muaddib-scanner 2.5.9 → 2.5.10

package/logs/alerts/{2026-03-06T19-26-22-192-evil-pkg.json → 2026-03-06T20-13-43-891-evil-pkg.json}

@@ -1,6 +1,6 @@
 {
   "target": "npm/evil-pkg@1.0.0",
-  "timestamp": "2026-03-06T19:26:22.192Z",
+  "timestamp": "2026-03-06T20:13:43.891Z",
   "ecosystem": "npm",
   "summary": {
     "critical": 1,

package/logs/alerts/{2026-03-06T19-26-22-193-evil-pkg.json → 2026-03-06T20-13-43-892-evil-pkg.json}

@@ -1,6 +1,6 @@
 {
   "target": "npm/evil-pkg@1.0.0",
-  "timestamp": "2026-03-06T19:26:22.193Z",
+  "timestamp": "2026-03-06T20:13:43.892Z",
   "ecosystem": "npm",
   "summary": {
     "critical": 1,

package/logs/alerts/{2026-03-06T19-26-22-192-suspect-pkg.json → 2026-03-06T20-13-43-892-suspect-pkg.json}

@@ -1,6 +1,6 @@
 {
   "target": "npm/suspect-pkg@1.0",
-  "timestamp": "2026-03-06T19:26:22.192Z",
+  "timestamp": "2026-03-06T20:13:43.892Z",
   "ecosystem": "npm",
   "summary": {
     "critical": 0,

package/logs/alerts/{2026-03-06T19-26-22-572-evil-pkg.json → 2026-03-06T20-13-44-264-evil-pkg.json}

@@ -1,6 +1,6 @@
 {
   "target": "npm/evil-pkg@2.0.0",
-  "timestamp": "2026-03-06T19:26:22.572Z",
+  "timestamp": "2026-03-06T20:13:44.264Z",
   "ecosystem": "npm",
   "summary": {
     "critical": 1,

package/logs/daily-reports/2026-03-06.json

@@ -1,6 +1,6 @@
 {
   "date": "2026-03-06",
-  "timestamp": "2026-03-06T19:26:22.664Z",
+  "timestamp": "2026-03-06T20:13:44.379Z",
   "embed": {
     "embeds": [
       {
@@ -34,14 +34,14 @@
           },
           {
             "name": "Top Suspects",
-            "value": "1. **npm/test-dedup-detection-1772825182189@1.0.0** — 1 finding(s)",
+            "value": "1. **npm/test-dedup-detection-1772828023889@1.0.0** — 1 finding(s)",
             "inline": false
           }
         ],
         "footer": {
-          "text": "MUAD'DIB - Daily summary | 2026-03-06 19:26:22 UTC"
+          "text": "MUAD'DIB - Daily summary | 2026-03-06 20:13:44 UTC"
         },
-        "timestamp": "2026-03-06T19:26:22.664Z"
+        "timestamp": "2026-03-06T20:13:44.379Z"
       }
     ]
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.5.9",
+  "version": "2.5.10",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/src/canary-tokens.js

@@ -1,31 +1,51 @@
 const crypto = require('crypto');
 
 /**
- * Canary token definitions.
- * Each key is an env var name, value is a prefix.
- * A random suffix is appended at generation time.
+ * Generate a base32-encoded string of the given length.
+ * Uses characters A-Z and 2-7 (RFC 4648 base32 alphabet).
  */
-const CANARY_PREFIXES = {
-  GITHUB_TOKEN: 'ghp_MUADDIB_CANARY_',
-  NPM_TOKEN: 'npm_MUADDIB_CANARY_',
-  AWS_ACCESS_KEY_ID: 'AKIA_MUADDIB_CANARY_',
-  AWS_SECRET_ACCESS_KEY: 'MUADDIB_CANARY_SECRET_',
-  GITLAB_TOKEN: 'glpat-MUADDIB_CANARY_',
-  DOCKER_PASSWORD: 'dckr_MUADDIB_CANARY_',
-  NPM_AUTH_TOKEN: 'npm_MUADDIB_CANARY_AUTH_',
-  GH_TOKEN: 'ghp_MUADDIB_CANARY_GH_'
+function generateBase32(length) {
+  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+  const bytes = crypto.randomBytes(length);
+  return Array.from(bytes).map(b => chars[b % 32]).join('');
+}
+
+/**
+ * Canary token generators.
+ * Each generator produces a format-valid token that matches the real service format.
+ * No common marker (like "MUADDIB_CANARY") — detection relies on exact value matching.
+ */
+const CANARY_GENERATORS = {
+  // GitHub PAT: ghp_ + 36 alphanumeric chars
+  GITHUB_TOKEN: () => 'ghp_' + crypto.randomBytes(27).toString('base64url').substring(0, 36),
+  // npm token: npm_ + 36 hex chars
+  NPM_TOKEN: () => 'npm_' + crypto.randomBytes(18).toString('hex'),
+  // AWS Access Key: AKIA + 16 chars [A-Z2-7]
+  AWS_ACCESS_KEY_ID: () => 'AKIA' + generateBase32(16),
+  // AWS Secret: 40 chars base64
+  AWS_SECRET_ACCESS_KEY: () => crypto.randomBytes(30).toString('base64').substring(0, 40),
+  // GitLab PAT: glpat- + 20 alphanumeric
+  GITLAB_TOKEN: () => 'glpat-' + crypto.randomBytes(15).toString('base64url').substring(0, 20),
+  // Docker: dckr_pat_ + 56 alphanumeric
+  DOCKER_PASSWORD: () => 'dckr_pat_' + crypto.randomBytes(42).toString('base64url').substring(0, 56),
+  // npm auth token: same as NPM_TOKEN format
+  NPM_AUTH_TOKEN: () => 'npm_' + crypto.randomBytes(18).toString('hex'),
+  // GH_TOKEN: same as GITHUB_TOKEN format
+  GH_TOKEN: () => 'ghp_' + crypto.randomBytes(27).toString('base64url').substring(0, 36)
 };
 
