nisten/shaiscan

shaiscan is a single shell script that scans a Mac or Linux computer for signs of infection by a specific supply chain worm called Mini Shai Hulud, which spreads through malicious npm and PyPI packages. The script does not need any special installation beyond a normal shell and a few common command line tools, and it never modifies files, never contacts the worm's control servers, and never asks for extra permissions beyond what is needed to read files. The README's first recommendation, before even running the scanner, is a thirty second fix: adding a handful of lines to the computer's hosts file that block network access to six domains the worm uses for command and control. Doing this alone stops the worm's stolen data from ever reaching the attacker, even if the malicious code is already present. The README gives copy paste instructions for Linux, macOS, and Windows to do this. Running the actual scanner checks a long list of things: suspicious running processes, malicious files left behind in common folders, network connections to the worm's servers, tampered editor or CI configuration files, lockfiles and package files that reference known bad package versions, git commit history, installed packages, and package manager caches, among other checks. Findings are written to a markdown report and labeled by severity, ranging from confirmed compromise down to purely informational notes. The scanner is explicitly read only. It will not delete anything it finds, will not rotate any credentials for you, and recommends imaging the disk for forensic purposes before doing any cleanup. The README also encourages running your package manager's own built in security audit tool alongside shaiscan, since shaiscan only knows about the specific indicators it has been given and may miss newer advisories.