npm - muaddib-scanner - Versions diffs - 2.11.76 → 2.11.78 - Mend

muaddib-scanner 2.11.76 → 2.11.78

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (40) hide show

package/.githooks/pre-commit +18 -0
package/README.md +15 -6
package/bin/muaddib.js +18 -4
package/package.json +1 -2
package/{self-scan-v2.11.76.json → self-scan-v2.11.78.json} +1 -1
package/src/commands/interactive.js +5 -6
package/src/commands/safe-install.js +19 -19
package/src/ioc/scraper.js +46 -10
package/src/monitor/daemon.js +39 -28
package/src/monitor/ingestion.js +32 -2
package/src/monitor/queue.js +84 -21
package/src/monitor/scan-queue.js +68 -1
package/src/monitor/state.js +24 -1
package/src/monitor/webhook.js +32 -11
package/src/output/formatter.js +3 -4
package/src/pipeline/executor.js +9 -1
package/src/runtime/daemon.js +27 -28
package/src/runtime/watch.js +7 -7
package/src/sandbox/index.js +11 -9
package/src/scanner/temporal-analysis.js +8 -0
package/src/scanner/temporal-ast-diff.js +5 -0
package/src/utils.js +60 -1
package/.dockerignore +0 -7
package/.env.example +0 -43
package/ml-retrain/auto-labeler/auto_labeler.py +0 -312
package/ml-retrain/auto-labeler/ghsa_checker.py +0 -169
package/ml-retrain/auto-labeler/labeler.py +0 -256
package/ml-retrain/auto-labeler/npm_checker.py +0 -228
package/ml-retrain/auto-labeler/ossf_index.py +0 -178
package/ml-retrain/auto-labeler/requirements.txt +0 -1
package/ml-retrain/confusion-matrix.png +0 -0
package/ml-retrain/model-trees-retrained.js +0 -12
package/ml-retrain/retrain-report.json +0 -225
package/ml-retrain/retrain.py +0 -974
package/sbom.json +0 -0
package/src/ml/train-bundler-detector.py +0 -725
package/src/ml/train-xgboost.py +0 -957
package/tools/export-model-js.py +0 -160
package/tools/requirements-ml.txt +0 -5
package/tools/train-classifier.py +0 -333

