muaddib-scanner 2.2.19 → 2.2.22

package/src/scanner/ast.js

@@ -1,96 +1,96 @@
-const path = require('path');
-const acorn = require('acorn');
-const walk = require('acorn-walk');
-const { ACORN_OPTIONS } = require('../shared/constants.js');
-const { analyzeWithDeobfuscation } = require('../shared/analyze-helper.js');
-const {
-  handleVariableDeclarator,
-  handleCallExpression,
-  handleImportExpression,
-  handleNewExpression,
-  handleLiteral,
-  handleAssignmentExpression,
-  handleMemberExpression,
-  handlePostWalk
-} = require('./ast-detectors.js');
-
-const EXCLUDED_FILES = [
-  'src/scanner/ast.js',
-  'src/scanner/shell.js',
-  'src/scanner/package.js',
-  'src/response/playbooks.js'
-];
-
-async function analyzeAST(targetPath, options = {}) {
-  return analyzeWithDeobfuscation(targetPath, analyzeFile, {
-    deobfuscate: options.deobfuscate,
-    excludedFiles: EXCLUDED_FILES
-  });
-}
-
-function analyzeFile(content, filePath, basePath) {
-  const threats = [];
-  let ast;
-
-  try {
-    ast = acorn.parse(content, ACORN_OPTIONS);
-  } catch {
-    // AST parse failed — apply regex fallback for known dangerous patterns
-
-    // Workflow manipulation: reads + writes to .github/workflows
-    if (/\.github/.test(content) && /workflows/.test(content) &&
-        /writeFileSync|writeFile/.test(content) &&
-        /readdirSync|readFileSync/.test(content)) {
-      threats.push({
-        type: 'workflow_write',
-        severity: 'CRITICAL',
-        message: 'File reads and modifies .github/workflows — GitHub Actions injection (regex fallback).',
-        file: path.relative(basePath, filePath)
-      });
-    }
-
-    if (content.length > 1000 && content.split('\n').length < 10) {
-      threats.push({
-        type: 'possible_obfuscation',
-        severity: 'MEDIUM',
-        message: 'File difficult to parse, possibly obfuscated.',
-        file: path.relative(basePath, filePath)
-      });
-    }
-    return threats;
-  }
-
-  // Shared detection context
-  const ctx = {
-    threats,
-    relFile: path.relative(basePath, filePath),
-    dynamicRequireVars: new Set(),
-    dangerousCmdVars: new Map(),
-    workflowPathVars: new Set(),
-    execPathVars: new Map(),
-    globalThisAliases: new Set(),
-    hasFromCharCode: content.includes('fromCharCode'),
-    hasJsReverseShell: /\bnet\.Socket\b/.test(content) &&
-      /\.connect\s*\(/.test(content) &&
-      /\.pipe\b/.test(content) &&
-      (/\bspawn\b/.test(content) || /\bstdin\b/.test(content) || /\bstdout\b/.test(content)),
-    hasBinaryFileLiteral: /\.(png|jpg|jpeg|gif|bmp|ico|wasm)\b/i.test(content),
-    hasEvalInFile: false
-  };
-
-  walk.simple(ast, {
-    VariableDeclarator(node) { handleVariableDeclarator(node, ctx); },
-    CallExpression(node) { handleCallExpression(node, ctx); },
-    ImportExpression(node) { handleImportExpression(node, ctx); },
-    NewExpression(node) { handleNewExpression(node, ctx); },
-    Literal(node) { handleLiteral(node, ctx); },
-    AssignmentExpression(node) { handleAssignmentExpression(node, ctx); },
-    MemberExpression(node) { handleMemberExpression(node, ctx); }
-  });
-
-  handlePostWalk(ctx);
-
-  return threats;
-}
-
-module.exports = { analyzeAST };
+const path = require('path');
+const acorn = require('acorn');
+const walk = require('acorn-walk');
+const { ACORN_OPTIONS } = require('../shared/constants.js');
+const { analyzeWithDeobfuscation } = require('../shared/analyze-helper.js');
+const {
+  handleVariableDeclarator,
+  handleCallExpression,
+  handleImportExpression,
+  handleNewExpression,
+  handleLiteral,
+  handleAssignmentExpression,
+  handleMemberExpression,
+  handlePostWalk
+} = require('./ast-detectors.js');
+
+const EXCLUDED_FILES = [
