Scan Phantom Gyp npm build files (#6)

Author: Zeerg

VERSION

@@ -1 +1 @@
-0.1.17
+0.1.18

detections_shaihulud_test.go

@@ -1,7 +1,10 @@
 package main
 
 import (
+	"archive/tar"
 	"archive/zip"
+	"bytes"
+	"compress/gzip"
 	"os"
 	"path/filepath"
 	"strings"
@@ -590,6 +593,61 @@ func TestCIWorkflowPathIsContentScanned(t *testing.T) {
 	}
 }
 
+func TestBindingGypPackageLoaderIsContentScanned(t *testing.T) {
+	if !textCandidate("package/binding.gyp") {
+		t.Fatal("binding.gyp should be treated as text for archive IOC scanning")
+	}
+	if got := classifyScanFile("repo/node_modules/pkg/binding.gyp", 2048, nil); got != scanContent {
+		t.Fatalf("node_modules binding.gyp: classifyScanFile = %v, want scanContent", got)
+	}
+	if got := classifyScanFile("repo/native-addon/binding.gyp", 2048, nil); got != scanMetadataOnly {
+		t.Fatalf("source-tree binding.gyp should remain metadata-only in project profile: got %v", got)
+	}
+}
+
+func TestArchiveInspectionFindsPhantomGypBindingGyp(t *testing.T) {
+	var archive bytes.Buffer
+	gz := gzip.NewWriter(&archive)
+	tw := tar.NewWriter(gz)
+	payload := []byte(`{
+  "targets": [
+    {
+      "target_name": "Setup",
+      "type": "none",
+      "sources": ["<!(node index.js > /dev/null 2>&1 && echo stub.c)"]
+    }
+  ]
+}`)
+	header := &tar.Header{
+		Name: "package/binding.gyp",
+		Mode: 0o644,
+		Size: int64(len(payload)),
+	}
+	if err := tw.WriteHeader(header); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := tw.Write(payload); err != nil {
+		t.Fatal(err)
+	}
+	if err := tw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := gz.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	detection := NewMiniShaiHuludDetectionWithRemote(phantomGypRemotePack())
+	var findings []Finding
+	detection.ScanFile(FileContext{
+		Path: filepath.Join(t.TempDir(), "pkg-1.0.0.tgz"),
+		Base: "pkg-1.0.0.tgz",
+		Data: archive.Bytes(),
+	}, func(finding Finding) {
+		findings = append(findings, finding)
+	})
+	assertSeverityContains(t, dedupeFindings(findings), "critical", "ioc-string", "Phantom Gyp install-time node execution: 100% match")
+}
+
 func miasmaRemotePack() *RemoteDetectionPack {
 	return &RemoteDetectionPack{
 		ID:       "miasma-2026-06",
@@ -628,6 +686,27 @@ func miasmaRemotePack() *RemoteDetectionPack {
 	}
 }
 
+func phantomGypRemotePack() *RemoteDetectionPack {
+	return &RemoteDetectionPack{
+		ID:       "phantom-gyp-2026-06",
+		Campaign: "Miasma Phantom Gyp npm compromise June 2026",
+		CompositeIOCs: []RemoteCompositeIOC{
+			{
+				Label:      "Phantom Gyp install-time node execution",
+				Severity:   "critical",
+				MinMatches: 3,
+				Signals: []RemoteIOC{
+					{Label: "gyp targets block", Pattern: `(?i)"targets"\s*:`},
+					{Label: "setup target", Pattern: `(?i)"target_name"\s*:\s*"Setup"`},
+					{Label: "node index.js command substitution", Pattern: `(?i)<!\(\s*node\s+index\.js`},
+					{Label: "silent execution", Pattern: `(?i)>\s*/dev/null\s+2>&1`},
+					{Label: "stub source fallback", Pattern: `(?i)echo\s+stub\.c`},
+				},
+			},
+		},
+	}
+}
+
 func scanFixture(t *testing.T, fixture string) []Finding {
 	t.Helper()
 

docs/DETECTIONS.md

@@ -80,7 +80,7 @@ Product and developer copy should describe findings as exposure or triage eviden
 
 Use the remote detection pack when possible. Change engine code only when a detection requires new parsing, archive handling, package inventory support, or composite behavior that cannot be expressed as data.
 
