muaddib-scanner 2.4.4 → 2.4.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (28) hide show
  1. package/LICENSE +20 -20
  2. package/iocs/builtin.yaml +131 -131
  3. package/iocs/hashes.yaml +214 -214
  4. package/iocs/packages.yaml +276 -276
  5. package/package.json +2 -3
  6. package/src/canary-tokens.js +184 -184
  7. package/src/ioc/bootstrap.js +181 -181
  8. package/src/ioc/yaml-loader.js +223 -223
  9. package/src/maintainer-change.js +224 -224
  10. package/src/output-formatter.js +192 -192
  11. package/src/publish-anomaly.js +206 -206
  12. package/src/report.js +230 -230
  13. package/src/sarif.js +96 -96
  14. package/src/scanner/ai-config.js +183 -183
  15. package/src/scanner/ast-detectors.js +40 -17
  16. package/src/scanner/ast.js +1 -0
  17. package/src/scanner/dataflow.js +14 -2
  18. package/src/scanner/dependencies.js +223 -223
  19. package/src/scanner/entropy.js +7 -0
  20. package/src/scanner/hash.js +118 -118
  21. package/src/scanner/npm-registry.js +128 -128
  22. package/src/scanner/python.js +442 -442
  23. package/src/scoring.js +3 -1
  24. package/src/shared/analyze-helper.js +49 -49
  25. package/src/temporal-analysis.js +260 -260
  26. package/src/temporal-runner.js +139 -139
  27. package/src/utils.js +327 -327
  28. package/src/watch.js +55 -55
package/iocs/hashes.yaml CHANGED
@@ -1,214 +1,214 @@
1
- # MUAD'DIB IOCs - Hashes SHA256 malveillants
2
- # Contribuez via PR: https://github.com/DNSZLSK/muad-dib
3
-
4
- version: "1.0.0"
5
- updated: "2026-01-01"
6
-
7
- hashes:
8
- # ============================================
9
- # SHAI-HULUD v2 - bun_environment.js
10
- # ============================================
11
- - id: HASH-SHAI-V2-001
12
- sha256: "62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0"
13
- file: "bun_environment.js"
14
- source: shai-hulud-v2
15
- severity: critical
16
- confidence: high
17
- description: "Payload Shai-Hulud v2 - exfiltration credentials"
18
- references:
19
- - https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
20
-
21
- - id: HASH-SHAI-V2-002
22
- sha256: "cbb9bc5a8496243e02f3cc080efbe3e4a1430ba0671f2e43a202bf45b05479cd"
23
- file: "bun_environment.js"
24
- source: shai-hulud-v2
25
- severity: critical
26
- confidence: high
27
- description: "Variante Shai-Hulud v2"
28
- references:
29
- - https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
30
-
31
- - id: HASH-SHAI-V2-003
32
- sha256: "f099c5d9ec417d4445a0328ac0ada9cde79fc37410914103ae9c609cbc0ee068"
33
- file: "bun_environment.js"
34
- source: shai-hulud-v2
35
- severity: critical
36
- confidence: high
37
- description: "Variante Shai-Hulud v2"
38
- references:
39
- - https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
40
-
41
- # ============================================
42
- # SHAI-HULUD v2 - setup_bun.js
43
- # ============================================
44
- - id: HASH-SHAI-V2-004
45
- sha256: "a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a"
46
- file: "setup_bun.js"
47
- source: shai-hulud-v2
48
- severity: critical
49
- confidence: high
50
- description: "Loader Shai-Hulud v2"
51
- references:
52
- - https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
53
-
54
- - id: HASH-SHAI-V2-005
55
- sha256: "f1df4896244500671eb4aa63ebb48ea11cee196fafaa0e9874e17b24ac053c02"
56
- file: "setup_bun.js"
57
- source: shai-hulud-v2
58
- severity: critical
59
- confidence: high
60
- description: "Variante Shai-Hulud v2"
61
- references:
62
- - https://blog.phylum.io/shai-hulud-npm-worm
63
-
64
- - id: HASH-SHAI-V2-006
65
- sha256: "9d59fd0bcc14b671079824c704575f201b74276238dc07a9c12a93a84195648a"
66
- file: "setup_bun.js"
67
- source: shai-hulud-v2
68
- severity: critical
69