+  'src/scanner/ast.js',
+  'src/scanner/shell.js',
+  'src/scanner/package.js',
+  'src/response/playbooks.js'
+];
+
+async function analyzeAST(targetPath, options = {}) {
+  return analyzeWithDeobfuscation(targetPath, analyzeFile, {
+    deobfuscate: options.deobfuscate,
+    excludedFiles: EXCLUDED_FILES
+  });
+}
+
+function analyzeFile(content, filePath, basePath) {
+  const threats = [];
+  let ast;
+
+  try {
+    ast = acorn.parse(content, ACORN_OPTIONS);
+  } catch {
+    // AST parse failed — apply regex fallback for known dangerous patterns
+
+    // Workflow manipulation: reads + writes to .github/workflows
+    if (/\.github/.test(content) && /workflows/.test(content) &&
+        /writeFileSync|writeFile/.test(content) &&
+        /readdirSync|readFileSync/.test(content)) {
+      threats.push({
+        type: 'workflow_write',
+        severity: 'CRITICAL',
+        message: 'File reads and modifies .github/workflows — GitHub Actions injection (regex fallback).',
+        file: path.relative(basePath, filePath)
+      });
+    }
+
+    if (content.length > 1000 && content.split(/\r?\n/).length < 10) {
+      threats.push({
+        type: 'possible_obfuscation',
+        severity: 'MEDIUM',
+        message: 'File difficult to parse, possibly obfuscated.',
+        file: path.relative(basePath, filePath)
+      });
+    }
+    return threats;
+  }
+
+  // Shared detection context
+  const ctx = {
+    threats,
+    relFile: path.relative(basePath, filePath),
+    dynamicRequireVars: new Set(),
+    dangerousCmdVars: new Map(),
+    workflowPathVars: new Set(),
+    execPathVars: new Map(),
+    globalThisAliases: new Set(),
+    hasFromCharCode: content.includes('fromCharCode'),
+    hasJsReverseShell: /\bnet\.Socket\b/.test(content) &&
+      /\.connect\s*\(/.test(content) &&
+      /\.pipe\b/.test(content) &&
+      (/\bspawn\b/.test(content) || /\bstdin\b/.test(content) || /\bstdout\b/.test(content)),
+    hasBinaryFileLiteral: /\.(png|jpg|jpeg|gif|bmp|ico|wasm)\b/i.test(content),
+    hasEvalInFile: false
+  };
+
+  walk.simple(ast, {
+    VariableDeclarator(node) { handleVariableDeclarator(node, ctx); },
+    CallExpression(node) { handleCallExpression(node, ctx); },
+    ImportExpression(node) { handleImportExpression(node, ctx); },
+    NewExpression(node) { handleNewExpression(node, ctx); },
+    Literal(node) { handleLiteral(node, ctx); },
+    AssignmentExpression(node) { handleAssignmentExpression(node, ctx); },
+    MemberExpression(node) { handleMemberExpression(node, ctx); }
+  });
+
+  handlePostWalk(ctx);
+
+  return threats;
+}
+
+module.exports = { analyzeAST };

package/src/scanner/github-actions.js

@@ -1,96 +1,96 @@
-const fs = require('fs');
-const path = require('path');
-
-const { MAX_FILE_SIZE } = require('../shared/constants.js');
-
-const YAML_EXTENSIONS = ['.yml', '.yaml'];
-const MAX_DEPTH = 10;
-
-function scanGitHubActions(targetPath) {
-  const threats = [];
-
-  // Scan both workflows and custom actions directories
-  const dirsToScan = [
-    path.join(targetPath, '.github', 'workflows'),
-    path.join(targetPath, '.github', 'actions')
-  ];
-
-  for (const dirPath of dirsToScan) {
-    if (!fs.existsSync(dirPath)) continue;
-    scanDirRecursive(dirPath, targetPath, threats);
-  }
-
-  return threats;
-}
-
-function scanDirRecursive(dirPath, targetPath, threats, depth = 0) {
-  if (depth > MAX_DEPTH) return;
-  let files;
-  try { files = fs.readdirSync(dirPath); } catch { return; }
-  const relDir = path.relative(targetPath, dirPath).replace(/\\/g, '/');
-
-  for (const file of files) {
-    const filePath = path.join(dirPath, file);
-
-    try {
-      const stat = fs.lstatSync(filePath);
-      if (stat.isSymbolicLink()) continue;
