muaddib-scanner 2.11.89 → 2.11.91

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.89",
+  "version": "2.11.91",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/{self-scan-v2.11.89.json → self-scan-v2.11.91.json}

@@ -1,6 +1,6 @@
 {
   "target": "node_modules",
-  "timestamp": "2026-06-11T08:17:41.614Z",
+  "timestamp": "2026-06-11T10:21:58.953Z",
   "threats": [
     {
       "type": "string_mutation_obfuscation",

package/src/monitor/state.js

@@ -975,6 +975,14 @@ const SCAN_LEDGER_OUTCOMES = new Set([
   'static_timeout', 'size_skip', 'dropped', 'error'
 ]);
 
+// Benign terminal verdicts — the ledger-headline "clean" bucket. Mirrors the
+// in-memory stats.clean semantics (every path that increments stats.clean writes
+// one of these outcomes). sandbox_inconclusive/unconfirmed and size_skip are
+// deliberately in neither bucket: scanned but not vouched-for.
+const CLEAN_LEDGER_OUTCOMES = new Set([
+  'clean', 'clean_low_signal', 'clean_tooling', 'ml_clean', 'llm_benign'
+]);
+
 /**
  * Append one per-scan ledger entry recording the terminal outcome of a dequeued
  * package. Best-effort: NEVER throws (a ledger failure must not break scanning).
@@ -1112,6 +1120,12 @@ function computeLedgerRollup(sinceTs, opts = {}) {
   const byOutcome = Object.create(null);
   const byEcosystem = Object.create(null);
   let total = 0, scanned = 0, dropped = 0, alerted = 0;
+  // Headline counters (ledger-derived daily-report headline — restart-proof, unlike
+  // the in-memory stats counters). clean buckets all the benign terminal verdicts;
+  // errors only the ledgerized failure outcomes (HTTP/tar failures live in the
+  // in-memory errorsByType breakdown, not the ledger).
+  let hClean = 0, hErrors = 0;
+  const hByTier = { t1: 0, t1a: 0, t1b: 0, t2: 0, t3: 0 };
   let earliest = null, latest = null;
   // Two sets so `vanished` is correct regardless of drop/scan ordering in the file.
   // droppedKeys is small (drops only happen under queue-cap pressure); scannedKeys is
@@ -1153,10 +1167,24 @@ function computeLedgerRollup(sinceTs, opts = {}) {
       if (underCap) { droppedKeys.add(key); allNames.add(e.name); } else exactVanished = false;
     } else {
       scanned++; ecoNode.scanned++;
-      if (outcome === 'suspect' || outcome === 'confirmed') { alerted++; ecoNode.alerted++; }
+      if (outcome === 'suspect' || outcome === 'confirmed') {
+        alerted++; ecoNode.alerted++;
+        const t = e.tier !== undefined && e.tier !== null ? String(e.tier) : null;
+        if (t === '1a') hByTier.t1a++;
+        else if (t === '1b') hByTier.t1b++;
+        else if (t === '1') hByTier.t1++;
+        else if (t === '2') hByTier.t2++;
+        else if (t === '3') hByTier.t3++;
+      } else if (CLEAN_LEDGER_OUTCOMES.has(outcome)) {
+        hClean++;
+      } else if (outcome === 'error' || outcome === 'static_timeout') {
+        hErrors++;
+      }
       if (underCap) { scannedKeys.add(key); allNames.add(e.name); scannedNames.add(e.name); } else exactVanished = false;
     }
   });
+  // Match the in-memory suspectByTier semantics where t1 = t1a + t1b (+ legacy '1').
+  hByTier.t1 += hByTier.t1a + hByTier.t1b;
 
   let vanished = 0;
   for (const k of droppedKeys) { if (!scannedKeys.has(k)) vanished++; }
@@ -1181,6 +1209,16 @@ function computeLedgerRollup(sinceTs, opts = {}) {
     distinctPackages: allNames.size,
     distinctScanned: scannedNames.size,
     distinctCoverage: allNames.size > 0 ? scannedNames.size / allNames.size : null,
+    // Ledger-derived daily-report headline (window-exact, restart-proof). `suspect`
+    // mirrors `alerted` (suspect+confirmed); `scanned` mirrors the non-dropped count
+    // above. The in-memory counters remain the fallback when the ledger is unavailable.
+    headline: {
+      scanned,
+      clean: hClean,
+      suspect: alerted,
+      errors: hErrors,
+      byTier: hByTier
+    },
     byOutcome,
     byEcosystem
   };
@@ -1421,6 +1459,21 @@ function loadLastDailyReportDate() {
   }
 }
 
