scan.sh

#!/usr/bin/env bash
# scan local machine + repos for shai-hulud / miasma / mini-shai-hulud worm artifacts
#
# Severity tiers:
#   [hit]     confirmed IOC — distinctive worm artifact, treat as compromised
#   [suspect] launcher-vector config / unexpected binary / odd config; CONTENTS
#             or filesystem context match a malicious pattern
#   [review]  benign-looking artifact worth eyeballing (AI-agent config present
#             but clean, etc.) — listed so it is never silently ignored
#
# Usage: scan.sh [root-dir]   (default: $HOME)
#        scan.sh --no-host    skip the once-per-machine host checks
set -uo pipefail

HOST_CHECKS=1
ROOT=""
for arg in "$@"; do
  case "$arg" in
  --no-host) HOST_CHECKS=0 ;;
  -*)
    printf "unknown flag: %s\n" "$arg" >&2
    exit 2
    ;;
  *) ROOT="$arg" ;;
  esac
done
ROOT="${ROOT:-$HOME}"

R=$'\033[1;31m'
G=$'\033[1;32m'
Y=$'\033[1;33m'
D=$'\033[2m'
X=$'\033[0m'

# --- confirmed IOCs (high confidence) ---------------------------------------
IOC_PATHS='(^|/)(setup_bun\.js|bun_environment\.js|router_init\.js|router_runtime\.js|\.github/workflows/shai-hulud-workflow\.yml|\.github/workflows/discussion\.yaml)$'
IOC_REFS='shai-hulud|sha1-hulud' # branch/tag refs containing this string (case-insensitive)
IOC_NAME='shai-hulud|sha1-hulud' # repo dir name (case-insensitive)

# --- launcher-vector config files (inspect contents, don't auto-trust) -------
SCAN_PATHS='(^|/)(\.vscode/tasks\.json|\.vscode/settings\.json|\.claude/settings\.json|\.gemini/settings\.json|\.cursor/rules/setup\.mdc|setup\.mjs|\.github/setup\.js|package\.json|binding\.gyp)$'
REVIEW_PATHS='(^|/)(\.vscode/tasks\.json|\.claude/settings\.json|\.gemini/settings\.json|\.cursor/rules/setup\.mdc|setup\.mjs|\.github/setup\.js)$'

# --- malicious content signatures (high signal, low noise) -------------------
STRONG='base64 (-d|--decode)|atob\(|Buffer\.from\(.*base64|[^a-z]eval\(|child_process|execSync|spawnSync|\|[[:space:]]*(ba)?sh([[:space:]]|$)|curl[[:space:]]|wget[[:space:]]|Invoke-WebRequest|iex[[:space:]]|/dev/tcp/|webhook\.site|setup_bun|bun_environment|router_init|router_runtime|\bbunx?[[:space:]]|npmjs\.help|masscan\.cloud|getsession\.org|sfrclak\.com|https?://[^[:space:]"'\'']+\.(sh|js)([[:space:]"'\'']|$)|npm[[:space:]]+install[[:space:]]+https?://'

# --- compromised npm packages (high-confidence subset from public IOC lists) -
# Exact names (any version) — pulled from Cobenian/shai-hulud-detect,
# Wiz, Datadog, JFrog, Snyk, StepSecurity reports.
COMPROMISED_EXACT='^(ngx-bootstrap|ng2-file-upload|rxnt-authentication|ts-gaussian|encounter-playground|intercom-client|ai-sdk-ollama|posthog-js|tsconfig-paths|plain-crypto-js)$'
# Scoped families — any package under these scopes is currently flagged. If you
# legitimately depend on a healthy version, validate the specific version.
COMPROMISED_SCOPES='^(@crowdstrike/|@art-ws/|@nstudio/|@redhat-cloud-services/|@ctrl/tinycolor|@vapi-ai/server-sdk|@asyncapi/|@operato/|@nativescript-community/|@browserbasehq/|@uipath/|@zapier/|@postman/|@tanstack/)'
# Specific name+version pinned hits (axios got two malicious versions)
COMPROMISED_VERSIONED='^(axios)@(1\.14\.1|0\.30\.4)$'

declare -i repos=0 hits=0 suspects=0 reviews=0

# All findings prepend \r\033[K so they don't smear against an in-flight progress line.
hit() {
  printf "\r\033[K%s[hit]%s %s\n" "$R" "$X" "$*"
  hits+=1
}
suspect() {
  printf "\r\033[K%s[suspect]%s %s\n" "$Y" "$X" "$*"
  suspects+=1
}
review() {
  printf "\r\033[K%s[review] %s%s\n" "$D" "$*" "$X"
  reviews+=1
}
info() { printf "%s%s%s\n" "$D" "$*" "$X"; }