 /**
- * Generate a unique set of canary tokens with random suffixes.
+ * Generate a unique set of canary tokens with format-valid values.
+ * Each token matches its real service format (ghp_, AKIA, npm_, etc.).
  * @returns {{ tokens: Record<string, string>, suffix: string }}
  */
 function generateCanaryTokens() {
-  const suffix = crypto.randomBytes(8).toString('hex');
   const tokens = {};
-  for (const [key, prefix] of Object.entries(CANARY_PREFIXES)) {
-    tokens[key] = prefix + suffix;
+  for (const [key, generator] of Object.entries(CANARY_GENERATORS)) {
+    tokens[key] = generator();
   }
+  // Suffix retained for backward compatibility (used in some callers)
+  const suffix = crypto.randomBytes(8).toString('hex');
   return { tokens, suffix };
 }
 
@@ -175,7 +195,7 @@ function detectCanaryInOutput(stdout, stderr, tokens) {
 }
 
 module.exports = {
-  CANARY_PREFIXES,
+  CANARY_GENERATORS,
   generateCanaryTokens,
   createCanaryEnvFile,
   createCanaryNpmrc,

package/src/sandbox/index.js

@@ -51,14 +51,15 @@ const SAFE_SANDBOX_CMDS = new Set(['timeout', 'node', 'npm', 'npx', 'su', 'env']
 
 // Static canary tokens injected by sandbox-runner.sh (fallback honeypots).
 // These are searched in the sandbox report as a complement to the dynamic
-// tokens from canary-tokens.js (which use random suffixes per session).
+// tokens from canary-tokens.js (which use random values per session).
+// Format-valid: match real service token formats to resist format-based detection.
 const STATIC_CANARY_TOKENS = {
-  GITHUB_TOKEN: 'MUADDIB_CANARY_GITHUB_f8k3t0k3n',
-  NPM_TOKEN: 'MUADDIB_CANARY_NPM_s3cr3tt0k3n',
-  AWS_ACCESS_KEY_ID: 'MUADDIB_CANARY_AKIAIOSFODNN7EXAMPLE',
-  AWS_SECRET_ACCESS_KEY: 'MUADDIB_CANARY_wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
-  SLACK_WEBHOOK_URL: 'MUADDIB_CANARY_SLACK',
-  DISCORD_WEBHOOK_URL: 'MUADDIB_CANARY_DISCORD'
+  GITHUB_TOKEN: 'ghp_R8kLmN2pQ4vW7xY9aB3cD5eF6gH8jK0mN2pQ4vW',
+  NPM_TOKEN: 'npm_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8',
+  AWS_ACCESS_KEY_ID: 'AKIAIOSFODNN7EXAMPLE',
+  AWS_SECRET_ACCESS_KEY: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+  SLACK_WEBHOOK_URL: 'https://hooks.example.com/services/TCANARY/BCANARY/canary-slack-token',
+  DISCORD_WEBHOOK_URL: 'https://discord.com/api/webhooks/000000000000000000/abcdefghijklmnopqrstuvwxyz'
 };
 
 // Patterns indicating data exfiltration in HTTP bodies
@@ -151,7 +152,7 @@ async function runSingleSandbox(packageName, options = {}) {
     let stdout = '';
     let stderr = '';
     let timedOut = false;
-    const containerName = `muaddib-sandbox-${Date.now()}-${crypto.randomBytes(4).toString('hex')}`;
+    const containerName = `npm-audit-${Date.now()}-${crypto.randomBytes(4).toString('hex')}`;
 
     const dockerArgs = [
       'run',
@@ -175,7 +176,7 @@ async function runSingleSandbox(packageName, options = {}) {
     }
 
