muaddib-scanner 2.2.3 → 2.2.4

package/README.fr.md

@@ -327,40 +327,6 @@ muaddib scan . --breakdown
 
 Affiche la décomposition explicable du score : contribution de chaque finding au score final, avec les poids par règle et multiplicateurs de sévérité.
 
-### API Threat Feed
-
-```bash
-muaddib feed [--limit N] [--severity LEVEL] [--since DATE]
-muaddib serve [--port N]
-```
-
-Exporte les détections sous forme de flux JSON pour intégration SIEM.
-
-- `muaddib feed` — Affiche le flux de menaces JSON sur stdout (filtrable par limit, sévérité, date)
-- `muaddib serve` — Démarre un serveur HTTP (port 3000 par défaut) avec `GET /feed` et `GET /health`
-
-```bash
-muaddib serve --port 8080
-# GET http://localhost:8080/feed?limit=50&severity=HIGH
-# GET http://localhost:8080/health
-```
-
-### Logging des temps de détection
-
-```bash
-muaddib detections [--stats] [--json]
-```
-
-Historique des détections avec timestamps de première observation et métriques de lead time (délai entre la détection MUAD'DIB et l'advisory publique).
-
-### Suivi du taux de faux positifs
-
-```bash
-muaddib stats [--daily] [--json]
-```
-
-Statistiques de scan : total scanné, clean, suspect, taux de faux positifs, nombre confirmé malveillant. Utilisez `--daily` pour le détail par jour.
-
 ### Replay ground truth
 
 ```bash
@@ -739,7 +705,7 @@ Output (CLI, JSON, HTML, SARIF, Webhook, Threat Feed)
 - **ADR** (Adversarial Detection Rate) : taux de detection sur 35 samples malveillants evasifs (4 vagues red team + holdout promu)
 - **Holdout** (pre-tuning) : taux de detection sur 10 samples jamais vus avant correction des regles (mesure de generalisation)
 
-Lancez `muaddib evaluate` pour reproduire ces metriques localement. Voir [Evaluation Methodology](docs/EVALUATION_METHODOLOGY.md) pour le protocole experimental complet.
+Voir [Evaluation Methodology](docs/EVALUATION_METHODOLOGY.md) pour le protocole experimental complet.
 
 ---
 

package/README.md

@@ -327,40 +327,6 @@ muaddib scan . --breakdown
 
 Shows explainable score breakdown: how each finding contributes to the final risk score, with per-rule weights and severity multipliers.
 
-### Threat Feed API
-
-```bash
-muaddib feed [--limit N] [--severity LEVEL] [--since DATE]
-muaddib serve [--port N]
-```
-
-Export detections as a JSON threat feed for SIEM integration.
-
-- `muaddib feed` — Output threat feed JSON to stdout (filterable by limit, severity, date)
-- `muaddib serve` — Start an HTTP server (default port 3000) with `GET /feed` and `GET /health` endpoints
-
-```bash
-muaddib serve --port 8080
-# GET http://localhost:8080/feed?limit=50&severity=HIGH
-# GET http://localhost:8080/health
-```
-
-### Detection time logging
-
-```bash
-muaddib detections [--stats] [--json]
-```
-
-View detection history with first-seen timestamps and lead time metrics (time between MUAD'DIB detection and public advisory).
-
-### FP rate tracking
-
-```bash
-muaddib stats [--daily] [--json]
-```
-
-View scan statistics: total scanned, clean, suspect, false positive rate, confirmed malicious count. Use `--daily` for per-day breakdown.
-
 ### Ground truth replay
 
 ```bash
@@ -742,7 +708,7 @@ Output (CLI, JSON, HTML, SARIF, Webhook, Threat Feed)
 - **ADR** (Adversarial Detection Rate): detection rate on 35 evasive malicious samples across 4 red-team waves + promoted holdout
 - **Holdout** (pre-tuning): detection rate on 10 unseen samples before any rule correction (measures generalization)
 
-Run `muaddib evaluate` to reproduce these metrics locally. See [Evaluation Methodology](docs/EVALUATION_METHODOLOGY.md) for the full experimental protocol.
+See [Evaluation Methodology](docs/EVALUATION_METHODOLOGY.md) for the full experimental protocol.
 
 ---
 

package/bin/muaddib.js

@@ -363,15 +363,6 @@ const helpText = `
     muaddib scrape                   Scrape new IOCs
     muaddib sandbox <pkg> [--strict] [--no-canary]  Analyze in isolated Docker container
     muaddib sandbox-report <pkg>     Sandbox + detailed network report
-    muaddib feed [options]            Threat feed (JSON)
-    muaddib serve [options]           Start threat feed HTTP server
-    muaddib detections               List recent detections
-    muaddib detections --stats       Show aggregated detection stats
-    muaddib detections --json        Raw JSON output
-    muaddib stats                    Show scan stats + FP rate
-    muaddib stats --daily            Last 7 days daily breakdown
-    muaddib stats --json             Raw JSON dump
-    muaddib evaluate                 Evaluate scanner effectiveness (TPR, FPR, ADR)
     muaddib version                  Show version
 
   Replay Options:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.2.3",
+  "version": "2.2.4",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {