Release MLVScan.Core 1.8.2

[ifBars]

Closes the confirmed-malware detection gaps for encoded EVM/Java staging and fragmented hidden-shell execution, adds exact sample coverage for Meowtopia and SunriseFurrowCoach, and aligns the Core/WASM package versions at 1.8.2.

• Release MLVScan.Core and WASM package version 1.8.2.
• Detect remote text retrieval followed by hidden or fragmented shell execution.
• Detect encoded EVM Java stager variants.
• Expand encoded indicator coverage.
• Add threat-family and disposition classification tests.
• Add exact sample coverage for Meowtopia and SunriseFurrowCoach.

Author	Lines added	Lines removed
ifBars	518	34

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: aed7d51f-75d6-40ef-adc5-c591ba7adb7c

📥 Commits

Reviewing files that changed from the base of the PR and between 9082dfa and 42b2737.

⛔ Files ignored due to path filters (1)

• MLVScan.WASM/npm/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (13)

• Directory.Build.props
• MLVScan.Core.Tests/Integration/NewSampleThreatFamilyTests.cs
• MLVScan.Core.Tests/Integration/ThreatFamilyQuarantineTests.cs
• MLVScan.Core.Tests/Unit/Rules/CoordinatedPayloadDeliveryRuleTests.cs
• MLVScan.Core.Tests/Unit/Services/NewThreatFamilyClassifierTests.cs
• MLVScan.Core.Tests/Unit/Services/ThreatDispositionClassifierTests.cs
• MLVScan.WASM/npm/package.json
• MLVScanVersions.cs
• Models/Rules/CoordinatedPayloadDeliveryRule.cs
• Models/Rules/EncodedStringPipelineRule.cs
• Services/ThreatIntel/ThreatDispositionClassifier.cs
• Services/ThreatIntel/ThreatFamilyCatalog.NewSamples.cs
• Services/ThreatIntel/ThreatFamilyCatalog.cs

 __________________________________________________________________________________________________________________________________________________
< I've got a very particular set of skills. Skills I have acquired over a very long career. Skills that make me a nightmare for bugs in your code. >
 --------------------------------------------------------------------------------------------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-20T02:42:02.982508Z	42b2737	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 42b2737d8b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require an actual hidden-window setting

UseShellExecute=true only selects the operating-system shell for process startup; it does not conceal the new process. For a method that downloads and transforms text before visibly launching PowerShell with dynamic arguments, this branch emits a “hidden shell” coordinator finding, and the matching predicate in ThreatFamilyCatalog.NewSamples.cs likewise accepts UseShellExecute=true, promoting the file to the blocking KnownThreat disposition. Require CreateNoWindow=true or WindowStyle=Hidden instead of treating UseShellExecute as hidden execution.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Correlate fallback signals to the same async operation

In assemblies containing several classes under one namespace, this fallback can combine a fragmented hidden launcher from one method, a GetString call from another, a string transform from a third, and any hidden-process finding in the namespace. For example, an unrelated update checker and a local hidden launcher are consequently labeled as the remote-text malware family and blocked as KnownThreat. Restrict this fallback to the relevant state-machine/originating method relationship rather than testing independent namespace-wide signals.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Scan remote-text launchers in the global namespace

This new detector runs only inside the surrounding namespace-group loop, which filters out every top-level type whose Namespace is empty. A remote-text hidden-shell launcher declared in the global namespace therefore never reaches this call and receives no behavior-family match unless its exact hash is already cataloged, providing a straightforward detection bypass for new samples. Include global-namespace types in the grouping or run this analysis independently of that filter.

Useful? React with 👍 / 👎.