{"id":31286829,"url":"https://github.com/sngular/shai-hulud-integrity-scanner","last_synced_at":"2025-09-24T10:19:37.729Z","repository":{"id":315408011,"uuid":"1058874618","full_name":"sngular/shai-hulud-integrity-scanner","owner":"sngular","description":"A script to scan Node.js projects for known vulnerabilities and suspicious patterns related to the Shai-Hulud supply-chain attack.","archived":false,"fork":false,"pushed_at":"2025-09-23T15:53:59.000Z","size":311,"stargazers_count":6,"open_issues_count":0,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-09-23T17:41:39.258Z","etag":null,"topics":["cibersecurity","npm","pnpm","shaid-hulud","vulnerability-scanners","yarn"],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sngular.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-09-17T17:04:20.000Z","updated_at":"2025-09-23T15:54:03.000Z","dependencies_parsed_at":"2025-09-23T17:41:40.018Z","dependency_job_id":null,"html_url":"https://github.com/sngular/shai-hulud-integrity-scanner","commit_stats":null,"previous_names":["sng-jroji/hulud-party","sngular/shai-hulud-integrity-scanner"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/sngular/shai-hulud-integrity-scanner","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sngular%2Fshai-hulud-integrity-scanner","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sngular%2Fshai-hulud-integrity-scanner/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sngular%2Fshai-hulud-integrity-scanner/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sngular%2Fshai-hulud-integrity-scanner/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sngular","download_url":"https://codeload.github.com/sngular/shai-hulud-integrity-scanner/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sngular%2Fshai-hulud-integrity-scanner/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":276730383,"owners_count":25694447,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-24T02:00:09.776Z","response_time":97,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cibersecurity","npm","pnpm","shaid-hulud","vulnerability-scanners","yarn"],"created_at":"2025-09-24T10:19:36.459Z","updated_at":"2025-09-24T10:19:37.718Z","avatar_url":"https://github.com/sngular.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Shai-Hulud Integrity Scanner\n\nA script to scan Node.js projects for known vulnerabilities and suspicious patterns related to the Shai-Hulud\nsupply-chain attack.\n\n## What it does\n\nThis scanner performs a multi-vector check on a project to find:\n\n* **Compromised Dependencies:** Compares `package.json` against a list of known malicious package versions.\n* **Malicious Files:** Checks for files with a known malware signature (SHA256 hash).\n* **Correlated Exfiltration:** Flags files that both access environment variables (`process.env`) and contain data\n  exfiltration URLs (`webhook.site`).\n* **Suspicious Code:** Looks for `postinstall` hooks, hardcoded secret-scanning tools (`trufflehog`), and other\n  suspicious patterns.\n* **Risky Namespaces:** Warns if the project uses packages from known-compromised npm organizations (e.g., `@ctrl`).\n\n**Important:** The content scan intentionally ignores documentation (`.md`), and TypeScript definitions (`.d.ts`) to\nreduce false positives.\n\n## Prerequisites\n\nThe script requires a POSIX environment (Linux, macOS, or Windows with WSL2) and the following tools:\n\n* `git`\n* `curl`\n* `jq`\n* `shasum`\n\n## How to use\n\n### Running on Linux/macOS/WSL\n\nExecute the following curl INSIDE the project you want to analyze:\n\n```bash\n    curl -s https://raw.githubusercontent.com/sngular/shai-hulud-integrity-scanner/refs/heads/main/scan-project.sh | bash /dev/stdin\n```\n\nOr locally:\n\n1. Make the script executable:\n   ```bash\n   chmod +x scan-project.sh\n   ```\n\n2. Run it against a specific project path:\n    ```bash\n    ./scan-project.sh /path/to/project\n    ```\n\nOf course. This is a critical piece of documentation that sets clear expectations for the tool's capabilities. It needs\nto be direct and unambiguous.