muaddib-scanner 2.2.9 → 2.2.10

package/README.fr.md

@@ -720,9 +720,19 @@ Output (CLI, JSON, HTML, SARIF, Webhook, Threat Feed)
 |----------|----------|---------|
 | **TPR** (Ground Truth) | **100%** (4/4) | Attaques reelles : event-stream, ua-parser-js, coa, node-ipc |
 | **FPR** (Benign) | **17.5%** (92/527) | 529 packages npm, vrai code source via `npm pack`, seuil > 20 |
+| **FPR** (Packages standard) | **6.0%** (15/251) | Packages avec <10 fichiers JS — librairies et outils typiques |
 | **ADR** (Adversarial) | **100%** (35/35) | 35 samples evasifs sur 4 vagues red team |
 | **Holdouts** (pre-tuning) | 40/40 pass | Tous les holdouts passent apres corrections |
 
+**FPR par taille de package** — Le FPR correle lineairement avec la taille du package. Les gros frameworks (Next.js, Gatsby, Webpack) accumulent des findings legitimes qui declenchent les heuristiques :
+
+| Categorie | Packages | FP | FPR |
+|-----------|----------|-----|-----|
+| Petits (<10 fichiers JS) | 251 | 15 | **6.0%** |
+| Moyens (10-50 fichiers JS) | 137 | 27 | 19.7% |
+| Gros (50-100 fichiers JS) | 38 | 14 | 36.8% |
+| Tres gros (100+ fichiers JS) | 62 | 29 | 46.8% |
+
 **Progression FPR** : 0% (invalide, dirs vides, v2.2.0-v2.2.6) → 38% (premiere vraie mesure, v2.2.7) → 19.4% (v2.2.8) → **17.5%** (v2.2.9)
 
 **Progression holdout** (scores pre-tuning, regles gelees) :
@@ -736,7 +746,7 @@ Output (CLI, JSON, HTML, SARIF, Webhook, Threat Feed)
 | v5 | 50% (5/10) | Dataflow inter-module (nouveau scanner) |
 
 - **TPR** (True Positive Rate) : taux de detection sur 4 attaques supply-chain reelles (event-stream, ua-parser-js, coa, node-ipc)
-- **FPR** (False Positive Rate) : packages avec score > 20 sur 529 packages npm reels (code source scanne, pas des dirs vides)
+- **FPR** (False Positive Rate) : packages avec score > 20 sur 529 packages npm reels (code source scanne, pas des dirs vides). Le 6% sur les packages standard (<10 fichiers JS, 251 packages) est la metrique la plus representative pour un usage typique — la plupart des packages npm sont petits.
 - **ADR** (Adversarial Detection Rate) : taux de detection sur 35 samples malveillants evasifs sur 4 vagues red team
 - **Holdout** (pre-tuning) : taux de detection sur 10 samples jamais vus avec regles gelees (mesure de generalisation)
 

package/README.md

@@ -723,9 +723,19 @@ Output (CLI, JSON, HTML, SARIF, Webhook, Threat Feed)
 |--------|--------|---------|
 | **TPR** (Ground Truth) | **100%** (4/4) | Real-world attacks: event-stream, ua-parser-js, coa, node-ipc |
 | **FPR** (Benign) | **17.5%** (92/527) | 529 npm packages, real source code via `npm pack`, threshold > 20 |
+| **FPR** (Standard packages) | **6.0%** (15/251) | Packages with <10 JS files — typical libraries and tools |
 | **ADR** (Adversarial) | **100%** (35/35) | 35 evasive samples across 4 red-team waves |
 | **Holdouts** (pre-tuning) | 40/40 pass | All holdout samples pass after corrections |
 
+**FPR by package size** — FPR correlates linearly with package size. Large frameworks (Next.js, Gatsby, Webpack) accumulate legitimate findings that trigger heuristics:
+
+| Category | Packages | FP | FPR |
+|----------|----------|-----|-----|
+| Small (<10 JS files) | 251 | 15 | **6.0%** |
+| Medium (10-50 JS files) | 137 | 27 | 19.7% |
+| Large (50-100 JS files) | 38 | 14 | 36.8% |
+| Very large (100+ JS files) | 62 | 29 | 46.8% |
+
 **FPR progression**: 0% (invalid, empty dirs, v2.2.0-v2.2.6) → 38% (first real measurement, v2.2.7) → 19.4% (v2.2.8) → **17.5%** (v2.2.9)
 
 **Holdout progression** (pre-tuning scores, rules frozen):
@@ -739,7 +749,7 @@ Output (CLI, JSON, HTML, SARIF, Webhook, Threat Feed)
 | v5 | 50% (5/10) | Inter-module dataflow (new scanner) |
 
 - **TPR** (True Positive Rate): detection rate on 4 real-world supply-chain attacks (event-stream, ua-parser-js, coa, node-ipc)
-- **FPR** (False Positive Rate): packages scoring > 20 out of 529 real npm packages (source code scanned, not empty dirs)
+- **FPR** (False Positive Rate): packages scoring > 20 out of 529 real npm packages (source code scanned, not empty dirs). The 6% on standard packages (<10 JS files, 251 packages) is the most representative metric for typical use — most npm packages are small.
 - **ADR** (Adversarial Detection Rate): detection rate on 35 evasive malicious samples across 4 red-team waves
 - **Holdout** (pre-tuning): detection rate on 10 unseen samples with rules frozen (measures generalization)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.2.9",
+  "version": "2.2.10",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {