supply-chain-guard 5.2.19 → 5.2.21

package/dist/patterns.js

@@ -8,7 +8,18 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PROVENANCE_PATTERNS = exports.OBFUSCATION_V3_PATTERNS = exports.SECRETS_PATTERNS = exports.C2_EXTENDED_PATTERNS = exports.PROMPT_INJECTION_PATTERNS = exports.LURE_PATTERNS = exports.INFOSTEALER_PATTERNS = exports.IAC_PATTERNS = exports.OBFUSCATION_PATTERNS_V2 = exports.CAMPAIGN_PATTERNS_V2 = exports.MONOREPO_PATTERNS = exports.BUILD_CONFIG_FILES = exports.BUILD_TOOL_PATTERNS = exports.MAX_FILE_SIZE = exports.SCANNABLE_EXTENSIONS = exports.BEACON_MINER_PATTERNS = exports.KNOWN_NATIVE_PACKAGES = exports.BINARY_DOWNLOAD_PATTERNS = exports.BINARY_EXTENSIONS = exports.PYPI_TYPOSQUAT_PATTERNS = exports.PYTHON_EXTENSIONS = exports.PYPI_INSTALL_HOOK_PATTERNS = exports.PYPI_SETUP_FILES = exports.PYPI_FILE_PATTERNS = exports.CAMPAIGN_PATTERNS = exports.MALICIOUS_PACKAGE_PATTERNS = exports.SUSPICIOUS_SCRIPTS = exports.SUSPICIOUS_FILES = exports.FILE_PATTERNS = exports.C2_DOMAIN_PATTERNS = exports.KNOWN_C2_WALLETS = exports.GLASSWORM_MARKERS = void 0;
 /** Matches the scanner's own source files — used to prevent self-scan false positives. */
-const SCANNER_SRC = /(?:patterns|scanner|playbooks|correlation-engine|ioc-blocklist|threat-intel|remediation-engine|secret-simulator|workflow-modeler|config-scanner|install-hook-scanner|github-trust-scanner|dependency-confusion|attack-graph|reporter|active-validation)\.(ts|js)$/;
+const SCANNER_SRC = /(?:patterns|scanner|playbooks|correlation-engine|ioc-blocklist|threat-intel|remediation-engine|secret-simulator|workflow-modeler|config-scanner|install-hook-scanner|github-trust-scanner|dependency-confusion|attack-graph|reporter|active-validation|solana-monitor|solana-watchlist|slsa-verifier|sbom-generator)\.(ts|js)$/;
+// v5.2.21: documentation files (.md/.markdown/.txt/.rst) legitimately discuss
+// malware markers as part of threat-intel write-ups, changelog entries, blog
+// posts, and academic research. Patterns that match source-code-embedded
+// markers (campaign signatures, IOC strings, infostealer paths, C2 references)
+// must skip these to avoid flagging discussion as malware.
+//
+// Used together with SCANNER_SRC via SCANNER_SRC_OR_DOCS. Patterns whose
+// design is to fire on documentation (LURE_PATTERNS, PROMPT_INJECTION_PATTERNS)
+// keep plain SCANNER_SRC and stay on their onlyFilePattern scope.
+const BENIGN_DOC_FILES = /\.(md|markdown|txt|rst)$/i;
+const SCANNER_SRC_OR_DOCS = new RegExp(`(?:${SCANNER_SRC.source})|(?:${BENIGN_DOC_FILES.source})`, "i");
 // ---------------------------------------------------------------------------
 // GlassWorm-specific IOCs
 // ---------------------------------------------------------------------------
@@ -36,7 +47,7 @@ exports.FILE_PATTERNS = [
         description: "GlassWorm campaign marker variable detected",
         severity: "critical",
         rule: "GLASSWORM_MARKER",
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
         notTestFile: true,
     },
     // Invisible Unicode characters (zero-width spaces, joiners, etc.)
