      age_days: null, version_count: 0,
     };
   }
+  // Stage 2.1 — extract reputation signals from the packument we already have,
+  // so triageRisk in queue.js doesn't have to refetch metadata via
+  // getPackageMetadata. Two fields are derivable from the packument alone:
+  //   - age_days   : time.created (package creation timestamp)
+  //   - version_count : Object.keys(versions).length (excludes unpublished
+  //                     tombstones kept only in `time`)
+  // weekly_downloads requires a separate api.npmjs.org call and is fetched in
+  // parallel by preResolveNpmBatch (it has its own cache + no semaphore).
+  const createdAt = (packument && packument.time && packument.time.created) || null;
+  result.age_days = createdAt
+    ? Math.floor((Date.now() - new Date(createdAt).getTime()) / 86_400_000)
+    : null;
+  result.version_count = (packument && packument.versions)
+    ? Object.keys(packument.versions).length : 0;
   return result;
 }
 
@@ -465,15 +483,30 @@ async function preResolveNpmBatch(items, stats, scanQueue) {
     await Promise.all(chunk.map(async (item) => {
       if (item.tarballUrl) { alreadyResolved++; return; }
       try {
-        const npmInfo = await getNpmLatestTarball(item.name);
+        // Stage 2.1 — fetch downloads in parallel with the packument. The
+        // downloads endpoint (api.npmjs.org) is not on the registry semaphore
+        // and has its own internal cache, so this is effectively free in the
+        // warm-cache case and adds at most one parallel HTTP otherwise.
+        const [npmInfo, weeklyDownloads] = await Promise.all([
+          getNpmLatestTarball(item.name),
+          getWeeklyDownloads(item.name).catch(() => null)
+        ]);
         if (npmInfo && npmInfo.tarball) {
           item.tarballUrl = npmInfo.tarball;
           if (!item.version) item.version = npmInfo.version || '';
           if (!item.unpackedSize) item.unpackedSize = npmInfo.unpackedSize || 0;
           if (!item.registryScripts) item.registryScripts = npmInfo.scripts || null;
+          // weekly_downloads is best-effort. getWeeklyDownloads returns -1 on
+          // failure; normalize that to null so triageRisk treats it as missing
+          // (rather than silently biasing the reputation factor toward "suspect").
+          npmInfo.weekly_downloads = (typeof weeklyDownloads === 'number' && weeklyDownloads >= 0)
+            ? weeklyDownloads : null;
           // Stash full packument-derived metadata for resolveTarballAndScan so
           // the worker can run ATO-signature, burst-extras, and fast-track logic
-          // without a second registry call.
+          // without a second registry call. Stage 2.1 enriches this with
+          // age_days / version_count (from getNpmLatestTarball) and
+          // weekly_downloads (from getWeeklyDownloads) so the triage block in
+          // queue.js can read meta directly without re-fetching.
           item._npmInfo = npmInfo;
           resolved++;
         } else {

package/src/monitor/queue.js

@@ -128,6 +128,22 @@ const LARGE_PACKAGE_SIZE = 10 * 1024 * 1024; // 10MB
 const FIRST_PUBLISH_SANDBOX_MAX_QUEUE = parseInt(process.env.MUADDIB_FIRST_PUBLISH_SANDBOX_MAX_QUEUE, 10) || 10;
 const FIRST_PUBLISH_SANDBOX_ENABLED = process.env.MUADDIB_FIRST_PUBLISH_SANDBOX !== '0';
 
