{"id":51134667,"url":"https://github.com/frobware/shudders","last_synced_at":"2026-06-25T16:02:25.454Z","repository":{"id":349148295,"uuid":"1112502711","full_name":"frobware/shudders","owner":"frobware","description":"Shai-Hulud malware scanner in Rust - detects malicious NPM packages and IOCs","archived":false,"fork":false,"pushed_at":"2025-12-08T21:49:10.000Z","size":48,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2026-04-30T12:23:11.858Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/frobware.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-12-08T18:01:34.000Z","updated_at":"2025-12-08T21:49:16.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/frobware/shudders","commit_stats":null,"previous_names":["frobware/shudders"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/frobware/shudders","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/frobware%2Fshudders","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/frobware%2Fshudders/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/frobware%2Fshudders/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/frobware%2Fshudders/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/frobware","download_url":"https://codeload.github.com/frobware/shudders/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/frobware%2Fshudders/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34782137,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-25T02:00:05.521Z","response_time":101,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-25T16:02:24.495Z","updated_at":"2026-06-25T16:02:25.449Z","avatar_url":"https://github.com/frobware.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# shudders\n\nA Rust implementation of the Shai-Hulud malware scanner that detects malicious NPM packages and host-based indicators of compromise.\n\nBased on the Python scanner from [Red-Hat-Information-Security/Incident-Response](https://github.com/Red-Hat-Information-Security/Incident-Response/).\n\n## Features\n\n- Scans `package.json` files against a known malicious package database\n- Detects file and directory IOCs using recursive and absolute patterns\n- Supports scanning multiple directories in a single invocation\n- Uses the [ignore](https://crates.io/crates/ignore) crate for fast filesystem traversal\n\n## Building\n\n```bash\ncargo build --release\n```\n\n## Usage\n\n```bash\n# Scan the entire filesystem (default)\nshudders\n\n# Scan a specific directory\nshudders /home/user/projects\n\n# Scan multiple directories\nshudders /home/user/projects /var/lib/node\n\n# Verbose mode - show each package.json being checked\nshudders -v /home/user/projects\n```\n\n## How it works\n\nThe scanner fetches two databases from the Red Hat Information Security Incident Response repository:\n\n1. **Malicious NPM packages** - a list of known malicious package name/version combinations\n2. **Host IOCs** - file and directory indicators of compromise\n\nIt then walks the specified directories, checking:\n\n- Each `package.json` against the malicious package database\n- Each file and directory path against the IOC patterns\n\n## Example output\n\n```\nFetching malicious package database from https://raw.githubusercontent.com/...\nLoaded 1055 known malicious packages\nFetching host IOC database from https://raw.githubusercontent.com/...\nLoaded 5 host IOCs\n\nScanning for Indicators of Compromise (IoCs)...\n\n[WARNING] Malicious Package IoC(s) Found:\n\n- Finding: Malicious Package: malicious-pkg@1.0.0\n  Context: Campaign: Shai-Hulud\n  Location: /path/to/node_modules/malicious-pkg/package.json\n\nScanned 42 package.json files\n\n[IMPORTANT] Please include the following in your ticket to InfoSec:\n\n- ALL OF THE SCRIPT OUTPUT ABOVE\n- Username: user\n- Hostname: workstation\n- Timestamp: 1733680000\n```\n\n## Licence\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffrobware%2Fshudders","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffrobware%2Fshudders","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffrobware%2Fshudders/lists"}