+/**
+ * Load the exact ISO timestamp of the last daily report send (the start of the
+ * current reporting window). Returns null when absent (pre-upgrade file, first
+ * report ever, corrupt file) — callers fall back to a fixed 24h window.
+ */
+function loadLastDailyReportTs() {
+  try {
+    const raw = fs.readFileSync(LAST_DAILY_REPORT_FILE, 'utf8');
+    const data = JSON.parse(raw);
+    return typeof data.lastReportTs === 'string' ? data.lastReportTs : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Persist the date of the last daily report sent (YYYY-MM-DD), and optionally the
  * monotonic scan-stats baseline captured at that moment (used by the next report's
@@ -1430,6 +1483,10 @@ function saveLastDailyReportDate(dateStr, scanStatsBaseline) {
   try {
     const payload = { lastReportDate: dateStr };
     if (scanStatsBaseline) payload.scanStatsBaseline = scanStatsBaseline;
+    // Exact send timestamp = start of the NEXT report's ledger window (8h→8h
+    // semantics, restart-proof). Written in the same write-ahead as the date
+    // stamp, so a mid-send kill can neither hole nor double-count the window.
+    payload.lastReportTs = new Date().toISOString();
     atomicWriteFileSync(LAST_DAILY_REPORT_FILE, JSON.stringify(payload, null, 2));
   } catch (err) {
     console.error(`[MONITOR] Failed to save last daily report date: ${err.message}`);
@@ -1735,6 +1792,7 @@ module.exports = {
   captureScanStatsBaseline,
   reconcileDailyHeadline,
   loadLastDailyReportDate,
+  loadLastDailyReportTs,
   saveLastDailyReportDate,
   hasReportBeenSentToday,
   saveRecentlyScanned,

package/src/monitor/webhook.js

@@ -30,7 +30,8 @@ const {
   loadStateRaw,
   getScansSinceLastMemoryPersist,
   setScansSinceLastMemoryPersist,
-  computeLedgerRollup
+  computeLedgerRollup,
+  loadLastDailyReportTs
 } = require('./state.js');
 const {
   HIGH_CONFIDENCE_MALICE_TYPES,
@@ -1049,24 +1050,59 @@ function formatDelta(current, previous) {
   return '=0';
 }
 
-// Phase 0b: rolling window for the daily report's ledger section. The report runs
-// once/day, so 24h is the natural "what happened today" view and keeps the rollup's
-// distinct-key sets small (one day of scans, far below MAX_ROLLUP_KEYS). Env-tunable.
+// Phase 0b: fallback window for the daily report's ledger section when no
+// last-report timestamp exists yet (first report ever / pre-upgrade stamp file).
+// Normal operation derives the window from lastReportTs instead (8h→8h Paris,
+// restart-proof). Env-tunable.
 const LEDGER_ROLLUP_WINDOW_MS = (() => {
   const v = parseInt(process.env.MUADDIB_LEDGER_ROLLUP_WINDOW_MS, 10);
   return Number.isFinite(v) && v > 0 ? v : 24 * 60 * 60 * 1000;
 })();
 
