muaddib-scanner 2.4.7 → 2.4.9

package/.dockerignore

@@ -0,0 +1,7 @@
+node_modules
+.git
+datasets
+tests
+metrics
+.muaddib-cache
+*.md

package/bin/muaddib.js

@@ -5,7 +5,7 @@ const { updateIOCs } = require('../src/ioc/updater.js');
 const { watch } = require('../src/watch.js');
 const { runScraper } = require('../src/ioc/scraper.js');
 const { safeInstall } = require('../src/safe-install.js');
-const { buildSandboxImage, runSandbox, generateNetworkReport } = require('../src/sandbox.js');
+const { buildSandboxImage, runSandbox, generateNetworkReport } = require('../src/sandbox/index.js');
 const { diff, showRefs } = require('../src/diff.js');
 const { initHooks, removeHooks } = require('../src/hooks-init.js');
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.4.7",
+  "version": "2.4.9",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/src/response/playbooks.js

@@ -188,6 +188,32 @@ const PLAYBOOKS = {
   sandbox_timeout:
     'CRITIQUE: Le container sandbox a depasse le timeout. Possible boucle infinie ou consommation de ressources.',
 
+  sandbox_timer_delay_suspicious:
+    'Timer avec delai > 1h detecte. Possible time-bomb: le malware attend avant de s\'activer pour eviter les sandbox. ' +
+    'Verifier le code pour des setTimeout/setInterval avec des delais inhabituels.',
+
+  sandbox_timer_delay_critical:
+    'CRITIQUE: Timer avec delai > 24h detecte. Fort indicateur de time-bomb malware. ' +
+    'Le package retarde volontairement l\'execution du payload pour echapper a l\'analyse sandbox. ' +
+    'NE PAS installer. Analyser le code pour identifier le payload retarde.',
+
+  sandbox_preload_sensitive_read:
+    'Lecture de fichiers sensibles detectee via monkey-patching runtime (.npmrc, .ssh, .aws, .env). ' +
+    'Le package accede a des credentials pendant l\'installation. Regenerer les secrets exposes.',
+
+  sandbox_network_after_sensitive_read:
+    'CRITIQUE: Activite reseau detectee apres lecture de fichiers sensibles. ' +
+    'Fort indicateur d\'exfiltration de credentials. Isoler la machine, supprimer le package, ' +
+    'regenerer TOUS les secrets. Auditer les connexions reseau recentes.',
+
+  sandbox_exec_suspicious:
+    'Execution de commandes dangereuses detectee via monkey-patching runtime (curl, wget, bash, sh, powershell). ' +
+    'Verifier les commandes executees. Si le package n\'a pas de raison legitime d\'executer ces commandes, supprimer.',
+
+  sandbox_env_token_access:
+    'Acces a des variables d\'environnement sensibles detecte via monkey-patching runtime (TOKEN, SECRET, KEY, PASSWORD). ' +
+    'Verifier si le package a une raison legitime d\'acceder a ces variables. Revoquer les credentials si necessaire.',
+
   high_entropy_string:
     'Chaine a haute entropie detectee. Verifier si c\'est du base64, hex, ou un payload chiffre. Analyser le contexte d\'utilisation.',
   js_obfuscation_pattern:

package/src/rules/index.js

@@ -892,6 +892,62 @@ const RULES = {
     mitre: 'T1499'
   },
 
+  // Sandbox preload detections (time-bomb and behavioral analysis)
+  sandbox_timer_delay_suspicious: {
+    id: 'MUADDIB-SANDBOX-009',
+    name: 'Sandbox: Suspicious Timer Delay',
+    severity: 'MEDIUM',
+    confidence: 'medium',
+    description: 'Package uses setTimeout/setInterval with delay > 1 hour. Possible time-bomb to evade sandbox analysis.',
+    references: ['https://attack.mitre.org/techniques/T1497/003/'],
+    mitre: 'T1497.003'
+  },
+  sandbox_timer_delay_critical: {
+    id: 'MUADDIB-SANDBOX-010',
+    name: 'Sandbox: Critical Timer Delay (Time-Bomb)',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    description: 'Package uses setTimeout/setInterval with delay > 24 hours. Strong indicator of time-bomb malware designed to evade sandbox analysis.',
+    references: ['https://attack.mitre.org/techniques/T1497/003/'],
+    mitre: 'T1497.003'
+  },
+  sandbox_preload_sensitive_read: {
+    id: 'MUADDIB-SANDBOX-011',
+    name: 'Sandbox: Preload Sensitive File Read',
+    severity: 'HIGH',
+    confidence: 'high',
+    description: 'Package reads sensitive credential files (.npmrc, .ssh, .aws, .env) detected via runtime monkey-patching.',
+    references: ['https://attack.mitre.org/techniques/T1552/001/'],
+    mitre: 'T1552.001'
+  },
+  sandbox_network_after_sensitive_read: {
+    id: 'MUADDIB-SANDBOX-012',
+    name: 'Sandbox: Network After Sensitive Read',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    description: 'Package makes network requests after reading sensitive files. Strong indicator of credential exfiltration.',
