muaddib-scanner 2.3.3 → 2.4.0

package/src/scoring.js

@@ -137,7 +137,38 @@ const FRAMEWORK_PROTO_RE = new RegExp(
   '^(' + FRAMEWORK_PROTOTYPES.join('|') + ')\\.prototype\\.'
 );
 
-function applyFPReductions(threats, reachableFiles) {
+// ============================================
+// BENIGN PACKAGE WHITELIST (v2.3.5)
+// ============================================
+// Well-known npm packages whose legitimate code patterns trigger false positives.
+// For whitelisted packages, non-IOC threats are downgraded to LOW.
+// IOC matches, lifecycle_shell_pipe, and cross_file_dataflow are NEVER downgraded
+// — a compromised version of these packages would still be detected.
+const BENIGN_PACKAGE_WHITELIST = new Set([
+  'meteor',               // powershell PATH setup in install.js (dangerous_exec FP)
+  'blessed',              // module._compile for terminal capabilities (module_compile FP)
+  'sharp',                // native bindings with dynamic require + postinstall (lifecycle FP)
+  'forever',              // process manager: detached spawn + HOME config access (dataflow FP)
+  'start-server-and-test' // curl/wget in test scripts, not install hooks (lifecycle FP)
+]);
+
+// Threat types never affected by benign package whitelist (real compromise indicators)
+const WHITELIST_EXEMPT_TYPES = new Set([
+  'ioc_match', 'known_malicious_package', 'pypi_malicious_package', 'shai_hulud_marker',
+  'lifecycle_shell_pipe',
+  'cross_file_dataflow'
+]);
+
+function applyFPReductions(threats, reachableFiles, packageName) {
+  // Benign package whitelist: downgrade all non-IOC threats to LOW
+  if (packageName && BENIGN_PACKAGE_WHITELIST.has(packageName)) {
+    for (const t of threats) {
+      if (!WHITELIST_EXEMPT_TYPES.has(t.type) && t.severity !== 'LOW') {
+        t.severity = 'LOW';
+      }
+    }
+  }
+
   // Count occurrences of each threat type (package-level, across all files)
   const typeCounts = {};
   for (const t of threats) {
@@ -267,5 +298,6 @@ function calculateRiskScore(deduped) {
 
 module.exports = {
   SEVERITY_WEIGHTS, RISK_THRESHOLDS, MAX_RISK_SCORE,
+  BENIGN_PACKAGE_WHITELIST, WHITELIST_EXEMPT_TYPES,
   isPackageLevelThreat, computeGroupScore, applyFPReductions, calculateRiskScore
 };

package/src/shared/analyze-helper.js

@@ -1,49 +1,49 @@
-const path = require('path');
-const { isDevFile, findJsFiles, forEachSafeFile } = require('../utils.js');
-
-/**
- * Shared scanner wrapper: iterates JS files, runs analyzeFileFn on original + deobfuscated code,
- * deduplicates findings by type::message key.
- * @param {string} targetPath - Root directory to scan
- * @param {Function} analyzeFileFn - (content, filePath, basePath) => threats[]
- * @param {object} [options]
- * @param {Function} [options.deobfuscate] - Deobfuscation function
- * @param {string[]} [options.excludedFiles] - Relative paths to skip
- * @param {boolean} [options.skipDevFiles=true] - Whether to skip dev/test files
- * @returns {Array} Combined threats
- */
-function analyzeWithDeobfuscation(targetPath, analyzeFileFn, options = {}) {
-  const threats = [];
-  const files = findJsFiles(targetPath);
-
-  forEachSafeFile(files, (file, content) => {
-    const relativePath = path.relative(targetPath, file).replace(/\\/g, '/');
-
-    if (options.excludedFiles && options.excludedFiles.includes(relativePath)) return;
-    if (options.skipDevFiles !== false && isDevFile(relativePath)) return;
-
-    // Analyze original code first (preserves obfuscation-detection rules)
-    const fileThreats = analyzeFileFn(content, file, targetPath);
-    threats.push(...fileThreats);
-
-    // Also analyze deobfuscated code for additional findings hidden by obfuscation
-    if (typeof options.deobfuscate === 'function') {
-      try {
-        const result = options.deobfuscate(content);
-        if (result.transforms.length > 0) {
-          const deobThreats = analyzeFileFn(result.code, file, targetPath);
-          const existingKeys = new Set(fileThreats.map(t => `${t.type}::${t.message}`));
-          for (const dt of deobThreats) {
-            if (!existingKeys.has(`${dt.type}::${dt.message}`)) {
-              threats.push(dt);
-            }
-          }
-        }
-      } catch { /* deobfuscation failed — skip */ }
-    }
-  });
-
-  return threats;
-}
-
-module.exports = { analyzeWithDeobfuscation };
+const path = require('path');
+const { isDevFile, findJsFiles, forEachSafeFile } = require('../utils.js');
+
+/**
+ * Shared scanner wrapper: iterates JS files, runs analyzeFileFn on original + deobfuscated code,
+ * deduplicates findings by type::message key.
+ * @param {string} targetPath - Root directory to scan
+ * @param {Function} analyzeFileFn - (content, filePath, basePath) => threats[]
+ * @param {object} [options]
+ * @param {Function} [options.deobfuscate] - Deobfuscation function
+ * @param {string[]} [options.excludedFiles] - Relative paths to skip
+ * @param {boolean} [options.skipDevFiles=true] - Whether to skip dev/test files
+ * @returns {Array} Combined threats
+ */
+function analyzeWithDeobfuscation(targetPath, analyzeFileFn, options = {}) {
+  const threats = [];
+  const files = findJsFiles(targetPath);
+
+  forEachSafeFile(files, (file, content) => {
+    const relativePath = path.relative(targetPath, file).replace(/\\/g, '/');
+
+    if (options.excludedFiles && options.excludedFiles.includes(relativePath)) return;
+    if (options.skipDevFiles !== false && isDevFile(relativePath)) return;
+
+    // Analyze original code first (preserves obfuscation-detection rules)
+    const fileThreats = analyzeFileFn(content, file, targetPath);
+    threats.push(...fileThreats);
+
+    // Also analyze deobfuscated code for additional findings hidden by obfuscation
+    if (typeof options.deobfuscate === 'function') {
+      try {
+        const result = options.deobfuscate(content);
+        if (result.transforms.length > 0) {
+          const deobThreats = analyzeFileFn(result.code, file, targetPath);
+          const existingKeys = new Set(fileThreats.map(t => `${t.type}::${t.message}`));
+          for (const dt of deobThreats) {
+            if (!existingKeys.has(`${dt.type}::${dt.message}`)) {
+              threats.push(dt);
+            }
+          }
+        }
+      } catch { /* deobfuscation failed — skip */ }
+    }
+  });
+
+  return threats;
+}
+
+module.exports = { analyzeWithDeobfuscation };

package/src/shared/constants.js

@@ -1,93 +1,113 @@
-// Shared REHABILITATED_PACKAGES — single source of truth
-// Packages that were temporarily compromised but are now safe
-// These packages will NOT be blocked (except specific compromised versions)
-const REHABILITATED_PACKAGES = {
-  // September 2025 - Massive compromise via phishing, fixed within hours
-  'chalk': {
-    compromised: [],
-    safe: true,
-    note: 'Compromised Sept 2025, malicious versions removed from npm'
-  },
-  'debug': {
-    compromised: [],
-    safe: true,
-    note: 'Compromised Sept 2025, quickly fixed'
-  },
-  'ansi-styles': {
-    compromised: [],
-    safe: true,
-    note: 'Compromised Sept 2025, quickly fixed'
-  },
-  'strip-ansi': {
-    compromised: [],
-    safe: true,
-    note: 'Compromised Sept 2025, quickly fixed'
-  },
-  'wrap-ansi': {
-    compromised: [],
-    safe: true,
-    note: 'Compromised Sept 2025, quickly fixed'
-  },
-  'is-arrayish': {
-    compromised: [],
-    safe: true,
-    note: 'Compromised Sept 2025, quickly fixed'
-  },
-  'simple-swizzle': {
-    compromised: [],
-    safe: true,
-    note: 'Compromised Sept 2025, quickly fixed'
-  },
-  'color-convert': {
-    compromised: [],
-    safe: true,
-    note: 'Compromised Sept 2025, quickly fixed'
-  },
-  'supports-color': {
-    compromised: [],
-    safe: true,
-    note: 'Compromised Sept 2025, quickly fixed'
-  },
-  'has-flag': {
-    compromised: [],
-    safe: true,
-    note: 'Compromised Sept 2025, quickly fixed'
-  },
-
-  // Packages with specific compromised versions (not all)
-  'ua-parser-js': {
-    compromised: ['0.7.29', '0.8.0', '1.0.0'],
-    safe: false,
-    note: 'Specific versions compromised Oct 2021'
-  },
-  'coa': {
-    compromised: ['2.0.3', '2.0.4', '2.1.1', '2.1.3', '3.0.1', '3.1.3'],
-    safe: false,
-    note: 'Specific versions compromised Nov 2021'
-  },
-  'rc': {
-    compromised: ['1.2.9', '1.3.9', '2.3.9'],
-    safe: false,
-    note: 'Specific versions compromised Nov 2021'
-  },
-
-  // MUAD'DIB self-allowlisting (only the tool itself, not deps — deps must pass IOC checks)
-  'muaddib-scanner': {
-    compromised: [],
-    safe: true,
-    note: 'Our package — self-allowlisted to avoid self-flagging during scan'
-  }
-};
-
-// Regex to validate npm package names (prevents command injection)
-const NPM_PACKAGE_REGEX = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
-
-// Download/extraction limits
-const MAX_TARBALL_SIZE = 50 * 1024 * 1024; // 50MB
-const DOWNLOAD_TIMEOUT = 30_000; // 30 seconds
-
-// Shared scanner constants
-const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB — skip files larger than this to avoid memory issues
-const ACORN_OPTIONS = { ecmaVersion: 2024, sourceType: 'module', allowHashBang: true };
-
-module.exports = { REHABILITATED_PACKAGES, NPM_PACKAGE_REGEX, MAX_TARBALL_SIZE, DOWNLOAD_TIMEOUT, MAX_FILE_SIZE, ACORN_OPTIONS };
+// Shared REHABILITATED_PACKAGES — single source of truth
+// Packages that were temporarily compromised but are now safe
+// These packages will NOT be blocked (except specific compromised versions)
+const REHABILITATED_PACKAGES = {