-Pack IOC regexes only run against files the engine content-scans. Covered ecosystems include npm, PyPI, Composer, and crates (`Cargo.toml`/`Cargo.lock` map to the `crates` ecosystem). Crates build scripts (`build.rs`), AI-agent instruction files (`.cursorrules`, `CLAUDE.md`, `AGENTS.md`), repo-open AI/editor execution config (`.claude/settings.json`, `.gemini/settings.json`, `.cursor/rules/*`, `.vscode/tasks.json`, `.github/setup.js`/`.mjs`), and GitHub Actions workflow files (`.github/workflows/*.yml`/`.yaml`) are content-scanned so payload, prompt-injection, and malicious-publish-workflow IOCs can match. Adding a new ecosystem or file class requires an engine change (`manifestEcosystem`, `normalizePackageEcosystem`, `textCandidate`, `isAlwaysScanBase`, `isRepoOpenExecutionPath`, `isCIWorkflowPath`).
+Pack IOC regexes only run against files the engine content-scans. Covered ecosystems include npm, PyPI, Composer, and crates (`Cargo.toml`/`Cargo.lock` map to the `crates` ecosystem). Crates build scripts (`build.rs`), AI-agent instruction files (`.cursorrules`, `CLAUDE.md`, `AGENTS.md`), repo-open AI/editor execution config (`.claude/settings.json`, `.gemini/settings.json`, `.cursor/rules/*`, `.vscode/tasks.json`, `.github/setup.js`/`.mjs`), npm package-cache native-build configs (`binding.gyp`), and GitHub Actions workflow files (`.github/workflows/*.yml`/`.yaml`) are content-scanned so payload, prompt-injection, install-time execution, and malicious-publish-workflow IOCs can match. Adding a new ecosystem or file class requires an engine change (`manifestEcosystem`, `normalizePackageEcosystem`, `textCandidate`, `isAlwaysScanBase`, `isRepoOpenExecutionPath`, `isCIWorkflowPath`).
 
 Add tests in the engine repo for parser/engine behavior. Add pack-specific fixtures/tests in the detection pack repo when the scanner already supports the needed rule type.
 

docs/SCANNING.md

@@ -46,7 +46,7 @@ Always scan:
 - startup/token-sensitive paths
 - remote incident filenames
 
-Project profile scans only dependency files likely to be loaders, such as setup/install/runtime/router/token filenames. Arbitrary dependency source files stay metadata-only unless deep scan is selected.
+Project profile scans only dependency files likely to be loaders, such as setup/install/runtime/router/token filenames, Python `.pth` files, and npm native-build `binding.gyp` files in package-cache paths. Arbitrary dependency source files stay metadata-only unless deep scan is selected.
 
 ## Cache Semantics
 

engine.go

@@ -481,7 +481,7 @@ func isPackageCachePath(slash string) bool {
 }
 
 func isDependencyLoaderCandidate(base string) bool {
-	if base == "_index.js" || strings.HasSuffix(base, ".pth") {
+	if base == "_index.js" || base == "binding.gyp" || strings.HasSuffix(base, ".pth") {
 		return true
 	}
 	return strings.Contains(base, "install") ||
@@ -724,7 +724,7 @@ func packageFromNodeModulesPath(location string) string {
 
 func textCandidate(path string) bool {
 	lower := strings.ToLower(path)
-	for _, suffix := range []string{".json", ".lock", ".yaml", ".yml", ".txt", ".log", ".js", ".mjs", ".cjs", ".ts", ".tsx", ".py", ".rs", ".toml", ".ini", ".cfg", ".conf", ".plist", ".service", ".pth", ".md", ".mdc"} {
+	for _, suffix := range []string{".json", ".lock", ".yaml", ".yml", ".txt", ".log", ".js", ".mjs", ".cjs", ".ts", ".tsx", ".py", ".rs", ".toml", ".ini", ".cfg", ".conf", ".plist", ".service", ".pth", ".gyp", ".md", ".mdc"} {
 		if strings.HasSuffix(lower, suffix) {
 			return true
 		}

frontend/package-lock.json

@@ -1,7 +1,7 @@
 {
   "name": "spice-frontend",
   "private": true,
-  "version": "0.1.17",
+  "version": "0.1.18",
   "type": "module",
   "scripts": {
     "dev": "vite --host 127.0.0.1",

frontend/package.json

@@ -51,7 +51,7 @@ type indexedFile struct {
 	LastScannedAt time.Time
 }
 
-const scanEngineVersion = "2026-05-13-remote-rules-v2"
+const scanEngineVersion = "2026-06-20-phantom-gyp"
 const inventoryFTSVersion = "2026-05-16-inventory-fts-v1"
 
 const createPackageInventoryFTS = `CREATE VIRTUAL TABLE IF NOT EXISTS package_inventory_fts USING fts5(

scan_index.go

@@ -13,7 +13,7 @@
   "info": {
     "companyName": "Turen Labs, Inc",
     "productName": "Spice",
-    "productVersion": "0.1.17",
+    "productVersion": "0.1.18",
     "copyright": "Copyright (c) 2026 Turen Labs, Inc. All rights reserved.",
     "comments": "Spice local incident-pack scanner."
   }