muaddib-scanner 2.3.3 → 2.4.0

package/src/sarif.js

@@ -1,97 +1,97 @@
-const fs = require('fs');
-const path = require('path');
-const { RULES } = require('./rules/index.js');
-
-const pkgVersion = (() => {
-  try {
-    return JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8')).version;
-  } catch {
-    return '0.0.0';
-  }
-})();
-
-function generateSARIF(results) {
-  const sarif = {
-    $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
-    version: '2.1.0',
-    runs: [
-      {
-        tool: {
-          driver: {
-            name: 'MUADDIB',
-            version: pkgVersion,
-            informationUri: 'https://github.com/DNSZLSK/muad-dib',
-            rules: Object.values(RULES).map(rule => ({
-              id: rule.id,
-              name: rule.name,
-              shortDescription: { text: rule.description },
-              fullDescription: { text: rule.description },
-              helpUri: rule.references[0] || '',
-              properties: {
-                severity: rule.severity,
-                confidence: rule.confidence,
-                mitre: rule.mitre
-              }
-            }))
-          }
-        },
-        properties: results.sandbox ? {
-          sandbox: {
-            score: results.sandbox.score,
-            severity: results.sandbox.severity,
-            network: results.sandbox.network || {}
-          }
-        } : {},
-        results: (results.threats || []).map(threat => ({
-          ruleId: threat.rule_id,
-          level: sarifLevel(threat.severity),
-          message: { text: threat.message },
-          locations: [
-            {
-              physicalLocation: {
-                artifactLocation: {
-                  uri: encodeURI(threat.file || ''),
-                  uriBaseId: '%SRCROOT%'
-                },
-                region: {
-                  startLine: threat.line || 1
-                }
-              }
-            }
-          ],
-          properties: {
-            confidence: threat.confidence,
-            mitre: threat.mitre
-          }
-        }))
-      }
-    ]
-  };
-
-  return sarif;
-}
-
-function sarifLevel(severity) {
-  switch (severity) {
-    case 'CRITICAL': return 'error';
-    case 'HIGH': return 'error';
-    case 'MEDIUM': return 'warning';
-    case 'LOW': return 'note';
-    default: return 'note';
-  }
-}
-
-function saveSARIF(results, outputPath) {
-  if (!outputPath || typeof outputPath !== 'string') {
-    throw new Error('Invalid output path for SARIF report');
-  }
-  const sarif = generateSARIF(results);
-  try {
-    fs.writeFileSync(outputPath, JSON.stringify(sarif, null, 2));
-  } catch (e) {
-    throw new Error(`Failed to write SARIF report to ${outputPath}: ${e.message}`);
-  }
-  return outputPath;
-}
-
+const fs = require('fs');
+const path = require('path');
+const { RULES } = require('./rules/index.js');
+
+const pkgVersion = (() => {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8')).version;
+  } catch {
+    return '0.0.0';
+  }
+})();
+
+function generateSARIF(results) {
+  const sarif = {
+    $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
+    version: '2.1.0',
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: 'MUADDIB',
+            version: pkgVersion,
+            informationUri: 'https://github.com/DNSZLSK/muad-dib',
+            rules: Object.values(RULES).map(rule => ({
+              id: rule.id,
+              name: rule.name,
+              shortDescription: { text: rule.description },
+              fullDescription: { text: rule.description },
+              helpUri: rule.references[0] || '',
+              properties: {
+                severity: rule.severity,
+                confidence: rule.confidence,
+                mitre: rule.mitre
+              }
+            }))
+          }
+        },
+        properties: results.sandbox ? {
+          sandbox: {
+            score: results.sandbox.score,
+            severity: results.sandbox.severity,
+            network: results.sandbox.network || {}
+          }
+        } : {},
+        results: (results.threats || []).map(threat => ({
+          ruleId: threat.rule_id,
+          level: sarifLevel(threat.severity),
+          message: { text: threat.message },
+          locations: [
+            {
+              physicalLocation: {
+                artifactLocation: {
+                  uri: encodeURI(threat.file || ''),
+                  uriBaseId: '%SRCROOT%'
+                },
+                region: {
+                  startLine: threat.line || 1
+                }
+              }
+            }
+          ],
+          properties: {
+            confidence: threat.confidence,
+            mitre: threat.mitre
+          }
+        }))
+      }
+    ]
+  };
+
+  return sarif;
+}
+
+function sarifLevel(severity) {
+  switch (severity) {
+    case 'CRITICAL': return 'error';
+    case 'HIGH': return 'error';
+    case 'MEDIUM': return 'warning';
+    case 'LOW': return 'note';
+    default: return 'note';
+  }
+}
+
+function saveSARIF(results, outputPath) {
+  if (!outputPath || typeof outputPath !== 'string') {
+    throw new Error('Invalid output path for SARIF report');
+  }
+  const sarif = generateSARIF(results);
+  try {
+    fs.writeFileSync(outputPath, JSON.stringify(sarif, null, 2));
+  } catch (e) {
+    throw new Error(`Failed to write SARIF report to ${outputPath}: ${e.message}`);
+  }
+  return outputPath;
+}
+
 module.exports = { generateSARIF, saveSARIF };

