shai-hulud-detect: multi-ecosystem npm/PyPI/Composer/Crates/Go/Hex/RubyGems supply-chain worm scanner

What it is

shai-hulud-detect (Cobenian) — a Bash scanner for traces of the Sept 2025 → Aug 2026 Shai-Hulud supply-chain waves across npm/PyPI/Composer/Crates/Go/Hex/RubyGems. The summary covers scope and modes; what follows is the operational detail the summary points at but doesn't state: the destructive-wipe remediation order, the runtime requirements, and the CI contract.

The remediation ordering constraint (the safety-critical part)

The May 11 and May 19, 2026 waves install a persistence daemon (gh-token-monitor / kitty-monitor) that wipes the host if its monitored GitHub token is revoked. The order is not interchangeable:

1. Stop the persistence service.
2. Delete its files.
3. Then rotate credentials.

Revoking the monitored token before stopping the service is what triggers the wipe. Run --check-host (off by default; it walks $HOME) to detect the artifacts before touching any token. The console summary and aggregate report both print this order for you.

Running it

git clone https://github.com/Cobenian/shai-hulud-detect
cd shai-hulud-detect
chmod +x shai-hulud-detector.sh
./shai-hulud-detector.sh /path/to/your/project          # one project
./shai-hulud-detector.sh --bulk ~/dev ~/work            # aggregate report
./shai-hulud-detector.sh --save-log report.log /path    # CI-format log
./shai-hulud-detector.sh --json report.json /path       # structured, needs jq

CI exit codes: 0 clean · 1 high-risk · 2 medium-risk · 3 per-project scan error (bulk mode only). The exit code — not log parsing — is the authoritative CI signal, and --json/--save-log can be combined with it.

Note the node_modules/ behavior: it's excluded from ecosystem auto-detection (deciding which checks run), but its contents are still fully scanned for compromised versions and malware indicators.

Requirements

• Bash 5.0+ (needs associative arrays, mapfile). macOS ships 3.x — brew install bash and invoke via /opt/homebrew/bin/bash.
• Standard Unix tools (find, grep, comm, shasum/sha256sum). Auto-selects git grep > ripgrep > grep.
• jq is required only for --json; text output keeps the zero-runtime-dependency guarantee.

Caveats

• Hash detection matches only the 20 exact known-malicious SHA-256s; new payloads need a list update.
• Compromised-version detection requires the version to already be in compromised-packages.txt (whole-package campaigns like TrapDoor are matched version-agnostically by name instead).
• --paranoid (typosquatting + network-exfil heuristics) produces false positives — "useful for audits, not recommended for CI gating."
• Detection is read-only; it never removes, downgrades, or quarantines. Remediation is manual.
• Reads filesystem state only — it does not query npm/PyPI registries for live data.