{"id":34674653,"url":"https://github.com/ysskrishna/shai-hulud-detector","last_synced_at":"2025-12-24T20:02:21.789Z","repository":{"id":326043658,"uuid":"1103607773","full_name":"ysskrishna/shai-hulud-detector","owner":"ysskrishna","description":"A CLI security scanner that detects GitHub accounts compromised by the “Sha1-Hulud: The Second Coming” npm supply-chain worm.","archived":false,"fork":false,"pushed_at":"2025-12-06T08:44:50.000Z","size":294,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-12-10T02:09:33.156Z","etag":null,"topics":["github","malware","malware-detection","nodejs","npm","pypi","pypi-package","security","shai-hulud","shai-hulud-detector","typer","vulnerability-scanners","worm","ysskrishna"],"latest_commit_sha":null,"homepage":"https://pypi.org/project/shai-hulud-detector/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ysskrishna.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-11-25T05:09:43.000Z","updated_at":"2025-12-08T21:28:17.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/ysskrishna/shai-hulud-detector","commit_stats":null,"previous_names":["ysskrishna/shai-hulud-detector"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/ysskrishna/shai-hulud-detector","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ysskrishna%2Fshai-hulud-detector","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ysskrishna%2Fshai-hulud-detector/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ysskrishna%2Fshai-hulud-detector/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ysskrishna%2Fshai-hulud-detector/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ysskrishna","download_url":"https://codeload.github.com/ysskrishna/shai-hulud-detector/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ysskrishna%2Fshai-hulud-detector/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28007455,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-12-24T02:00:07.193Z","response_time":83,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["github","malware","malware-detection","nodejs","npm","pypi","pypi-package","security","shai-hulud","shai-hulud-detector","typer","vulnerability-scanners","worm","ysskrishna"],"created_at":"2025-12-24T20:01:06.233Z","updated_at":"2025-12-24T20:02:21.783Z","avatar_url":"https://github.com/ysskrishna.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Shai Hulud Detector\n\n![License](https://img.shields.io/badge/license-MIT-blue.svg)\n![Python](https://img.shields.io/badge/python-3.11%2B-blue.svg)\n[![PyPI](https://img.shields.io/pypi/v/shai-hulud-detector)](https://pypi.org/project/shai-hulud-detector/)\n[![PyPI Downloads](https://static.pepy.tech/personalized-badge/shai-hulud-detector?period=total\u0026units=INTERNATIONAL_SYSTEM\u0026left_color=GREY\u0026right_color=BLUE\u0026left_text=downloads)](https://pepy.tech/projects/shai-hulud-detector)\n\nA CLI tool to detect potential Shai Hulud npm-worm compromises in GitHub users and organizations.\n\n![OG Image](https://raw.githubusercontent.com/ysskrishna/shai-hulud-detector/main/media/og.png)\n\n## What is Shai Hulud?\n\nShai Hulud is a self-replicating npm worm that spreads through compromised developer systems,\ninfecting GitHub repositories and injecting malicious code.  \nIt has already been linked to multiple global supply-chain attacks targeting major npm libraries.\n\nThis tool scans for known indicators of compromise (IOCs), including:\n\n- Suspicious repository descriptions containing  \n  **`\"Sha1-Hulud: The Second Coming.\"`**\n- Presence of suspicious JSON files containing secrets, credentials or environment configuration\n\n## Features\n\n- Scan individual GitHub users\n- Scan all members of a GitHub organization\n- Dual detection methods: repository description patterns and suspicious file detection\n- Concurrent scanning with configurable workers\n- Color-coded output for easy identification (FLAG/OKAY/ERROR status)\n- Detailed verbose mode\n\n## Requirements\n\n- Python 3.11+\n- GitHub Personal Access Token (https://github.com/settings/tokens)\n\n## Installation\n\nInstall directly from PyPI:\n\n```bash\npip install shai-hulud-detector\n```\n\n## Authentication\n\nSet your GitHub token as an environment variable (recommended):\n\n```bash\nexport GITHUB_TOKEN=\u003cGITHUB_TOKEN_HERE\u003e\n```\n\nOr pass it via command-line flag (see Usage section below). If omitted, the tool exits with a clear warning.\n\n## Usage\n\n### Scan one or more users\n\n```bash\nshai-hulud-detector scan \u003cUSERNAME_HERE\u003e\nshai-hulud-detector scan \u003cUSERNAME_HERE1\u003e \u003cUSERNAME_HERE2\u003e \u003cUSERNAME_HERE3\u003e\n```\n\n### Scan all members of an organization\n\n```bash\nshai-hulud-detector scan --org \u003cORGANIZATION_NAME_HERE\u003e\n```\n\n### Authentication via command-line\n\n```bash\nshai-hulud-detector scan \u003cUSERNAME_HERE\u003e --token \u003cGITHUB_TOKEN_HERE\u003e\n```\n\n### Help\n\n```bash\nshai-hulud-detector scan --help\n```\n\n### Parallelism\n\nSet concurrency (default 5):\n\n```bash\nshai-hulud-detector scan --org \u003cORGANIZATION_NAME_HERE\u003e --workers 10\n```\n\n### Verbose Output\n\n```bash\nshai-hulud-detector scan \u003cUSERNAME_HERE\u003e --verbose\n```\n\n### Recommended Actions\n\nIf you detect a compromise (FLAG status):\n\n- Rotate **all** GitHub, npm, cloud, and CI/CD secrets\n- Enforce MFA on GitHub \u0026 npm accounts\n- Check GitHub for repositories with the description \"Sha1-Hulud: The Second Coming.\"\n- Review and remove any suspicious files found (e.g., `secrets.json`, `credentials.json`, etc.)\n- Disable npm `postinstall` scripts in CI where possible\n- Audit all npm dependencies and versions\n\n### References\n\nFor more detailed information about Shai Hulud attacks, see:\n\n- [HelixGuard: Malicious Sha1Hulud Analysis](https://helixguard.ai/blog/malicious-sha1hulud-2025-11-24)\n- [Aikido Security: Shai Hulud Strikes Again](https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains)\n- [Wiz: Shai Hulud 2.0 Ongoing Supply Chain Attack](https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack)\n\n## License\n\nMIT License - see [LICENSE](LICENSE) file for details.\n\n## Author\n\n**Y. Siva Sai Krishna**\n\n- GitHub: [@ysskrishna](https://github.com/ysskrishna)\n- LinkedIn: [ysskrishna](https://linkedin.com/in/ysskrishna)\n\n## Development\n\nFor development setup, building, and contributing, see [DEVELOPMENT.md](https://github.com/ysskrishna/shai-hulud-detector/blob/main/DEVELOPMENT.md).\n\n## Changelog\n\nSee [CHANGELOG.md](https://github.com/ysskrishna/shai-hulud-detector/blob/main/CHANGELOG.md) for a detailed list of changes and version history.\n\n## Releases\n\nFor information on the release process and how to create new releases, see [RELEASE.md](https://github.com/ysskrishna/shai-hulud-detector/blob/main/RELEASE.md).\n\n## Contributing\n\nContributions are welcome! Please feel free to submit a Pull Request.\n\n## Issues\n\nIf you encounter any issues or have feature requests, please open an issue on [GitHub](https://github.com/ysskrishna/shai-hulud-detector/issues).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fysskrishna%2Fshai-hulud-detector","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fysskrishna%2Fshai-hulud-detector","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fysskrishna%2Fshai-hulud-detector/lists"}