muaddib-scanner 2.7.8 → 2.7.10

package/README.md

@@ -30,7 +30,7 @@
 
 npm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond.
 
-MUAD'DIB combines **14 parallel scanners** (133 detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **per-file max scoring**, Docker sandbox with **monkey-patching preload** for time-bomb detection, **behavioral anomaly detection**, and **ground truth validation** to detect threats AND guide your response — even before they appear in any IOC database.
+MUAD'DIB combines **14 parallel scanners** (134 detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **per-file max scoring**, Docker sandbox with **monkey-patching preload** for time-bomb detection, **behavioral anomaly detection**, and **ground truth validation** to detect threats AND guide your response — even before they appear in any IOC database.
 
 ---
 
@@ -195,7 +195,7 @@ muaddib replay                     # Ground truth validation (46/49 TPR)
 | GitHub Actions | Shai-Hulud backdoor detection |
 | Hash Scanner | Known malicious file hashes |
 
-### 133 detection rules
+### 134 detection rules
 
 All rules are mapped to MITRE ATT&CK techniques. See [SECURITY.md](SECURITY.md#detection-rules-v262) for the complete rules reference.
 
@@ -286,7 +286,7 @@ repos:
 | **FPR** (Benign) | **12.1%** (64/529) | 529 npm packages, real source via `npm pack` |
 | **ADR** (Adversarial + Holdout) | **92.2%** (71/77) | 53 adversarial + 40 holdout (77 available on disk), global threshold=20 |
 
-**2093 tests** across 49 files. **134 rules** (129 RULES + 5 PARANOID).
+**2166 tests** across 49 files. **134 rules** (129 RULES + 5 PARANOID).
 
 > **Methodology caveats:**
 > - TPR measured on 49 Node.js attack samples (3 browser-only excluded from 51 total)
@@ -327,7 +327,7 @@ npm test
 
 ### Testing
 
-- **2093 tests** across 49 modular test files
+- **2166 tests** across 49 modular test files
 - **56 fuzz tests** - Malformed inputs, ReDoS, unicode, binary
 - **Datadog 17K benchmark** - 17,922 real malware samples
 - **Ground truth validation** - 51 real-world attacks (93.9% TPR)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muaddib-scanner",
-  "version": "2.7.8",
+  "version": "2.7.10",
   "description": "Supply-chain threat detection & response for npm & PyPI/Python",
   "main": "src/index.js",
   "bin": {

package/src/index.js

@@ -592,7 +592,8 @@ async function run(targetPath, options = {}) {
   // Enrich each threat with rules
   const enrichedThreats = deduped.map(t => {
     const rule = getRule(t.type);
-    const points = SEVERITY_WEIGHTS[t.severity] || 0;
+    const confFactor = { high: 1.0, medium: 0.85, low: 0.6 }[rule.confidence] || 1.0;
+    const points = Math.round((SEVERITY_WEIGHTS[t.severity] || 0) * confFactor);
     return {
       ...t,
       rule_id: rule.id || t.type,

package/src/ioc/scraper.js

@@ -154,6 +154,8 @@ function loadStaticIOCs() {
 
 const MAX_REDIRECTS = 5;
 const MAX_RESPONSE_SIZE = 200 * 1024 * 1024; // 200MB
+const MAX_ENTRY_UNCOMPRESSED = 50 * 1024 * 1024;   // 50MB per zip entry
+const MAX_TOTAL_UNCOMPRESSED = 500 * 1024 * 1024;   // 500MB total budget per zip
 
 function fetchJSON(url, options = {}, redirectCount = 0) {
   return new Promise((resolve, reject) => {
@@ -762,6 +764,7 @@ async function scrapeOSVDataDump() {
 
     let malCount = 0;
     let skippedCount = 0;
+    let totalUncompressed = 0;
 