     // Inject time offset (preload.js deferred to entry point in sandbox-runner.sh)
-    dockerArgs.push('-e', `MUADDIB_TIME_OFFSET_MS=${timeOffset}`);
+    dockerArgs.push('-e', `NODE_TIMING_OFFSET=${timeOffset}`);
 
     // Both modes need NET_RAW for tcpdump (runs as root in entrypoint).
     // Strict mode also needs NET_ADMIN for iptables network blocking.

package/src/sandbox.js

@@ -41,12 +41,12 @@ const DANGEROUS_CMDS = ['curl', 'wget', 'nc', 'netcat', 'python', 'python3', 'ba
 // These are searched in the sandbox report as a complement to the dynamic
 // tokens from canary-tokens.js (which use random suffixes per session).
 const STATIC_CANARY_TOKENS = {
-  GITHUB_TOKEN: 'MUADDIB_CANARY_GITHUB_f8k3t0k3n',
-  NPM_TOKEN: 'MUADDIB_CANARY_NPM_s3cr3tt0k3n',
-  AWS_ACCESS_KEY_ID: 'MUADDIB_CANARY_AKIAIOSFODNN7EXAMPLE',
-  AWS_SECRET_ACCESS_KEY: 'MUADDIB_CANARY_wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
-  SLACK_WEBHOOK_URL: 'MUADDIB_CANARY_SLACK',
-  DISCORD_WEBHOOK_URL: 'MUADDIB_CANARY_DISCORD'
+  GITHUB_TOKEN: 'ghp_R8kLmN2pQ4vW7xY9aB3cD5eF6gH8jK0mN2pQ4vW',
+  NPM_TOKEN: 'npm_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8',
+  AWS_ACCESS_KEY_ID: 'AKIAIOSFODNN7EXAMPLE',
+  AWS_SECRET_ACCESS_KEY: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+  SLACK_WEBHOOK_URL: 'https://hooks.example.com/services/TCANARY/BCANARY/canary-slack-token',
+  DISCORD_WEBHOOK_URL: 'https://discord.com/api/webhooks/000000000000000000/abcdefghijklmnopqrstuvwxyz'
 };
 
 // Patterns indicating data exfiltration in HTTP bodies

package/src/scoring.js

@@ -161,41 +161,7 @@ const FRAMEWORK_PROTO_RE = new RegExp(
   '^(' + FRAMEWORK_PROTOTYPES.join('|') + ')\\.prototype\\.'
 );
 
-// ============================================
-// BENIGN PACKAGE WHITELIST (v2.3.5)
-// ============================================
-// Well-known npm packages whose legitimate code patterns trigger false positives.
-// For whitelisted packages, non-IOC threats are downgraded to LOW.
-// IOC matches, lifecycle_shell_pipe, and cross_file_dataflow are NEVER downgraded
-// — a compromised version of these packages would still be detected.
-const BENIGN_PACKAGE_WHITELIST = new Set([
-  'meteor',               // powershell PATH setup in install.js (dangerous_exec FP)
-  'blessed',              // module._compile for terminal capabilities (module_compile FP)
-  'sharp',                // native bindings with dynamic require + postinstall (lifecycle FP)
-  'forever',              // process manager: detached spawn + HOME config access (dataflow FP)
-  'start-server-and-test', // curl/wget in test scripts, not install hooks (lifecycle FP)
-  'ultra-runner',         // aliased fs.readFileSync in pnp.js + dynamic require (taint-tracked dataflow FP)
-  'node-gyp',             // aliased child_process.spawn in node-gyp.js + env access (taint-tracked dataflow FP)
-  'graceful-fs'           // aliased fs.readFile/readdir/writeFile monkey-patching (taint-tracked credential_tampering FP)
-]);
-
-// Threat types never affected by benign package whitelist (real compromise indicators)
-const WHITELIST_EXEMPT_TYPES = new Set([
-  'ioc_match', 'known_malicious_package', 'pypi_malicious_package', 'shai_hulud_marker',
-  'lifecycle_shell_pipe',
-  'cross_file_dataflow'
-]);
-
 function applyFPReductions(threats, reachableFiles, packageName) {
-  // Benign package whitelist: downgrade all non-IOC threats to LOW
-  if (packageName && BENIGN_PACKAGE_WHITELIST.has(packageName)) {
-    for (const t of threats) {
-      if (!WHITELIST_EXEMPT_TYPES.has(t.type) && t.severity !== 'LOW') {
-        t.severity = 'LOW';
-      }
-    }
-  }
-
   // Count occurrences of each threat type (package-level, across all files)
   const typeCounts = {};
   for (const t of threats) {
@@ -369,6 +335,5 @@ function calculateRiskScore(deduped) {
 
 module.exports = {
   SEVERITY_WEIGHTS, RISK_THRESHOLDS, MAX_RISK_SCORE,
-  BENIGN_PACKAGE_WHITELIST, WHITELIST_EXEMPT_TYPES,
   isPackageLevelThreat, computeGroupScore, applyFPReductions, calculateRiskScore
 };