package/src/scanner/ai-config.js

@@ -1,183 +1,183 @@
-/**
- * AI Config Injection Scanner
- *
- * Detects prompt injection attacks hidden in AI agent configuration files:
- * .cursorrules, CLAUDE.md, AGENT.md, .github/copilot-instructions.md,
- * copilot-setup-steps.yml, .cursorignore, .windsurfrules, etc.
- *
- * These files are designed to be read by AI coding assistants and may contain
- * hidden instructions to execute shell commands, exfiltrate secrets, or
- * download and run remote payloads.
- *
- * References:
- * - ToxicSkills (Snyk, Feb 2026)
- * - NVIDIA AI agent security guidance
- * - arxiv 2601.17548 (prompt injection in AI agents)
- * - Clinejection (Snyk, Feb 2026)
- */
-
-const fs = require('fs');
-const path = require('path');
-
-// AI agent config files to scan (relative to project root)
-const AI_CONFIG_FILES = [
-  '.cursorrules',
-  '.cursorignore',
-  '.windsurfrules',
-  'CLAUDE.md',
-  'AGENT.md',
-  '.github/copilot-instructions.md',
-  'copilot-setup-steps.yml',
-  '.github/copilot-setup-steps.yml'
-];
-
-// Dangerous shell command patterns in AI config files
-const SHELL_COMMAND_PATTERNS = [
-  // Download and execute
-  { regex: /curl\s+[^\n]*\|\s*(sh|bash|zsh)\b/i, label: 'curl pipe to shell', critical: true },
-  { regex: /wget\s+[^\n]*\|\s*(sh|bash|zsh)\b/i, label: 'wget pipe to shell', critical: true },
-  { regex: /curl\s+-[sS]*L?\s+https?:\/\/[^\s"']+\s*\|\s*(sh|bash)/i, label: 'curl download and execute', critical: true },
-  { regex: /wget\s+-[qQ]*O?-?\s+https?:\/\/[^\s"']+\s*\|\s*(sh|bash)/i, label: 'wget download and execute', critical: true },
-
-  // Direct shell execution
-  { regex: /\beval\s*\(/i, label: 'eval() call', critical: false },
-  { regex: /\bexec\s*\(/i, label: 'exec() call', critical: false },
-  { regex: /\bsource\s+\.env\b/i, label: 'source .env', critical: false },
-  { regex: /\bsh\s+-c\s+["']/i, label: 'sh -c execution', critical: false },
-  { regex: /\bbash\s+-c\s+["']/i, label: 'bash -c execution', critical: false },
-  { regex: /\bnode\s+-e\s+["']/i, label: 'node -e inline execution', critical: false },
-  { regex: /\bpython[3]?\s+-c\s+["']/i, label: 'python -c inline execution', critical: false }
-];
-
-// Exfiltration patterns — sending data to external endpoints
-const EXFIL_PATTERNS = [
-  { regex: /curl\s+[^\n]*-X\s*POST\s+[^\n]*https?:\/\/(?!api\.github\.com|registry\.npmjs\.org)[^\s"']+/i, label: 'curl POST to external endpoint' },
-  { regex: /curl\s+[^\n]*-d\s+[^\n]*https?:\/\/(?!api\.github\.com|registry\.npmjs\.org)[^\s"']+/i, label: 'curl data upload to external endpoint' },
-  { regex: /curl\s+[^\n]*https?:\/\/(?!api\.github\.com|registry\.npmjs\.org)[^\s"']+[^\n]*-d\s/i, label: 'curl data upload to external endpoint' },
-  { regex: /\|\s*curl\s+[^\n]*https?:\/\/(?!api\.github\.com|registry\.npmjs\.org)/i, label: 'pipe output to curl' },
-  { regex: /\|\s*base64\s*\|\s*curl/i, label: 'base64 encode and send via curl' }
-];
-