@@ -96,6 +107,7 @@ exports.FILE_PATTERNS = [
         description: "Solana mainnet RPC reference detected (potential C2 channel)",
         severity: "medium",
         rule: "SOLANA_MAINNET",
+        notFilePattern: SCANNER_SRC_OR_DOCS,
         notTestFile: true,
     },
     {
@@ -249,7 +261,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "XZ_GET_CPUID",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "xz-lzma-crc64",
@@ -258,7 +270,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "high",
         rule: "XZ_LZMA_CRC64",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "xz-build-inject",
@@ -267,7 +279,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "high",
         rule: "XZ_BUILD_INJECT",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "xz-obfuscated-test",
@@ -276,7 +288,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "high",
         rule: "XZ_OBFUSCATED_TEST",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // --- Codecov Bash Uploader ---
     {
@@ -286,7 +298,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "high",
         rule: "CODECOV_CURL_BASH",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "codecov-exfil",
@@ -295,7 +307,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "high",
         rule: "CODECOV_EXFIL",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // --- SolarWinds SUNBURST ---
     {
@@ -305,7 +317,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "SUNBURST_DGA",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "sunburst-orion-class",
@@ -314,7 +326,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "SUNBURST_ORION_CLASS",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "sunburst-delayed-exec",
@@ -323,7 +335,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "high",
         rule: "SUNBURST_DELAYED_EXEC",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // --- ua-parser-js hijack ---
     {
@@ -333,7 +345,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "UAPARSER_MINER",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "uaparser-preinstall-download",
@@ -342,7 +354,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "UAPARSER_PREINSTALL_DL",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // --- Checkmarx KICS / Bitwarden CLI supply-chain breach (April 2026) ---
     {
@@ -352,7 +364,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "CHECKMARX_SHAI_HULUD_V3",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "checkmarx-mcp-addon",
@@ -361,7 +373,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "CHECKMARX_MCP_ADDON",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "bitwarden-cli-loader",
@@ -370,7 +382,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "BITWARDEN_CLI_LOADER",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // --- LofyGang / LofyStealer (April 2026) ---
     {
@@ -380,7 +392,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "LOFYSTEALER_MARKER",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "lofygang-minecraft-lure",
@@ -389,7 +401,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "high",
         rule: "LOFYGANG_MINECRAFT_LURE",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // --- DPRK AI-inserted npm malware (April 2026) ---
     {
@@ -399,7 +411,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "DPRK_VALIDATE_SDK",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // --- ZiChatBot PyPI campaign (May 2026) ---
     {
@@ -409,7 +421,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "ZICHATBOT_PACKAGE",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // --- Mini Shai-Hulud / TeamPCP supply chain worm (April 2026) ---
     {
@@ -419,7 +431,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "MINI_SHAI_HULUD_MARKER",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "mini-shai-hulud-bun-loader",
@@ -428,7 +440,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "high",
         rule: "MINI_SHAI_HULUD_LOADER",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "mini-shai-hulud-preinstall-bun",
@@ -437,7 +449,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "MINI_SHAI_HULUD_PREINSTALL",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // --- Mini Shai-Hulud @antv / Nx Console / actions-cool wave (May 2026) ---
     // Triple-wave TeamPCP attack: @antv ecosystem (637 versions), Nx Console
@@ -452,7 +464,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "ANTV_WAVE_KITTY_PERSISTENCE",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "antv-wave-firedalazer-deaddrop",
@@ -461,7 +473,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "ANTV_WAVE_FIREDALAZER",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "antv-wave-otel-c2-masquerade",
@@ -470,7 +482,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "ANTV_WAVE_OTEL_C2",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // --- DPRK OtterCookie Node.js stealer (May 22, 2026) ---