- confidence: high
70
- description: "Variante Shai-Hulud v2"
71
- references:
72
- - https://blog.phylum.io/shai-hulud-npm-worm
73
-
74
- - id: HASH-SHAI-V2-007
75
- sha256: "e0250076c1d2ac38777ea8f542431daf61fcbaab0ca9c196614b28065ef5b918"
76
- file: "setup_bun.js"
77
- source: shai-hulud-v2
78
- severity: critical
79
- confidence: high
80
- description: "Variante Shai-Hulud v2"
81
- references:
82
- - https://blog.phylum.io/shai-hulud-npm-worm
83
-
84
- # ============================================
85
- # NODE-IPC PROTESTWARE
86
- # ============================================
87
- - id: HASH-PROTEST-001
88
- sha256: "4b2399646573bb737c4969563303d8ee2e9ddbd1b271f1ca9e35ea78062538db"
89
- file: "peacenotwar.js"
90
- source: protestware
91
- severity: critical
92
- confidence: high
93
- description: "Payload node-ipc peacenotwar"
94
- references:
95
- - https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/
96
-
97
- - id: HASH-PROTEST-002
98
- sha256: "46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09"
99
- file: "peacenotwar.js"
100
- source: protestware
101
- severity: critical
102
- confidence: high
103
- description: "Variante node-ipc peacenotwar"
104
- references:
105
- - https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/
106
-
107
- markers:
108
- # ============================================
109
- # SHAI-HULUD MARKERS
110
- # ============================================
111
- - id: MARKER-SHAI-001
112
- pattern: "Sha1-Hulud"
113
- source: shai-hulud-v1
114
- severity: critical
115
- confidence: high
116
- description: "Signature Shai-Hulud v1"
117
-
118
- - id: MARKER-SHAI-002
119
- pattern: "Shai-Hulud"
120
- source: shai-hulud-v1
121
- severity: critical
122
- confidence: high
123
- description: "Signature Shai-Hulud"
124
-
125
- - id: MARKER-SHAI-003
126
- pattern: "The Second Coming"
127
- source: shai-hulud-v2
128
- severity: critical
129
- confidence: high
130
- description: "Signature Shai-Hulud v2"
131
-
132
- - id: MARKER-SHAI-004
133
- pattern: "Goldox-T3chs"
134
- source: shai-hulud-v3
135
- severity: critical
136
- confidence: high
137
- description: "Signature Shai-Hulud v3 Golden Path"
138
-
139
- - id: MARKER-SHAI-005
140
- pattern: "Only Happy Girl"
141
- source: shai-hulud-v2
142
- severity: critical
143
- confidence: high
144
- description: "Signature Shai-Hulud v2 variante"
145
-
146
- # ============================================
147
- # PROTESTWARE MARKERS
148
- # ============================================
149
- - id: MARKER-PROTEST-001
150
- pattern: "peacenotwar"
151
- source: protestware
152
- severity: critical
153
- confidence: high
154
- description: "Signature node-ipc protestware"
155
-
156
- # ============================================
157
- # GENERIC MALWARE MARKERS
158
- # ============================================
159
- - id: MARKER-GENERIC-001
160
- pattern: "/dev/tcp"
161
- source: generic
162
- severity: critical
163
- confidence: high
164
- description: "Reverse shell bash"
165
-
166
- - id: MARKER-GENERIC-002
167
- pattern: "discord.com/api/webhooks"
168
- source: generic
169
- severity: high
170
- confidence: medium
171
- description: "Exfiltration via Discord webhook"
172
-
173
- files:
174
- # ============================================
175
- # FICHIERS SUSPECTS SHAI-HULUD
176
- # ============================================
177
- - id: FILE-SHAI-001
178
- name: "setup_bun.js"
179
- source: shai-hulud-v2
180
- severity: critical
181
- confidence: high
182
- description: "Loader Shai-Hulud"
183
-
184
- - id: FILE-SHAI-002
185
- name: "bun_environment.js"
186
- source: shai-hulud-v2
187
- severity: critical
188
- confidence: high
189
- description: "Payload Shai-Hulud"
190
