Name: Shai-Hulud IOC Scanner
Author: Locke Werks

Shai-Hulud Scanner

Find out whether the worm got into your dependencies.

A toolkit for detecting indicators of compromise from the Shai-Hulud and Mini Shai-Hulud npm and PyPI supply-chain attacks, including the fake-Bun-runtime wave. Scans projects checked out on disk, and audits GitHub repositories over the API without cloning anything.

Defensive Security MIT Licensed Bash · Python

What it looks for.

Known-malicious payloads

Files like router_init.js, tanstack_runner.js, setup_bun.js and bun_environment.js, matched by filename and by SHA-256 against the known-bad digest set.

Planted CI workflows

shai-hulud-workflow.yml, formatter_<digits>.yml, and any workflow that exfiltrates repository secrets.

Compromised package versions

Roughly 2,750 npm package versions plus PyPI packages, matched in package.json manifests and lockfiles.

Infrastructure indicators

Command-and-control domains, marker strings, PBKDF2 constants, and forged-author indicators.

Malicious lifecycle hooks

preinstall and prepare hooks, plus GitHub orphan-commit dependency references.

Exfiltration artifacts

Exfil repository and branch naming patterns, and double-base64 encoded data.json artifacts.

Two halves.

# local: scan projects on disk
./detector.sh /path/to/project
./detector.sh --paranoid /path/to/project   # + typosquatting heuristics
./detector.sh --bulk ~/dev ~/work           # every project under these dirs

# remote: audit GitHub over the API, nothing cloned
python scan.py --self                       # yours, including private
python scan.py org:my-company
python scan.py --all-orgs --self            # everything you can reach

The remote scanners are repository-agnostic. You point them at any organization or user on the command line, and nothing is hard-coded. Findings are written as JSON with a severity, category, detail, and file path per hit.

It only reads.

The remote scan performs only GET requests. No repository, branch, file, or setting is ever created, modified, or deleted. For each repository it enumerates branches, walks the full default-branch git tree, fetches and inspects every manifest, lockfile and Actions workflow, and hashes flagged payload files against the known-malicious digest set.

Authentication uses your own GitHub token, from the GitHub CLI or the GITHUB_TOKEN environment variable. Locke Werks operates no service in this path and receives no findings. Output files are written next to the script and are gitignored, because they may contain target-specific findings.

Authorized use only. Run these tools only against repositories and systems you own or are explicitly authorized to assess. This is defensive tooling for incident response and supply-chain hygiene.

What a clean result does not prove.

These tools inspect repository contents only. They do not assess Actions secrets, npm publish tokens, or CI run logs, which is the surface where Shai-Hulud actually steals credentials. A clean repository is not proof that a token was never exposed.
Deep content inspection covers each repository's default branch. Non-default branches are checked for indicator names only.
The compromised-package list is current to roughly May 2026. These campaigns self-propagate, so newly poisoned packages may not be catalogued yet. Re-scan when advisories update.
Findings are signals, not verdicts. A dependency whose name is on the list but whose version is clean is benign. Triage every finding.

Standing on other people's work.

detector.sh and the compromised-package dataset are vendored from shai-hulud-detect by Cobenian, under the MIT License. The GitHub API scanners are original work. Indicator data is drawn from StepSecurity, Wiz.io, Socket.dev, Semgrep, and JFrog security advisories.