+    references: ['https://attack.mitre.org/techniques/T1041/'],
+    mitre: 'T1041'
+  },
+  sandbox_exec_suspicious: {
+    id: 'MUADDIB-SANDBOX-013',
+    name: 'Sandbox: Suspicious Command Execution',
+    severity: 'HIGH',
+    confidence: 'high',
+    description: 'Package executes dangerous commands (curl, wget, bash, sh, powershell) detected via runtime monkey-patching.',
+    references: ['https://attack.mitre.org/techniques/T1059/'],
+    mitre: 'T1059'
+  },
+  sandbox_env_token_access: {
+    id: 'MUADDIB-SANDBOX-014',
+    name: 'Sandbox: Sensitive Env Var Access',
+    severity: 'MEDIUM',
+    confidence: 'medium',
+    description: 'Package accesses sensitive environment variables (TOKEN, SECRET, KEY, PASSWORD) detected via runtime monkey-patching.',
+    references: ['https://attack.mitre.org/techniques/T1552/001/'],
+    mitre: 'T1552.001'
+  },
+
   // Entropy detections
   high_entropy_string: {
     id: 'MUADDIB-ENTROPY-001',

package/src/sandbox/analyzer.js

@@ -0,0 +1,182 @@
+/**
+ * MUAD'DIB Sandbox Preload Log Analyzer
+ *
+ * Parses [PRELOAD] log lines produced by docker/preload.js and generates
+ * scored findings for behavioral analysis. Six detection rules:
+ *
+ *   1. sandbox_timer_delay_suspicious — timer delay > 1h (MEDIUM, +15)
+ *   2. sandbox_timer_delay_critical   — timer delay > 24h (CRITICAL, +30, supersedes #1)
+ *   3. sandbox_preload_sensitive_read  — sensitive file read (HIGH, +20)
+ *   4. sandbox_network_after_sensitive_read — network call after sensitive read (CRITICAL, +40)
+ *   5. sandbox_exec_suspicious        — dangerous command execution (HIGH, +25)
+ *   6. sandbox_env_token_access       — sensitive env var access (MEDIUM, +10)
+ */
+
+const ONE_HOUR_MS = 3600000;
+const TWENTY_FOUR_HOURS_MS = 24 * ONE_HOUR_MS;
+
+/**
+ * Parse [PRELOAD] log content and produce scored findings.
+ *
+ * @param {string} logContent - Raw preload log content
+ * @returns {{ score: number, findings: Array<{type: string, severity: string, detail: string, evidence: string}> }}
+ */
+function analyzePreloadLog(logContent) {
+  const findings = [];
+  let score = 0;
+
+  if (!logContent || typeof logContent !== 'string') {
+    return { score: 0, findings: [] };
+  }
+
+  const lines = logContent.split('\n').filter(l => l.includes('[PRELOAD]'));
+
+  // Categorize lines
+  const timerLines = [];
+  const fsReadLines = [];
+  const fsWriteLines = [];
+  const networkLines = [];
+  const execLines = [];
+  const envLines = [];
+
+  for (const line of lines) {
+    if (line.includes('TIMER:')) {
+      timerLines.push(line);
+    } else if (line.includes('FS_READ:')) {
+      fsReadLines.push(line);
+    } else if (line.includes('FS_WRITE:')) {
+      fsWriteLines.push(line);
+    } else if (line.includes('NETWORK:')) {
+      networkLines.push(line);
+    } else if (line.includes('EXEC:')) {
+      execLines.push(line);
+    } else if (line.includes('ENV_ACCESS:')) {
+      envLines.push(line);
+    }
+  }
+
+  // ── Rule 1/2: Timer delay detection ──
+  // Parse delay values from timer lines
+  const delayRe = /delay=(\d+)ms/;
+  let hasCriticalTimer = false;
+  let hasSuspiciousTimer = false;
+
+  for (const line of timerLines) {
+    const match = line.match(delayRe);
+    if (!match) continue;
+    const delay = parseInt(match[1], 10);
+
+    if (delay > TWENTY_FOUR_HOURS_MS) {
+      // Critical supersedes suspicious for this specific timer
+      if (!hasCriticalTimer) {
+        hasCriticalTimer = true;
+        score += 30;
+        findings.push({
+          type: 'sandbox_timer_delay_critical',
+          severity: 'CRITICAL',
+          detail: `Timer delay > 24h detected: ${delay}ms (${(delay / 3600000).toFixed(1)}h) — likely time-bomb`,
+          evidence: line.trim()
+        });
+      }
+    } else if (delay > ONE_HOUR_MS) {
+      if (!hasSuspiciousTimer && !hasCriticalTimer) {
+        hasSuspiciousTimer = true;
+        score += 15;
+        findings.push({
+          type: 'sandbox_timer_delay_suspicious',
+          severity: 'MEDIUM',
+          detail: `Timer delay > 1h detected: ${delay}ms (${(delay / 3600000).toFixed(1)}h) — possible time-bomb`,
+          evidence: line.trim()
+        });
+      }
+    }
+  }
+
+  // If we found a critical timer, remove any suspicious timer finding (supersede)
+  if (hasCriticalTimer && hasSuspiciousTimer) {
+    const suspIdx = findings.findIndex(f => f.type === 'sandbox_timer_delay_suspicious');
+    if (suspIdx !== -1) {
+      score -= 15; // Remove the suspicious score since critical supersedes
+      findings.splice(suspIdx, 1);
+    }
+  }
+
+  // ── Rule 3: Sensitive file read ──
+  const hasSensitiveRead = fsReadLines.some(l => l.includes('SENSITIVE'));
+  if (hasSensitiveRead) {
+    const sensitiveFiles = fsReadLines
+      .filter(l => l.includes('SENSITIVE'))
+      .map(l => {
+        const m = l.match(/SENSITIVE\s+(.+?)(?:\s+\(t\+|$)/);
+        return m ? m[1].trim() : 'unknown';
+      });
+
+    score += 20;
+    findings.push({
+      type: 'sandbox_preload_sensitive_read',
+      severity: 'HIGH',
+      detail: `Sensitive file read detected via preload: ${sensitiveFiles.join(', ')}`,
+      evidence: sensitiveFiles.join(', ')
+    });
+  }
+
+  // ── Rule 4: Network after sensitive read (compound) ──
+  if (hasSensitiveRead && networkLines.length > 0) {
+    // Check that a network event occurs AFTER a sensitive read
+    // Lines are logged sequentially via appendFileSync, so order = temporal order
+    const firstSensitiveReadIdx = lines.findIndex(l => l.includes('FS_READ:') && l.includes('SENSITIVE'));
+    const lastNetworkIdx = lines.length - 1 - [...lines].reverse().findIndex(l => l.includes('NETWORK:'));
+
+    if (firstSensitiveReadIdx !== -1 && lastNetworkIdx > firstSensitiveReadIdx) {
+      const networkEvidence = networkLines[0].trim();
+      score += 40;
+      findings.push({
+        type: 'sandbox_network_after_sensitive_read',
+        severity: 'CRITICAL',
+        detail: 'Network activity detected after sensitive file read — possible exfiltration',
+        evidence: networkEvidence
+      });
+    }
+  }
+
+  // ── Rule 5: Suspicious exec ──
+  const dangerousExecLines = execLines.filter(l => l.includes('DANGEROUS'));
+  if (dangerousExecLines.length > 0) {
+    const cmds = dangerousExecLines.map(l => {
+      const m = l.match(/(?:exec|execSync|spawn|spawnSync|execFile|execFileSync):\s*(.+?)(?:\s+\(t\+|$)/);
+      return m ? m[1].trim() : 'unknown';
+    });
+
+    score += 25;
+    findings.push({
+      type: 'sandbox_exec_suspicious',
+      severity: 'HIGH',
+      detail: `Dangerous command execution detected: ${cmds.join('; ')}`,
+      evidence: cmds.join('; ')
+    });
+  }
+
+  // ── Rule 6: Env token access ──
+  if (envLines.length > 0) {
+    const vars = envLines.map(l => {
+      const m = l.match(/ENV_ACCESS:\s*(\S+)/);
+      return m ? m[1] : 'unknown';
+    });
+    const unique = [...new Set(vars)];
+
+    score += 10;
+    findings.push({
+      type: 'sandbox_env_token_access',
+      severity: 'MEDIUM',
+      detail: `Sensitive env var access detected: ${unique.join(', ')}`,
+      evidence: unique.join(', ')
+    });
+  }
+
+  return {
+    score: Math.min(100, score),
+    findings
+  };
+}
+
+module.exports = { analyzePreloadLog };

package/src/sandbox/index.js

@@ -0,0 +1,746 @@
+const { execSync, execFileSync, spawn } = require('child_process');
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const {
+  generateCanaryTokens,
+  createCanaryEnvFile,
+  createCanaryNpmrc,
+  detectCanaryExfiltration,
+  detectCanaryInOutput
+} = require('../canary-tokens.js');
+
+const { NPM_PACKAGE_REGEX } = require('../shared/constants.js');
+const { analyzePreloadLog } = require('./analyzer.js');
+
+const DOCKER_IMAGE = 'muaddib-sandbox';
+const CONTAINER_TIMEOUT = 120000; // 120 seconds
+const SINGLE_RUN_TIMEOUT = 60000; // 60 seconds per run in multi-run mode
+
+// Time offsets for multi-run sandbox execution (ms)
+const TIME_OFFSETS = [
+  { offset: 0, label: 'immediate' },
+  { offset: 259200000, label: '72h offset' },   // 72 hours
+  { offset: 604800000, label: '7d offset' }      // 7 days
+];
+
+// Domains excluded from network findings (false positives)
+const SAFE_DOMAINS = [
+  'registry.npmjs.org',
+  'github.com',
+  'objects.githubusercontent.com',
+  'api.github.com',
+  'raw.githubusercontent.com',
+  'codeload.github.com',
+  'npmjs.com',
+  'npmjs.org',
+  'yarnpkg.com',
+  'googleapis.com',
+  'cloudflare.com'
+];
+
+// IPs/ports excluded from connection findings (false positives)
+const SAFE_IPS = ['127.0.0.1'];
+const PROBE_PORTS = [65535]; // Node.js internal connectivity checks
+
+// Commands that are always suspicious in a sandbox
+const DANGEROUS_CMDS = ['curl', 'wget', 'nc', 'netcat', 'python', 'python3', 'bash', 'sh'];
+
+// Static canary tokens injected by sandbox-runner.sh (fallback honeypots).
+// These are searched in the sandbox report as a complement to the dynamic
+// tokens from canary-tokens.js (which use random suffixes per session).
