muaddib-scanner 2.4.4 → 2.4.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.4.4",
+  "version": "2.4.6",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/src/scanner/ast-detectors.js

@@ -221,8 +221,27 @@ function containsDecodePattern(node) {
 //   workflowPathVars, execPathVars, globalThisAliases,
 //   hasFromCharCode, hasEvalInFile (mutable)
 
+function isStaticValue(node) {
+  if (!node) return false;
+  if (node.type === 'Literal' && typeof node.value === 'string') return true;
+  if (node.type === 'ArrayExpression') {
+    return node.elements.every(el => el && el.type === 'Literal' && typeof el.value === 'string');
+  }
+  if (node.type === 'ObjectExpression') {
+    return node.properties.every(p =>
+      p.value && p.value.type === 'Literal' && typeof p.value.value === 'string'
+    );
+  }
+  return false;
+}
+
 function handleVariableDeclarator(node, ctx) {
   if (node.id?.type === 'Identifier') {
+    // Track statically-assigned variables for dynamic_require qualification
+    if (node.init && isStaticValue(node.init)) {
+      ctx.staticAssignments.add(node.id.name);
+    }
+
     // Track dynamic require vars
     if (node.init?.type === 'CallExpression') {
       const initCallName = getCallName(node.init);
@@ -305,10 +324,15 @@ function handleCallExpression(node, ctx) {
         });
       }
     } else if (arg.type === 'Identifier') {
+      // If the variable was assigned from a static value (string literal,
+      // array of strings, object with string values), it's a plugin loader pattern
+      const severity = ctx.staticAssignments.has(arg.name) ? 'LOW' : 'HIGH';
       ctx.threats.push({
         type: 'dynamic_require',
-        severity: 'HIGH',
-        message: 'Dynamic require() with variable argument (module name obfuscation).',
+        severity,
+        message: severity === 'LOW'
+          ? `Dynamic require() with statically-assigned variable "${arg.name}" (plugin loader pattern).`
+          : 'Dynamic require() with variable argument (module name obfuscation).',
         file: ctx.relFile
       });
     }
@@ -717,14 +741,13 @@ function handleCallExpression(node, ctx) {
         message: 'Function() with decode argument (atob/Buffer.from base64) — staged payload execution.',
         file: ctx.relFile
       });
-    } else {
-      const isConstant = hasOnlyStringLiteralArgs(node);
+    } else if (!hasOnlyStringLiteralArgs(node)) {
+      // Only flag dynamic Function() calls — string literal args (e.g. Function('return this'))
+      // are zero-risk globalThis polyfills used by every bundler
       ctx.threats.push({
         type: 'dangerous_call_function',
-        severity: isConstant ? 'LOW' : 'MEDIUM',
-        message: isConstant
-          ? 'Function() with constant string literal (low risk, globalThis polyfill pattern).'
-          : 'Function() with dynamic expression (template/factory pattern).',
+        severity: 'MEDIUM',
+        message: 'Function() with dynamic expression (template/factory pattern).',
         file: ctx.relFile
       });
     }
@@ -901,15 +924,15 @@ function handleImportExpression(node, ctx) {
 
 function handleNewExpression(node, ctx) {
   if (node.callee.type === 'Identifier' && node.callee.name === 'Function') {
-    const isConstant = hasOnlyStringLiteralArgs(node);
-    ctx.threats.push({
-      type: 'dangerous_call_function',
-      severity: isConstant ? 'LOW' : 'MEDIUM',
-      message: isConstant
-        ? 'new Function() with constant string literal (low risk, globalThis polyfill pattern).'
-        : 'new Function() with dynamic expression (template/factory pattern).',
-      file: ctx.relFile
-    });
+    // Skip string literal args — zero-risk globalThis polyfills used by every bundler
+    if (!hasOnlyStringLiteralArgs(node)) {
+      ctx.threats.push({
+        type: 'dangerous_call_function',
+        severity: 'MEDIUM',
+        message: 'new Function() with dynamic expression (template/factory pattern).',
+        file: ctx.relFile
+      });
+    }
   }
 
   // Detect new Proxy(process.env, handler)

package/src/scanner/ast.js

@@ -64,6 +64,7 @@ function analyzeFile(content, filePath, basePath) {
     threats,
     relFile: path.relative(basePath, filePath),
     dynamicRequireVars: new Set(),
+    staticAssignments: new Set(),
     dangerousCmdVars: new Map(),
     workflowPathVars: new Set(),
     execPathVars: new Map(),

package/src/scanner/dataflow.js

@@ -114,6 +114,10 @@ async function analyzeDataFlow(targetPath, options = {}) {
   });
 }
 
