mirror of
https://github.com/affaan-m/everything-claude-code.git
synced 2026-05-15 13:23:13 +08:00
security: add supply-chain IOC scanner (#1904)
This commit is contained in:
Affaan Mustafa
371
scripts/ci/scan-supply-chain-iocs.js
Executable file
371
scripts/ci/scan-supply-chain-iocs.js
Executable file
@@ -0,0 +1,371 @@
|
||||
#!/usr/bin/env node
|
||||
/**
|
||||
* Scan dependency manifests, lockfiles, AI-tool configs, and installed package
|
||||
* payload paths for active supply-chain incident indicators.
|
||||
*/
|
||||
|
||||
const fs = require('fs');
|
||||
const os = require('os');
|
||||
const path = require('path');
|
||||
|
||||
const DEFAULT_ROOT = path.resolve(__dirname, '../..');
|
||||
|
||||
const MALICIOUS_PACKAGE_VERSIONS = {
|
||||
'@mistralai/mistralai': ['2.2.3', '2.2.4'],
|
||||
'@mistralai/mistralai-azure': ['1.7.2', '1.7.3'],
|
||||
'@mistralai/mistralai-gcp': ['1.7.2', '1.7.3'],
|
||||
'@opensearch-project/opensearch': ['3.6.2', '3.8.0'],
|
||||
'@tanstack/arktype-adapter': ['1.166.12', '1.166.15'],
|
||||
'@tanstack/eslint-plugin-router': ['1.161.9', '1.161.12'],
|
||||
'@tanstack/eslint-plugin-start': ['0.0.4', '0.0.7'],
|
||||
'@tanstack/history': ['1.161.9', '1.161.12'],
|
||||
'@tanstack/nitro-v2-vite-plugin': ['1.154.12', '1.154.15'],
|
||||
'@tanstack/react-router': ['1.169.5', '1.169.8'],
|
||||
'@tanstack/react-router-devtools': ['1.166.16', '1.166.19'],
|
||||
'@tanstack/react-router-ssr-query': ['1.166.15', '1.166.18'],
|
||||
'@tanstack/react-start': ['1.167.68', '1.167.71'],
|
||||
'@tanstack/react-start-client': ['1.166.51', '1.166.54'],
|
||||
'@tanstack/react-start-rsc': ['0.0.47', '0.0.50'],
|
||||
'@tanstack/react-start-server': ['1.166.55', '1.166.58'],
|
||||
'@tanstack/router-cli': ['1.166.46', '1.166.49'],
|
||||
'@tanstack/router-core': ['1.169.5', '1.169.8'],
|
||||
'@tanstack/router-devtools': ['1.166.16', '1.166.19'],
|
||||
'@tanstack/router-devtools-core': ['1.167.6', '1.167.9'],
|
||||
'@tanstack/router-generator': ['1.166.45', '1.166.48'],
|
||||
'@tanstack/router-plugin': ['1.167.38', '1.167.41'],
|
||||
'@tanstack/router-ssr-query-core': ['1.168.3', '1.168.6'],
|
||||
'@tanstack/router-utils': ['1.161.11', '1.161.14'],
|
||||
'@tanstack/router-vite-plugin': ['1.166.53', '1.166.56'],
|
||||
'@tanstack/solid-router': ['1.169.5', '1.169.8'],
|
||||
'@tanstack/solid-router-devtools': ['1.166.16', '1.166.19'],
|
||||
'@tanstack/solid-router-ssr-query': ['1.166.15', '1.166.18'],
|
||||
'@tanstack/solid-start': ['1.167.65', '1.167.68'],
|
||||
'@tanstack/solid-start-client': ['1.166.50', '1.166.53'],
|
||||
'@tanstack/solid-start-server': ['1.166.54', '1.166.57'],
|
||||
'@tanstack/start-client-core': ['1.168.5', '1.168.8'],
|
||||
'@tanstack/start-fn-stubs': ['1.161.9', '1.161.12'],
|
||||
'@tanstack/start-plugin-core': ['1.169.23', '1.169.26'],
|
||||
'@tanstack/start-server-core': ['1.167.33', '1.167.36'],
|
||||
'@tanstack/start-static-server-functions': ['1.166.44', '1.166.47'],
|
||||
'@tanstack/start-storage-context': ['1.166.38', '1.166.41'],
|
||||
'@tanstack/valibot-adapter': ['1.166.12', '1.166.15'],
|
||||
'@tanstack/virtual-file-routes': ['1.161.10', '1.161.13'],
|
||||
'@tanstack/vue-router': ['1.169.5', '1.169.8'],