+const STATIC_CANARY_TOKENS = {
+  GITHUB_TOKEN: 'MUADDIB_CANARY_GITHUB_f8k3t0k3n',
+  NPM_TOKEN: 'MUADDIB_CANARY_NPM_s3cr3tt0k3n',
+  AWS_ACCESS_KEY_ID: 'MUADDIB_CANARY_AKIAIOSFODNN7EXAMPLE',
+  AWS_SECRET_ACCESS_KEY: 'MUADDIB_CANARY_wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+  SLACK_WEBHOOK_URL: 'MUADDIB_CANARY_SLACK',
+  DISCORD_WEBHOOK_URL: 'MUADDIB_CANARY_DISCORD'
+};
+
+// Patterns indicating data exfiltration in HTTP bodies
+const EXFIL_PATTERNS = [
+  { pattern: /\bNPM_TOKEN\b/i, label: 'npm token', severity: 'CRITICAL' },
+  { pattern: /\bGITHUB_TOKEN\b/i, label: 'GitHub token', severity: 'CRITICAL' },
+  { pattern: /\bAWS_SECRET/i, label: 'AWS credentials', severity: 'CRITICAL' },
+  { pattern: /npmrc/i, label: '.npmrc content', severity: 'CRITICAL' },
+  { pattern: /\bssh-rsa\b|\bssh-ed25519\b/i, label: 'SSH key', severity: 'CRITICAL' },
+  { pattern: /BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY/, label: 'private key', severity: 'CRITICAL' },
+  { pattern: /\bpassword\b/i, label: 'password', severity: 'CRITICAL' },
+  { pattern: /\btoken\b/i, label: 'token', severity: 'CRITICAL' },
+  { pattern: /\/etc\/passwd/, label: 'passwd file', severity: 'HIGH' },
+  { pattern: /\.env\b/, label: '.env content', severity: 'HIGH' }
+];
+
+// ── Docker availability checks ──
+
+function isDockerAvailable() {
+  try {
+    execSync('docker info', { stdio: 'pipe', timeout: 10000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function imageExists() {
+  try {
+    execFileSync('docker', ['image', 'inspect', DOCKER_IMAGE], { stdio: 'pipe', timeout: 10000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// ── Build image (with cache) ──
+
+async function buildSandboxImage() {
+  if (!isDockerAvailable()) {
+    console.log('[SANDBOX] Docker is not installed or not running. Skipping sandbox analysis.');
+    return false;
+  }
+
+  if (imageExists()) {
+    console.log('[SANDBOX] Using cached Docker image.');
+    return true;
+  }
+
+  console.log('[SANDBOX] Building Docker image...');
+
+  return new Promise((resolve) => {
+    const dockerfilePath = path.join(__dirname, '..', 'docker').replace(/\\/g, '/');
+    const proc = spawn('docker', ['build', '-t', DOCKER_IMAGE, dockerfilePath], {
+      stdio: 'inherit'
+    });
+
+    proc.on('close', (code) => {
+      if (code === 0) {
+        console.log('[SANDBOX] Image built successfully.');
+        resolve(true);
+      } else {
+        console.log('[SANDBOX] Docker build failed.');
+        resolve(false);
+      }
+    });
+
+    proc.on('error', () => {
+      console.log('[SANDBOX] Docker error during build.');
+      resolve(false);
+    });
+  });
+}
+
+// ── Run single sandbox execution ──
+
+async function runSingleSandbox(packageName, options = {}) {
+  const cleanResult = { score: 0, severity: 'CLEAN', findings: [], raw_report: null, suspicious: false };
+
+  const strict = options.strict || false;
+  const canaryTokens = options.canaryTokens || null;
+  const local = options.local || false;
+  const localAbsPath = options.localAbsPath || null;
+  const displayName = options.displayName || packageName;
+  const mode = strict ? 'strict' : 'permissive';
+  const timeOffset = options.timeOffset || 0;
+  const runTimeout = options.runTimeout || CONTAINER_TIMEOUT;
+
+  return new Promise((resolve) => {
+    let stdout = '';
+    let stderr = '';
+    let timedOut = false;
+    const containerName = `muaddib-sandbox-${Date.now()}-${crypto.randomBytes(4).toString('hex')}`;
+
+    const dockerArgs = [
+      'run',
+      '--rm',
+      `--name=${containerName}`,
+      '--network=bridge',
+      '--memory=512m',
+      '--cpus=1',
+      '--pids-limit=100',
+      '--cap-drop=ALL'
+    ];
+
+    // Inject canary tokens as environment variables
+    if (canaryTokens) {
+      for (const [key, value] of Object.entries(canaryTokens)) {
+        dockerArgs.push('-e', `${key}=${value}`);
+      }
+      // Also inject canary file contents as env vars for the entrypoint to write
+      dockerArgs.push('-e', `CANARY_ENV_CONTENT=${createCanaryEnvFile(canaryTokens).replace(/\r?\n/g, '\\n')}`);
+      dockerArgs.push('-e', `CANARY_NPMRC_CONTENT=${createCanaryNpmrc(canaryTokens).replace(/\r?\n/g, '\\n')}`);
+    }
+
+    // Inject time offset and preload for monkey-patching
+    dockerArgs.push('-e', `MUADDIB_TIME_OFFSET_MS=${timeOffset}`);
+    dockerArgs.push('-e', 'NODE_OPTIONS=--require /opt/preload.js');
+
+    // Both modes need NET_RAW for tcpdump (runs as root in entrypoint).
+    // Strict mode also needs NET_ADMIN for iptables network blocking.
+    // SYS_PTRACE is not needed: strace traces its own child (npm install via su).