     const spinner = new Spinner();
     try {
@@ -775,6 +778,19 @@ async function scrapeOSVDataDump() {
         if (!name.startsWith('MAL-') || !name.endsWith('.json')) {
           skippedCount++;
         } else {
+          // Zip bomb protection: check declared uncompressed size
+          const entrySize = entry.header ? entry.header.size : 0;
+          if (entrySize > MAX_ENTRY_UNCOMPRESSED) {
+            console.warn(`[WARN] Zip bomb protection: skipping oversized entry ${name} (${entrySize} bytes)`);
+            skippedCount++;
+            continue;
+          }
+          totalUncompressed += entrySize;
+          if (totalUncompressed > MAX_TOTAL_UNCOMPRESSED) {
+            console.warn(`[WARN] Zip bomb protection: total uncompressed budget exceeded at entry ${name}, stopping`);
+            break;
+          }
+
           try {
             const content = entry.getData().toString('utf8');
             const vuln = JSON.parse(content);
@@ -784,8 +800,8 @@ async function scrapeOSVDataDump() {
             // Track known IDs so OSSF can skip them
             knownIds.add(vuln.id || path.basename(name, '.json'));
             malCount++;
-          } catch {
-            // Skip unparseable entries
+          } catch (parseErr) {
+            console.warn(`[WARN] Skipping unparseable entry: ${name}`);
           }
         }
 
@@ -824,6 +840,7 @@ async function scrapeOSVPyPIDataDump() {
 
     let malCount = 0;
     let skippedCount = 0;
+    let totalUncompressed = 0;
 
     const spinner = new Spinner();
     try {
@@ -837,14 +854,27 @@ async function scrapeOSVPyPIDataDump() {
         if (!name.startsWith('MAL-') || !name.endsWith('.json')) {
           skippedCount++;
         } else {
+          // Zip bomb protection: check declared uncompressed size
+          const entrySize = entry.header ? entry.header.size : 0;
+          if (entrySize > MAX_ENTRY_UNCOMPRESSED) {
+            console.warn(`[WARN] Zip bomb protection: skipping oversized entry ${name} (${entrySize} bytes)`);
+            skippedCount++;
+            continue;
+          }
+          totalUncompressed += entrySize;
+          if (totalUncompressed > MAX_TOTAL_UNCOMPRESSED) {
+            console.warn(`[WARN] Zip bomb protection: total uncompressed budget exceeded at entry ${name}, stopping`);
+            break;
+          }
+
           try {
             const content = entry.getData().toString('utf8');
             const vuln = JSON.parse(content);
             const parsed = parseOSVEntry(vuln, 'osv-malicious-pypi', 'PyPI');
             for (const p of parsed) packages.push(p);
             malCount++;
-          } catch {
-            // Skip unparseable entries
+          } catch (parseErr) {
+            console.warn(`[WARN] Skipping unparseable entry: ${name}`);
           }
         }
 
@@ -1356,7 +1386,8 @@ module.exports = {
   parseCSVLine, parseCSV, extractVersions, parseOSVEntry,
   createFreshness, isAllowedRedirect, loadStaticIOCs,
   validateIOCEntry,
-  CONFIDENCE_ORDER, ALLOWED_REDIRECT_DOMAINS
+  CONFIDENCE_ORDER, ALLOWED_REDIRECT_DOMAINS,
+  MAX_ENTRY_UNCOMPRESSED, MAX_TOTAL_UNCOMPRESSED
 };
 
 // Direct execution if called as CLI

package/src/ioc/updater.js

@@ -345,7 +345,7 @@ function createOptimizedIOCs(iocs) {
 const NEVER_WILDCARD = new Set([
   'event-stream', 'ua-parser-js', 'coa', 'rc',
   'colors', 'faker', 'node-ipc',
-  'posthog-node', 'ngx-bootstrap', '@asyncapi/specs'
+  'posthog-node', 'posthog-js', 'ngx-bootstrap', '@asyncapi/specs'
 ]);
 
 function generateCompactIOCs(fullIOCs) {

package/src/scoring.js

@@ -1,3 +1,5 @@
+const { getRule } = require('./rules/index.js');
+
 // ============================================
 // SCORING CONSTANTS
 // ============================================
@@ -38,6 +40,13 @@ const MAX_RISK_SCORE = 100;
 // to limit noise while preserving some signal. CRITICAL and HIGH prototype_hook findings still score normally.
 const PROTO_HOOK_MEDIUM_CAP = 15;
 