|
||||
'@tanstack/vue-router-devtools': ['1.166.16', '1.166.19'],
|
||||
'@tanstack/vue-router-ssr-query': ['1.166.15', '1.166.18'],
|
||||
'@tanstack/vue-start': ['1.167.61', '1.167.64'],
|
||||
'@tanstack/vue-start-client': ['1.166.46', '1.166.49'],
|
||||
'@tanstack/vue-start-server': ['1.166.50', '1.166.53'],
|
||||
'@tanstack/zod-adapter': ['1.166.12', '1.166.15'],
|
||||
'@uipath/agent.sdk': ['0.0.18'],
|
||||
'@uipath/agent-sdk': ['1.0.2'],
|
||||
'@uipath/apollo-core': ['5.9.2'],
|
||||
'@uipath/cli': ['1.0.1'],
|
||||
'@uipath/robot': ['1.3.4'],
|
||||
'cmux-agent-mcp': ['0.1.3', '0.1.4', '0.1.5', '0.1.6', '0.1.7', '0.1.8'],
|
||||
'guardrails-ai': ['0.10.1'],
|
||||
'mistralai': ['2.4.6'],
|
||||
'nextmove-mcp': ['0.1.3', '0.1.4', '0.1.5', '0.1.7'],
|
||||
'safe-action': ['0.8.3', '0.8.4'],
|
||||
};
|
||||
|
||||
const CRITICAL_TEXT_INDICATORS = [
|
||||
'@tanstack/setup',
|
||||
'github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c',
|
||||
'router_init.js',
|
||||
'router_runtime.js',
|
||||
'tanstack_runner.js',
|
||||
'gh-token-monitor',
|
||||
'com.user.gh-token-monitor',
|
||||
'filev2.getsession.org',
|
||||
'seed1.getsession.org',
|
||||
'seed2.getsession.org',
|
||||
'seed3.getsession.org',
|
||||
'git-tanstack.com',
|
||||
'83.142.209.194',
|
||||
'api.masscan.cloud',
|
||||
'A Mini Shai-Hulud has Appeared',
|
||||
'PUSH UR T3MPRR',
|
||||
];
|
||||
|
||||
const DEPENDENCY_FILENAMES = new Set([
|
||||
'package.json',
|
||||
'package-lock.json',
|
||||
'pnpm-lock.yaml',
|
||||
'yarn.lock',
|
||||
'bun.lock',
|
||||
'pyproject.toml',
|
||||
'poetry.lock',
|
||||
'requirements.txt',
|
||||
]);
|
||||
|
||||
const PERSISTENCE_FILENAMES = new Set([
|
||||
'settings.json',
|
||||
'tasks.json',
|
||||
'router_runtime.js',
|
||||
'setup.mjs',
|
||||
'gh-token-monitor.sh',
|
||||
'com.user.gh-token-monitor.plist',
|
||||
'gh-token-monitor.service',
|
||||
]);
|
||||
|
||||
const PAYLOAD_FILENAMES = new Set([
|
||||
'router_init.js',
|
||||
'router_runtime.js',
|
||||
'tanstack_runner.js',
|
||||
'gh-token-monitor.sh',
|
||||
]);
|
||||
|
||||
const IGNORED_DIRS = new Set([
|
||||
'.git',
|
||||
'.next',
|
||||
'.pytest_cache',
|
||||
'__pycache__',
|
||||
'coverage',
|
||||
'dist',
|
||||
'docs',
|
||||
'target',
|
||||
'tests',
|
||||
]);
|
||||
|
||||
function normalizeForMatch(value) {
|
||||
return value.toLowerCase();
|
||||
}
|
||||
|
||||
function isInSpecialConfigPath(filePath) {
|
||||
const normalized = filePath.split(path.sep).join('/');
|
||||
return /\/\.claude\//.test(normalized)
|
||||
|| /\/\.vscode\//.test(normalized)
|
||||
|| /\/\.kiro\/settings\//.test(normalized)
|
||||
|| /\/Library\/LaunchAgents\//.test(normalized)
|
||||
|| /\/\.config\/systemd\/user\//.test(normalized)
|
||||
|| /\/\.local\/bin\//.test(normalized);
|
||||
}
|
||||
|
||||
function shouldInspectFile(filePath) {
|
||||
const base = path.basename(filePath);
|
||||
if (DEPENDENCY_FILENAMES.has(base)) return true;
|
||||
if (PERSISTENCE_FILENAMES.has(base) && isInSpecialConfigPath(filePath)) return true;
|
||||
if (PAYLOAD_FILENAMES.has(base) && filePath.includes(`${path.sep}node_modules${path.sep}`)) return true;
|
||||
return false;
|
||||
}
|
||||
|