-// Credential access patterns — reading sensitive files/vars
-const CREDENTIAL_ACCESS_PATTERNS = [
-  { regex: /cat\s+~?\/?\.ssh\/id_/i, label: 'read SSH private key' },
-  { regex: /cat\s+~?\/?\.npmrc/i, label: 'read .npmrc tokens' },
-  { regex: /cat\s+~?\/?\.aws\/credentials/i, label: 'read AWS credentials' },
-  { regex: /cat\s+~?\/?\.env\b/i, label: 'read .env file' },
-  { regex: /cat\s+~?\/?\.gnupg\//i, label: 'read GPG keys' },
-  { regex: /\$GITHUB_TOKEN|\$GH_TOKEN|\$NPM_TOKEN|\$AWS_SECRET_ACCESS_KEY|\$DISCORD_TOKEN/i, label: 'reference to secret env var' },
-  { regex: /grep\s+[^\n]*(TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL)[^\n]*/i, label: 'grep for secrets' },
-  { regex: /env\s*\|\s*grep\s+[^\n]*(TOKEN|KEY|SECRET|PASSWORD)/i, label: 'env grep for secrets' }
-];
-
-// Instruction patterns — AI prompt injection directives
-const INJECTION_INSTRUCTION_PATTERNS = [
-  { regex: /before\s+(reviewing|running|any|code|generating)[^\n]*(run|execute|source):/i, label: 'instruction to execute before review' },
-  { regex: /always\s+run\s+[^\n]*(before|first|initially)/i, label: 'instruction to always run command' },
-  { regex: /send\s+(contents?|data|output|results?)\s+(to|via)\s+https?:\/\//i, label: 'instruction to send data to URL' },
-  { regex: /upload\s+[^\n]*(to|via)\s+https?:\/\//i, label: 'instruction to upload to URL' },
-  { regex: /do\s+not\s+(display|show|output|mention|tell)/i, label: 'instruction to hide activity' }
-];
-
-/**
- * Scan AI config files for prompt injection
- */
-function scanAIConfig(targetPath) {
-  const threats = [];
-
-  for (const configFile of AI_CONFIG_FILES) {
-    const filePath = path.join(targetPath, configFile);
-
-    if (!fs.existsSync(filePath)) continue;
-
-    let content;
-    try {
-      const stat = fs.statSync(filePath);
-      if (stat.size > 1024 * 1024) continue; // Skip files > 1MB
-      content = fs.readFileSync(filePath, 'utf8');
-    } catch {
-      continue;
-    }
-
-    const relPath = configFile;
-    const fileThreats = analyzeAIConfigFile(content, relPath);
-    threats.push(...fileThreats);
-  }
-
-  return threats;
-}
-
-/**
- * Analyze a single AI config file for prompt injection patterns
- */
-function analyzeAIConfigFile(content, relPath) {
-  const threats = [];
-  let hasShellCommand = false;
-  let hasExfiltration = false;
-  let hasCredentialAccess = false;
-
-  // Check shell command patterns
-  for (const pattern of SHELL_COMMAND_PATTERNS) {
-    if (pattern.regex.test(content)) {
-      hasShellCommand = true;
-      threats.push({
-        type: pattern.critical ? 'ai_config_injection_critical' : 'ai_config_injection',
-        severity: pattern.critical ? 'CRITICAL' : 'HIGH',
-        message: `AI config prompt injection: ${pattern.label} in ${relPath}`,
-        file: relPath
-      });
-    }
-  }
-
-  // Check exfiltration patterns
-  for (const pattern of EXFIL_PATTERNS) {
-    if (pattern.regex.test(content)) {