-      if (stat.isDirectory()) {
-        scanDirRecursive(filePath, targetPath, threats, depth + 1);
-        continue;
-      }
-      if (!stat.isFile()) continue;
-      if (stat.size > MAX_FILE_SIZE) continue;
-    } catch {
-      continue;
-    }
-
-    // Only process YAML files
-    if (!YAML_EXTENSIONS.some(ext => file.endsWith(ext))) continue;
-
-      let content;
-      try {
-        content = fs.readFileSync(filePath, 'utf8');
-      } catch {
-        continue;
-      }
-
-      const relFile = `${relDir}/${file}`;
-
-      // GHA-001: Line-by-line YAML-aware parsing (skip comments)
-      const yamlLines = content.split('\n');
-      const activeLines = yamlLines.filter(l => !l.trim().startsWith('#'));
-      const activeContent = activeLines.join('\n');
-
-      // Détection du backdoor Shai-Hulud discussion.yaml
-      if (file === 'discussion.yaml' || file === 'discussion.yml') {
-        if (activeContent.includes('github.event.discussion.body')) {
-          threats.push({
-            type: 'shai_hulud_backdoor',
-            severity: 'CRITICAL',
-            message: 'Backdoor Shai-Hulud détecté: workflow discussion.yaml avec injection via discussion body',
-            file: relFile
-          });
-        }
-      }
-
-      // GHA-002: Detect attacker-controlled context injection on ALL runners (not just self-hosted)
-      const injectionPatterns = [
-        { regex: /\$\{\{\s*github\.event\.(comment\.body|issue\.body|issue\.title|pull_request\.body|pull_request\.title|discussion\.body|discussion\.title)/, msg: 'Attacker-controlled GitHub event context used in workflow' },
-        { regex: /\$\{\{\s*github\.head_ref/, msg: 'github.head_ref is attacker-controlled in pull_request workflows' }
-      ];
-
-      for (const { regex, msg } of injectionPatterns) {
-        if (regex.test(activeContent)) {
-          threats.push({
-            type: 'workflow_injection',
-            severity: 'HIGH',
-            message: 'Potential injection: ' + msg,
-            file: relFile
-          });
-        }
-      }
-    }
-}
-
-module.exports = { scanGitHubActions };
+const fs = require('fs');
+const path = require('path');
+
+const { MAX_FILE_SIZE } = require('../shared/constants.js');
+
+const YAML_EXTENSIONS = ['.yml', '.yaml'];
+const MAX_DEPTH = 10;
+
+function scanGitHubActions(targetPath) {
+  const threats = [];
+
+  // Scan both workflows and custom actions directories
+  const dirsToScan = [
+    path.join(targetPath, '.github', 'workflows'),
+    path.join(targetPath, '.github', 'actions')
+  ];
+
+  for (const dirPath of dirsToScan) {
+    if (!fs.existsSync(dirPath)) continue;
+    scanDirRecursive(dirPath, targetPath, threats);
+  }
+
+  return threats;
+}
+
+function scanDirRecursive(dirPath, targetPath, threats, depth = 0) {
+  if (depth > MAX_DEPTH) return;
+  let files;
+  try { files = fs.readdirSync(dirPath); } catch { return; }
+  const relDir = path.relative(targetPath, dirPath).replace(/\\/g, '/');
+
+  for (const file of files) {
+    const filePath = path.join(dirPath, file);
+
+    try {
+      const stat = fs.lstatSync(filePath);
+      if (stat.isSymbolicLink()) continue;
+      if (stat.isDirectory()) {
+        scanDirRecursive(filePath, targetPath, threats, depth + 1);
+        continue;
+      }
+      if (!stat.isFile()) continue;
+      if (stat.size > MAX_FILE_SIZE) continue;
+    } catch {
+      continue;
+    }
+
+    // Only process YAML files
+    if (!YAML_EXTENSIONS.some(ext => file.endsWith(ext))) continue;
+
+      let content;
+      try {
+        content = fs.readFileSync(filePath, 'utf8');
+      } catch {
+        continue;
+      }
+
+      const relFile = `${relDir}/${file}`;
+