+// Stage 3 — sandbox gate. Static-score threshold below which T1b/T2 packages
+// are NOT sandboxed (static result alone is authoritative). Tightens the prior
+// "T1b sandbox if score >= 25 or queue < 20" to remove low-signal sandbox runs
+// that consume slots without producing actionable findings (the dominant cost
+// in the queue-saturation diagnostic). Validated by axon-enterprise@1.0.0
+// (static 52, sandbox confirmed 100) — gate >= 40 still catches it.
+// T1a (high-confidence malice) bypasses this gate; it's mandatory.
+// Override via env var to widen the gate (lower threshold) for a short
+// rollback window without redeploying. Clamped to [0, 100].
+function computeSandboxScoreThreshold(envValue) {
+  const parsed = parseInt(envValue, 10);
+  const value = Number.isFinite(parsed) ? parsed : 40;
+  return Math.max(0, Math.min(100, value));
+}
+const SANDBOX_SCORE_THRESHOLD = computeSandboxScoreThreshold(process.env.MUADDIB_SANDBOX_SCORE_THRESHOLD);
+
 // --- Bundled tooling false-positive filter ---
 
 const KNOWN_BUNDLED_FILES = ['yarn.js', 'webpack.js', 'terser.js', 'esbuild.js', 'polyfills.js'];
@@ -738,14 +754,16 @@ async function scanPackage(name, version, ecosystem, tarballUrl, registryMeta, s
         }
 
         // T1a: mandatory sandbox (HC malice types, TIER1_TYPES non-LOW, lifecycle + intent compound)
-        // T1b: conditional sandbox (HIGH/CRITICAL without HC type — bundler FP zone)
-        //       → sandbox only if score >= 25 (significant risk) or queue pressure is low
-        // T2: sandbox if queue < 50 (as before)
+        // T1b: conditional sandbox — gated by SANDBOX_SCORE_THRESHOLD (Stage 3).
+        //       Previously gated at >= 25 OR queue < 20; tightened to >= 40 by
+        //       default because the 25-39 band produced no decisive sandbox
+        //       findings in 4 months of prod data (axon-enterprise was at 52).
+        // T2:  conditional sandbox — same score gate AND queue < 50.
         let sandboxResult = null;
         const shouldSandbox = !skipSandboxLargePackage && isSandboxEnabled() && sandboxAvailable && (
           tier === '1a' ||
-          (tier === '1b' && (riskScore >= 25 || scanQueue.length < 20)) ||
-          (tier === 2 && scanQueue.length < 50)
+          (tier === '1b' && riskScore >= SANDBOX_SCORE_THRESHOLD) ||
+          (tier === 2 && riskScore >= SANDBOX_SCORE_THRESHOLD && scanQueue.length < 50)
         );
 