-      hasExfiltration = true;
-      threats.push({
-        type: 'ai_config_injection_critical',
-        severity: 'CRITICAL',
-        message: `AI config exfiltration: ${pattern.label} in ${relPath}`,
-        file: relPath
-      });
-    }
-  }
-
-  // Check credential access patterns
-  for (const pattern of CREDENTIAL_ACCESS_PATTERNS) {
-    if (pattern.regex.test(content)) {
-      hasCredentialAccess = true;
-      threats.push({
-        type: 'ai_config_injection',
-        severity: 'HIGH',
-        message: `AI config credential access: ${pattern.label} in ${relPath}`,
-        file: relPath
-      });
-    }
-  }
-
-  // Check injection instruction patterns
-  for (const pattern of INJECTION_INSTRUCTION_PATTERNS) {
-    if (pattern.regex.test(content)) {
-      threats.push({
-        type: 'ai_config_injection',
-        severity: 'HIGH',
-        message: `AI config prompt injection: ${pattern.label} in ${relPath}`,
-        file: relPath
-      });
-    }
-  }
-
-  // Compound detection: shell + exfil or credential access → escalate
-  if (hasShellCommand && (hasExfiltration || hasCredentialAccess)) {
-    threats.push({
-      type: 'ai_config_injection_critical',
-      severity: 'CRITICAL',
-      message: `AI config compound attack: shell commands + ${hasExfiltration ? 'exfiltration' : 'credential access'} in ${relPath} — ToxicSkills/Clinejection pattern.`,
-      file: relPath
-    });
-  }
-
-  return threats;
-}
-
-module.exports = { scanAIConfig };
+/**
+ * AI Config Injection Scanner
+ *
+ * Detects prompt injection attacks hidden in AI agent configuration files:
+ * .cursorrules, CLAUDE.md, AGENT.md, .github/copilot-instructions.md,
+ * copilot-setup-steps.yml, .cursorignore, .windsurfrules, etc.
+ *
+ * These files are designed to be read by AI coding assistants and may contain
+ * hidden instructions to execute shell commands, exfiltrate secrets, or
+ * download and run remote payloads.
+ *
+ * References:
+ * - ToxicSkills (Snyk, Feb 2026)
+ * - NVIDIA AI agent security guidance
+ * - arxiv 2601.17548 (prompt injection in AI agents)
+ * - Clinejection (Snyk, Feb 2026)
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+// AI agent config files to scan (relative to project root)
+const AI_CONFIG_FILES = [
+  '.cursorrules',
+  '.cursorignore',
+  '.windsurfrules',
+  'CLAUDE.md',
+  'AGENT.md',
+  '.github/copilot-instructions.md',
+  'copilot-setup-steps.yml',
+  '.github/copilot-setup-steps.yml'
+];
+
+// Dangerous shell command patterns in AI config files
+const SHELL_COMMAND_PATTERNS = [
+  // Download and execute
+  { regex: /curl\s+[^\n]*\|\s*(sh|bash|zsh)\b/i, label: 'curl pipe to shell', critical: true },
+  { regex: /wget\s+[^\n]*\|\s*(sh|bash|zsh)\b/i, label: 'wget pipe to shell', critical: true },
+  { regex: /curl\s+-[sS]*L?\s+https?:\/\/[^\s"']+\s*\|\s*(sh|bash)/i, label: 'curl download and execute', critical: true },
