coreindustries/core-shai-hulud-mitigation

This repository is a security response toolkit for a software supply chain attack called Shai-Hulud. A supply chain attack is when malicious code is hidden inside software packages that developers install as dependencies, spreading through the normal act of adding libraries to a project. Shai-Hulud is documented across five waves targeting the npm package ecosystem used by JavaScript developers, and to a lesser extent PyPI used by Python developers, with the worm propagating by using stolen credentials to publish more infected packages. The repository provides two shell scripts. The first, scan.sh, scans a project directory for known indicators of compromise: specific filenames, suspicious install scripts, known malicious package versions, exfiltration domain names, and oversized bundle files. It can scan a single project or automatically discover every git repository inside a parent directory, and it exits with a machine readable status code so it can run as a gate inside a CI pipeline. The second script, mitigate.sh, applies remediations once an infection is confirmed, with a dry run mode to preview changes first. The README also works as an incident response guide, covering how to disable persistence hooks before rotating credentials so a dead man's switch is not triggered, how to find attacker created repositories holding exfiltrated secrets, how to revoke compromised access tokens through the GitHub web interface rather than the command line, and which specific package versions across each attack wave are known to be compromised and must not be used. You would use this if you suspect your development environment or CI pipeline may have been exposed to this attack, or want to run it as a preventive audit before problems appear. The toolkit itself is written in shell. The full README is longer than what was shown.