||||
function walkFiles(rootDir, files = []) {
|
||||
if (!fs.existsSync(rootDir)) return files;
|
||||
|
||||
const stat = fs.statSync(rootDir);
|
||||
if (stat.isFile()) {
|
||||
if (shouldInspectFile(rootDir)) files.push(rootDir);
|
||||
return files;
|
||||
}
|
||||
|
||||
for (const entry of fs.readdirSync(rootDir, { withFileTypes: true })) {
|
||||
const fullPath = path.join(rootDir, entry.name);
|
||||
if (entry.isDirectory()) {
|
||||
if (IGNORED_DIRS.has(entry.name) && entry.name !== 'node_modules') continue;
|
||||
if (entry.name === 'node_modules') {
|
||||
walkNodeModules(fullPath, files);
|
||||
} else {
|
||||
walkFiles(fullPath, files);
|
||||
}
|
||||
} else if (entry.isFile() && shouldInspectFile(fullPath)) {
|
||||
files.push(fullPath);
|
||||
}
|
||||
}
|
||||
|
||||
return files;
|
||||
}
|
||||
|
||||
function walkNodeModules(nodeModulesDir, files) {
|
||||
if (!fs.existsSync(nodeModulesDir)) return;
|
||||
|
||||
for (const entry of fs.readdirSync(nodeModulesDir, { withFileTypes: true })) {
|
||||
if (entry.name.startsWith('.')) continue;
|
||||
const fullPath = path.join(nodeModulesDir, entry.name);
|
||||
if (entry.isDirectory()) {
|
||||
if (entry.name.startsWith('@')) {
|
||||
for (const scopedEntry of fs.readdirSync(fullPath, { withFileTypes: true })) {
|
||||
if (scopedEntry.isDirectory()) {
|
||||
inspectPackageDir(path.join(fullPath, scopedEntry.name), files);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
inspectPackageDir(fullPath, files);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function inspectPackageDir(packageDir, files) {
|
||||
for (const filename of [...DEPENDENCY_FILENAMES, ...PAYLOAD_FILENAMES, 'setup.mjs', 'execution.js']) {
|
||||
const candidate = path.join(packageDir, filename);
|
||||
if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) {
|
||||
files.push(candidate);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function readText(filePath) {
|
||||
try {
|
||||
return fs.readFileSync(filePath, 'utf8');
|
||||
} catch {
|
||||
return '';
|
||||
}
|
||||
}
|
||||
|
||||
function lineForIndex(text, index) {
|
||||
return text.slice(0, index).split(/\r?\n/).length;
|
||||
}
|
||||
|
||||
function escapeRegExp(value) {
|
||||
return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
|
||||
}
|
||||
|
||||
function addFinding(findings, severity, filePath, line, indicator, message) {
|
||||
findings.push({ severity, filePath, line, indicator, message });
|
||||
}
|
||||
|
||||
function scanFile(filePath, rootDir, findings) {
|
||||
const base = path.basename(filePath);
|
||||
const relativePath = path.relative(rootDir, filePath) || filePath;
|
||||
const text = readText(filePath);
|
||||
const lowerText = normalizeForMatch(text);
|
||||
|
||||
if (PAYLOAD_FILENAMES.has(base)) {
|
||||
addFinding(
|
||||
findings,
|
||||
'critical',
|
||||
relativePath,
|
||||
1,
|
||||
base,
|
||||
'Known Mini Shai-Hulud/TanStack payload or persistence filename is present',
|
||||
);
|
||||
}
|
||||
|
||||
for (const indicator of CRITICAL_TEXT_INDICATORS) {
|
||||
const index = lowerText.indexOf(normalizeForMatch(indicator));
|
||||
if (index !== -1) {
|
||||
addFinding(
|
||||
findings,
|
||||
'critical',
|
||||