+    dockerArgs.push('--cap-add=NET_RAW');
+    if (strict) {
+      dockerArgs.push('--cap-add=NET_ADMIN');
+    }
+
+    dockerArgs.push('--tmpfs', '/tmp:rw,nosuid,size=64m');
+    dockerArgs.push('--tmpfs', '/sandbox/install:rw,nosuid,size=256m');
+    dockerArgs.push('--tmpfs', '/home/sandboxuser:rw,noexec,nosuid,size=16m');
+    dockerArgs.push('--read-only');
+
+    dockerArgs.push('--security-opt', 'no-new-privileges');
+
+    if (local && localAbsPath) {
+      dockerArgs.push('-v', `${localAbsPath}:/sandbox/local-pkg:ro`);
+    }
+
+    dockerArgs.push(DOCKER_IMAGE);
+    dockerArgs.push(local ? '/sandbox/local-pkg' : packageName);
+    dockerArgs.push(mode);
+
+    const proc = spawn('docker', dockerArgs);
+
+    // Timeout: kill container
+    const timer = setTimeout(() => {
+      timedOut = true;
+      console.log(`[SANDBOX] Timeout (${runTimeout / 1000}s). Killing container...`);
+      try {
+        execFileSync('docker', ['kill', containerName], { stdio: 'pipe', timeout: 5000 });
+      } catch {
+        proc.kill('SIGKILL');
+      }
+    }, runTimeout);
+
+    proc.stdout.on('data', (data) => {
+      stdout += data.toString();
+    });
+
+    proc.stderr.on('data', (data) => {
+      stderr += data.toString();
+      // Forward sandbox progress logs (sanitize ANSI escape sequences)
+      const text = data.toString().replace(/\x1b\[[0-9;]*[a-zA-Z]/g, '');
+      for (const line of text.split(/\r?\n/)) {
+        if (line.includes('[SANDBOX]')) {
+          console.log(line.trim());
+        }
+      }
+    });
+
+    proc.on('close', () => {
+      clearTimeout(timer);
+
+      if (timedOut) {
+        const result = {
+          score: 100,
+          severity: 'CRITICAL',
+          findings: [{
+            type: 'timeout',
+            severity: 'CRITICAL',
+            detail: `Container exceeded ${runTimeout / 1000}s timeout`,
+            evidence: `Killed after ${runTimeout}ms`
+          }],
+          raw_report: null,
+          suspicious: true
+        };
+        resolve(result);
+        return;
+      }
+
+      // Parse JSON from container stdout using delimiter
+      let report;
+      try {
+        const REPORT_DELIMITER = '---MUADDIB-REPORT-START---';
+        const delimIdx = stdout.indexOf(REPORT_DELIMITER);
+        let jsonStr;
+        if (delimIdx !== -1) {
+          // Reliable: use delimiter to skip any package output before the report
+          jsonStr = stdout.substring(delimIdx + REPORT_DELIMITER.length).trim();
+        } else {
+          // Fallback: find first '{' (backward compat with older images)
+          const jsonStart = stdout.indexOf('{');
+          const jsonEnd = stdout.lastIndexOf('}');
+          if (jsonStart === -1 || jsonEnd === -1) {
+            throw new Error('No JSON found in output');
+          }
+          jsonStr = stdout.substring(jsonStart, jsonEnd + 1);
+        }
+        report = JSON.parse(jsonStr);
+        if (local && report) {
+          report.package = displayName;
+        }
+      } catch (e) {
+        console.log('[SANDBOX] Failed to parse container output:', e.message);
+        resolve(cleanResult);
+        return;
+      }
+
+      const { score, findings } = scoreFindings(report);
+
+      // Analyze preload log for behavioral findings
+      if (report.preload_log) {
+        const preloadResult = analyzePreloadLog(report.preload_log);
+        for (const finding of preloadResult.findings) {
+          findings.push(finding);
+        }
+        // Add preload score (capped at 100 with the rest)
+        const combinedScore = Math.min(100, score + preloadResult.score);
+        // We'll use combinedScore below instead of score
+        report._preloadScore = preloadResult.score;
+      }
+
+      // Canary token exfiltration detection (dynamic tokens)
+      if (canaryTokens) {
+        const networkExfil = detectCanaryExfiltration(report.network || {}, canaryTokens);
+        const outputExfil = detectCanaryInOutput(stdout, stderr, canaryTokens);
+
+        for (const exfil of [...networkExfil.exfiltrations, ...outputExfil.exfiltrations]) {
+          findings.push({
+            type: 'canary_exfiltration',
+            severity: 'CRITICAL',
+            detail: `Package attempted to exfiltrate ${exfil.token} (${exfil.foundIn})`,
+            evidence: exfil.value
+          });
+        }
+      }
+
+      // Static canary token detection (fallback for shell-injected tokens)
+      const staticExfil = detectStaticCanaryExfiltration(report);
+      for (const { token, value } of staticExfil) {
+        const alreadyDetected = findings.some(f =>
+          f.type === 'canary_exfiltration' && f.detail && f.detail.includes(token)
+        );
+        if (!alreadyDetected) {
+          findings.push({
+            type: 'canary_exfiltration',
+            severity: 'CRITICAL',
+            detail: `Canary token exfiltration detected: ${token}`,
+            evidence: value
+          });
+        }
+      }
+
+      const preloadScore = report._preloadScore || 0;
+      const finalScore = Math.min(100, findings.reduce((s, f) => {
+        if (f.type === 'canary_exfiltration') return s + 50;
+        return s;
+      }, score + preloadScore));
+      const severity = getSeverity(finalScore);
