registry / muaddib-scanner / 2.11.180

muaddib-scanner@2.11.180

Supply-chain threat detection & response for npm & PyPI/Python

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source inspection shows a supply-chain security scanner whose flagged strings and canary values are detector and sandbox instrumentation. There is no concrete malicious chain or install-time attack behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Explicit user invocation of scanner, sandbox, evaluation, or webhook commands.

Impact

No install-time execution, credential theft, remote payload execution, persistence, or foreign agent-control mutation was found.

Mechanism

Security scanning, isolated package analysis, and optional user-configured reporting.

AI rationale

Evidence

package.jsonsrc/scanner/shell.jssrc/sandbox/index.jssrc/integrations/webhook.jsbin/muaddib.js

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Evidence against

package.json has no preinstall, install, or postinstall hook; its only lifecycle entry is publish-time.
The reverse-shell strings are detection patterns in the scanner, not commands executed by this package.
The apparent secrets are documented sandbox canary values used to detect exfiltration.
Network use is a registry version check or an explicit, allowlisted webhook option; no unconsented exfiltration path was found.
Child-process use is limited to explicitly invoked CLI evaluation and sandbox operations.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetry

Source & flagged code

21 flagged

src/sandbox/index.jsView file

Lines 1-34javascript

1/*

2 * MUAD'DIB — Supply-chain threat detection for npm & PyPI

4 *

5 * This program is free software: you can redistribute it and/or modify

6 * it under the terms of the GNU Affero General Public License version 3,

7 * as published by the Free Software Foundation.

8 *

9 * This program is distributed in the hope that it will be useful,

10 * but WITHOUT ANY WARRANTY; without even the implied warranty of

11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

12 * GNU Affero General Public License for more details.

13 *

14 * You should have received a copy of the GNU Affero General Public License

15 * along with this program. If not, see <https://www.gnu.org/licenses/>.

16 *

17 * SPDX-License-Identifier: AGPL-3.0-only

18 */

20const { execSync, execFileSync, spawn } = require('child_process');

21const crypto = require('crypto');

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/sandbox/index.jsView on unpkg · L14

22const fs = require('fs');

23const path = require('path');

24const {

25 generateCanaryTokens,

26 createCanaryEnvFile,

27 createCanaryNpmrc,

28 createCanaryAwsCredentials,

29 createCanarySshKey,

30 createCanaryGitconfig,

31 detectCanaryExfiltration,

32 detectCanaryInOutput

33} = require('../canary-tokens.js');

Lines 187-227javascript

187 'googleapis.com',

188 'cloudflare.com'

189];

190

191// IPs/ports excluded from connection findings (false positives)

192const SAFE_IPS = ['127.0.0.1'];

193const PROBE_PORTS = [65535];

14Trigger-reachable chain: manifest.bin -> bin/muaddib.js -> src/sandbox/index.js L14: * You should have received a copy of the GNU Affero General Public License L15: * along with this program. If not, see <https://www.gnu.org/licenses/>. L16: * ... L19: L20: const { execSync, execFileSync, spawn } = require('child_process'); L21: const crypto = require('crypto'); ... L63: // result-handling that also runs on the main thread (the deferred sandbox worker is a L64: // setInterval on the main loop — deferred-sandbox.js): JSON.parse of container stdout, L65: // gVisor kernel-log parse/cleanup, preload-log analysis. Uninstrumented today, so a ... L82: // Pattern: same semaphore as src/shared/http-limiter.js. L83: const SANDBOX_CONCURRENCY_MAX = Math.max(1, parseInt(process.env.MUADDIB_SANDBOX_C

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sandbox/index.jsView on unpkg · L14

207patternName = github_pat severity = critical line = 207 matchedText = GITHUB_T...gK',

Critical

Secret Pattern

GitHub personal access token in src/sandbox/index.js

src/sandbox/index.jsView on unpkg · L207

208patternName = npm_token severity = critical line = 208 matchedText = NPM_TOKE...5e',

Critical

Secret Pattern

npm access token in src/sandbox/index.js

src/sandbox/index.jsView on unpkg · L208

209patternName = aws_access_key severity = critical line = 209 matchedText = AWS_ACCE...Q3',

Critical

Secret Pattern

AWS access key ID in src/sandbox/index.js

src/sandbox/index.jsView on unpkg · L209

bin/muaddib.jsView file

Lines 5-45javascript

5 *

6 * This program is free software: you can redistribute it and/or modify

7 * it under the terms of the GNU Affero General Public License version 3,

8 * as published

src/response/playbooks.jsView file

Lines 1-34javascript

1/*

2 * MUAD'DIB — Supply-chain threat detection for npm & PyPI

4 *

5 * This program is free software: you can redistribute it and/or modify

6 * it under the terms of the GNU Affero General Public License version 3,

7 * as published by the Free Software Foundation.

8 *

9 * This program is distributed in the hope that it will be useful,

10 * but WITHOUT ANY WARRANTY; without even the implied warranty of

src/scoring.jsView file

Lines 438-478javascript

438 // as part of their core functionality. Lowered from 10→5 for env_access count threshold.

439 // The B5 network_sink_immunity above protects genuine exfiltration scenarios.