+/**
+ * Check if a VariableDeclarator init expression is a source-generating expression.
+ * Used to track which variables hold data from sensitive sources.
+ */
 function analyzeFile(content, filePath, basePath) {
   const threats = [];
   let ast;
@@ -208,6 +212,7 @@ function analyzeFile(content, filePath, basePath) {
           name: callName,
           line: node.loc?.start?.line
         });
+
       }
 
       if (callName === 'exec' || callName === 'execSync') {
@@ -219,6 +224,7 @@ function analyzeFile(content, filePath, basePath) {
               name: callName,
               line: node.loc?.start?.line
             });
+    
           }
         }
       }
@@ -268,18 +274,22 @@ function analyzeFile(content, filePath, basePath) {
           // DNS resolution as exfiltration sink
           if (obj.name === 'dns' && ['resolve', 'lookup', 'resolve4', 'resolve6', 'resolveTxt'].includes(prop.name)) {
             sinks.push({ type: 'network_send', name: `dns.${prop.name}`, line: node.loc?.start?.line });
+    
           }
           // HTTP/HTTPS request/get as network sink
           if ((obj.name === 'http' || obj.name === 'https') && ['request', 'get'].includes(prop.name)) {
             sinks.push({ type: 'network_send', name: `${obj.name}.${prop.name}`, line: node.loc?.start?.line });
+    
           }
           // net.connect / net.createConnection / tls.connect as network sink
           if ((obj.name === 'net' || obj.name === 'tls') && ['connect', 'createConnection'].includes(prop.name)) {
             sinks.push({ type: 'network_send', name: `${obj.name}.${prop.name}`, line: node.loc?.start?.line });
+    
           }
           // Instance socket.connect(port, host) when file imports net/tls
           if (hasRawSocketModule && prop.name === 'connect' && node.arguments.length >= 2) {
             sinks.push({ type: 'network_send', name: 'socket.connect', line: node.loc?.start?.line });
+    
           }
         }
       }
@@ -322,8 +332,9 @@ function analyzeFile(content, filePath, basePath) {
             // Check sink methods
             const sinkMethods = MODULE_SINK_METHODS[moduleName];
             if (sinkMethods && sinkMethods[methodName]) {
+              const sinkType = sinkMethods[methodName];
               sinks.push({
-                type: sinkMethods[methodName],
+                type: sinkType,
                 name: `${moduleName}.${methodName}`,
                 line: node.loc?.start?.line,
                 taint_tracked: true
@@ -341,8 +352,9 @@ function analyzeFile(content, filePath, basePath) {
           // Check sink methods for destructured calls
           const sinkMethods = MODULE_SINK_METHODS[moduleName];
           if (sinkMethods && sinkMethods[methodName]) {
+            const sinkType = sinkMethods[methodName];
             sinks.push({
-              type: sinkMethods[methodName],
+              type: sinkType,
               name: `${moduleName}.${methodName}`,
               line: node.loc?.start?.line,
               taint_tracked: true

package/src/scanner/entropy.js

@@ -13,6 +13,12 @@ const ENCODING_TABLE_RE = /(?:encoding|tables|unicode|charmap|codepage)/i;
 // Minimum string length to analyze (short strings naturally have low entropy)
 const MIN_STRING_LENGTH = 50;
 
+// Maximum string length to analyze — strings >1000 chars are data blobs
+// (certificates, unicode tables, embedded binary), not malware payloads.
+// Real malware uses 50-500 char encoded payloads; making payloads longer
+// defeats the purpose of obfuscation.
+const MAX_STRING_LENGTH = 1000;
+
 // Thresholds (string-level only — file-level entropy removed, see design notes)
 const STRING_ENTROPY_MEDIUM = 5.5;
 const STRING_ENTROPY_HIGH = 6.5;
@@ -222,6 +228,7 @@ function scanEntropy(targetPath, options = {}) {
     const strings = extractStringLiterals(content);
     for (const str of strings) {
       if (str.length < MIN_STRING_LENGTH) continue;
+      if (str.length > MAX_STRING_LENGTH) continue;
 
       // Skip whitelisted patterns
       if (isWhitelistedString(str, relativePath)) continue;

package/src/scoring.js

@@ -33,7 +33,9 @@ const RISK_THRESHOLDS = {
 // Maximum score (capped)
 const MAX_RISK_SCORE = 100;
 
-// Cap MEDIUM prototype_hook contribution (frameworks like Restify have 50+ extensions)
+// Cap MEDIUM prototype_hook contribution — MEDIUM hooks are framework class extensions
+// (Request/Response/App/Router) which are not security risks. Capped at 15 points (5 × MEDIUM weight)
+// to limit noise while preserving some signal. CRITICAL and HIGH prototype_hook findings still score normally.
 const PROTO_HOOK_MEDIUM_CAP = 15;
 
 // ============================================