muaddib-scanner 2.6.7 → 2.6.9

package/README.md

@@ -30,7 +30,7 @@
 
 npm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond.
 
-MUAD'DIB combines **14 parallel scanners** (129 detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **per-file max scoring**, Docker sandbox with **monkey-patching preload** for time-bomb detection, **behavioral anomaly detection**, and **ground truth validation** to detect threats AND guide your response — even before they appear in any IOC database.
+MUAD'DIB combines **14 parallel scanners** (133 detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **per-file max scoring**, Docker sandbox with **monkey-patching preload** for time-bomb detection, **behavioral anomaly detection**, and **ground truth validation** to detect threats AND guide your response — even before they appear in any IOC database.
 
 ---
 
@@ -195,7 +195,7 @@ muaddib replay                     # Ground truth validation (46/49 TPR)
 | GitHub Actions | Shai-Hulud backdoor detection |
 | Hash Scanner | Known malicious file hashes |
 
-### 129 detection rules
+### 133 detection rules
 
 All rules are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v262) for the complete rules reference.
 
@@ -286,7 +286,7 @@ repos:
 | **FPR** (Benign) | **12.1%** (64/529) | 529 npm packages, real source via `npm pack` |
 | **ADR** (Adversarial + Holdout) | **92.2%** (71/77) | 53 adversarial + 40 holdout (77 available on disk), global threshold=20 |
 
-**2009 tests** across 46 files, 86% code coverage. **130 rules** (125 RULES + 5 PARANOID).
+**2042 tests** across 49 files. **133 rules** (128 RULES + 5 PARANOID).
 
 > **Methodology caveats:**
 > - TPR measured on 49 Node.js attack samples (3 browser-only excluded from 51 total)
@@ -327,7 +327,7 @@ npm test
 
 ### Testing
 
-- **2009 tests** across 46 modular test files - 86% code coverage
+- **2042 tests** across 49 modular test files
 - **56 fuzz tests** - Malformed inputs, ReDoS, unicode, binary
 - **Datadog 17K benchmark** - 17,922 real malware samples
 - **Ground truth validation** - 51 real-world attacks (93.9% TPR)
@@ -347,7 +347,7 @@ npm test
 - [Evaluation Methodology](docs/EVALUATION_METHODOLOGY.md) - Experimental protocol, holdout scores
 - [Threat Model](docs/threat-model.md) - What MUAD'DIB detects and doesn't detect
 - [Adversarial Evaluation](ADVERSARIAL.md) - Red team samples and ADR results
-- [Security Policy](SECURITY.md) - Detection rules reference (129 rules)
+- [Security Policy](SECURITY.md) - Detection rules reference (133 rules)
 - [Security Audit](docs/SECURITY_AUDIT.md) - Bypass validation report
 - [FP Analysis](docs/EVALUATION.md) - Historical false positive analysis
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.6.7",
+  "version": "2.6.9",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {
@@ -48,10 +48,8 @@
     "acorn": "8.16.0",
     "acorn-walk": "8.3.5",
     "adm-zip": "0.5.16",
-    "js-yaml": "4.1.1"
-  },
-  "overrides": {
-    "loadash": "0.0.0-security"
+    "js-yaml": "4.1.1",
+    "loadash": "^1.0.0"
   },
   "devDependencies": {
     "@eslint/js": "10.0.1",

package/src/response/playbooks.js

@@ -174,6 +174,15 @@ const PLAYBOOKS = {
   wget_base64_decode:
     'Telechargement + decodage base64 detecte. Verifier l\'URL de telechargement et decoder le contenu. Pattern de staging malveillant en deux etapes.',
 
+  curl_ifs_evasion:
+    'CRITIQUE: Evasion IFS detectee — curl$IFS ou curl${IFS} pipe vers shell. Technique d\'evasion pour contourner la detection de "curl|sh". Ne pas installer.',
+
+  eval_curl_subshell:
+    'CRITIQUE: eval $(curl ...) detecte. Telecharge et execute du code distant via command substitution. Ne pas installer.',
+
+  sh_c_curl_exec:
+    'sh -c wrapping autour de curl detecte. Technique d\'evasion pour masquer l\'execution de commandes distantes. Analyser le contenu telecharge.',
+
   shai_hulud_backdoor:
     'CRITIQUE: Backdoor Shai-Hulud dans GitHub Actions. Supprimer le workflow et auditer les runs precedents.',
 

package/src/rules/index.js

@@ -1369,6 +1369,35 @@ const RULES = {
     ],
     mitre: 'T1557'
   },
+  // Shell IFS evasion rules (v2.6.9)
+  curl_ifs_evasion: {
+    id: 'MUADDIB-SHELL-016',
+    name: 'Curl IFS Variable Evasion',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    description: 'Evasion IFS: curl$IFS ou curl${IFS} pipe vers shell. Technique d\'evasion pour contourner la detection de curl|sh en utilisant $IFS comme separateur.',
+    references: ['https://attack.mitre.org/techniques/T1059/004/'],
+    mitre: 'T1059.004'
+  },
+  eval_curl_subshell: {
+    id: 'MUADDIB-SHELL-017',
+    name: 'Eval Curl Command Substitution',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    description: 'eval $(curl ...) detecte. Telecharge et execute du code distant via command substitution.',
+    references: ['https://attack.mitre.org/techniques/T1059/004/'],
+    mitre: 'T1059.004'
+  },
+  sh_c_curl_exec: {
+    id: 'MUADDIB-SHELL-018',
+    name: 'Shell -c Curl Execution',
+    severity: 'HIGH',
+    confidence: 'high',
+    description: 'sh -c wrapping autour de curl. Technique d\'evasion pour masquer l\'execution de commandes distantes.',
+    references: ['https://attack.mitre.org/techniques/T1059/004/'],
+    mitre: 'T1059.004'
+  },
+
   // Intent Graph rules (v2.6.0)
   intent_credential_exfil: {
     id: 'MUADDIB-INTENT-001',