         if (shouldSandbox) {
@@ -813,8 +831,12 @@ async function scanPackage(name, version, ecosystem, tarballUrl, registryMeta, s
           } catch (err) {
             console.error(`[MONITOR] SANDBOX error for ${name}@${version}: ${err.message}`);
           }
-        } else if (tier === '1b' && sandboxAvailable) {
-          console.log(`[MONITOR] SANDBOX DEFERRED (T1b, score=${riskScore} < 25, queue ${scanQueue.length} >= 20): ${name}@${version}`);
+        } else if (tier === '1b' && sandboxAvailable && riskScore >= SANDBOX_SCORE_THRESHOLD) {
+          // Stage 3 — defer only when the score crosses the gate. Below the
+          // threshold, sandbox is skipped entirely (static result is final).
+          // This stops the deferred-queue from filling with low-score items
+          // that would never produce decisive sandbox findings.
+          console.log(`[MONITOR] SANDBOX DEFERRED (T1b, score=${riskScore}, queue ${scanQueue.length}): ${name}@${version}`);
           enqueueDeferred({
             name, version, ecosystem, tier, riskScore, tarballUrl,
             enqueuedAt: Date.now(),
@@ -823,10 +845,14 @@ async function scanPackage(name, version, ecosystem, tarballUrl, registryMeta, s
             retries: 0
           });
           stats.sandboxDeferred = (stats.sandboxDeferred || 0) + 1;
+        } else if (tier === '1b' && sandboxAvailable) {
+          // Below SANDBOX_SCORE_THRESHOLD — no sandbox, no defer.
+          console.log(`[MONITOR] SANDBOX GATED (T1b, score=${riskScore} < ${SANDBOX_SCORE_THRESHOLD}): ${name}@${version}`);
+          stats.sandboxGated = (stats.sandboxGated || 0) + 1;
         } else if (tier === '1b') {
           console.log(`[MONITOR] SANDBOX SKIPPED (T1b, no Docker): ${name}@${version}`);
-        } else if (tier === 2 && sandboxAvailable) {
-          console.log(`[MONITOR] SANDBOX DEFERRED (T2, queue ${scanQueue.length} >= 50): ${name}@${version}`);
+        } else if (tier === 2 && sandboxAvailable && riskScore >= SANDBOX_SCORE_THRESHOLD) {
+          console.log(`[MONITOR] SANDBOX DEFERRED (T2, score=${riskScore}, queue ${scanQueue.length}): ${name}@${version}`);
           enqueueDeferred({
             name, version, ecosystem, tier, riskScore, tarballUrl,
             enqueuedAt: Date.now(),
@@ -835,6 +861,11 @@ async function scanPackage(name, version, ecosystem, tarballUrl, registryMeta, s
             retries: 0
           });
           stats.sandboxDeferred = (stats.sandboxDeferred || 0) + 1;
+        } else if (tier === 2 && sandboxAvailable) {
+          // Below SANDBOX_SCORE_THRESHOLD — T2 was already passive; staying
+          // static-only matches the existing T3 behaviour.
+          console.log(`[MONITOR] SANDBOX GATED (T2, score=${riskScore} < ${SANDBOX_SCORE_THRESHOLD}): ${name}@${version}`);
+          stats.sandboxGated = (stats.sandboxGated || 0) + 1;
         } else if (tier === 2) {
           console.log(`[MONITOR] SANDBOX SKIPPED (T2, no Docker): ${name}@${version}`);
         }
@@ -1295,10 +1326,23 @@ async function resolveTarballAndScan(item, stats, dailyAlerts, recentlyScanned,
   if (triageMode !== 'off' && !item.fastTrack) {
     let triageMeta = null;
     if (item.ecosystem === 'npm') {
-      try {
-        const { getPackageMetadata } = require('../scanner/npm-registry.js');
-        triageMeta = await getPackageMetadata(item.name);
-      } catch { /* metadata unavailable → triageRisk will see null and pick 'full' */ }
+      // Stage 2.1 — Stage 1 pre-resolve already fetched the packument and
+      // (Stage 2.1) computed age_days + version_count, plus parallel-fetched
+      // weekly_downloads. Read those directly to skip the second
+      // registry round-trip via getPackageMetadata. Fallback to the lazy
+      // metadata fetch only when _npmInfo is absent (lazy-resolve path).
+      if (item._npmInfo) {
+        triageMeta = {
+          age_days: item._npmInfo.age_days,
+          version_count: item._npmInfo.version_count,
+          weekly_downloads: item._npmInfo.weekly_downloads,
+        };
+      } else {
+        try {
+          const { getPackageMetadata } = require('../scanner/npm-registry.js');
+          triageMeta = await getPackageMetadata(item.name);
+        } catch { /* metadata unavailable → triageRisk will see null and pick 'full' */ }
+      }
     } else if (item.ecosystem === 'pypi') {
       triageMeta = item._pypiInfo || null;
     }
@@ -1413,6 +1457,8 @@ module.exports = {
   LARGE_PACKAGE_SIZE,
   FIRST_PUBLISH_SANDBOX_MAX_QUEUE,
   FIRST_PUBLISH_SANDBOX_ENABLED,
+  SANDBOX_SCORE_THRESHOLD,
+  computeSandboxScoreThreshold,
   KNOWN_BUNDLED_FILES,
   KNOWN_BUNDLED_PATHS,
   ML_EXCLUDED_DIRS,