![\"MUAD'DIB](\"assets/muaddibLogo.png\")
\n\n \n
\n ![\"npm](\"https://img.shields.io/npm/v/muaddib-scanner\")
![\"CI\"](\"https://github.com/DNSZLSK/muad-dib/actions/workflows/scan.yml/badge.svg\"){kind=icon}
\n ![\"Coverage\"](\"https://codecov.io/gh/DNSZLSK/muad-dib/branch/master/graph/badge.svg\"){kind=icon}
\n \n
![\"License\"](\"https://img.shields.io/badge/license-AGPL--3.0--only-blue\"){kind=icon}
![\"Node\"](\"https://img.shields.io/badge/node-%3E%3D18-brightgreen\"){kind=icon}
![\"IOCs\"](\"https://img.shields.io/badge/IOCs-225%2C000%2B-red\"){kind=icon}
\n Installation |\n Usage |\n Features |\n VS Code |\n CI/CD\n
\n\n\n Version francaise\n
\n\n---\n\n## Why MUAD'DIB?\n\nnpm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond.\n\nMUAD'DIB combines **22 parallel scanners** (278 detection rules), a **deobfuscation engine**, **inter-module dataflow analysis**, **compound scoring** (21 compound rules), and a gVisor/Docker sandbox to detect known threats and suspicious behavioral patterns in npm and PyPI packages. An XGBoost classifier exists in the codebase but is **currently inactive** (see [Evaluation](#evaluation)).\n\n---\n\n## Positioning\n\nMUAD'DIB is a free, open, and fully auditable supply-chain scanner for npm and PyPI. It detects **known** threats (225,000+ IOCs), install-time RCE, credential-then-exfiltration flows, obfuscated payloads, and other suspicious behavioral patterns — locally, with no telemetry.\n\nIt is licensed under the **AGPL-3.0**; a **commercial license** is available for organizations that need to embed it in a proprietary product or run it as a closed hosted service (see [License](#license)).\n\nIt deliberately does not try to do everything — see [Scope](#scope) for exactly what it catches and what it does not.\n\n---\n\n## Scope\n\n**Detects** (npm & PyPI): known-malicious packages (name + SHA256 IOC match), typosquats, install-time RCE (lifecycle `preinstall`/`postinstall`, `curl | sh`, Python import-time, `binding.gyp`), credential read then network exfiltration (intra- and cross-file), obfuscated / high-entropy / stub-loader payloads, binary droppers (`chmod +x` + exec/spawn), and anti-analysis evasion markers.\n\n**Out of scope**: browser-only attacks (DOM/`window`, no Node.js API), the *contents* of native binaries / WASM (no binary analysis), zero-day unknown packages (the IOC feed is reactive), and non-npm/PyPI ecosystems (RubyGems, Maven, Go). Determined anti-sandbox fingerprinting and multi-stage remote payloads are known false-negative risks. Full detail: [Threat Model](docs/threat-model.md).\n\n**No telemetry.** Your code and scan results never leave your machine — MUAD'DIB only *downloads* threat-intel feeds (`muaddib update`) and, for scoring, reads public npm registry metadata. Webhook alerts are opt-in.\n\n---\n\n## Installation\n\n### npm (recommended)\n\n```bash\nnpm install -g muaddib-scanner\n```\n\n### From source\n\n```bash\ngit clone https://github.com/DNSZLSK/muad-dib\ncd muad-dib\nnpm install\nnpm link\n```\n\n---\n\n## Usage\n\n### Basic scan\n\n```bash\nmuaddib scan .\nmuaddib scan /path/to/project\n```\n\nScans both npm (package.json, node_modules) and Python (requirements.txt, setup.py, pyproject.toml) dependencies.\n\n### Interactive mode\n\n```bash\nmuaddib\n```\n\n### Safe install\n\n```bash\nmuaddib install\n The spice must flow. The worms must die.\n
\n","readmeFilename":"README.md"}