+// Hard ceiling on the report window. A multi-day daemon outage would otherwise make
+// the next report's window (and the rollup's distinct-key sets) span the whole gap;
+// clamp to 48h and flag it so the report stays honest about the truncation.
+const LEDGER_ROLLUP_MAX_WINDOW_MS = 48 * 60 * 60 * 1000;
+
 /**
- * Compute the per-scan ledger rollup for the daily-report window. Best-effort: a
- * rollup failure (corrupt ledger, I/O) must NEVER break the daily report, so this
- * swallows errors and returns null. Also returns null when the ledger is empty so
- * the report omits the section instead of showing a noise row of zeros.
+ * Compute the per-scan ledger rollup for the daily-report window. The window is
+ * [last report send → now] (8h→8h Paris semantics, exact across restarts) when the
+ * lastReportTs stamp exists, else the fixed fallback window. Best-effort: a rollup
+ * failure (corrupt ledger, I/O) must NEVER break the daily report, so this swallows
+ * errors and returns null. Also returns null when the ledger is empty so the report
+ * omits the section instead of showing a noise row of zeros.
  */
 function safeLedgerRollup() {
   try {
-    const rollup = computeLedgerRollup(Date.now() - LEDGER_ROLLUP_WINDOW_MS);
-    return (rollup && rollup.total > 0) ? rollup : null;
+    const now = Date.now();
+    let sinceMs = now - LEDGER_ROLLUP_WINDOW_MS;
+    let windowClamped = false;
+    let windowSource = 'fallback_24h';
+    const lastTs = loadLastDailyReportTs();
+    if (lastTs) {
+      const p = Date.parse(lastTs);
+      // Guard against clock skew (stamp in the future) — fall back to 24h.
+      if (!Number.isNaN(p) && p <= now) {
+        if (p < now - LEDGER_ROLLUP_MAX_WINDOW_MS) {
+          sinceMs = now - LEDGER_ROLLUP_MAX_WINDOW_MS;
+          windowClamped = true;
+        } else {
+          sinceMs = p;
+        }
+        windowSource = 'last_report';
+      }
+    }
+    // Ledger source resolved at CALL time (not module load) so tests can point the
+    // rollup at a synthetic/empty ledger after the module graph is already loaded.
+    // Unset env → computeLedgerRollup falls back to its SCAN_LEDGER_FILE default.
+    const fileOverride = process.env.MUADDIB_SCAN_LEDGER_FILE;
+    const rollup = computeLedgerRollup(sinceMs, fileOverride ? { file: fileOverride } : {});
+    if (rollup && rollup.total > 0) {
+      rollup.windowClamped = windowClamped;
+      rollup.windowSource = windowSource;
+      return rollup;
+    }
+    return null;
   } catch {
     return null;
   }
@@ -1091,7 +1127,10 @@ function formatLedgerField(rollup) {
   if (ecos.length > 0) {
     lines.push(ecos.slice(0, 4).map(e => `${e} ${rollup.byEcosystem[e].total}`).join(' · '));
   }
-  return { name: 'Ledger (24h)', value: lines.join('\n'), inline: false };
+  const label = rollup.windowSource === 'last_report'
+    ? `Ledger (since last report${rollup.windowClamped ? ', clamped 48h' : ''})`
+    : 'Ledger (24h)';
+  return { name: label, value: lines.join('\n'), inline: false };
 }
 
 // AUDIT-C: MCP self-identity by package name (matches the F9/F15 MCP_NAME_RE family in
@@ -1115,6 +1154,22 @@ function buildDailyReportEmbed(stats, dailyAlerts, ledgerRollup) {
   // instead of disk-based daily entries which can undercount due to UTC/Paris date mismatch
   const { top3: diskTop3 } = buildReportFromDisk();
 
+  // --- Phase 0b: per-scan ledger rollup (resolved early so the headline can use it) ---
+  // Caller may pass a precomputed rollup (sendDailyReport does, to persist the same
+  // numbers it displays); undefined → compute here; explicit null → omit the section.
+  const ledger = ledgerRollup !== undefined ? ledgerRollup : safeLedgerRollup();
+
+  // HEADLINE BOUNDARY — scanned/clean/suspect come from the ledger window
+  // [last report → now] when available: window-exact and restart-proof, unlike the
+  // in-memory counters (reset-restore cycles can under-count after a restart storm).
+  // Everything NOT in the ledger (errorsByType breakdown, changes-stream/publish-event
+  // counts, pypi*, avg scan time) stays on the in-memory counters + daily-stats.json:
+  // best-effort since the last reset, may under-count after a restart.
+  const headline = (ledger && ledger.headline && ledger.headline.scanned > 0) ? ledger.headline : null;
+  const hScanned = headline ? headline.scanned : stats.scanned;
+  const hClean = headline ? headline.clean : stats.clean;
+  const hSuspect = headline ? headline.suspect : stats.suspect;
+
   // Prefer in-memory dailyAlerts for top suspects (richer data), fallback to disk
   const top3 = dailyAlerts.length > 0
     ? dailyAlerts.slice().sort((a, b) => (b.score || 0) - (a.score || 0) || b.findingsCount - a.findingsCount).slice(0, 3)
@@ -1133,14 +1188,9 @@ function buildDailyReportEmbed(stats, dailyAlerts, ledgerRollup) {
       }).join('\n')
     : 'None';
 