# ===========================================================================
# host-level checks (run once)
# ===========================================================================
scan_host() {
  info "host: binary, persistence, cache, history checks"

  # 1. Suspect binaries the worm installs/uses
  local bin path
  for bin in bun trufflehog; do
    path=$(command -v "$bin" 2>/dev/null || true)
    if [[ -n "$path" ]]; then
      suspect "binary '$bin' present at $path (worm-installed if you don't use it)"
    fi
  done

  # 2. Worm-specific filesystem paths.
  # gh-token-monitor is the Mini Shai-Hulud dead-man's switch — it polls GitHub
  # every 60s and runs `rm -rf ~/` if the token is revoked. DO NOT revoke
  # tokens before unloading and deleting it.
  local p
  for p in "$HOME/.truffler-cache" "$HOME/.dev-env" "$HOME/actions-runner" "$HOME/.bun/install/cache" \
    "$HOME/Library/LaunchAgents/com.user.gh-token-monitor.plist" \
    "$HOME/.config/systemd/user/gh-token-monitor.service"; do
    [[ -e "$p" ]] && hit "worm-path present: $p"
  done

  # 3. /etc/hosts pinning known C2 domains
  if grep -iE '(masscan\.cloud|getsession\.org|webhook\.site|sfrclak\.com|nemean-hydra)' /etc/hosts >/dev/null 2>&1; then
    hit "C2 reference in /etc/hosts"
    grep -inE '(masscan\.cloud|getsession\.org|webhook\.site|sfrclak\.com)' /etc/hosts | sed 's/^/      /'
  fi

  # 4. Shell history — installs from random URLs, mentions of worm artifacts.
  # Strip lines that just clone/reference public detector or scanner repos
  # (Cobenian/shai-hulud-detect, gensecaihq/Shai-Hulud-2.0-Detector, your own
  # scanner repo, etc.) — those are defensive research, not infection.
  local h
  for h in "$HOME/.zsh_history" "$HOME/.bash_history" "$HOME/.history"; do
    [[ -f "$h" ]] || continue
    local found
    found=$(grep -aiE '(shai-?hulud|sha1-?hulud|masscan\.cloud|getsession\.org|webhook\.site/bb8ca5f6|trufflehog|setup_bun|bun_environment|router_init|router_runtime|npm[[:space:]]+install[[:space:]]+https?://|npmjs\.help)' "$h" 2>/dev/null |
      grep -avEi '(shai-hulud-detect|shai-hulud-repo-scanner|shai-hulud-2\.0-detector|mini-shai-hulud-checker|hulud[-_]?(detector|scanner|response|migration-response)|compromised-npm-packages)' |
      head -5 || true)
    if [[ -n "$found" ]]; then
      suspect "shell history $h contains worm-related strings"
      printf "%s%s%s\n" "$D" "$(echo "$found" | sed 's/^/      /')" "$X"
    fi
  done

  # 5. launchd persistence — any plist referencing worm artifacts.
  # Adds gh-token-monitor (dead-man's switch), npmjs.help (typosquat), and the
  # token-wipe marker string. Catches the IOC even if the plist filename is
  # renamed but the contents still reference the launcher script.
  local plist found
  for plist in "$HOME"/Library/LaunchAgents/*.plist /Library/LaunchAgents/*.plist /Library/LaunchDaemons/*.plist; do
    [[ -f "$plist" ]] || continue
    found=$(grep -liE '(setup_bun|bun_environment|router_init|router_runtime|trufflehog|masscan\.cloud|getsession\.org|shai-?hulud|sha1-?hulud|gh-token-monitor|npmjs\.help|IfYouRevokeThisToken)' "$plist" 2>/dev/null || true)
    [[ -n "$found" ]] && hit "launchd plist references worm artifact: $found"
  done

