muaddib-scanner 2.11.9 → 2.11.10

package/.env.example

@@ -34,6 +34,10 @@ OSM_API_TOKEN=
 # MUADDIB_METADATA_FACTOR=0   # registry signals -> reputation multiplier
 # MUADDIB_DELTA_MODE=0        # delta scoring against prior versions
 #
-# Skip the npm registry fetch ENTIRELY (disables MATURE_CAP + METADATA_FACTOR
-# + DELTA_MODE in one shot, useful for air-gap / offline CI / perf-critical):
+# Skip ALL network fetches (npm registry packument + GitHub Releases IOC
+# bootstrap) in one shot. Disables MATURE_CAP + METADATA_FACTOR + DELTA_MODE
+# at the per-scan level AND the first-run IOC database download. Useful for:
+#   - air-gap / offline CI environments
+#   - test runners (set automatically by tests/run-tests.js)
+#   - perf-critical batch scans where you've pre-warmed the IOC cache
 # MUADDIB_NO_REGISTRY_FETCH=1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.11.9",
+  "version": "2.11.10",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/src/ioc/bootstrap.js

@@ -149,6 +149,17 @@ async function ensureIOCs() {
       }
     }
 
+    // Offline / CI escape hatch: cache is empty/missing AND we don't want to
+    // hit the network. Tests and air-gapped environments use this to avoid
+    // 1-2s timeouts × N tests when the asset is unavailable. Same env var as
+    // the per-scan registry fetch hatch so a single MUADDIB_NO_REGISTRY_FETCH=1
+    // covers both bootstrap + per-scan paths. Important: this gate sits AFTER
+    // the cache check so a healthy cache still returns true even in offline
+    // mode (otherwise tests that pre-populate the cache would falsely fail).
+    if (process.env.MUADDIB_NO_REGISTRY_FETCH === '1') {
+      return false;
+    }
+
     // Download IOCs (messages go to stderr to avoid contaminating JSON/SARIF stdout)
     process.stderr.write('[MUADDIB] First run: downloading IOC database...\n');
     await downloadAndDecompress(IOCS_URL, IOCS_PATH);