-  // Avg scan time from in-memory stats
+  // Avg scan time from in-memory stats (totalTimeMs is not ledgerized — best-effort)
   const avg = stats.scanned > 0 ? (stats.totalTimeMs / stats.scanned / 1000).toFixed(1) : '0.0';
 
-  // --- Phase 0b: per-scan ledger rollup (resolved early so Coverage can use it) ---
-  // Caller may pass a precomputed rollup (sendDailyReport does, to persist the same
-  // numbers it displays); undefined → compute here; explicit null → omit the section.
-  const ledger = ledgerRollup !== undefined ? ledgerRollup : safeLedgerRollup();
-
   // --- Coverage ---
   // HEADLINE: honest, version-collapsed coverage from the scan-ledger — distinct
   // package NAMES actually scanned vs distinct names seen (scanned + dropped) in
@@ -1155,8 +1205,8 @@ function buildDailyReportEmbed(stats, dailyAlerts, ledgerRollup) {
   const published = npmPub + pypiPub;
   const catchupSkipped = (stats.npmCatchupSkippedSeqs || 0) + (stats.pypiCatchupSkippedEvents || 0);
   const opsSuffix = catchupSkipped > 0
-    ? `\nOps: ${stats.scanned} | Catch-up skip: ${catchupSkipped}`
-    : `\nOps: ${stats.scanned}`;
+    ? `\nOps: ${hScanned} | Catch-up skip: ${catchupSkipped}`
+    : `\nOps: ${hScanned}`;
   let coverageText;
   if (ledger && ledger.distinctPackages > 0 && ledger.distinctCoverage != null) {
     const pct = (ledger.distinctCoverage * 100).toFixed(0);
@@ -1183,8 +1233,8 @@ function buildDailyReportEmbed(stats, dailyAlerts, ledgerRollup) {
   const yesterday = loadYesterdayMetrics();
   let trendsText = 'No data (first day or missing)';
   if (yesterday) {
-    const dScanned = formatDelta(stats.scanned, yesterday.scanned || 0);
-    const dSuspect = formatDelta(stats.suspect, yesterday.suspect || 0);
+    const dScanned = formatDelta(hScanned, yesterday.scanned || 0);
+    const dSuspect = formatDelta(hSuspect, yesterday.suspect || 0);
     const dErrors = formatDelta(stats.errors, yesterday.errors || 0);
     trendsText = `${dScanned} scanned, ${dSuspect} suspects, ${dErrors} errors`;
   }
@@ -1245,8 +1295,8 @@ function buildDailyReportEmbed(stats, dailyAlerts, ledgerRollup) {
       color: 0x3498db,
       fields: [
         { name: 'Coverage', value: coverageText, inline: true },
-        { name: 'Clean', value: `${stats.clean}`, inline: true },
-        { name: 'Suspects', value: `${stats.suspect}`, inline: true },
+        { name: 'Clean', value: `${hClean}`, inline: true },
+        { name: 'Suspects', value: `${hSuspect}`, inline: true },
         { name: 'Errors', value: formatErrorBreakdown(stats.errors, stats.errorsByType), inline: true },
         { name: 'Avg Scan Time', value: `${avg}s/pkg`, inline: true },
         { name: 'Timeouts', value: timeoutText, inline: true },
@@ -1262,7 +1312,9 @@ function buildDailyReportEmbed(stats, dailyAlerts, ledgerRollup) {
         { name: 'System', value: healthText, inline: false }
       ],
       footer: {
-        text: `MUAD'DIB - Daily summary | ${readableTime}`
+        // Headline-source annotation: 'ledger' = window-exact [last report → now],
+        // 'counters' = in-memory fallback (ledger unavailable — pre-upgrade behavior).
+        text: `MUAD'DIB - Daily summary | headline: ${headline ? 'ledger (since last report)' : 'counters'} | ${readableTime}`
       },
       timestamp: now.toISOString()
     }]
@@ -1285,20 +1337,34 @@ async function sendDailyReport(stats, dailyAlerts, recentlyScanned, downloadsCac
     console.log(`[MONITOR] Daily report suppressed: before ${DAILY_REPORT_HOUR}:00 Paris (hour=${getParisHour()})`);
     return;
   }
-  // Crash-safe headline: a restart-storm around report time can zero the in-memory
-  // counter (the monitor OOM-restarts ~10×/day). Floor scanned/clean/suspect at the
-  // durable scan-stats delta so we never publish "5" when ~44k were really scanned.
-  reconcileDailyHeadline(stats);
+  // Phase 0b: compute the ledger rollup ONCE so the embed shows exactly the numbers
+  // we persist (no double-scan, no drift between Discord and the on-disk metrics).
+  // Resolved BEFORE the empty-skip and the reconcile: when the ledger headline is
+  // available it IS the published number (window [last report → now], restart-proof),
+  // and the counter-based machinery below only runs as fallback.
+  const ledgerRollup = safeLedgerRollup();
+  const headline = (ledgerRollup && ledgerRollup.headline && ledgerRollup.headline.scanned > 0)
+    ? ledgerRollup.headline : null;
+
+  if (!headline) {
+    // Crash-safe FALLBACK headline: a restart-storm around report time can zero the
+    // in-memory counter (the monitor OOM-restarts ~10×/day). Floor scanned/clean/suspect
+    // at the durable scan-stats delta so we never publish "5" when ~44k were really
+    // scanned. Not applied when the ledger headline is used — that one is window-exact.
+    reconcileDailyHeadline(stats);
+  }
 