+      // GHA-001: Line-by-line YAML-aware parsing (skip comments)
+      const yamlLines = content.split(/\r?\n/);
+      const activeLines = yamlLines.filter(l => !l.trim().startsWith('#'));
+      const activeContent = activeLines.join('\n');
+
+      // Détection du backdoor Shai-Hulud discussion.yaml
+      if (file === 'discussion.yaml' || file === 'discussion.yml') {
+        if (activeContent.includes('github.event.discussion.body')) {
+          threats.push({
+            type: 'shai_hulud_backdoor',
+            severity: 'CRITICAL',
+            message: 'Backdoor Shai-Hulud détecté: workflow discussion.yaml avec injection via discussion body',
+            file: relFile
+          });
+        }
+      }
+
+      // GHA-002: Detect attacker-controlled context injection on ALL runners (not just self-hosted)
+      const injectionPatterns = [
+        { regex: /\$\{\{\s*github\.event\.(comment\.body|issue\.body|issue\.title|pull_request\.body|pull_request\.title|discussion\.body|discussion\.title)/, msg: 'Attacker-controlled GitHub event context used in workflow' },
+        { regex: /\$\{\{\s*github\.head_ref/, msg: 'github.head_ref is attacker-controlled in pull_request workflows' }
+      ];
+
+      for (const { regex, msg } of injectionPatterns) {
+        if (regex.test(activeContent)) {
+          threats.push({
+            type: 'workflow_injection',
+            severity: 'HIGH',
+            message: 'Potential injection: ' + msg,
+            file: relFile
+          });
+        }
+      }
+    }
+}
+
+module.exports = { scanGitHubActions };

package/src/scanner/module-graph.js

@@ -1,7 +1,7 @@
 const fs = require('fs');
 const path = require('path');
 const acorn = require('acorn');
-const { findFiles } = require('../utils');
+const { findFiles, EXCLUDED_DIRS } = require('../utils');
 const { ACORN_OPTIONS: BASE_ACORN_OPTIONS } = require('../shared/constants.js');
 
 // --- Sensitive source patterns ---
@@ -33,7 +33,7 @@ function buildModuleGraph(packagePath) {
   const graph = {};
   const files = findFiles(packagePath, {
     extensions: ['.js', '.mjs', '.cjs'],
-    excludedDirs: ['node_modules', '.git'],
+    excludedDirs: EXCLUDED_DIRS,
   });
   for (const absFile of files) {
     const relFile = toRel(absFile, packagePath);

package/src/scanner/obfuscation.js

@@ -1,129 +1,129 @@
-const fs = require('fs');
-const path = require('path');
-const { findFiles, forEachSafeFile } = require('../utils.js');
-
-// node_modules NOT excluded: detect obfuscated code in dependencies
-const OBF_EXCLUDED_DIRS = ['.git', '.muaddib-cache'];
-
-function detectObfuscation(targetPath) {
-  const threats = [];
-  const files = findFiles(targetPath, { extensions: ['.js', '.mjs', '.cjs'], excludedDirs: OBF_EXCLUDED_DIRS });
-
-  forEachSafeFile(files, (file, content) => {
-    const relativePath = path.relative(targetPath, file);
-
-    const signals = [];
-    let score = 0;
-    const basename = path.basename(file);
-    const isMinified = basename.endsWith('.min.js');
-    const isBundled = basename.endsWith('.bundle.js');
-    const pathParts = relativePath.split(path.sep);
-    const isInDistOrBuild = pathParts.some(p => p === 'dist' || p === 'build');
-    const isPackageOutput = isMinified || isBundled || isInDistOrBuild;
-
-    // 1. Ratio code sur une seule ligne (skip .min.js — minification, not obfuscation)
-    if (!isMinified) {
-      const lines = content.split('\n').filter(l => l.trim());
-      const longLines = lines.filter(l => l.length > 500);
-      if (lines.length > 0 && longLines.length / lines.length > 0.3) {
-        score += 25;
-        signals.push('long_single_lines');
-      }
-    }
-
-    // 2. Hex escapes massifs (tracked but only scored with corroborating signals)