+  { regex: /wget\s+-[qQ]*O?-?\s+https?:\/\/[^\s"']+\s*\|\s*(sh|bash)/i, label: 'wget download and execute', critical: true },
+
+  // Direct shell execution
+  { regex: /\beval\s*\(/i, label: 'eval() call', critical: false },
+  { regex: /\bexec\s*\(/i, label: 'exec() call', critical: false },
+  { regex: /\bsource\s+\.env\b/i, label: 'source .env', critical: false },
+  { regex: /\bsh\s+-c\s+["']/i, label: 'sh -c execution', critical: false },
+  { regex: /\bbash\s+-c\s+["']/i, label: 'bash -c execution', critical: false },
+  { regex: /\bnode\s+-e\s+["']/i, label: 'node -e inline execution', critical: false },
+  { regex: /\bpython[3]?\s+-c\s+["']/i, label: 'python -c inline execution', critical: false }
+];
+
+// Exfiltration patterns — sending data to external endpoints
+const EXFIL_PATTERNS = [
+  { regex: /curl\s+[^\n]*-X\s*POST\s+[^\n]*https?:\/\/(?!api\.github\.com|registry\.npmjs\.org)[^\s"']+/i, label: 'curl POST to external endpoint' },
+  { regex: /curl\s+[^\n]*-d\s+[^\n]*https?:\/\/(?!api\.github\.com|registry\.npmjs\.org)[^\s"']+/i, label: 'curl data upload to external endpoint' },
+  { regex: /curl\s+[^\n]*https?:\/\/(?!api\.github\.com|registry\.npmjs\.org)[^\s"']+[^\n]*-d\s/i, label: 'curl data upload to external endpoint' },
+  { regex: /\|\s*curl\s+[^\n]*https?:\/\/(?!api\.github\.com|registry\.npmjs\.org)/i, label: 'pipe output to curl' },
+  { regex: /\|\s*base64\s*\|\s*curl/i, label: 'base64 encode and send via curl' }
+];
+
+// Credential access patterns — reading sensitive files/vars
+const CREDENTIAL_ACCESS_PATTERNS = [
+  { regex: /cat\s+~?\/?\.ssh\/id_/i, label: 'read SSH private key' },
+  { regex: /cat\s+~?\/?\.npmrc/i, label: 'read .npmrc tokens' },
+  { regex: /cat\s+~?\/?\.aws\/credentials/i, label: 'read AWS credentials' },
+  { regex: /cat\s+~?\/?\.env\b/i, label: 'read .env file' },
+  { regex: /cat\s+~?\/?\.gnupg\//i, label: 'read GPG keys' },
+  { regex: /\$GITHUB_TOKEN|\$GH_TOKEN|\$NPM_TOKEN|\$AWS_SECRET_ACCESS_KEY|\$DISCORD_TOKEN/i, label: 'reference to secret env var' },
+  { regex: /grep\s+[^\n]*(TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL)[^\n]*/i, label: 'grep for secrets' },
+  { regex: /env\s*\|\s*grep\s+[^\n]*(TOKEN|KEY|SECRET|PASSWORD)/i, label: 'env grep for secrets' }
+];
+
+// Instruction patterns — AI prompt injection directives
+const INJECTION_INSTRUCTION_PATTERNS = [
+  { regex: /before\s+(reviewing|running|any|code|generating)[^\n]*(run|execute|source):/i, label: 'instruction to execute before review' },
+  { regex: /always\s+run\s+[^\n]*(before|first|initially)/i, label: 'instruction to always run command' },
+  { regex: /send\s+(contents?|data|output|results?)\s+(to|via)\s+https?:\/\//i, label: 'instruction to send data to URL' },
+  { regex: /upload\s+[^\n]*(to|via)\s+https?:\/\//i, label: 'instruction to upload to URL' },
+  { regex: /do\s+not\s+(display|show|output|mention|tell)/i, label: 'instruction to hide activity' }
+];
+
+/**
+ * Scan AI config files for prompt injection