   // Never send an empty report (0 scanned — restart with no work done)
-  if (stats.scanned === 0) {
+  const publishedScanned = headline ? headline.scanned : stats.scanned;
+  if (publishedScanned === 0) {
     console.log('[MONITOR] Daily report skipped (0 packages scanned)');
     return;
   }
 
   // Write-ahead: mark today's report as sent BEFORE the webhook HTTP request.
   // If the process is killed (SIGKILL) during sendWebhook, the date is already
-  // recorded on disk and prevents duplicate reports on next startup.
+  // recorded on disk and prevents duplicate reports on next startup. The same
+  // write-ahead stamps lastReportTs = start of the next report's ledger window.
   const today = getParisDateString();
   stats.lastDailyReportDate = today;
   // Persist the monotonic scan-stats counter as the baseline for the NEXT report's
@@ -1306,23 +1372,23 @@ async function sendDailyReport(stats, dailyAlerts, recentlyScanned, downloadsCac
   saveLastDailyReportDate(today, captureScanStatsBaseline());
   // Observability: the success path previously logged nothing, which made the late-fire bug
   // invisible in the journal. Log the stamped date + the actual Paris hour (an on-time 08:00
-  // fire vs a catch-up at hour 14 are now distinguishable) + the headline count.
-  console.log(`[MONITOR] Daily report firing for ${today} (hour=${getParisHour()} Paris, scanned=${stats.scanned})`);
+  // fire vs a catch-up at hour 14 are now distinguishable) + the headline count + source.
+  console.log(`[MONITOR] Daily report firing for ${today} (hour=${getParisHour()} Paris, scanned=${publishedScanned}, headline=${headline ? 'ledger' : 'counters'})`);
 
-  // Phase 0b: compute the ledger rollup ONCE so the embed shows exactly the numbers
-  // we persist (no double-scan, no drift between Discord and the on-disk metrics).
-  const ledgerRollup = safeLedgerRollup();
   const payload = buildDailyReportEmbed(stats, dailyAlerts, ledgerRollup);
 
-  // Persist locally with full raw metrics (independent of webhook — enables trend analysis)
+  // Persist locally with full raw metrics (independent of webhook — enables trend analysis).
+  // Headline (scanned/clean/suspect/byTier) follows the same source as the embed: ledger
+  // window when available, in-memory counters otherwise. headlineSource records which.
   persistDailyReport(payload, {
-    scanned: stats.scanned,
-    clean: stats.clean,
-    suspect: stats.suspect,
+    headlineSource: headline ? 'ledger' : 'counters',
+    scanned: publishedScanned,
+    clean: headline ? headline.clean : stats.clean,
+    suspect: headline ? headline.suspect : stats.suspect,
     errors: stats.errors,
     errorsByType: { ...stats.errorsByType },
     avgScanTimeMs: stats.scanned > 0 ? Math.round(stats.totalTimeMs / stats.scanned) : 0,
-    suspectByTier: { ...stats.suspectByTier },
+    suspectByTier: headline ? { ...headline.byTier } : { ...stats.suspectByTier },
     mlFiltered: stats.mlFiltered || 0,
     llmAnalyzed: stats.llmAnalyzed || 0,
     llmSuppressed: stats.llmSuppressed || 0,