+  // September 2025 - Massive compromise via phishing, fixed within hours
+  'chalk': {
+    compromised: [],
+    safe: true,
+    note: 'Compromised Sept 2025, malicious versions removed from npm'
+  },
+  'debug': {
+    compromised: [],
+    safe: true,
+    note: 'Compromised Sept 2025, quickly fixed'
+  },
+  'ansi-styles': {
+    compromised: [],
+    safe: true,
+    note: 'Compromised Sept 2025, quickly fixed'
+  },
+  'strip-ansi': {
+    compromised: [],
+    safe: true,
+    note: 'Compromised Sept 2025, quickly fixed'
+  },
+  'wrap-ansi': {
+    compromised: [],
+    safe: true,
+    note: 'Compromised Sept 2025, quickly fixed'
+  },
+  'is-arrayish': {
+    compromised: [],
+    safe: true,
+    note: 'Compromised Sept 2025, quickly fixed'
+  },
+  'simple-swizzle': {
+    compromised: [],
+    safe: true,
+    note: 'Compromised Sept 2025, quickly fixed'
+  },
+  'color-convert': {
+    compromised: [],
+    safe: true,
+    note: 'Compromised Sept 2025, quickly fixed'
+  },
+  'supports-color': {
+    compromised: [],
+    safe: true,
+    note: 'Compromised Sept 2025, quickly fixed'
+  },
+  'has-flag': {
+    compromised: [],
+    safe: true,
+    note: 'Compromised Sept 2025, quickly fixed'
+  },
+
+  // Packages with specific compromised versions (not all)
+  'ua-parser-js': {
+    compromised: ['0.7.29', '0.8.0', '1.0.0'],
+    safe: false,
+    note: 'Specific versions compromised Oct 2021'
+  },
+  'coa': {
+    compromised: ['2.0.3', '2.0.4', '2.1.1', '2.1.3', '3.0.1', '3.1.3'],
+    safe: false,
+    note: 'Specific versions compromised Nov 2021'
+  },
+  'rc': {
+    compromised: ['1.2.9', '1.3.9', '2.3.9'],
+    safe: false,
+    note: 'Specific versions compromised Nov 2021'
+  },
+
+  // MUAD'DIB self-allowlisting (only the tool itself, not deps — deps must pass IOC checks)
+  'muaddib-scanner': {
+    compromised: [],
+    safe: true,
+    note: 'Our package — self-allowlisted to avoid self-flagging during scan'
+  }
+};
+
+// Regex to validate npm package names (prevents command injection)
+const NPM_PACKAGE_REGEX = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+
+// Download/extraction limits
+const MAX_TARBALL_SIZE = 50 * 1024 * 1024; // 50MB
+const DOWNLOAD_TIMEOUT = 30_000; // 30 seconds
+
+// Shared scanner constants
+const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB — skip files larger than this to avoid memory issues
+const ACORN_OPTIONS = { ecmaVersion: 2024, sourceType: 'module', allowHashBang: true };
+
+const acorn = require('acorn');
+
+/**
+ * Parse JS source with module-mode fallback to script-mode.
+ * `const package = ...` is valid in script mode but reserved in module mode.
+ * Returns AST or null if both modes fail.
+ */
+function safeParse(code, extraOptions = {}) {
+  const opts = { ...ACORN_OPTIONS, ...extraOptions };
+  try {
+    return acorn.parse(code, opts);
+  } catch {
+    try {
+      return acorn.parse(code, { ...opts, sourceType: 'script' });
+    } catch {
+      return null;
+    }
+  }
+}
+
+module.exports = { REHABILITATED_PACKAGES, NPM_PACKAGE_REGEX, MAX_TARBALL_SIZE, DOWNLOAD_TIMEOUT, MAX_FILE_SIZE, ACORN_OPTIONS, safeParse };