+ */
+function scanAIConfig(targetPath) {
+  const threats = [];
+
+  for (const configFile of AI_CONFIG_FILES) {
+    const filePath = path.join(targetPath, configFile);
+
+    if (!fs.existsSync(filePath)) continue;
+
+    let content;
+    try {
+      const stat = fs.statSync(filePath);
+      if (stat.size > 1024 * 1024) continue; // Skip files > 1MB
+      content = fs.readFileSync(filePath, 'utf8');
+    } catch {
+      continue;
+    }
+
+    const relPath = configFile;
+    const fileThreats = analyzeAIConfigFile(content, relPath);
+    threats.push(...fileThreats);
+  }
+
+  return threats;
+}
+
+/**
+ * Analyze a single AI config file for prompt injection patterns
+ */
+function analyzeAIConfigFile(content, relPath) {
+  const threats = [];
+  let hasShellCommand = false;
+  let hasExfiltration = false;
+  let hasCredentialAccess = false;
+
+  // Check shell command patterns
+  for (const pattern of SHELL_COMMAND_PATTERNS) {
+    if (pattern.regex.test(content)) {
+      hasShellCommand = true;
+      threats.push({
+        type: pattern.critical ? 'ai_config_injection_critical' : 'ai_config_injection',
+        severity: pattern.critical ? 'CRITICAL' : 'HIGH',
+        message: `AI config prompt injection: ${pattern.label} in ${relPath}`,
+        file: relPath
+      });
+    }
+  }
+
+  // Check exfiltration patterns
+  for (const pattern of EXFIL_PATTERNS) {
+    if (pattern.regex.test(content)) {
+      hasExfiltration = true;
+      threats.push({
+        type: 'ai_config_injection_critical',
+        severity: 'CRITICAL',
+        message: `AI config exfiltration: ${pattern.label} in ${relPath}`,
+        file: relPath
+      });
+    }
+  }
+
+  // Check credential access patterns
+  for (const pattern of CREDENTIAL_ACCESS_PATTERNS) {
+    if (pattern.regex.test(content)) {
+      hasCredentialAccess = true;
+      threats.push({
+        type: 'ai_config_injection',
+        severity: 'HIGH',
+        message: `AI config credential access: ${pattern.label} in ${relPath}`,
+        file: relPath
+      });
+    }
+  }
+
+  // Check injection instruction patterns
+  for (const pattern of INJECTION_INSTRUCTION_PATTERNS) {
+    if (pattern.regex.test(content)) {
+      threats.push({
+        type: 'ai_config_injection',
+        severity: 'HIGH',
+        message: `AI config prompt injection: ${pattern.label} in ${relPath}`,
+        file: relPath
+      });
+    }
+  }
+
+  // Compound detection: shell + exfil or credential access → escalate
+  if (hasShellCommand && (hasExfiltration || hasCredentialAccess)) {
+    threats.push({
+      type: 'ai_config_injection_critical',
+      severity: 'CRITICAL',
+      message: `AI config compound attack: shell commands + ${hasExfiltration ? 'exfiltration' : 'credential access'} in ${relPath} — ToxicSkills/Clinejection pattern.`,
+      file: relPath
+    });
+  }
+
+  return threats;
+}
+
+module.exports = { scanAIConfig };