package/src/scanner/npm-registry.js

@@ -217,6 +217,10 @@ async function getPackageMetadata(packageName) {
     // / pinned-old / vendored versions bypass the cap so we don't mask attacks
     // captured in static fixtures (e.g. eslint-scope 3.7.2, chalk 5.6.1).
     latest_version: latestVersion || null,
+    // P4 : full dist-tags map ({ latest, next, canary, ... }) so scoring can tell a
+    // maintainer-controlled pre-release channel version (inherits partial reputation)
+    // from a historical / pinned-old version (no reputation).
+    dist_tags: (meta['dist-tags'] && typeof meta['dist-tags'] === 'object') ? meta['dist-tags'] : null,
     // F3 : list of maintainer email addresses (lowercased, unique) for DNS
     // MX / RDAP downstream checks. Empty array if no emails published.
     maintainer_emails: maintainerEmails,

package/src/scoring.js

@@ -1874,6 +1874,23 @@ function _hasMaliceSignal(threats) {
   return threats.some(t => t.severity === 'HIGH' || t.severity === 'CRITICAL');
 }
 
+// P4 (pre-release reputation): known maintainer-controlled pre-release dist-tag names.
+const _PRERELEASE_TAG_RE = /^(next|canary|nightly|rc|beta|alpha|dev|experimental|preview|snapshot|edge|insider|insiders)$/i;
+
+// True when the scanned version is published on a NON-latest pre-release dist-tag
+// (e.g. dist-tags = { latest: "3.19.1", next: "3.19.0-nightly-..." } and we scan the
+// nightly). Maintainer-controlled, so an attacker cannot put a payload on `next`
+// without the account — and Track R still floors confirmed malice regardless.
+function _isPrereleaseChannelVersion(metadata) {
+  const dt = metadata && metadata.dist_tags;
+  const sv = metadata && metadata.scan_version;
+  if (!dt || typeof dt !== 'object' || typeof sv !== 'string') return false;
+  for (const [tag, ver] of Object.entries(dt)) {
+    if (ver === sv && tag !== 'latest' && _PRERELEASE_TAG_RE.test(tag)) return true;
+  }
+  return false;
+}
+
 function applyReputationFactor(result, metadata) {
   if (!result || !result.summary || !metadata) return null;
   // FPR plan : the reputation factor describes "how trustworthy this package
@@ -1884,12 +1901,21 @@ function applyReputationFactor(result, metadata) {
   // scan version is unknown (CLI scanning a directory without version field),
   // we fail open : skip the factor entirely rather than apply a multiplier
   // we cannot situate in time.
+  // P4 (pre-release reputation): a canary/nightly/rc of an established package is a NEW
+  // (not historical) version on a maintainer-controlled pre-release dist-tag, so it should
+  // inherit the package's reputation — but only PARTIALLY (it is not the verified latest).
+  // Any OTHER non-latest version (historical / pinned-old / vendored) keeps the full skip.
+  let _prereleaseAttenuation = 1.0;
   if (
     typeof metadata.latest_version === 'string' &&
     typeof metadata.scan_version === 'string' &&
     metadata.latest_version !== metadata.scan_version
   ) {
-    return null;
+    if (_isPrereleaseChannelVersion(metadata)) {
+      _prereleaseAttenuation = 0.85;
+    } else {
+      return null;
+    }
   }
   if (
     typeof metadata.latest_version === 'string' &&
@@ -1900,9 +1926,14 @@ function applyReputationFactor(result, metadata) {
   // P3 hardening: a valid attestation must NOT earn a trust bonus on a package that
   // also shows malice (TeamPCP attested-malware scenario). Withhold it here, where
   // the threat list is available.
-  const factor = _factorFromMetadata(metadata, {
+  let factor = _factorFromMetadata(metadata, {
     allowProvenanceBonus: !_hasMaliceSignal(result.threats)
   });
+  // P4: blend the factor toward neutral (1.0) for pre-release channel versions — they
+  // get most of the reputation suppression but not 100% (they are not the verified latest).
+  if (_prereleaseAttenuation !== 1.0) {
+    factor = 1.0 + (factor - 1.0) * _prereleaseAttenuation;
+  }
   if (factor === 1.0) {
     result.summary.reputationFactor = 1.0;
     return null;