+// Confidence-weighted scoring factors (v2.7.10)
+// High-confidence detections (eval, IOC, shell injection) score at full weight.
+// Medium-confidence heuristics (lifecycle_script, obfuscation, high_entropy) are discounted.
+// Low-confidence informational findings (possible_obfuscation, base64_in_script) are heavily discounted.
+// Unknown/paranoid rules default to 1.0 (no penalty).
+const CONFIDENCE_FACTORS = { high: 1.0, medium: 0.85, low: 0.6 };
+
 // ============================================
 // PER-FILE MAX SCORING (v2.2.11)
 // ============================================
@@ -76,24 +85,24 @@ function isPackageLevelThreat(threat) {
  * @returns {number} score 0-100
  */
 function computeGroupScore(threats) {
-  const criticalCount = threats.filter(t => t.severity === 'CRITICAL').length;
-  const highCount = threats.filter(t => t.severity === 'HIGH').length;
-  const mediumCount = threats.filter(t => t.severity === 'MEDIUM').length;
-  const lowCount = threats.filter(t => t.severity === 'LOW').length;
+  let score = 0;
+  let protoHookMediumPoints = 0;
 
-  const mediumProtoHookCount = threats.filter(
-    t => t.type === 'prototype_hook' && t.severity === 'MEDIUM'
-  ).length;
-  const protoHookPoints = Math.min(mediumProtoHookCount * SEVERITY_WEIGHTS.MEDIUM, PROTO_HOOK_MEDIUM_CAP);
-  const otherMediumCount = mediumCount - mediumProtoHookCount;
+  for (const t of threats) {
+    const weight = SEVERITY_WEIGHTS[t.severity] || 0;
+    const rule = getRule(t.type);
+    const factor = CONFIDENCE_FACTORS[rule.confidence] || 1.0;
 
-  let score = 0;
-  score += criticalCount * SEVERITY_WEIGHTS.CRITICAL;
-  score += highCount * SEVERITY_WEIGHTS.HIGH;
-  score += otherMediumCount * SEVERITY_WEIGHTS.MEDIUM;
-  score += protoHookPoints;
-  score += lowCount * SEVERITY_WEIGHTS.LOW;
-  return Math.min(MAX_RISK_SCORE, score);
+    if (t.type === 'prototype_hook' && t.severity === 'MEDIUM') {
+      protoHookMediumPoints += weight * factor;
+      continue;
+    }
+
+    score += weight * factor;
+  }
+
+  score += Math.min(protoHookMediumPoints, PROTO_HOOK_MEDIUM_CAP);
+  return Math.min(MAX_RISK_SCORE, Math.round(score));
 }
 
 // ============================================
@@ -198,6 +207,11 @@ const FRAMEWORK_PROTO_RE = new RegExp(
 );
 
 function applyFPReductions(threats, reachableFiles, packageName, packageDeps) {
+  // Initialize reductions audit trail on each threat
+  for (const t of threats) {
+    t.reductions = [];
+  }
+
   // Count occurrences of each threat type (package-level, across all files)
   const typeCounts = {};
   for (const t of threats) {
@@ -224,6 +238,7 @@ function applyFPReductions(threats, reachableFiles, packageName, packageDeps) {
       if ((t.type === 'dynamic_require' || t.type === 'dynamic_import') && t.severity === 'HIGH') {
         const f = t.file || '(unknown)';
         if (perFilePluginCount[f] > 4) {
+          t.reductions.push({ rule: 'plugin_loader_per_file', from: 'HIGH', to: 'LOW' });
           t.severity = 'LOW';
         }
       }
@@ -245,6 +260,7 @@ function applyFPReductions(threats, reachableFiles, packageName, packageDeps) {
       if (typeRatio < 0.4 ||
           (t.type === 'suspicious_dataflow' && typeCounts[t.type] > rule.maxCount) ||
           (t.type === 'vm_code_execution' && typeCounts[t.type] > rule.maxCount)) {
+        t.reductions.push({ rule: 'count_threshold', from: t.severity, to: rule.to });
         t.severity = rule.to;
       }
     }
@@ -253,6 +269,7 @@ function applyFPReductions(threats, reachableFiles, packageName, packageDeps) {
     // Malware poisons cache repeatedly; a single access is framework behavior
     if (t.type === 'require_cache_poison' && t.severity === 'CRITICAL' &&
         typeCounts.require_cache_poison === 1) {
+      t.reductions.push({ rule: 'cache_poison_single', from: 'CRITICAL', to: 'HIGH' });
       t.severity = 'HIGH';
     }
 