+      const result = { score: finalScore, severity, findings, raw_report: report, suspicious: finalScore > 0 };
+
+      resolve(result);
+    });
+
+    proc.on('error', (err) => {
+      clearTimeout(timer);
+      if (err.code === 'ENOENT') {
+        console.log('[SANDBOX] Docker not found. Please install Docker.');
+      } else {
+        console.log(`[SANDBOX] Error: ${err.message}`);
+      }
+      resolve(cleanResult);
+    });
+  });
+}
+
+// ── Multi-run sandbox orchestrator ──
+
+async function runSandbox(packageName, options = {}) {
+  const cleanResult = { score: 0, severity: 'CLEAN', findings: [], raw_report: null, suspicious: false };
+
+  const strict = options.strict || false;
+  const canaryEnabled = options.canary !== false; // enabled by default
+  const local = options.local || false;
+
+  // Validate inputs before checking Docker availability
+  let localAbsPath = null;
+  let displayName = packageName;
+
+  if (local) {
+    localAbsPath = path.resolve(packageName);
+    if (!fs.existsSync(localAbsPath)) {
+      console.log('[SANDBOX] Local path does not exist: ' + localAbsPath);
+      return cleanResult;
+    }
+    // Read package name for display
+    const pkgJsonPath = path.join(localAbsPath, 'package.json');
+    if (fs.existsSync(pkgJsonPath)) {
+      try {
+        const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
+        displayName = pkg.name || path.basename(localAbsPath);
+      } catch { displayName = path.basename(localAbsPath); }
+    } else {
+      displayName = path.basename(localAbsPath);
+    }
+  } else {
+    if (!NPM_PACKAGE_REGEX.test(packageName)) {
+      console.log('[SANDBOX] Invalid package name: ' + packageName);
+      return cleanResult;
+    }
+  }
+
+  if (!isDockerAvailable()) {
+    console.log('[SANDBOX] Docker is not installed or not running. Skipping.');
+    return cleanResult;
+  }
+
+  // Generate canary tokens for this sandbox session
+  let canaryTokens = null;
+  if (canaryEnabled) {
+    const canary = generateCanaryTokens();
+    canaryTokens = canary.tokens;
+  }
+
+  const mode = strict ? 'strict' : 'permissive';
+  console.log(`[SANDBOX] Analyzing "${displayName}" in isolated container (mode: ${mode}${canaryEnabled ? ', canary: on' : ''}${local ? ', local' : ''}, runs: ${TIME_OFFSETS.length})...`);
+
+  const allRuns = [];
+  let bestResult = cleanResult;
+
+  for (let i = 0; i < TIME_OFFSETS.length; i++) {
+    const { offset, label } = TIME_OFFSETS[i];
+    console.log(`[SANDBOX] Run ${i + 1}/${TIME_OFFSETS.length} (${label})...`);
+
+    const runResult = await runSingleSandbox(packageName, {
+      strict,
+      canaryTokens,
+      local,
+      localAbsPath,
+      displayName,
+      timeOffset: offset,
+      runTimeout: SINGLE_RUN_TIMEOUT
+    });
+
+    allRuns.push({
+      run: i + 1,
+      label,
+      timeOffset: offset,
+      score: runResult.score,
+      severity: runResult.severity,
+      findingCount: runResult.findings.length
+    });
+
+    // Keep the result with the highest score
+    if (runResult.score > bestResult.score) {
+      bestResult = runResult;
+    }
+
+    // Early exit: CRITICAL found, skip remaining runs
+    if (runResult.score >= 80) {
+      console.log(`[SANDBOX] Critical score (${runResult.score}) detected in run ${i + 1}. Skipping remaining runs.`);
+      break;
+    }
+  }
+
+  // Attach multi-run metadata
+  bestResult.all_runs = allRuns;
+
+  displayResults(bestResult);
+  return bestResult;
+}
+
+// ── Static canary detection ──
+
+/**
+ * Detect static canary token exfiltration in a sandbox report.
+ * Searches HTTP bodies, DNS queries, HTTP request URLs, TLS domains,
+ * filesystem changes, process commands, and install output.
+ * @param {object} report - Parsed sandbox report JSON
+ * @returns {Array<{token: string, value: string}>} Exfiltrated tokens
+ */
+function detectStaticCanaryExfiltration(report) {
+  const exfiltrated = [];
+  if (!report) return exfiltrated;
+
+  const searchable = [];
+
+  // Network data
+  for (const body of (report.network?.http_bodies || [])) if (body) searchable.push(body);
+  for (const domain of (report.network?.dns_queries || [])) if (domain) searchable.push(domain);
+  for (const req of (report.network?.http_requests || [])) {
+    searchable.push(`${req.method || ''} ${req.host || ''}${req.path || ''}`);
+  }
+  for (const tls of (report.network?.tls_connections || [])) if (tls.domain) searchable.push(tls.domain);
+
+  // Filesystem + processes
+  for (const file of (report.filesystem?.created || [])) if (file) searchable.push(file);
+  for (const proc of (report.processes?.spawned || [])) if (proc.command) searchable.push(proc.command);
+
+  // Install + entrypoint output
+  if (report.install_output) searchable.push(report.install_output);
+  if (report.entrypoint_output) searchable.push(report.entrypoint_output);
+
+  const allOutput = searchable.join('\n');
+
+  for (const [tokenName, tokenValue] of Object.entries(STATIC_CANARY_TOKENS)) {
+    if (allOutput.includes(tokenValue)) {
+      exfiltrated.push({ token: tokenName, value: tokenValue });
+    }
+  }
+
+  return exfiltrated;
+}
+
+// ── Scoring engine ──
+
+function scoreFindings(report) {
+  let score = 0;
+  const findings = [];
+
+  // 1. Sensitive file reads
+  for (const file of (report.sensitive_files?.read || [])) {