-
191
- - id: FILE-SHAI-003
192
- name: "bundle.js"
193
- source: shai-hulud-v2
194
- severity: high
195
- confidence: medium
196
- description: "Payload obfusque potentiel"
197
-
198
- # ============================================
199
- # FICHIERS SUSPECTS GENERIQUES
200
- # ============================================
201
- - id: FILE-GENERIC-001
202
- name: "stealer.js"
203
- source: generic
204
- severity: critical
205
- confidence: high
206
- description: "Token stealer potentiel"
207
-
208
- - id: FILE-GENERIC-002
209
- name: "token-grabber.js"
210
- source: generic
211
- severity: critical
212
- confidence: high
213
- description: "Token stealer potentiel"
214
-
1
+ # MUAD'DIB IOCs - Hashes SHA256 malveillants
2
+ # Contribuez via PR: https://github.com/DNSZLSK/muad-dib
3
+
4
+ version: "1.0.0"
5
+ updated: "2026-01-01"
6
+
7
+ hashes:
8
+ # ============================================
9
+ # SHAI-HULUD v2 - bun_environment.js
10
+ # ============================================
11
+ - id: HASH-SHAI-V2-001
12
+ sha256: "62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0"
13
+ file: "bun_environment.js"
14
+ source: shai-hulud-v2
15
+ severity: critical
16
+ confidence: high
17
+ description: "Payload Shai-Hulud v2 - exfiltration credentials"
18
+ references:
19
+ - https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
20
+
21
+ - id: HASH-SHAI-V2-002
22
+ sha256: "cbb9bc5a8496243e02f3cc080efbe3e4a1430ba0671f2e43a202bf45b05479cd"
23
+ file: "bun_environment.js"
24
+ source: shai-hulud-v2
25
+ severity: critical
26
+ confidence: high
27
+ description: "Variante Shai-Hulud v2"
28
+ references:
29
+ - https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
30
+
31
+ - id: HASH-SHAI-V2-003
32
+ sha256: "f099c5d9ec417d4445a0328ac0ada9cde79fc37410914103ae9c609cbc0ee068"
33
+ file: "bun_environment.js"
34
+ source: shai-hulud-v2
35
+ severity: critical
36
+ confidence: high
37
+ description: "Variante Shai-Hulud v2"
38
+ references:
39
+ - https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
40
+
41
+ # ============================================
42
+ # SHAI-HULUD v2 - setup_bun.js
43
+ # ============================================
44
+ - id: HASH-SHAI-V2-004
45
+ sha256: "a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a"
46
+ file: "setup_bun.js"
47
+ source: shai-hulud-v2
48
+ severity: critical
49
+ confidence: high
50
+ description: "Loader Shai-Hulud v2"
51
+ references:
52
+ - https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
53
+
54
+ - id: HASH-SHAI-V2-005
55
+ sha256: "f1df4896244500671eb4aa63ebb48ea11cee196fafaa0e9874e17b24ac053c02"
56
+ file: "setup_bun.js"
57
+ source: shai-hulud-v2
58
+ severity: critical
59
+ confidence: high
60
+ description: "Variante Shai-Hulud v2"
61
+ references:
62
+ - https://blog.phylum.io/shai-hulud-npm-worm
63
+
64
+ - id: HASH-SHAI-V2-006
65
+ sha256: "9d59fd0bcc14b671079824c704575f201b74276238dc07a9c12a93a84195648a"
66
+ file: "setup_bun.js"
67
+ source: shai-hulud-v2
68
+ severity: critical
69
+ confidence: high
70
+ description: "Variante Shai-Hulud v2"
71
+ references:
72
+ - https://blog.phylum.io/shai-hulud-npm-worm
73
+
74
+ - id: HASH-SHAI-V2-007
75
+ sha256: "e0250076c1d2ac38777ea8f542431daf61fcbaab0ca9c196614b28065ef5b918"
76
+ file: "setup_bun.js"
77
+ source: shai-hulud-v2
78
+ severity: critical
79
+ confidence: high
80
+ description: "Variante Shai-Hulud v2"
81
+ references:
82
+ - https://blog.phylum.io/shai-hulud-npm-worm
83
+
84
+ # ============================================
85
+ # NODE-IPC PROTESTWARE
86
+ # ============================================
87
+ - id: HASH-PROTEST-001
88
+ sha256: "4b2399646573bb737c4969563303d8ee2e9ddbd1b271f1ca9e35ea78062538db"