  # 5b. launchctl runtime — any loaded service with worm naming
  if command -v launchctl >/dev/null 2>&1; then
    local svc
    svc=$(launchctl list 2>/dev/null | awk '{print $3}' |
      grep -iE '(gh-token-monitor|shai-?hulud|sha1-?hulud|trufflehog|bun_environment|setup_bun)' || true)
    [[ -n "$svc" ]] && while IFS= read -r r; do hit "loaded launchd service: $r"; done <<<"$svc"
  fi

  # 5c. systemd user persistence (Linux) — Mini Shai-Hulud uses
  # ~/.config/systemd/user/gh-token-monitor.service
  if [[ -d "$HOME/.config/systemd/user" ]]; then
    local unit
    unit=$(grep -rliE '(gh-token-monitor|setup_bun|bun_environment|router_init|trufflehog|masscan\.cloud|getsession\.org|shai-?hulud|sha1-?hulud|IfYouRevokeThisToken)' "$HOME/.config/systemd/user" 2>/dev/null || true)
    [[ -n "$unit" ]] && while IFS= read -r r; do hit "systemd user unit references worm artifact: $r"; done <<<"$unit"
  fi

  # 6. crontab
  if crontab -l 2>/dev/null | grep -iE '(setup_bun|bun_environment|trufflehog|masscan\.cloud|getsession\.org|shai-?hulud|node[[:space:]].*\.js)' >/dev/null 2>&1; then
    suspect "crontab contains node/bun-related entries — review:"
    crontab -l 2>/dev/null | grep -iE '(setup_bun|bun_environment|trufflehog|masscan|getsession|shai|node)' | sed 's/^/      /'
  fi

  # 7. Shell rc files — any sourcing of suspicious scripts
  local rc
  for rc in "$HOME/.zshrc" "$HOME/.bashrc" "$HOME/.bash_profile" "$HOME/.zprofile" "$HOME/.profile"; do
    [[ -f "$rc" ]] || continue
    found=$(grep -nE '(setup_bun|bun_environment|router_init|trufflehog|masscan\.cloud|getsession\.org|shai-?hulud|/dev/tcp/|curl[[:space:]]+[^[:space:]]+\|[[:space:]]*(ba)?sh)' "$rc" 2>/dev/null || true)
    [[ -n "$found" ]] && hit "$rc references worm artifact:" && printf "%s%s%s\n" "$D" "$(echo "$found" | sed 's/^/      /')" "$X"
  done

  # 8. .npmrc — look for the malicious-token "wipe-the-computer" description marker
  local nrc
  for nrc in "$HOME/.npmrc" "$HOME/.config/npm/npmrc" /etc/npmrc /opt/homebrew/etc/npmrc; do
    [[ -f "$nrc" ]] || continue
    if grep -iE '(IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner|masscan\.cloud|getsession\.org)' "$nrc" >/dev/null 2>&1; then
      hit "$nrc contains worm marker"
    fi
  done

  # 9. Running processes — node/bun/trufflehog with worm filenames
  if ps -axo pid,comm,args 2>/dev/null |
    grep -iE '(setup_bun|bun_environment|router_init|router_runtime|trufflehog|masscan\.cloud|getsession\.org)' |
    grep -v 'grep' >/dev/null; then
    hit "process matches worm artifact:"
    ps -axo pid,comm,args 2>/dev/null |
      grep -iE '(setup_bun|bun_environment|router_init|router_runtime|trufflehog)' |
      grep -v 'grep' | sed 's/^/      /'
  fi

  # 10. AI-agent home configs — list for review only (likely legit if you use them)
  for p in "$HOME/.claude/settings.json" "$HOME/.claude/setup.mjs" \
    "$HOME/.gemini/settings.json" "$HOME/.cursor/rules/setup.mdc" \
    "$HOME/.vscode/setup.mjs" "$HOME/.github/setup.js"; do
    [[ -f "$p" ]] || continue
    local evidence
    evidence=$(grep -nEi "$STRONG" "$p" 2>/dev/null | head -n3 | sed 's/^/      /' || true)
    if [[ -n "$evidence" ]]; then
      suspect "$p"
      printf "%s%s%s\n" "$D" "$evidence" "$X"
    else
      review "$p"
    fi
  done