     // SANS ISC diary 33006. Sample uploaded to VT as "extracted-decoded.js"; obfuscator.io-style;
@@ -483,7 +495,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "OTTERCOOKIE_HMAC_KEY",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "ottercookie-notify-endpoint",
@@ -492,7 +504,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "OTTERCOOKIE_C2_ENDPOINT",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // --- Megalodon GitHub Actions workflow injection (May 22, 2026) ---
     // 5,718 malicious commits to 5,561 GitHub repositories in 6 hours via throwaway accounts
@@ -506,7 +518,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "MEGALODON_C2_ENDPOINT",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // --- coa/rc npm hijack ---
     {
@@ -516,7 +528,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "COA_RC_SDD_DLL",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "coa-rc-postinstall-encoded",
@@ -525,7 +537,7 @@ exports.CAMPAIGN_PATTERNS = [
         severity: "critical",
         rule: "COA_RC_POSTINSTALL",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
 ];
 // ---------------------------------------------------------------------------
@@ -850,7 +862,7 @@ exports.BEACON_MINER_PATTERNS = [
         description: "Periodic network request detected (setInterval + fetch). This is a common beacon pattern for C2 communication.",
         severity: "medium",
         rule: "BEACON_INTERVAL_FETCH",
-        notFilePattern: /\.min\.(js|css)$/,
+        notFilePattern: /\.min\.(js|css)$|\.(md|markdown|txt|rst)$/i,
         notTestFile: true,
     },
     {
@@ -869,7 +881,7 @@ exports.BEACON_MINER_PATTERNS = [
         severity: "critical",
         rule: "MINER_STRATUM_PROTOCOL",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "mining-pool-domain",
@@ -878,7 +890,7 @@ exports.BEACON_MINER_PATTERNS = [
         severity: "critical",
         rule: "MINER_POOL_DOMAIN",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "mining-config-keys",
@@ -886,7 +898,7 @@ exports.BEACON_MINER_PATTERNS = [
         description: "Mining configuration keys detected. This may be a cryptocurrency miner configuration.",
         severity: "high",
         rule: "MINER_CONFIG_KEYS",
-        notFilePattern: /\.json$/,
+        notFilePattern: /\.json$|\.(md|markdown|txt|rst)$/i,
         notTestFile: true,
     },
     {
@@ -896,7 +908,7 @@ exports.BEACON_MINER_PATTERNS = [
         severity: "critical",
         rule: "MINER_LIBRARY_REF",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // Suspicious WebSocket connections
     {
@@ -914,7 +926,7 @@ exports.BEACON_MINER_PATTERNS = [
         description: "Locale/timezone check followed by destructive code. This is a protestware pattern that targets users by geography.",
         severity: "critical",
         rule: "PROTESTWARE_LOCALE_DESTRUCT",
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
         notTestFile: true,
     },
     {
@@ -923,7 +935,7 @@ exports.BEACON_MINER_PATTERNS = [
         description: "GeoIP lookup combined with destructive operations detected. This is a protestware/geo-targeted attack pattern.",
         severity: "critical",
         rule: "PROTESTWARE_GEOIP_DESTRUCT",
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
         notTestFile: true,
     },
 ];
@@ -1045,7 +1057,7 @@ exports.CAMPAIGN_PATTERNS_V2 = [
         rule: "SHAI_HULUD_WORM",
         onlyExtensions: [".js", ".mjs", ".cjs", ".ts", ".tsx", ".jsx", ".py", ".sh", ".bash"],
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "shai-hulud-npmrc-steal",
@@ -1055,7 +1067,7 @@ exports.CAMPAIGN_PATTERNS_V2 = [
         rule: "SHAI_HULUD_CRED_STEAL",
         onlyExtensions: [".js", ".mjs", ".cjs", ".ts", ".tsx", ".jsx", ".py", ".sh", ".bash"],
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // Expanded protestware
     {
@@ -1065,7 +1077,7 @@ exports.CAMPAIGN_PATTERNS_V2 = [
         severity: "critical",
         rule: "PROTESTWARE_IP_GEO_V2",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
 ];
 // ---------------------------------------------------------------------------
@@ -1086,7 +1098,7 @@ exports.OBFUSCATION_PATTERNS_V2 = [
         description: "Proxy handler trap detected. Proxy objects can intercept and modify all object operations.",
         severity: "high",
         rule: "PROXY_HANDLER_TRAP",
-        notFilePattern: /\.min\.(js|css)$|(?:\/static\/js\/|\/vendor\/|\/public\/js\/|\/assets\/js\/).*\.js$/,
+        notFilePattern: /\.min\.(js|css)$|(?:\/static\/js\/|\/vendor\/|\/public\/js\/|\/assets\/js\/).*\.js$|\.(md|markdown|txt|rst)$/i,
         notTestFile: true,
     },
     {
@@ -1180,7 +1192,7 @@ exports.INFOSTEALER_PATTERNS = [
         severity: "critical",
         rule: "DEAD_DROP_STEAM",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "dead-drop-telegram",
@@ -1189,7 +1201,7 @@ exports.INFOSTEALER_PATTERNS = [
         severity: "critical",
