zsp/everything-claude-code
1
0
Fork 0
mirror of https://github.com/affaan-m/everything-claude-code.git synced 2026-05-18 14:53:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

security: cover gh-token-monitor token persistence

Browse Source
This commit is contained in:
Affaan Mustafa
2026-05-17 17:46:35 -04:00
parent 6b282aaa43
commit 36d390aa7d
3 changed files with 37 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/security/supply-chain-incident-response.md
View File

@@ -27,8 +27,8 @@ credentials:
they carried destructive or unauthorized file-writing behavior.
- The live IOC set includes persistence through Claude Code
`.claude/settings.json`, VS Code `.vscode/tasks.json`, and OS-level
`gh-token-monitor` LaunchAgent/systemd services. Some variants add a
dead-man-switch token description
`gh-token-monitor` LaunchAgent/systemd services. Some variants add
`~/.config/gh-token-monitor/token` plus a dead-man-switch token description
`IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner`, malicious workflow
files such as `.github/workflows/codeql_analysis.yml`, and Python runtime
payloads such as `transformers.pyz` / `pgmonitor.py`. Remove those
@@ -124,6 +124,7 @@ If ECC or a maintainer machine installed a known-bad package version:
- `~/Library/LaunchAgents/com.user.gh-token-monitor.plist`;
- `~/.config/systemd/user/gh-token-monitor.service`;
- `~/.config/systemd/user/pgsql-monitor.service`;
- `~/.config/gh-token-monitor/token`;
- `~/.local/bin/gh-token-monitor.sh`;
- `~/.local/bin/pgmonitor.py`;
- `/tmp/transformers.pyz`, `/tmp/pgmonitor.py`, and their