registry / Staged payload carrier / muaddib-scanner / 2.12.0

muaddib-scanner@2.12.0

Supply-chain threat detection & response for npm & PyPI/Python

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Inspected source is a user-invoked npm and PyPI malware scanner with no install-time hook; critical scanner hits are rule catalogs, playbooks, and sandbox canaries. It still ships dual-use exec plus an unreadable WASM module, so this stays a warning rather than a clean or block verdict.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user installs the package without lifecycle execution, then later runs the muaddib CLI, monitor, sandbox, or Python AST scan.

Impact

The scanner process can run Docker and git and load vendored WASM whose bytes could not be reviewed as source; no unattended install-time compromise was shown.

Mechanism

Dual-use scanner with opaque WASM load and operator process execution

AI rationale

Evidence

src/scanner/python-ast.jssrc/sandbox/index.jsbin/muaddib.jssrc/commands/diff.jssrc/vendor/tree-sitter-python.wasm

Decision evidence

public snapshot

AI called this Suspicious at 68.0% confidence as Dangerous Capability with high false-positive risk.

Evidence for warning

Vendored tree-sitter-python.wasm cannot be read as text and is loaded into the Python AST parser at runtime, so that artifact is not fully inspectable.
The sandbox module runs Docker through child_process and ships honeypot credential-shaped tokens for canary detection.
The published muaddib CLI exposes scan, sandbox, watch, and install helpers; it is operator-invoked, not an npm install hook.
The diff command runs git through execFileSync in a user-chosen directory.
Monitor classification reads operator environment flags, including ANTHROPIC_API_KEY.
Rule catalogs and the cross-file taint detector describe fetch-plus-eval, npm-publish worms, and network or exec sinks as detection logic.

Evidence against

package.json has no preinstall, install, or postinstall script; prepublishOnly only refuses local publishes outside CI.
src/index.js exports an explicit run() scan pipeline with no import-time eval or network send.
npm publish worm and staged-payload wording in playbooks is operator response text, not code that republishes the package.
Webhook sending is opt-in HTTPS to an allowlisted Discord and Slack set.

Source & flagged code

18 flagged

src/sandbox/index.jsView file

Lines 1-34javascript

1/*

2 * MUAD'DIB — Supply-chain threat detection for npm & PyPI

4 *

5 * This program is free software: you can redistribute it and/or modify

6 * it under the terms of the GNU Affero General Public License version 3,

7 * as published by the Free Software Foundation.

8 *

9 * This program is distributed in the hope that it will be useful,

10 * but WITHOUT ANY WARRANTY; without even the implied warranty of

11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

12 * GNU Affero General Public License for more details.

13 *

14 * You should have received a copy of the GNU Affero General Public License

15 * along with this program. If not, see <https://www.gnu.org/licenses/>.

16 *

17 * SPDX-License-Identifier: AGPL-3.0-only

18 */

20const { execSync, execFileSync, spawn } = require('child_process');

21const crypto = require('crypto');

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/sandbox/index.jsView on unpkg · L14

22const fs = require('fs');

23const path = require('path');

24const {

25 generateCanaryTokens,

26 createCanaryEnvFile,

27 createCanaryNpmrc,

28 createCanaryAwsCredentials,

29 createCanarySshKey,

30 createCanaryGitconfig,

31 detectCanaryExfiltration,

32 detectCanaryInOutput

33} = require('../canary-tokens.js');

Lines 187-227javascript

187 'googleapis.com',

188 'cloudflare.com'

189];

190

191// IPs/ports excluded from connection findings (false positives)

192const SAFE_IPS = ['127.0.0.1'];

193const PROBE_PORTS = [65535];

14Trigger-reachable chain: manifest.bin -> bin/muaddib.js -> src/sandbox/index.js L14: * You should have received a copy of the GNU Affero General Public License L15: * along with this program. If not, see <https://www.gnu.org/licenses/>. L16: * ... L19: L20: const { execSync, execFileSync, spawn } = require('child_process'); L21: const crypto = require('crypto'); ... L63: // result-handling that also runs on the main thread (the deferred sandbox worker is a L64: // setInterval on the main loop — deferred-sandbox.js): JSON.parse of container stdout, L65: // gVisor kernel-log parse/cleanup, preload-log analysis. Uninstrumented today, so a ... L82: // Pattern: same semaphore as src/shared/http-limiter.js. L83: const SANDBOX_CONCURRENCY_MAX = Math.max(1, parseInt(process.env.MUADDIB_SANDBOX_C

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sandbox/index.jsView on unpkg · L14

207patternName = github_pat severity = critical line = 207

Critical

Secret Pattern

GitHub personal access token in src/sandbox/index.js

src/sandbox/index.jsView on unpkg · L207

208patternName = npm_token severity = critical line = 208

Critical

Secret Pattern

npm access token in src/sandbox/index.js

src/sandbox/index.jsView on unpkg · L208

209patternName = aws_access_key severity = critical line = 209

Critical

Secret Pattern

AWS access key ID in src/sandbox/index.js

src/sandbox/index.jsView on unpkg · L209

bin/muaddib.jsView file

Lines 5-45javascript

5 *

6 * This program is free software: you can redistribute it and/or modify

7 * it under the terms of the GNU Affero General Public License version 3,

8 * as published

src/monitor/classify.js#virtual:normalized:round1View file

1/* L2: * MUAD"DIB — Supply-chain threat detection for npm & PyPI\n * Copyright (C) 2026 DNSZLSK\n *\n * This program is free software: you can redistribute it and/or modify\n * it under t... L3: // core/.asar with injected code (payload-in-write coupling ⇒ FP≈0). Bypasses MT-1 cap like the