package/src/scanner/deobfuscate.js

@@ -71,6 +71,8 @@ function deobfuscate(sourceCode) {
       if (isStringFromCharCode(node)) {
         const nums = extractNumericArgs(node);
         if (nums === null) return;
+        // Validate charcode range [0, 0x10FFFF] to prevent invalid codepoints
+        if (nums.some(n => n < 0 || n > 0x10FFFF || !Number.isFinite(n))) return;
         try {
           const decoded = String.fromCharCode(...nums);
           const before = sourceCode.slice(node.start, node.end);

package/src/scanner/module-graph.js

@@ -167,15 +167,16 @@ function analyzeExports(filePath) {
 
   // Track which local variables hold sensitive module references
   // e.g. const fs = require('fs') → moduleVars['fs'] = 'fs'
-  const moduleVars = {};
+  // Object.create(null) prevents prototype pollution via __proto__/constructor keys
+  const moduleVars = Object.create(null);
   // Track which local variables hold tainted values
   // e.g. const data = fs.readFileSync(...) → taintedVars['data'] = { source, detail }
-  const taintedVars = {};
+  const taintedVars = Object.create(null);
 
   // Track class declarations: class Foo { ... }
-  const classDefs = {};
+  const classDefs = Object.create(null);
   // Track function declarations: function foo() { ... }
-  const funcDefs = {};
+  const funcDefs = Object.create(null);
   walkAST(ast, (node) => {
     if (node.type === 'ClassDeclaration' && node.id && node.id.name) {
       classDefs[node.id.name] = node;
@@ -468,7 +469,7 @@ function describeSensitiveCall(mod, method, args) {
  */
 function scanBodyForTaint(body, moduleVars, taintedVars) {
   // Collect local tainted vars within this function scope too
-  const localTainted = { ...taintedVars };
+  const localTainted = Object.assign(Object.create(null), taintedVars);
 
   let found = null;
   walkAST({ type: 'Program', body }, (node) => {

package/src/scanner/shell.js

@@ -20,7 +20,11 @@ const MALICIOUS_PATTERNS = [
   { pattern: /mkfifo.*\/dev\/tcp/m, name: 'fifo_reverse_shell', severity: 'CRITICAL' },
   { pattern: /mkfifo\s+\S+.*(?:\|\s*nc\s|nc\s+\S+.*>\s*\/tmp\/)/m, name: 'fifo_nc_reverse_shell', severity: 'CRITICAL' },
   { pattern: /base64\s+-d\b.*\|\s*(ba)?sh/m, name: 'base64_decode_exec', severity: 'CRITICAL' },
-  { pattern: /wget\s+\S+.*&&.*base64\s+-d/m, name: 'wget_base64_decode', severity: 'HIGH' }
+  { pattern: /wget\s+\S+.*&&.*base64\s+-d/m, name: 'wget_base64_decode', severity: 'HIGH' },
+  // IFS evasion patterns (v2.6.9)
+  { pattern: /curl\$\{?IFS\}?.*\|.*sh/m, name: 'curl_ifs_evasion', severity: 'CRITICAL' },
+  { pattern: /eval\s+.*\$\(curl/m, name: 'eval_curl_subshell', severity: 'CRITICAL' },
+  { pattern: /sh\s+-c\s+['"].*curl/m, name: 'sh_c_curl_exec', severity: 'HIGH' }
 ];
 
 const SHEBANG_RE = /^#!.*\b(?:ba)?sh\b/;

package/src/scoring.js

@@ -164,7 +164,10 @@ const DIST_BUNDLER_ARTIFACT_TYPES = new Set([
   'js_obfuscation_pattern', 'vm_code_execution',
   'module_compile', 'module_compile_dynamic',
   // P7: env_access in dist/ is bundled SDK config reading, not credential theft
-  'env_access'
+  'env_access',
+  // P8: Proxy traps in dist/ are state management frameworks (MobX, Vue reactivity, Immer),
+  // not malicious data interception. Two-notch downgrade (CRITICAL→MEDIUM, HIGH→LOW).
+  'proxy_data_intercept'
 ]);
 
 // Types exempt from reachability downgrade — IOC matches, lifecycle, and package-level types.

package/src/shared/download.js

@@ -116,8 +116,15 @@ async function safeDnsResolve(hostname) {
     return hostname;
   }
   const dns = require('dns');
-  const addresses = await dns.promises.resolve4(hostname);
-  if (!addresses || addresses.length === 0) {
+  const [v4, v6] = await Promise.allSettled([
+    dns.promises.resolve4(hostname),
+    dns.promises.resolve6(hostname),
+  ]);
+  const addresses = [
+    ...(v4.status === 'fulfilled' ? v4.value : []),
+    ...(v6.status === 'fulfilled' ? v6.value : []),
+  ];
+  if (addresses.length === 0) {
     throw new Error(`DNS resolution failed for ${hostname}`);
   }
   for (const addr of addresses) {