@@ -261,6 +278,7 @@ function applyFPReductions(threats, reachableFiles, packageName, packageDeps) {
     // Browser/native APIs (globalThis.fetch, XMLHttpRequest) stay HIGH
     if (t.type === 'prototype_hook' && t.severity === 'HIGH' &&
         FRAMEWORK_PROTO_RE.test(t.message)) {
+      t.reductions.push({ rule: 'framework_prototype', from: 'HIGH', to: 'MEDIUM' });
       t.severity = 'MEDIUM';
     }
 
@@ -271,6 +289,7 @@ function applyFPReductions(threats, reachableFiles, packageName, packageDeps) {
         typeCounts.prototype_hook > 20) {
       const HTTP_PROTO_RE = /\b(Request|Response|IncomingMessage|ClientRequest|ServerResponse|fetch)\b/i;
       if (HTTP_PROTO_RE.test(t.message)) {
+        t.reductions.push({ rule: 'http_client_whitelist', from: t.severity, to: 'MEDIUM' });
         t.severity = 'MEDIUM';
       }
     }
@@ -283,14 +302,18 @@ function applyFPReductions(threats, reachableFiles, packageName, packageDeps) {
     if (t.file && !DIST_EXEMPT_TYPES.has(t.type) && DIST_FILE_RE.test(t.file)) {
       if (DIST_BUNDLER_ARTIFACT_TYPES.has(t.type)) {
         // Two-notch downgrade for bundler artifacts
+        const fromSev = t.severity;
         if (t.severity === 'CRITICAL') t.severity = 'MEDIUM';
         else if (t.severity === 'HIGH') t.severity = 'LOW';
         else if (t.severity === 'MEDIUM') t.severity = 'LOW';
+        if (t.severity !== fromSev) t.reductions.push({ rule: 'dist_file', from: fromSev, to: t.severity });
       } else {
         // One-notch downgrade for other non-exempt types
+        const fromSev = t.severity;
         if (t.severity === 'CRITICAL') t.severity = 'HIGH';
         else if (t.severity === 'HIGH') t.severity = 'MEDIUM';
         else if (t.severity === 'MEDIUM') t.severity = 'LOW';
+        if (t.severity !== fromSev) t.reductions.push({ rule: 'dist_file', from: fromSev, to: t.severity });
       }
     }
 
@@ -300,6 +323,7 @@ function applyFPReductions(threats, reachableFiles, packageName, packageDeps) {
         !isPackageLevelThreat(t)) {
       const normalizedFile = t.file.replace(/\\/g, '/');
       if (!reachableFiles.has(normalizedFile)) {
+        t.reductions.push({ rule: 'unreachable', from: t.severity, to: 'LOW' });
         t.severity = 'LOW';
         t.unreachable = true;
       }
@@ -312,6 +336,7 @@ function applyFPReductions(threats, reachableFiles, packageName, packageDeps) {
     if (t.type === 'mcp_config_injection' && t.severity === 'CRITICAL' &&
         packageDeps && typeof packageDeps === 'object' &&
         packageDeps['@modelcontextprotocol/sdk']) {
+      t.reductions.push({ rule: 'mcp_sdk', from: 'CRITICAL', to: 'MEDIUM' });
       t.severity = 'MEDIUM';
       t.mcpSdkDowngrade = true;
     }
@@ -418,6 +443,6 @@ function calculateRiskScore(deduped, intentResult) {
 }
 
 module.exports = {
-  SEVERITY_WEIGHTS, RISK_THRESHOLDS, MAX_RISK_SCORE,
+  SEVERITY_WEIGHTS, RISK_THRESHOLDS, MAX_RISK_SCORE, CONFIDENCE_FACTORS,
   isPackageLevelThreat, computeGroupScore, applyFPReductions, calculateRiskScore
 };

package/src/shared/download.js

@@ -23,7 +23,11 @@ const PRIVATE_IP_PATTERNS = [
   /^::1$/,
   /^::ffff:127\./,
   /^fc00:/,
-  /^fe80:/
+  /^fe80:/,
+  /^ff/i,                      // IPv6 multicast (RFC 4291 ff00::/8)
+  /^2001:0?db8:/i,             // IPv6 documentation (RFC 3849 2001:db8::/32)
+  /^100:/,                     // IPv6 discard (RFC 6666 100::/64)
+  /^64:ff9b:/i                 // IPv6 NAT64 well-known (RFC 6052 64:ff9b::/96)
 ];
 
 /**