  # 11. npm cache index cross-checked against known compromised package names
  if [[ -d "$HOME/.npm/_cacache/index-v5" ]]; then
    info "host: cross-checking npm cache against known compromised packages"
    local listfile
    listfile=$(mktemp)
    find "$HOME/.npm/_cacache/index-v5" -type f -print0 2>/dev/null |
      xargs -0 cat 2>/dev/null |
      awk -F'\t' 'NF==2 {print $2}' |
      python3 -c "
import json, sys
seen = set()
for line in sys.stdin:
    line = line.strip()
    if not line: continue
    try:
        j = json.loads(line)
        k = j.get('key', '')
        if 'registry.npmjs.org/' in k:
            tail = k.split('registry.npmjs.org/', 1)[1]
            name = tail.split('/-/', 1)[0]
            seen.add(name.replace('%2f', '/').replace('%40', '@'))
    except Exception: pass
for n in sorted(seen): print(n)
" 2>/dev/null >"$listfile"
    local count
    count=$(wc -l <"$listfile" | tr -d ' ')
    local bad
    bad=$(grep -E "$COMPROMISED_EXACT|$COMPROMISED_SCOPES" "$listfile" 2>/dev/null || true)
    if [[ -n "$bad" ]]; then
      while IFS= read -r p; do hit "npm cache holds compromised package: $p"; done <<<"$bad"
    fi
    rm -f "$listfile"
    info "host: scanned $count cached package names"
  fi

  # 12. Global npm packages — same cross-check
  if command -v npm >/dev/null 2>&1; then
    local globals
    globals=$(npm ls -g --depth=0 --parseable 2>/dev/null | awk -F/ '/node_modules/ {n=$NF; if (n ~ /^@/) n=$(NF-1)"/"$NF; print n}' | sort -u || true)
    if [[ -n "$globals" ]]; then
      local badg
      badg=$(echo "$globals" | grep -E "$COMPROMISED_EXACT|$COMPROMISED_SCOPES" || true)
      [[ -n "$badg" ]] && while IFS= read -r p; do hit "global npm package compromised: $p"; done <<<"$badg"
    fi
  fi

  # 13. Tiny binding.gyp files (Miasma v2 phantom-gyp is ~157 bytes)
  while IFS= read -r -d '' bg; do
    local sz
    sz=$(stat -f%z "$bg" 2>/dev/null || stat -c%s "$bg" 2>/dev/null || echo 0)
    if ((sz > 0 && sz <= 300)); then
      # Real ones are usually much bigger; tiny ones with command-substitution are the Miasma vector.
      if grep -qE '<!\(|<\$|\$\(' "$bg" 2>/dev/null; then
        suspect "tiny binding.gyp with command substitution ($sz bytes): $bg"
      fi
    fi
  done < <(find "$ROOT" \( -path '*/node_modules' -o -path '*/Library' -o -path '*/.Trash' \) -prune -o -type f -name 'binding.gyp' -print0 2>/dev/null)

  echo
}

# ===========================================================================
# per-repo checks
# ===========================================================================
scan_repo() {
  local repo="$1" name refs wt hist r f where cand evidence authors
  name="$(basename "$repo")"

  shopt -s nocasematch
  [[ "$name" =~ $IOC_NAME ]] && hit "repo name: $repo"
  shopt -u nocasematch

  refs=$(git -C "$repo" for-each-ref --format='%(refname)' 2>/dev/null |
    grep -iE "$IOC_REFS" || true)
  [[ -n "$refs" ]] && while IFS= read -r r; do hit "ref $r in $repo"; done <<<"$refs"

  wt=$(git -C "$repo" ls-files -co --exclude-standard 2>/dev/null |
    grep -E "$IOC_PATHS" || true)
  [[ -n "$wt" ]] && while IFS= read -r f; do hit "working tree: $repo/$f"; done <<<"$wt"

  hist=$(git -C "$repo" log --all --diff-filter=A --name-only --pretty=format: 2>/dev/null |
    sort -u | grep -E "$IOC_PATHS" || true)
  [[ -n "$hist" ]] && while IFS= read -r f; do
    where=$(git -C "$repo" log --all --diff-filter=A --pretty=format:'%h %D' -- "$f" 2>/dev/null | head -n1)
    hit "history: $repo/$f ($where)"
  done <<<"$hist"