+    if (/\.npmrc/.test(file) || /\.ssh/.test(file) || /\.aws/.test(file)) {
+      score += 40;
+      findings.push({ type: 'sensitive_file_read', severity: 'CRITICAL', detail: `Read credential file: ${file}`, evidence: file });
+    } else if (/\/etc\/passwd/.test(file) || /\/etc\/shadow/.test(file)) {
+      score += 25;
+      findings.push({ type: 'sensitive_file_read', severity: 'HIGH', detail: `Read system file: ${file}`, evidence: file });
+    } else if (/\.env/.test(file) || /\.gitconfig/.test(file) || /\.bash_history/.test(file)) {
+      score += 15;
+      findings.push({ type: 'sensitive_file_read', severity: 'MEDIUM', detail: `Read config file: ${file}`, evidence: file });
+    }
+  }
+
+  // 2. Sensitive file writes (from strace)
+  for (const file of (report.sensitive_files?.written || [])) {
+    if (/\.npmrc/.test(file) || /\.ssh/.test(file) || /\.aws/.test(file)) {
+      score += 40;
+      findings.push({ type: 'sensitive_file_write', severity: 'CRITICAL', detail: `Write to credential file: ${file}`, evidence: file });
+    } else if (/\/etc\/passwd/.test(file) || /\/etc\/shadow/.test(file)) {
+      score += 25;
+      findings.push({ type: 'sensitive_file_write', severity: 'HIGH', detail: `Write to system file: ${file}`, evidence: file });
+    } else {
+      score += 15;
+      findings.push({ type: 'sensitive_file_write', severity: 'MEDIUM', detail: `Write to sensitive file: ${file}`, evidence: file });
+    }
+  }
+
+  // 3. Filesystem changes — files created in suspicious locations
+  for (const file of (report.filesystem?.created || [])) {
+    if (/^\/usr\/bin\//.test(file) || /crontab/.test(file) || /\/cron\.d\//.test(file)) {
+      score += 50;
+      findings.push({ type: 'suspicious_filesystem', severity: 'CRITICAL', detail: `File created in system path: ${file}`, evidence: file });
+    } else if (/^\/tmp\//.test(file)) {
+      score += 30;
+      findings.push({ type: 'suspicious_filesystem', severity: 'HIGH', detail: `File created in /tmp: ${file}`, evidence: file });
+    }
+  }
+
+  // 4a. DNS queries (exclude safe domains)
+  for (const domain of (report.network?.dns_queries || [])) {
+    if (isSafeDomain(domain)) continue;
+    score += 20;
+    findings.push({ type: 'suspicious_dns', severity: 'HIGH', detail: `DNS query to non-registry domain: ${domain}`, evidence: domain });
+  }
+
+  // 4b. DNS resolutions — extra detail
+  for (const res of (report.network?.dns_resolutions || [])) {
+    if (isSafeDomain(res.domain)) continue;
+    // Already scored in 4a via dns_queries, but flag the resolution for reporting
+    findings.push({ type: 'dns_resolution', severity: 'INFO', detail: `${res.domain} → ${res.ip}`, evidence: `${res.domain}:${res.ip}` });
+  }
+
+  // 5a. TCP connections (exclude safe hosts, probe ports, localhost)
+  for (const conn of (report.network?.http_connections || [])) {
+    if (isSafeHost(conn.host)) continue;
+    if (SAFE_IPS.includes(conn.host)) continue;
+    if (PROBE_PORTS.includes(conn.port)) continue;
+    score += 25;
+    findings.push({ type: 'suspicious_connection', severity: 'HIGH', detail: `TCP connection to ${conn.host}:${conn.port}`, evidence: `${conn.host}:${conn.port}` });
+  }
+
+  // 5b. TLS connections — non-safe domains
+  for (const tls of (report.network?.tls_connections || [])) {
+    if (isSafeDomain(tls.domain)) continue;
+    score += 20;
+    findings.push({ type: 'suspicious_tls', severity: 'HIGH', detail: `TLS connection to ${tls.domain} (${tls.ip}:${tls.port})`, evidence: tls.domain });
+  }
+
+  // 5c. HTTP exfiltration detection — scan body snippets for sensitive data
+  for (const body of (report.network?.http_bodies || [])) {
+    for (const pat of EXFIL_PATTERNS) {
+      if (pat.pattern.test(body)) {
+        score += 50;
+        findings.push({
+          type: 'data_exfiltration',
+          severity: pat.severity,
+          detail: `HTTP body contains ${pat.label}`,
+          evidence: body.substring(0, 200)
+        });
+        break; // One match per body is enough
+      }
+    }
+  }
+
+  // 5d. HTTP requests to non-safe hosts
+  for (const req of (report.network?.http_requests || [])) {
+    if (isSafeDomain(req.host)) continue;
+    score += 20;
+    findings.push({ type: 'suspicious_http_request', severity: 'HIGH', detail: `${req.method} ${req.host}${req.path}`, evidence: `${req.method} ${req.host}${req.path}` });
+  }
+
+  // 5e. Blocked connections (strict mode)
+  for (const blocked of (report.network?.blocked_connections || [])) {
+    score += 30;
+    findings.push({ type: 'blocked_connection', severity: 'HIGH', detail: `Blocked outbound to ${blocked.ip}:${blocked.port}`, evidence: `${blocked.ip}:${blocked.port}` });
+  }
+
+  // 6. Suspicious processes
+  for (const p of (report.processes?.spawned || [])) {
+    const cmd = p.command || '';
+    const basename = path.basename(cmd);
+    if (DANGEROUS_CMDS.some(d => basename === d)) {
+      score += 40;
+      findings.push({ type: 'suspicious_process', severity: 'CRITICAL', detail: `Dangerous command spawned: ${cmd}`, evidence: cmd });
+    } else if (cmd) {
+      score += 15;
+      findings.push({ type: 'unknown_process', severity: 'MEDIUM', detail: `Unknown process spawned: ${cmd}`, evidence: cmd });
+    }
+  }
+