\n\nHere is a concise warning section that you can add to the internal `README.md`.\n\n---\n\n### Running on Windows with PowerShell\n\nIf you are on Windows and prefer to use the PowerShell version of the scanner (`scan-project.ps1`), follow these steps:\n\n1. **Download the script** into your project directory (or anywhere on your machine):\n\n    ```powershell\n    Invoke-WebRequest -Uri \"https://raw.githubusercontent.com/sngular/shai-hulud-integrity-scanner/refs/heads/main/scan-project.ps1\" -OutFile \"scan-project.ps1\"\n    ```\n\n2. **Open PowerShell** (preferably PowerShell 7 / Windows Terminal for full UTF-8 and color support).\n\n3. **Allow script execution** if needed (only once per system):\n\n    ```powershell\n    Set-ExecutionPolicy -Scope CurrentUser RemoteSigned\n    ```\n\n4. **Run the scanner inside your project folder**:\n\n    ```powershell\n    .\\scan-project.ps1\n    ```\n\n   Or run it against a specific project path:\n\n    ```powershell\n    .\\scan-project.ps1 -Path \"C:\\path\\to\\project\"\n    ```\n\n5. **Exit codes:**\n\n    * **0:** Scan complete, no issues found.\n    * **1:** Script error (e.g., a required dependency is missing).\n    * **2:** Scan complete, actionable issues were found.\n\n**Tip:** For best results on Windows, run the script in **PowerShell 7+** inside **Windows Terminal**.  \nThis ensures UTF-8 characters and colored output render correctly.\n\n## ⚠️ Important note on scanning accuracy\n\n**This scanner provides the most accurate results when a lockfile is present.**\n\nThe script automatically detects and prioritizes the most reliable dependency file available in the following order:\n\n1. **`pnpm-lock.yaml` (Highest Accuracy):** If found, and if `pnpm` is installed, the scanner will analyze the complete\n   dependency tree, including all **transitive dependencies**.\n2. **`yarn.lock` (High Accuracy):** If found, and if `yarn` is installed, the scanner will analyze the complete\n   dependency tree, including all **transitive dependencies**.\n3. **`package-lock.json` (High Accuracy):** If found, the scanner will parse the lockfile to analyze the complete\n   dependency tree, including all **transitive dependencies**.\n4. **`package.json` (Fallback - Low Accuracy):** If no lockfile is found, the scanner will fall back to reading\n   `package.json`. In this mode, it can **only** detect vulnerabilities in your *direct* dependencies and will be blind\n   to any threats hidden in the transitive ones.\n\n#### Best Practice\n\nFor a complete and reliable security audit, always run the scanner **after** installing your dependencies (e.g.,\n`npm install`, `yarn install`, or `pnpm install`), as this guarantees a lockfile is present.\n\n## Exit codes \u0026 example output\n\nThe script uses exit codes for automation:\n\n* **0:** Scan complete, no issues found.\n* **1:** Script error (e.g., a dependency is missing).\n* **2:** Scan complete, actionable issues were found.\n\n```\n==============================================\n      SHAI-HULUD DETECTION REPORT\n==============================================\n\n🚨 HIGH RISK: Compromised Package Versions Detected\n   - Package: @ctrl/tinycolor@4.1.0\n   NOTE: These specific package versions are known to be compromised.\n\n🚨 HIGH RISK: Environment Scanning with Exfiltration Detected\n   - File: src/services/telemetry-service.js\n   NOTE: These files access secrets AND contain data exfiltration patterns.\n\n⚠️ MEDIUM RISK: Packages from Compromised Namespaces\n   - Warning: Contains packages from compromised namespace: @ctrl (Found in package.json)\n   NOTE: Review packages from these organizations carefully.\n\n==============================================\n🔍 SUMMARY:\n   High/Critical Risk Issues: 2\n   Medium Risk Issues: 1\n   Total Actionable Issues: 3\n==============================================\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsngular%2Fshai-hulud-integrity-scanner","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsngular%2Fshai-hulud-integrity-scanner","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsngular%2Fshai-hulud-integrity-scanner/lists"}