         rule: "DEAD_DROP_TELEGRAM",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "dead-drop-pastebin",
@@ -1198,7 +1210,7 @@ exports.INFOSTEALER_PATTERNS = [
         severity: "high",
         rule: "DEAD_DROP_PASTEBIN",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "dead-drop-dns-txt",
@@ -1207,7 +1219,7 @@ exports.INFOSTEALER_PATTERNS = [
         severity: "medium",
         rule: "DEAD_DROP_DNS_TXT",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // Browser credential theft patterns
     {
@@ -1216,7 +1228,7 @@ exports.INFOSTEALER_PATTERNS = [
         description: "Browser credential/cookie file access pattern. Infostealers (Vidar, Lumma, RedLine) steal browser data from these paths.",
         severity: "high",
         rule: "VIDAR_BROWSER_THEFT",
-        notFilePattern: /\.min\.(js|css)$|(?:patterns|scanner|playbooks|correlation-engine|ioc-blocklist|threat-intel|remediation-engine|secret-simulator|workflow-modeler|config-scanner|install-hook-scanner|github-trust-scanner|dependency-confusion|attack-graph|reporter|active-validation)\.(ts|js)$/,
+        notFilePattern: /\.min\.(js|css)$|(?:patterns|scanner|playbooks|correlation-engine|ioc-blocklist|threat-intel|remediation-engine|secret-simulator|workflow-modeler|config-scanner|install-hook-scanner|github-trust-scanner|dependency-confusion|attack-graph|reporter|active-validation|solana-monitor|solana-watchlist|slsa-verifier|sbom-generator)\.(ts|js)$|\.(md|markdown|txt|rst)$/i,
         notTestFile: true,
     },
     // Crypto wallet theft patterns
@@ -1227,7 +1239,7 @@ exports.INFOSTEALER_PATTERNS = [
         severity: "high",
         rule: "VIDAR_WALLET_THEFT",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     // SOCKS5 proxy / backconnect patterns
     {
@@ -1237,7 +1249,7 @@ exports.INFOSTEALER_PATTERNS = [
         severity: "critical",
         rule: "GHOSTSOCKS_SOCKS5",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "proxy-backconnect",
@@ -1245,7 +1257,7 @@ exports.INFOSTEALER_PATTERNS = [
         description: "Reverse proxy/backconnect pattern. Infected machines are registered as proxy nodes for criminal infrastructure.",
         severity: "high",
         rule: "PROXY_BACKCONNECT",
-        notFilePattern: /\.min\.(js|css)$|(?:patterns|scanner|playbooks|correlation-engine|ioc-blocklist|threat-intel|remediation-engine|secret-simulator|workflow-modeler|config-scanner|install-hook-scanner|github-trust-scanner|dependency-confusion|attack-graph|reporter|active-validation)\.(ts|js)$/,
+        notFilePattern: /\.min\.(js|css)$|(?:patterns|scanner|playbooks|correlation-engine|ioc-blocklist|threat-intel|remediation-engine|secret-simulator|workflow-modeler|config-scanner|install-hook-scanner|github-trust-scanner|dependency-confusion|attack-graph|reporter|active-validation|solana-monitor|solana-watchlist|slsa-verifier|sbom-generator)\.(ts|js)$|\.(md|markdown|txt|rst)$/i,
         notTestFile: true,
     },
     // Dropper / loader patterns
@@ -1255,7 +1267,7 @@ exports.INFOSTEALER_PATTERNS = [
         description: "Dropper pattern: writing and executing files in temporary directories.",
         severity: "critical",
         rule: "DROPPER_TEMP_EXEC",
-        notFilePattern: /\.json$|(?:patterns|scanner|playbooks|correlation-engine|ioc-blocklist|threat-intel|remediation-engine|secret-simulator|workflow-modeler|config-scanner|install-hook-scanner|github-trust-scanner|dependency-confusion|attack-graph|reporter|active-validation)\.(ts|js)$/,
+        notFilePattern: /\.json$|(?:patterns|scanner|playbooks|correlation-engine|ioc-blocklist|threat-intel|remediation-engine|secret-simulator|workflow-modeler|config-scanner|install-hook-scanner|github-trust-scanner|dependency-confusion|attack-graph|reporter|active-validation|solana-monitor|solana-watchlist|slsa-verifier|sbom-generator)\.(ts|js)$|\.(md|markdown|txt|rst)$/i,
         notTestFile: true,
     },
     {
@@ -1265,7 +1277,7 @@ exports.INFOSTEALER_PATTERNS = [
         severity: "high",
         rule: "DROPPER_ANTIVM",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "dropper-sleep-evasion",
@@ -1274,7 +1286,7 @@ exports.INFOSTEALER_PATTERNS = [
         severity: "high",
         rule: "DROPPER_SLEEP_EVASION",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
 ];
 // ---------------------------------------------------------------------------
@@ -1315,6 +1327,7 @@ exports.LURE_PATTERNS = [
         severity: "critical",
         rule: "CAMPAIGN_CLAUDE_LURE",
         notTestFile: true,
+        // Stay on .md - lure patterns target malicious READMEs by design.
         notFilePattern: SCANNER_SRC,
     },
     {
@@ -1360,6 +1373,7 @@ exports.PROMPT_INJECTION_PATTERNS = [
         severity: "high",
         rule: "PROMPT_INJECTION_SYSTEM_REMINDER",
         onlyFilePattern: DOC_FILE_PATTERN,
+        // Prompt-injection patterns target docs - stay on .md, only exclude scanner source.