package/src/scanner/ast-detectors.js

@@ -68,7 +68,7 @@ const CREDENTIAL_CLI_COMMANDS = [
 ];
 
 // Dangerous shell command patterns for variable tracking
-const DANGEROUS_CMD_PATTERNS = [/\bcurl\b/, /\bwget\b/, /\bnc\s+-/, /\/dev\/tcp\//, /\bbash\s+-i/];
+const DANGEROUS_CMD_PATTERNS = [/\bcurl\b/, /\bwget\b/, /\bnc\s+-/, /\/dev\/tcp\//, /\bbash\s+-i/, /\bpowershell\b/, /\bpwsh\b/, /\bnslookup\b/, /\bdig\s+/];
 
 // Native APIs targeted for prototype hooking (chalk Sept 2025, Sygnia)
 const HOOKABLE_NATIVES = [
@@ -325,7 +325,7 @@ function handleCallExpression(node, ctx) {
 
     if (cmdStr) {
       // Check for dangerous shell patterns
-      if (/\|\s*(sh|bash)\b/.test(cmdStr) || /nc\s+-[elp]/.test(cmdStr) || /\/dev\/tcp\//.test(cmdStr) || /bash\s+-i/.test(cmdStr) || /\bcurl\b/.test(cmdStr) || /\bwget\b/.test(cmdStr)) {
+      if (/\|\s*(sh|bash)\b/.test(cmdStr) || /nc\s+-[elp]/.test(cmdStr) || /\/dev\/tcp\//.test(cmdStr) || /bash\s+-i/.test(cmdStr) || /\bcurl\b/.test(cmdStr) || /\bwget\b/.test(cmdStr) || /\bpowershell\b/.test(cmdStr) || /\bpwsh\b/.test(cmdStr) || /\bnslookup\b/.test(cmdStr) || /\bdig\s+/.test(cmdStr) || /\bhost\s+\S+\.\S+/.test(cmdStr)) {
         ctx.threats.push({
           type: 'dangerous_exec',
           severity: 'CRITICAL',

package/src/scanner/ast.js

@@ -1,7 +1,7 @@
 const path = require('path');
 const acorn = require('acorn');
 const walk = require('acorn-walk');
-const { ACORN_OPTIONS } = require('../shared/constants.js');
+const { ACORN_OPTIONS, safeParse } = require('../shared/constants.js');
 const { analyzeWithDeobfuscation } = require('../shared/analyze-helper.js');
 const {
   handleVariableDeclarator,
@@ -32,9 +32,8 @@ function analyzeFile(content, filePath, basePath) {
   const threats = [];
   let ast;
 
-  try {
-    ast = acorn.parse(content, ACORN_OPTIONS);
-  } catch {
+  ast = safeParse(content);
+  if (!ast) {
     // AST parse failed — apply regex fallback for known dangerous patterns
 
     // Workflow manipulation: reads + writes to .github/workflows

package/src/scanner/dataflow.js

@@ -3,7 +3,7 @@ const path = require('path');
 const acorn = require('acorn');
 const walk = require('acorn-walk');
 const { getCallName } = require('../utils.js');
-const { ACORN_OPTIONS } = require('../shared/constants.js');
+const { ACORN_OPTIONS, safeParse } = require('../shared/constants.js');
 const { analyzeWithDeobfuscation } = require('../shared/analyze-helper.js');
 
 async function analyzeDataFlow(targetPath, options = {}) {
@@ -16,11 +16,8 @@ function analyzeFile(content, filePath, basePath) {
   const threats = [];
   let ast;
 
-  try {
-    ast = acorn.parse(content, { ...ACORN_OPTIONS, locations: true });
-  } catch {
-    return threats;
-  }
+  ast = safeParse(content, { locations: true });
+  if (!ast) return threats;
 
   const sources = [];
   const sinks = [];
@@ -340,9 +337,17 @@ function isCredentialPath(arg, sensitivePathVars) {
   return false;
 }
 
+// System identity env vars used for fingerprinting/exfiltration
+const SYSTEM_IDENTITY_ENVS = new Set([
+  'USER', 'USERNAME', 'LOGNAME', 'HOME', 'HOSTNAME',
+  'USERPROFILE', 'COMPUTERNAME', 'WHOAMI'
+]);
+
 function isSensitiveEnv(name) {
+  const upper = name.toUpperCase();
+  if (SYSTEM_IDENTITY_ENVS.has(upper)) return true;
   const sensitive = ['TOKEN', 'SECRET', 'KEY', 'PASSWORD', 'CREDENTIAL', 'AUTH', 'NPM', 'AWS', 'AZURE', 'GCP'];
-  return sensitive.some(s => name.toUpperCase().includes(s));
+  return sensitive.some(s => upper.includes(s));
 }
 
 module.exports = { analyzeDataFlow };