muaddib-scanner 2.11.86 → 2.11.88

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.86",
+  "version": "2.11.88",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.86.json → self-scan-v2.11.88.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-06-10T23:35:51.270Z",
+  "timestamp": "2026-06-11T08:02:35.162Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/ml/feature-extractor.js

@@ -1090,7 +1090,11 @@ const CASCADE_TYPES = new Set([
   'proxy_data_intercept',         // MUADDIB-AST-043
   'remote_code_load',             // MUADDIB-AST-040
   'obfuscation_detected',         // src/scanner/obfuscation.js
-  'js_obfuscation_pattern'
+  'js_obfuscation_pattern',
+  // FPR audit 2026-06: these two also fire on legitimate minified vendor bundles
+  // (string-rewrite tables, base64 blobs) and were escaping the bundle cap.
+  'string_mutation_obfuscation',
+  'high_entropy_string'
 ]);
 const CASCADE_MIN_TYPES = 3;
 const CASCADE_MIN_FILE_BYTES = 20 * 1024;

package/src/monitor/classify.js

@@ -175,11 +175,29 @@ function isSuspectClassification(result) {
   if (hasLifecycleWithIntent(result)) {
     return { suspect: true, tier: '1a' };
   }
+  // IOC / known-malicious matches (known_malicious_package/hash, pypi_malicious_package,
+  // shai_hulud_marker/backdoor) are definite malware → mandatory sandbox, unconditionally.
+  // Promotes them out of the (now corroboration-gated) tier-1b zone so the tightening
+  // below can never drop a confirmed IOC hit, regardless of score.
+  if (hasIOCMatch(result)) {
+    return { suspect: true, tier: '1a' };
+  }
 
-  // Tier 1b: HIGH/CRITICAL severity without HC type or TIER1_TYPES
-  // Typical bundler FP zone (eval in webpack, minification as obfuscation, etc.)
-  // Sandbox conditional on score >= 25 or low queue pressure
-  if (result.summary.critical > 0 || result.summary.high > 0) {
+  // Tier 1b: HIGH/CRITICAL severity without HC type or TIER1_TYPES — the heuristic
+  // FP zone (a lone non-HC HIGH heuristic like compromised_email_domain /
+  // prototype_pollution / trusted_new_dependency flips a package to suspect even at
+  // score ~3). FPR audit 2026-06 (200-pkg blind adjudication, ~99% FP): a SINGLE
+  // non-HC HIGH finding made ~half of all "suspect" packages, almost all FP. It is
+  // no longer sufficient on its own — require corroboration: a real alert score
+  // (>=20), a compound, or >=2 DISTINCT HIGH/CRITICAL types. HC types / TIER1_TYPES /
+  // lifecycle+intent already returned tier 1a above, and Track R floors confirmed
+  // malice at 20, so detection is preserved; lone-heuristic packages fall through to
+  // the 2+-distinct-type tier 2/3 logic (and to CLEAN when they carry one finding).
+  const _hcSevere = result.threats.filter(t => t.severity === 'HIGH' || t.severity === 'CRITICAL');
+  const _highCritTypes = new Set(_hcSevere.map(t => t.type));
+  const _hasCompound = result.threats.some(t => t.compound === true);
+  const _score = (result.summary && typeof result.summary.riskScore === 'number') ? result.summary.riskScore : 0;
+  if (_hcSevere.length > 0 && (_score >= 20 || _hasCompound || _highCritTypes.size >= 2)) {
     return { suspect: true, tier: '1b' };
   }
 

package/src/rules/index.js

@@ -3348,7 +3348,7 @@ const RULES = {
   trusted_new_dependency: {
     id: 'MUADDIB-TRUSTED-002',
     name: 'Trusted Package Added New Dependency',
-    severity: 'HIGH',
+    severity: 'MEDIUM',
     confidence: 'medium',
     domain: 'malware',
     description: 'Un package TRUSTED (>50k downloads/semaine) a ajoute une nouvelle dependance connue (>7 jours) dans un bump de version — changement de surface d\'attaque a verifier.',

package/src/scanner/trusted-dep-diff.js

@@ -154,7 +154,12 @@ async function checkDepDiff(name, newVersion) {
         const ageDays = Math.floor(ageMs / 86400000);
         findings.push({
           type: 'trusted_new_dependency',
-          severity: 'HIGH',
+          // FPR audit 2026-06: a trusted package adding an ESTABLISHED (>=7d) dependency
+          // is an audit/surface-change signal ("a verifier"), not malice — it produced
+          // ~169 FPs. Downgraded HIGH->MEDIUM so it no longer alone meets the tier-1b
+          // corroboration bar. The real account-takeover case (new/unknown dep <7d) is
+          // the separate CRITICAL `trusted_new_unknown_dependency` (HC type) and is intact.
+          severity: 'MEDIUM',
           confidence: 'medium',
           file: 'package.json',
           message: `TRUSTED package ${name} added new dependency ${dep} (age: ${ageDays}d) in version ${prevVersion} → ${newVersion}`,