89
+ file: "peacenotwar.js"
90
+ source: protestware
91
+ severity: critical
92
+ confidence: high
93
+ description: "Payload node-ipc peacenotwar"
94
+ references:
95
+ - https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/
96
+
97
+ - id: HASH-PROTEST-002
98
+ sha256: "46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09"
99
+ file: "peacenotwar.js"
100
+ source: protestware
101
+ severity: critical
102
+ confidence: high
103
+ description: "Variante node-ipc peacenotwar"
104
+ references:
105
+ - https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/
106
+
107
+ markers:
108
+ # ============================================
109
+ # SHAI-HULUD MARKERS
110
+ # ============================================
111
+ - id: MARKER-SHAI-001
112
+ pattern: "Sha1-Hulud"
113
+ source: shai-hulud-v1
114
+ severity: critical
115
+ confidence: high
116
+ description: "Signature Shai-Hulud v1"
117
+
118
+ - id: MARKER-SHAI-002
119
+ pattern: "Shai-Hulud"
120
+ source: shai-hulud-v1
121
+ severity: critical
122
+ confidence: high
123
+ description: "Signature Shai-Hulud"
124
+
125
+ - id: MARKER-SHAI-003
126
+ pattern: "The Second Coming"
127
+ source: shai-hulud-v2
128
+ severity: critical
129
+ confidence: high
130
+ description: "Signature Shai-Hulud v2"
131
+
132
+ - id: MARKER-SHAI-004
133
+ pattern: "Goldox-T3chs"
134
+ source: shai-hulud-v3
135
+ severity: critical
136
+ confidence: high
137
+ description: "Signature Shai-Hulud v3 Golden Path"
138
+
139
+ - id: MARKER-SHAI-005
140
+ pattern: "Only Happy Girl"
141
+ source: shai-hulud-v2
142
+ severity: critical
143
+ confidence: high
144
+ description: "Signature Shai-Hulud v2 variante"
145
+
146
+ # ============================================
147
+ # PROTESTWARE MARKERS
148
+ # ============================================
149
+ - id: MARKER-PROTEST-001
150
+ pattern: "peacenotwar"
151
+ source: protestware
152
+ severity: critical
153
+ confidence: high
154
+ description: "Signature node-ipc protestware"
155
+
156
+ # ============================================
157
+ # GENERIC MALWARE MARKERS
158
+ # ============================================
159
+ - id: MARKER-GENERIC-001
160
+ pattern: "/dev/tcp"
161
+ source: generic
162
+ severity: critical
163
+ confidence: high
164
+ description: "Reverse shell bash"
165
+
166
+ - id: MARKER-GENERIC-002
167
+ pattern: "discord.com/api/webhooks"
168
+ source: generic
169
+ severity: high
170
+ confidence: medium
171
+ description: "Exfiltration via Discord webhook"
172
+
173
+ files:
174
+ # ============================================
175
+ # FICHIERS SUSPECTS SHAI-HULUD
176
+ # ============================================
177
+ - id: FILE-SHAI-001
178
+ name: "setup_bun.js"
179
+ source: shai-hulud-v2
180
+ severity: critical
181
+ confidence: high
182
+ description: "Loader Shai-Hulud"
183
+
184
+ - id: FILE-SHAI-002
185
+ name: "bun_environment.js"
186
+ source: shai-hulud-v2
187
+ severity: critical
188
+ confidence: high
189
+ description: "Payload Shai-Hulud"
190
+
191
+ - id: FILE-SHAI-003
192
+ name: "bundle.js"
193
+ source: shai-hulud-v2
194
+ severity: high
195
+ confidence: medium
196
+ description: "Payload obfusque potentiel"
197
+
198
+ # ============================================
199
+ # FICHIERS SUSPECTS GENERIQUES
200
+ # ============================================
201
+ - id: FILE-GENERIC-001
202
+ name: "stealer.js"
203
+ source: generic
204
+ severity: critical
205
+ confidence: high
206
+ description: "Token stealer potentiel"
207
+
208
+ - id: FILE-GENERIC-002
209
+ name: "token-grabber.js"
210
+ source: generic
211
+ severity: critical
212
+ confidence: high
213
+ description: "Token stealer potentiel"
214
+