muaddib-scanner 2.2.7 → 2.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.2.7",
+  "version": "2.2.8",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/src/index.js

@@ -64,6 +64,50 @@ const MAX_RISK_SCORE = 100;
 
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
 
+// ============================================
+// FP REDUCTION POST-PROCESSING
+// ============================================
+// Legitimate frameworks produce high volumes of certain threat types that
+// malware never does. This function downgrades severity when the count
+// exceeds thresholds only seen in legitimate codebases.
+const FP_COUNT_THRESHOLDS = {
+  dynamic_require: { maxCount: 10, from: 'HIGH', to: 'LOW' },
+  dangerous_call_function: { maxCount: 5, from: 'MEDIUM', to: 'LOW' },
+  require_cache_poison: { maxCount: 3, from: 'CRITICAL', to: 'LOW' }
+};
+
+// Custom class prototypes that HTTP frameworks legitimately extend.
+// Distinguished from dangerous core Node.js prototype hooks.
+const FRAMEWORK_PROTOTYPES = ['Request', 'Response', 'App', 'Router'];
+const FRAMEWORK_PROTO_RE = new RegExp(
+  '^(' + FRAMEWORK_PROTOTYPES.join('|') + ')\\.prototype\\.'
+);
+
+function applyFPReductions(threats) {
+  // Count occurrences of each threat type (package-level, across all files)
+  const typeCounts = {};
+  for (const t of threats) {
+    typeCounts[t.type] = (typeCounts[t.type] || 0) + 1;
+  }
+
+  for (const t of threats) {
+    // Count-based downgrade: if a threat type appears too many times,
+    // it's a framework/plugin system, not malware
+    const rule = FP_COUNT_THRESHOLDS[t.type];
+    if (rule && typeCounts[t.type] > rule.maxCount && t.severity === rule.from) {
+      t.severity = rule.to;
+    }
+
+    // Prototype hook: framework class prototypes → MEDIUM
+    // Core Node.js prototypes (http.IncomingMessage, net.Socket) stay CRITICAL
+    // Browser/native APIs (globalThis.fetch, XMLHttpRequest) stay HIGH
+    if (t.type === 'prototype_hook' && t.severity === 'HIGH' &&
+        FRAMEWORK_PROTO_RE.test(t.message)) {
+      t.severity = 'MEDIUM';
+    }
+  }
+}
+
 // Paranoid mode scanner
 function scanParanoid(targetPath) {
   const threats = [];
@@ -563,6 +607,10 @@ async function run(targetPath, options = {}) {
     }
   }
 
+  // FP reduction: legitimate frameworks produce high volumes of certain threat types.
+  // A malware package typically has 1-3 occurrences, not dozens.
+  applyFPReductions(deduped);
+
   // Enrich each threat with rules
   const enrichedThreats = deduped.map(t => {
     const rule = getRule(t.type);

package/src/scanner/typosquat.js

@@ -72,7 +72,19 @@ const WHITELIST = new Set([
   'eslint-config-prettier', 'eslint-plugin-prettier',
   'eslint-scope', 'eslint-visitor-keys',
   'esbuild-register',
-  'neo-async'
+  'neo-async',
+
+  // Packages with names close to other popular packages (not typosquats)
+  'chai',       // resembles chalk (missing_char)
+  'pino',       // resembles sinon (missing_char)
+  'ioredis',    // resembles redis (extra prefix)
+  'bcryptjs',   // resembles bcrypt (suffix)
+  'recast',     // resembles react (extra_char)
+  'asyncdi',    // resembles async (suffix)
+  'redux',      // resembles redis (wrong_char)
+  'args',       // resembles yargs (missing_char)
+  'oxlint',     // resembles eslint (wrong_char)
+  'vasync'      // resembles async (extra prefix)
 ]);
 
 

package/tmp-summary.js

@@ -1,24 +0,0 @@
-const m = require('./metrics/v2.2.6.json');
-console.log('=== BENIGN FPR RESULTS (50 packages) ===');
-console.log('TPR:', m.groundTruth.tpr*100+'%');
-console.log('FPR:', m.benign.fpr*100+'%', '('+m.benign.flagged+'/'+m.benign.scanned+')');
-console.log('ADR:', m.adversarial.adr*100+'%');
-console.log();
-console.log('=== FALSE POSITIVES (score > 20) ===');
-const fps = m.benign.details.filter(d => d.flagged).sort((a,b) => b.score - a.score);
-fps.forEach(fp => {
-  console.log(fp.name+': score '+fp.score);
-  const types = {};
-  (fp.threats||[]).forEach(t => { types[t.type] = (types[t.type]||0)+1; });
-  Object.entries(types).sort((a,b)=>b[1]-a[1]).forEach(([k,v]) => console.log('  '+k+': '+v));
-});
-console.log();
-console.log('=== NON-FLAGGED BUT ELEVATED (score > 0) ===');
-m.benign.details.filter(d => !d.flagged && d.score > 0).sort((a,b) => b.score - a.score).forEach(d => console.log(d.name+': score '+d.score));
-console.log();
-console.log('=== THREAT TYPE FREQUENCY ===');
-const allTypes = {};
-fps.forEach(fp => {
-  (fp.threats||[]).forEach(t => { allTypes[t.type] = (allTypes[t.type]||0)+1; });
-});
-Object.entries(allTypes).sort((a,b)=>b[1]-a[1]).forEach(([k,v]) => console.log('  '+k+': '+v));