-    let hexScore = 0;
-    const hexCount = countMatches(content, /\\x[0-9a-fA-F]{2}/g);
-    if (hexCount > 20) {
-      hexScore = 25;
-      signals.push('hex_escapes');
-    }
-
-    // 3. Unicode escapes massifs (tracked but only scored with corroborating signals)
-    let unicodeScore = 0;
-    const unicodeCount = countMatches(content, /\\u[0-9a-fA-F]{4}/g);
-    if (unicodeCount > 20) {
-      unicodeScore = 20;
-      signals.push('unicode_escapes');
-    }
-
-    // 4. Variables style obfuscateur (_0x, _0xabc)
-    const obfVarCount = countMatches(content, /\b_0x[a-f0-9]+\b/gi);
-    if (obfVarCount > 5) {
-      score += 30;
-      signals.push('obfuscated_variables');
-    }
-
-    // 5. String arrays suspects (programmatic check to avoid ReDoS)
-    if (hasLargeStringArray(content)) {
-      score += 25;
-      signals.push('string_array');
-    }
-
-    // 6. atob/btoa avec eval
-    if (/atob\s*\(/.test(content) && /(eval|Function)\s*\(/.test(content)) {
-      score += 30;
-      signals.push('base64_eval');
-    }
-
-    // Hex/unicode escapes alone are not obfuscation (e.g. lodash Unicode char tables).
-    // Only count them when combined with strong obfuscation signals.
-    const hasStrongSignals = signals.some(s => s !== 'hex_escapes' && s !== 'unicode_escapes');
-    if (hasStrongSignals) {
-      score += hexScore + unicodeScore;
-    }
-
-    if (score >= 40) {
-      threats.push({
-        type: 'obfuscation_detected',
-        severity: isPackageOutput ? 'LOW' : (score >= 70 ? 'CRITICAL' : 'HIGH'),
-        message: `Code obfusque (score: ${score}). Signaux: ${signals.join(', ')}`,
-        file: relativePath
-      });
-    }
-  });
-
-  return threats;
-}
-
-/**
- * Count regex matches without creating a full match array (avoids memory spikes on large files).
- */
-function countMatches(str, regex) {
-  let count = 0;
-  while (regex.exec(str) !== null) count++;
-  return count;
-}
-
-/**
- * Programmatic check for large string arrays (avoids ReDoS from nested regex quantifiers).
- * Detects patterns like: var x = ["a", "b", "c", ...] with 10+ quoted items.
- */
-function hasLargeStringArray(content) {
-  const lines = content.split('\n');
-  for (const line of lines) {
-    const varIdx = line.indexOf('var ');
-    if (varIdx === -1) continue;
-    const bracketIdx = line.indexOf('[', varIdx);
-    if (bracketIdx === -1) continue;
-    const closeBracketIdx = line.indexOf(']', bracketIdx);
-    if (closeBracketIdx === -1) continue;
-    const segment = line.slice(bracketIdx, closeBracketIdx + 1);
-    // Count quoted strings in the segment
-    let count = 0;
-    for (let i = 0; i < segment.length; i++) {
-      if (segment[i] === '"' || segment[i] === "'") {
-        const quote = segment[i];
-        const end = segment.indexOf(quote, i + 1);
-        if (end !== -1 && end - i - 1 <= 50) {
-          count++;
-          i = end;
-        }
-      }
-    }
-    if (count >= 10) return true;
-  }
-  return false;
-}
-
+const fs = require('fs');
+const path = require('path');
+const { findFiles, forEachSafeFile } = require('../utils.js');
+
+// node_modules NOT excluded: detect obfuscated code in dependencies
+const OBF_EXCLUDED_DIRS = ['.git', '.muaddib-cache'];
+
+function detectObfuscation(targetPath) {
+  const threats = [];
+  const files = findFiles(targetPath, { extensions: ['.js', '.mjs', '.cjs'], excludedDirs: OBF_EXCLUDED_DIRS });
+
+  forEachSafeFile(files, (file, content) => {
+    const relativePath = path.relative(targetPath, file);
+
+    const signals = [];
+    let score = 0;
+    const basename = path.basename(file);
+    const isMinified = basename.endsWith('.min.js');
+    const isBundled = basename.endsWith('.bundle.js');
+    const pathParts = relativePath.split(path.sep);
+    const isInDistOrBuild = pathParts.some(p => p === 'dist' || p === 'build');
+    const isPackageOutput = isMinified || isBundled || isInDistOrBuild;
+
+    // 1. Ratio code sur une seule ligne (skip .min.js — minification, not obfuscation)
+    if (!isMinified) {
+      const lines = content.split(/\r?\n/).filter(l => l.trim());
+      const longLines = lines.filter(l => l.length > 500);
+      if (lines.length > 0 && longLines.length / lines.length > 0.3) {
+        score += 25;
+        signals.push('long_single_lines');
+      }
+    }
+
+    // 2. Hex escapes massifs (tracked but only scored with corroborating signals)
+    let hexScore = 0;
+    const hexCount = countMatches(content, /\\x[0-9a-fA-F]{2}/g);
+    if (hexCount > 20) {
+      hexScore = 25;
+      signals.push('hex_escapes');
+    }
+
+    // 3. Unicode escapes massifs (tracked but only scored with corroborating signals)
+    let unicodeScore = 0;
+    const unicodeCount = countMatches(content, /\\u[0-9a-fA-F]{4}/g);
+    if (unicodeCount > 20) {
+      unicodeScore = 20;
+      signals.push('unicode_escapes');
+    }
+
+    // 4. Variables style obfuscateur (_0x, _0xabc)
+    const obfVarCount = countMatches(content, /\b_0x[a-f0-9]+\b/gi);
+    if (obfVarCount > 5) {
+      score += 30;
+      signals.push('obfuscated_variables');
+    }
+
+    // 5. String arrays suspects (programmatic check to avoid ReDoS)
+    if (hasLargeStringArray(content)) {
+      score += 25;
+      signals.push('string_array');
+    }
+
+    // 6. atob/btoa avec eval
+    if (/atob\s*\(/.test(content) && /(eval|Function)\s*\(/.test(content)) {
+      score += 30;
+      signals.push('base64_eval');
+    }
+
+    // Hex/unicode escapes alone are not obfuscation (e.g. lodash Unicode char tables).
+    // Only count them when combined with strong obfuscation signals.
+    const hasStrongSignals = signals.some(s => s !== 'hex_escapes' && s !== 'unicode_escapes');
+    if (hasStrongSignals) {
+      score += hexScore + unicodeScore;
+    }
+
+    if (score >= 40) {
+      threats.push({
+        type: 'obfuscation_detected',
+        severity: isPackageOutput ? 'LOW' : (score >= 70 ? 'CRITICAL' : 'HIGH'),
+        message: `Code obfusque (score: ${score}). Signaux: ${signals.join(', ')}`,
+        file: relativePath
+      });
+    }
+  });
+
+  return threats;
+}
+
+/**
+ * Count regex matches without creating a full match array (avoids memory spikes on large files).
+ */
+function countMatches(str, regex) {
+  let count = 0;
+  while (regex.exec(str) !== null) count++;
+  return count;
+}
+
+/**
+ * Programmatic check for large string arrays (avoids ReDoS from nested regex quantifiers).
+ * Detects patterns like: var x = ["a", "b", "c", ...] with 10+ quoted items.
+ */
+function hasLargeStringArray(content) {
+  const lines = content.split(/\r?\n/);
+  for (const line of lines) {
+    const varIdx = line.indexOf('var ');
+    if (varIdx === -1) continue;
+    const bracketIdx = line.indexOf('[', varIdx);
+    if (bracketIdx === -1) continue;
+    const closeBracketIdx = line.indexOf(']', bracketIdx);
+    if (closeBracketIdx === -1) continue;
+    const segment = line.slice(bracketIdx, closeBracketIdx + 1);
+    // Count quoted strings in the segment
+    let count = 0;
+    for (let i = 0; i < segment.length; i++) {
+      if (segment[i] === '"' || segment[i] === "'") {
+        const quote = segment[i];
+        const end = segment.indexOf(quote, i + 1);
+        if (end !== -1 && end - i - 1 <= 50) {
+          count++;
+          i = end;
+        }
+      }
+    }
+    if (count >= 10) return true;
+  }
+  return false;
+}
+
 module.exports = { detectObfuscation };