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/monitor/classify.js#virtual:normalized:round1View on unpkg · L1

src/scanner/module-graph/detect-cross-file.js#virtual:normalized:round1View file

293if (pipeSource) { L294: // The final .pipe() destination — check if it"s a known sink\n const destArg = node.arguments && node.arguments[0];\n if (destArg) {\n const destSink ... L295: walkAST(ast, (node) => {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/scanner/module-graph/detect-cross-file.js#virtual:normalized:round1View on unpkg · L293

293Trigger-reachable command-output exfiltration chain: manifest.main -> src/index.js -> src/pipeline/executor.js -> src/scanner/module-graph/index.js -> src/scanner/module-graph/detect-cross-file.js L293: if (pipeSource) { L294: // The final .pipe() destination — check if it"s a known sink\n const destArg = node.arguments && node.arguments[0];\n if (destArg) {\n const destSink ... L295: walkAST(ast, (node) => {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

src/scanner/module-graph/detect-cross-file.js#virtual:normalized:round1View on unpkg · L293

src/response/playbooks.jsView file

Lines 1-34javascript

1/*

2 * MUAD'DIB — Supply-chain threat detection for npm & PyPI

4 *

5 * This program is free software: you can redistribute it and/or modify

6 * it under the terms of the GNU Affero General Public License version 3,

7 * as published by the Free Software Foundation.

8 *

9 * This program is distributed in the hope that it will be useful,

10 * but WITHOUT ANY WARRANTY; without even the implied warranty of

src/rules/index.jsView file

Lines 1-34javascript

1/*

2 * MUAD'DIB — Supply-chain threat detection for npm & PyPI

4 *

5 * This program is free software: you can redistribute it and/or modify

6 * it under the terms of the GNU Affero General Public License version 3,

7 * as published by the Free Software Foundation.

8 *

9 * This program is distributed in the hope that it will be useful,

10 * but WITHOUT ANY WARRANTY; without even the implied warranty of

src/commands/diff.js#virtual:normalized:round1View file

92try { L93: execFileSync("npm", ["install", "--quiet", "--no-audit", "--no-fund", "--ignore-scripts"], { L94: cwd: tempDir, ... L98: } catch { L99: // Ignore npm install errors L100: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/diff.js#virtual:normalized:round1View on unpkg · L92

src/vendor/tree-sitter-python.wasmView file

•path = src/vendor/tree-sitter-python.wasm kind = wasm_module sizeBytes = 459862 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/vendor/tree-sitter-python.wasmView on unpkg

bin/muaddib.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/muaddib.js#virtual:normalized:round1View on unpkg

src/scanner/paranoid.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = muaddib-scanner@2.11.180 matchedIdentity = npm:bXVhZGRpYi1zY2FubmVy:2.11.180 similarity = 0.733 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/scanner/paranoid.jsView on unpkg

Source & flagged code

18 flagged · loading source

src/sandbox/index.jsView file

207patternName = github_pat severity = critical line = 207

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/sandbox/index.jsView on unpkg · L207

14* You should have received a copy of the GNU Affero General Public License L15: * along with this program. If not, see <https://www.gnu.org/licenses/>. L16: * ... L19: L20: const { execSync, execFileSync, spawn } = require('child_process'); L21: const crypto = require('crypto'); ... L63: // result-handling that also runs on the main thread (the deferred sandbox worker is a L64: // setInterval on the main loop — deferred-sandbox.js): JSON.parse of container stdout, L65: // gVisor kernel-log parse/cleanup, preload-log analysis. Uninstrumented today, so a ... L82: // Pattern: same semaphore as src/shared/http-limiter.js. L83: const SANDBOX_CONCURRENCY_MAX = Math.max(1, parseInt(process.env.MUADDIB_SANDBOX_CONCURRENCY, 10) || 3); L84:

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/sandbox/index.jsView on unpkg · L14

Findings

10 Critical8 High4 Medium7 Low

CriticalCritical Secretsrc/sandbox/index.js

CriticalSame File Env Network Executionsrc/monitor/classify.js#virtual:normalized:round1

CriticalHardcoded Runtime Data Exfiltrationsrc/sandbox/index.js

CriticalNpm Publish Wormsrc/response/playbooks.js

CriticalRemote Asset Decode Executesrc/rules/index.js

CriticalTrigger Reachable Dangerous Capabilitysrc/sandbox/index.js

CriticalPrevious Version Dangerous Deltasrc/scanner/paranoid.js

CriticalSecret Patternsrc/sandbox/index.js

HighChild Processbin/muaddib.js

Affected versions and remediation

This report applies to muaddib-scanner@2.12.0.

See all versions of muaddib-scanner for other recorded verdicts.

Review the evidence and your use of muaddib-scanner@2.12.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 00:21:04.012Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

muaddib-scanner@2.12.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code