         notFilePattern: SCANNER_SRC,
         notTestFile: true,
     },
@@ -1371,6 +1385,7 @@ exports.PROMPT_INJECTION_PATTERNS = [
         severity: "high",
         rule: "PROMPT_INJECTION_CHATML",
         onlyFilePattern: DOC_FILE_PATTERN,
+        // Prompt-injection patterns target docs - stay on .md, only exclude scanner source.
         notFilePattern: SCANNER_SRC,
         notTestFile: true,
     },
@@ -1383,6 +1398,7 @@ exports.PROMPT_INJECTION_PATTERNS = [
         severity: "high",
         rule: "PROMPT_INJECTION_INST_TAG",
         onlyFilePattern: DOC_FILE_PATTERN,
+        // Prompt-injection patterns target docs - stay on .md, only exclude scanner source.
         notFilePattern: SCANNER_SRC,
         notTestFile: true,
     },
@@ -1394,6 +1410,7 @@ exports.PROMPT_INJECTION_PATTERNS = [
         severity: "high",
         rule: "PROMPT_INJECTION_ROLE_TOKEN",
         onlyFilePattern: DOC_FILE_PATTERN,
+        // Prompt-injection patterns target docs - stay on .md, only exclude scanner source.
         notFilePattern: SCANNER_SRC,
         notTestFile: true,
     },
@@ -1407,6 +1424,7 @@ exports.PROMPT_INJECTION_PATTERNS = [
         severity: "high",
         rule: "PROMPT_INJECTION_OVERRIDE_PROSE",
         onlyFilePattern: DOC_FILE_PATTERN,
+        // Prompt-injection patterns target docs - stay on .md, only exclude scanner source.
         notFilePattern: SCANNER_SRC,
         notTestFile: true,
     },
@@ -1421,7 +1439,7 @@ exports.C2_EXTENDED_PATTERNS = [
         description: "DNS-over-HTTPS (DoH) resolver in code. Malware uses DoH to resolve C2 domains while bypassing network monitoring.",
         severity: "medium",
         rule: "C2_DOH_RESOLVER",
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
         notTestFile: true,
     },
     {
@@ -1430,6 +1448,7 @@ exports.C2_EXTENDED_PATTERNS = [
         description: "GitHub Gist used as dead-drop resolver. Gists store C2 configuration that changes without updating malware code.",
         severity: "high",
         rule: "DEAD_DROP_GIST",
+        notFilePattern: SCANNER_SRC_OR_DOCS,
         notTestFile: true,
     },
     {
@@ -1438,6 +1457,7 @@ exports.C2_EXTENDED_PATTERNS = [
         description: "Dynamic config fetch followed by code execution. Runtime C2 command pattern.",
         severity: "high",
         rule: "C2_DYNAMIC_CONFIG",
+        notFilePattern: SCANNER_SRC_OR_DOCS,
         notTestFile: true,
     },
     {
@@ -1446,6 +1466,7 @@ exports.C2_EXTENDED_PATTERNS = [
         description: "WebSocket connection with dynamically constructed URL. Hides C2 server address.",
         severity: "high",
         rule: "C2_WEBSOCKET_DYNAMIC",
+        notFilePattern: SCANNER_SRC_OR_DOCS,
         notTestFile: true,
     },
 ];
@@ -1457,7 +1478,7 @@ exports.SECRETS_PATTERNS = [
         severity: "critical",
         rule: "SECRETS_AWS_KEY",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "secrets-github-token",
@@ -1466,7 +1487,7 @@ exports.SECRETS_PATTERNS = [
         severity: "critical",
         rule: "SECRETS_GITHUB_TOKEN",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "secrets-private-key",
@@ -1475,7 +1496,7 @@ exports.SECRETS_PATTERNS = [
         severity: "critical",
         rule: "SECRETS_PRIVATE_KEY",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "secrets-ssh-key-read",
@@ -1484,7 +1505,7 @@ exports.SECRETS_PATTERNS = [
         severity: "critical",
         rule: "SECRETS_SSH_KEY_READ",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "secrets-npm-token",
@@ -1493,7 +1514,7 @@ exports.SECRETS_PATTERNS = [
         severity: "critical",
         rule: "SECRETS_NPM_TOKEN",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
     {
         name: "secrets-generic-api-key",
@@ -1502,7 +1523,7 @@ exports.SECRETS_PATTERNS = [
         severity: "high",
         rule: "SECRETS_GENERIC_API_KEY",
         notTestFile: true,
-        notFilePattern: SCANNER_SRC,
+        notFilePattern: SCANNER_SRC_OR_DOCS,
     },
 ];
 // ---------------------------------------------------------------------------