+  score = Math.min(100, score);
+  return { score, findings };
+}
+
+// ── Network report (detailed, colored) ──
+
+function generateNetworkReport(report) {
+  const lines = [];
+  const RED = '\x1b[31m';
+  const YELLOW = '\x1b[33m';
+  const GREEN = '\x1b[32m';
+  const CYAN = '\x1b[36m';
+  const MAGENTA = '\x1b[35m';
+  const BOLD = '\x1b[1m';
+  const DIM = '\x1b[2m';
+  const RESET = '\x1b[0m';
+
+  lines.push('');
+  lines.push(`${BOLD}${MAGENTA}╔══════════════════════════════════════════════════╗${RESET}`);
+  lines.push(`${BOLD}${MAGENTA}║   MUAD'DIB — Sandbox Network Report              ║${RESET}`);
+  lines.push(`${BOLD}${MAGENTA}╚══════════════════════════════════════════════════╝${RESET}`);
+  lines.push('');
+  lines.push(`  Package: ${BOLD}${report.package}${RESET}`);
+  lines.push(`  Mode:    ${report.mode === 'strict' ? RED + 'STRICT' : GREEN + 'permissive'}${RESET}`);
+  lines.push(`  Time:    ${report.timestamp}`);
+  lines.push(`  Duration: ${report.duration_ms}ms`);
+
+  // DNS Resolutions
+  const dnsRes = report.network?.dns_resolutions || [];
+  lines.push('');
+  lines.push(`${BOLD}${CYAN}── DNS Resolutions (${dnsRes.length}) ──${RESET}`);
+  if (dnsRes.length === 0) {
+    lines.push(`  ${DIM}No DNS resolutions captured${RESET}`);
+  } else {
+    for (const r of dnsRes) {
+      const safe = isSafeDomain(r.domain);
+      const icon = safe ? GREEN + '[OK]' : YELLOW + '[!!]';
+      lines.push(`  ${icon}${RESET} ${r.domain} → ${r.ip}`);
+    }
+  }
+
+  // HTTP Requests
+  const httpReqs = report.network?.http_requests || [];
+  lines.push('');
+  lines.push(`${BOLD}${CYAN}── HTTP Requests (${httpReqs.length}) ──${RESET}`);
+  if (httpReqs.length === 0) {
+    lines.push(`  ${DIM}No HTTP requests captured${RESET}`);
+  } else {
+    for (const req of httpReqs) {
+      const safe = isSafeDomain(req.host);
+      const icon = safe ? GREEN + '[OK]' : RED + '[!!]';
+      lines.push(`  ${icon}${RESET} ${req.method} ${req.host}${req.path}`);
+    }
+  }
+
+  // TLS Connections
+  const tlsConns = report.network?.tls_connections || [];
+  lines.push('');
+  lines.push(`${BOLD}${CYAN}── TLS Connections (${tlsConns.length}) ──${RESET}`);
+  if (tlsConns.length === 0) {
+    lines.push(`  ${DIM}No TLS connections captured${RESET}`);
+  } else {
+    for (const tls of tlsConns) {
+      const safe = isSafeDomain(tls.domain);
+      const icon = safe ? GREEN + '[OK]' : YELLOW + '[!!]';
+      lines.push(`  ${icon}${RESET} ${tls.domain} (${tls.ip}:${tls.port})`);
+    }
+  }
+
+  // Blocked Connections (strict mode)
+  const blocked = report.network?.blocked_connections || [];
+  if (blocked.length > 0) {
+    lines.push('');
+    lines.push(`${BOLD}${RED}── Blocked Connections (${blocked.length}) ──${RESET}`);
+    for (const b of blocked) {
+      lines.push(`  ${RED}[BLOCKED]${RESET} ${b.ip}:${b.port}`);
+    }
+  }
+
+  // Data Exfiltration Alerts
+  const bodies = report.network?.http_bodies || [];
+  const exfilAlerts = [];
+  for (const body of bodies) {
+    for (const pat of EXFIL_PATTERNS) {
+      if (pat.pattern.test(body)) {
+        exfilAlerts.push({ label: pat.label, severity: pat.severity, snippet: body.substring(0, 100) });
+        break;
+      }
+    }
+  }
+  if (exfilAlerts.length > 0) {
+    lines.push('');
+    lines.push(`${BOLD}${RED}── Data Exfiltration Alerts (${exfilAlerts.length}) ──${RESET}`);
+    for (const alert of exfilAlerts) {
+      lines.push(`  ${RED}[${alert.severity}]${RESET} ${alert.label} detected in HTTP body`);
+      lines.push(`    ${DIM}${alert.snippet}...${RESET}`);
+    }
+  }
+
+  // Raw TCP connections
+  const conns = report.network?.http_connections || [];
+  if (conns.length > 0) {
+    lines.push('');
+    lines.push(`${BOLD}${CYAN}── Raw TCP Connections (${conns.length}) ──${RESET}`);
+    for (const c of conns) {
+      const safe = isSafeHost(c.host);
+      const icon = safe ? GREEN + '[OK]' : YELLOW + '[!!]';
+      lines.push(`  ${icon}${RESET} ${c.host}:${c.port} (${c.protocol})`);
+    }
+  }
+
+  lines.push('');
+  return lines.join('\n');
+}
+
+// ── Helpers ──
+
+function isSafeDomain(domain) {
+  return SAFE_DOMAINS.some(safe => domain === safe || domain.endsWith('.' + safe));
+}
+
+function isSafeHost(host) {
+  return SAFE_DOMAINS.some(safe => host === safe || host.endsWith('.' + safe));
+}
+
+function getSeverity(score) {
+  if (score === 0) return 'CLEAN';
+  if (score <= 20) return 'LOW';
+  if (score <= 50) return 'MEDIUM';
+  if (score <= 80) return 'HIGH';
+  return 'CRITICAL';
+}
+
+function displayResults(result) {
+  console.log(`\n[SANDBOX] Score: ${result.score}/100 — ${result.severity}`);
+  if (result.findings.length === 0) {
+    console.log('[SANDBOX] No suspicious behavior detected.');
+  } else {
+    const actionable = result.findings.filter(f => f.severity !== 'INFO');
+    console.log(`[SANDBOX] ${actionable.length} finding(s):`);
+    for (const f of actionable) {
+      console.log(`  [${f.severity}] ${f.type}: ${f.detail}`);
+    }
+  }
+}
+
+module.exports = { buildSandboxImage, runSandbox, runSingleSandbox, scoreFindings, generateNetworkReport, EXFIL_PATTERNS, SAFE_DOMAINS, getSeverity, displayResults, isDockerAvailable, imageExists, STATIC_CANARY_TOKENS, detectStaticCanaryExfiltration, analyzePreloadLog, TIME_OFFSETS };