440 sensitive_string: { maxCount: 5, to: 'LOW' },

441 // Audit v3 B3: Template engines (htmx, marko) with many staged_payload hits are using

442 // fetch+eval for dynamic content loading, not payload staging. fetch_decrypt_exec (triple

src/scanner/ast-detectors/handle-call-expression.jsView file

Lines 1-34javascript

1/*

2 * MUAD'DIB — Supply-chain threat detection for npm & PyPI

4 *

5 * This program is free software: you can redistribute it and/or modify

6 * it under the terms of the GNU Affero General Public License version 3,

7 * as published by the Free Software Foundation.

8 *

9 * This program is distributed in the hope that it will be useful,

10 * but WITHOUT ANY WARRANTY; without even the implied warranty of

src/ioc/scraper.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. src/ioc/scraper.js: * along with this program. If not, see <https://www.gnu.org/licenses/>. res.resume(); // Drain old response before following redirect res.resume(); // Drain old response before following redirect res.resume(); // Drain response body before following redirect const url = 'https://raw.githubusercontent.com/gensecaihq/Shai-Hulud-2.0-Detector/main/compromised-packages.json'; references: ['https://github.com/gensecaihq/Shai-Hulud-2.0-Detector'], const consolidatedUrl = 'https://raw.githubusercontent.com/DataDog/indicators-of-compromise/main/shai-hulud-2.0/consolidated_iocs.csv'; references: ['https://securitylabs.datadoghq.com/articles/shai

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

src/ioc/scraper.jsView on unpkg

src/scanner/shell.jsView file

14* You should have received a copy of the GNU Affero General Public License L15: * along with this program. If not, see <https://www.gnu.org/licenses/>. L16: * ... L40: { pattern: /mkfifo\s+\S+.*(?:\|\s*nc\s|nc\s+\S+.*>\s*\/tmp\/)/m, name: 'fifo_nc_reverse_shell', severity: 'CRITICAL' }, L41: { pattern: /base64\s+-d\b.*\|\s*(ba)?sh/m, name: 'base64_decode_exec', severity: 'CRITICAL' }, L42: { pattern: /wget\s+\S+.*&&.*base64\s+-d/m, name: 'wget_base64_decode', severity: 'HIGH' }, ... L62: // Source files (.js/.ts/...) can embed shell reverse-shell commands inside L63: // child_process exec/execSync/spawn string args. shell.js historically scanned only L64: // .sh/shebang files, so `execSync("bash -i >& /dev/tcp/...")` in index.js was invisible L65: // (missed npx-whoami-demo, 2026-06

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

src/scanner/shell.jsView on unpkg · L14

src/rules/index.jsView file

14* You should have received a copy of the GNU Affero General Public License L15: * along with this program. If not, see <https://www.gnu.org/licenses/>. L16: * ... L109: domain: 'vulnerability', L110: description: 'Utilisation de eval() ou new Function() - execution de code dynamique', L111: references: [ ... L161: domain: 'malware', L162: description: 'Script preinstall/postinstall suspect dans package.json', L163: references: [ ... L316: }, L317: import_time_base64_exec: { L318: id: 'MUADDIB-PYSRC-005',

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

src/rules/index.jsView on unpkg · L14

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/rules/index.jsView on unpkg · L14

src/vendor/tree-sitter-python.wasmView file

•path = src/vendor/tree-sitter-python.wasm kind = wasm_module sizeBytes = 459862 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/vendor/tree-sitter-python.wasmView on unpkg

Source & flagged code

21 flagged · loading source

src/sandbox/index.jsView file

207patternName = github_pat severity = critical line = 207 matchedText = GITHUB_T...gK',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/sandbox/index.jsView on unpkg · L207

14* You should have received a copy of the GNU Affero General Public License L15: * along with this program. If not, see <https://www.gnu.org/licenses/>. L16: * ... L19: L20: const { execSync, execFileSync, spawn } = require('child_process'); L21: const crypto = require('crypto'); ... L63: // result-handling that also runs on the main thread (the deferred sandbox worker is a L64: // setInterval on the main loop — deferred-sandbox.js): JSON.parse of container stdout, L65: // gVisor kernel-log parse/cleanup, preload-log analysis. Uninstrumented today, so a ... L82: // Pattern: same semaphore as src/shared/http-limiter.js. L83: const SANDBOX_CONCURRENCY_MAX = Math.max(1, parseInt(process.env.MUADDIB_SANDBOX_CONCURRENCY, 10) || 3); L84:

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/sandbox/index.jsView on unpkg · L14

Findings

10 Critical8 High7 Medium7 Low

CriticalCritical Secretsrc/sandbox/index.js

CriticalHardcoded Runtime Data Exfiltrationsrc/sandbox/index.js

CriticalNpm Publish Wormsrc/response/playbooks.js

CriticalReverse Shellsrc/scanner/shell.js

CriticalRemote Asset Decode Executesrc/rules/index.js

CriticalTrigger Reachable Dangerous Capabilitysrc/sandbox/index.js

CriticalPrevious Version Dangerous Deltasrc/scoring.js

CriticalSecret Patternsrc/sandbox/index.js

HighChild Processbin/muaddib.js

HighShell

Affected versions and remediation

This report applies to muaddib-scanner@2.11.180.

See all versions of muaddib-scanner for other recorded verdicts.

Review the evidence and your use of muaddib-scanner@2.11.180 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-28 07:16:08.446Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.