  # commit-author IOC: the worm signs commits as claude@users.noreply.github.com
  authors=$(git -C "$repo" log --all --since='2025-09-01' --format='%H %ae' 2>/dev/null |
    grep -iE 'claude@users\.noreply\.github\.com$' | head -5 || true)
  [[ -n "$authors" ]] && while IFS= read -r r; do hit "worm-signature commit in $repo: $r"; done <<<"$authors"

  cand=$(find "$repo" -path '*/node_modules' -prune -o -type f \
    \( -name 'tasks.json' -o -name 'settings.json' -o -name 'setup.mjs' \
    -o -name 'setup.mdc' -o -name 'setup.js' -o -name 'package.json' -o -name 'binding.gyp' \) -print 2>/dev/null |
    grep -E "$SCAN_PATHS" || true)
  [[ -n "$cand" ]] && while IFS= read -r f; do
    evidence=$(grep -nEi "$STRONG" "$f" 2>/dev/null | head -n3 | sed 's/^/      /')
    if [[ -n "$evidence" ]]; then
      suspect "$f"
      printf "%s%s%s\n" "$D" "$evidence" "$X"
    elif [[ "$f" =~ $REVIEW_PATHS ]]; then
      review "$f"
    fi
  done <<<"$cand"

  # package.json dependency cross-check
  while IFS= read -r pj; do
    local deps
    deps=$(python3 -c "
import json, sys
try:
    d = json.load(open(sys.argv[1]))
    for sect in ('dependencies','devDependencies','optionalDependencies','peerDependencies'):
        for n,v in (d.get(sect) or {}).items():
            print(f'{n} {v}')
except Exception: pass
" "$pj" 2>/dev/null || true)
    while IFS= read -r dep; do
      [[ -z "$dep" ]] && continue
      local n v
      n="${dep%% *}"
      v="${dep#* }"
      if echo "$n" | grep -qE "$COMPROMISED_EXACT|$COMPROMISED_SCOPES"; then
        hit "$pj depends on compromised package: $n ($v)"
      elif echo "${n}@${v}" | grep -qE "$COMPROMISED_VERSIONED"; then
        hit "$pj depends on pinned-compromised version: $n@$v"
      fi
    done <<<"$deps"
  done < <(find "$repo" -path '*/node_modules' -prune -o -type f -name package.json -print 2>/dev/null)
}

# ===========================================================================
# main
# ===========================================================================
info "scanning $ROOT"

((HOST_CHECKS)) && scan_host

# Pass 1: every git repo under ROOT (skip node_modules / Library / Trash)
while IFS= read -r -d '' g; do
  repo="$(dirname "$g")"
  repos+=1
  printf "\r\033[K%s[%d]%s %s" "$D" "$repos" "$X" "$repo" >&2
  scan_repo "$repo"
done < <(find "$ROOT" \
  \( -path '*/node_modules' -o -path '*/Library' -o -path '*/.Trash' \) -prune -o \
  -type d -name '.git' -print0 2>/dev/null)
printf "\r\033[K" >&2

# Pass 2: dropper payloads installed into node_modules (not under git control)
while IFS= read -r -d '' nm; do
  found=$(find "$nm" -maxdepth 6 -type f \
    \( -name 'setup_bun.js' -o -name 'bun_environment.js' \
    -o -name 'router_init.js' -o -name 'router_runtime.js' \) 2>/dev/null || true)
  [[ -n "$found" ]] && while IFS= read -r f; do hit "node_modules: $f"; done <<<"$found"
done < <(find "$ROOT" -type d -name 'node_modules' -prune -print0 2>/dev/null)

# --- summary ----------------------------------------------------------------
rc=0
((hits > 0)) && {
  printf "%s%d confirmed hit(s)%s\n" "$R" "$hits" "$X"
  rc=1
}
((suspects > 0)) && {
  printf "%s%d suspect item(s) — inspect the lines above%s\n" "$Y" "$suspects" "$X"
  rc=1
}
((reviews > 0)) && printf "%s%d item(s) listed for manual review%s\n" "$D" "$reviews" "$X"

if ((rc == 0)); then
  printf "%sclean%s — %d repos scanned\n" "$G" "$X" "$repos"
else
  printf "%s%d repos scanned%s\n" "$D" "$repos" "$X"
fi
exit "$rc"