package/ml-retrain/retrain-report.json DELETED Viewed

@@ -1,225 +0,0 @@
-{
-  "generated_at": "2026-04-05T06:55:40.434405+00:00",
-  "dataset": {
-    "confirmed_malicious_jsonl": 15,
-    "confirmed_malicious_alert": 0,
-    "confirmed_malicious_no_features": 357,
-    "likely_malicious_excluded": 19,
-    "unconfirmed_as_clean": 898,
-    "pending_excluded": 3971,
-    "clean_no_match": 41064,
-    "datadog_malicious": 14587
-  },
-  "best_hyperparams": {
-    "learning_rate": 0.05,
-    "max_depth": 4,
-    "n_estimators": 300
-  },
-  "grid_search_top5": [
-    {
-      "learning_rate": 0.05,
-      "max_depth": 4,
-      "n_estimators": 300,
-      "mean_f1": 0.9603269422604979
-    },
-    {
-      "learning_rate": 0.2,
-      "max_depth": 4,
-      "n_estimators": 200,
-      "mean_f1": 0.960326424181845
-    },
-    {
-      "learning_rate": 0.2,
-      "max_depth": 4,
-      "n_estimators": 300,
-      "mean_f1": 0.960326424181845
-    },
-    {
-      "learning_rate": 0.2,
-      "max_depth": 6,
-      "n_estimators": 200,
-      "mean_f1": 0.960326424181845
-    },
-    {
-      "learning_rate": 0.2,
-      "max_depth": 6,
-      "n_estimators": 300,
-      "mean_f1": 0.960326424181845
-    }
-  ],
-  "cv_metrics": {
-    "precision": 0.9361788617886179,
-    "recall": 0.9857045026536552,
-    "f1": 0.9603035610040864
-  },
-  "holdout_metrics": {
-    "precision": 0.9243,
-    "recall": 0.9993,
-    "f1": 0.9603,
-    "auc_roc": 0.9989,
-    "fpr": 0.0285,
-    "tpr": 0.9993,
-    "confusion_matrix": [
-      [
-        8154,
-        239
-      ],
-      [
-        2,
-        2918
-      ]
-    ],
-    "tp": 2918,
-    "fp": 239,
-    "fn": 2,
-    "tn": 8154,
-    "top_20_features": [
-      [
-        "unpacked_size_bytes",
-        2504.6235
-      ],
-      [
-        "file_count_total",
-        654.4614
-      ],
-      [
-        "version_count",
-        610.4544
-      ],
-      [
-        "max_single_points",
-        607.4086
-      ],
-      [
-        "score",
-        366.6144
-      ],
-      [
-        "global_risk_score",
-        337.9385
-      ],
-      [
-        "has_tests",
-        171.9633
-      ],
-      [
-        "distinct_threat_types",
-        60.4275
-      ],
-      [
-        "points_concentration",
-        50.8792
-      ],
-      [
-        "has_env_access",
-        31.3521
-      ],
-      [
-        "count_low",
-        28.3965
-      ],
-      [
-        "type_env_access",
-        27.3926
-      ],
-      [
-        "file_score_mean",
-        19.4835
-      ],
-      [
-        "author_package_count",
-        18.6849
-      ],
-      [
-        "package_score",
-        13.6326
-      ],
-      [
-        "count_total",
-        9.09
-      ],
-      [
-        "max_file_score",
-        6.8378
-      ],
-      [
-        "severity_ratio_high",
-        4.6229
-      ],
-      [
-        "has_repository",
-        3.9423
-      ],
-      [
-        "package_age_days",
-        3.6351
-      ]
-    ]
-  },
-  "active_features": [
-    "score",
-    "max_file_score",
-    "package_score",
-    "global_risk_score",
-    "count_total",
-    "count_critical",
-    "count_high",
-    "count_medium",
-    "count_low",
-    "distinct_threat_types",
-    "type_suspicious_dataflow",
-    "type_env_access",
-    "type_sensitive_string",
-    "type_dangerous_call_eval",
-    "type_dangerous_call_exec",
-    "type_dangerous_call_function",
-    "type_obfuscation_detected",
-    "type_high_entropy_string",
-    "type_dynamic_require",
-    "type_dynamic_import",
-    "type_lifecycle_script",
-    "type_typosquat_detected",
-    "type_staged_payload",
-    "type_staged_binary_payload",
-    "type_network_require",
-    "type_sandbox_evasion",
-    "type_credential_regex_harvest",
-    "type_remote_code_load",
-    "type_suspicious_domain",
-    "type_prototype_hook",
-    "type_intent_credential_exfil",
-    "type_crypto_decipher",
-    "type_env_charcode_reconstruction",
-    "type_reverse_shell",
-    "type_mcp_config_injection",
-    "type_js_obfuscation_pattern",
-    "type_other",
-    "has_lifecycle_script",
-    "has_network_access",
-    "has_obfuscation",
-    "has_env_access",
-    "has_eval",
-    "has_staged_payload",
-    "has_typosquat",
-    "has_ioc_match",
-    "has_intent_pair",
-    "has_sandbox_finding",
-    "file_count_with_threats",
-    "file_score_mean",
-    "file_score_max",
-    "severity_ratio_high",
-    "max_single_points",
-    "points_concentration",
-    "unpacked_size_bytes",
-    "reputation_factor",
-    "package_age_days",
-    "weekly_downloads",
-    "version_count",
-    "author_package_count",
-    "has_repository",
-    "readme_size",
-    "file_count_total",
-    "has_tests",
-    "threat_density"
-  ]
-}