relativePath,
|
||||
lineForIndex(text, index),
|
||||
indicator,
|
||||
'Known active supply-chain IOC is present',
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
if (!DEPENDENCY_FILENAMES.has(base)) return;
|
||||
|
||||
for (const [packageName, versions] of Object.entries(MALICIOUS_PACKAGE_VERSIONS)) {
|
||||
const packageIndex = lowerText.indexOf(normalizeForMatch(packageName));
|
||||
if (packageIndex === -1) continue;
|
||||
|
||||
for (const version of versions) {
|
||||
const versionPattern = new RegExp(`(^|[^0-9a-z.])${escapeRegExp(version)}([^0-9a-z.]|$)`, 'i');
|
||||
if (versionPattern.test(text) || lowerText.includes(`@${version}`)) {
|
||||
addFinding(
|
||||
findings,
|
||||
'critical',
|
||||
relativePath,
|
||||
lineForIndex(text, packageIndex),
|
||||
`${packageName}@${version}`,
|
||||
'Dependency manifest or lockfile references a known compromised package version',
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function homeTargets(homeDir) {
|
||||
return [
|
||||
'.claude/settings.json',
|
||||
'.claude/router_runtime.js',
|
||||
'.claude/setup.mjs',
|
||||
'.vscode/tasks.json',
|
||||
'.vscode/setup.mjs',
|
||||
'Library/LaunchAgents/com.user.gh-token-monitor.plist',
|
||||
'.config/systemd/user/gh-token-monitor.service',
|
||||
'.local/bin/gh-token-monitor.sh',
|
||||
].map(relativePath => path.join(homeDir, relativePath));
|
||||
}
|
||||
|
||||
function scanSupplyChainIocs(options = {}) {
|
||||
const rootDir = path.resolve(options.rootDir || DEFAULT_ROOT);
|
||||
const files = walkFiles(rootDir);
|
||||
const findings = [];
|
||||
|
||||
if (options.home) {
|
||||
for (const target of homeTargets(options.homeDir || os.homedir())) {
|
||||
if (fs.existsSync(target)) files.push(target);
|
||||
}
|
||||
}
|
||||
|
||||
for (const filePath of [...new Set(files)].sort()) {
|
||||
scanFile(filePath, rootDir, findings);
|
||||
}
|
||||
|
||||
return {
|
||||
rootDir,
|
||||
scannedFiles: files.length,
|
||||
findings,
|
||||
};
|
||||
}
|
||||
|
||||
function parseArgs(argv) {
|
||||
const options = {};
|
||||
for (let i = 0; i < argv.length; i++) {
|
||||
const arg = argv[i];
|
||||
if (arg === '--root') {
|
||||
options.rootDir = argv[++i];
|
||||
} else if (arg === '--home') {
|
||||
options.home = true;
|
||||
} else if (arg === '--home-dir') {
|
||||
options.home = true;
|
||||
options.homeDir = argv[++i];
|
||||
} else if (arg === '--json') {
|
||||
options.json = true;
|
||||
} else {
|
||||
throw new Error(`Unknown argument: ${arg}`);
|
||||
}
|
||||
}
|
||||
return options;
|
||||
}
|
||||
|
||||
function printReport(result, json = false) {
|
||||
if (json) {
|
||||
console.log(JSON.stringify(result, null, 2));
|
||||
return;
|
||||
}
|
||||
|
||||
if (result.findings.length === 0) {
|
||||
console.log(`Supply-chain IOC scan passed for ${result.rootDir} (${result.scannedFiles} files inspected)`);
|
||||
return;
|
||||
}
|
||||
|
||||
for (const finding of result.findings) {
|
||||
console.error(
|
||||
`${finding.severity.toUpperCase()}: ${finding.filePath}:${finding.line} ${finding.indicator}`,
|
||||
);
|
||||
console.error(` ${finding.message}`);
|
||||
}
|
||||
}
|
||||
|
||||
if (require.main === module) {
|
||||
try {
|
||||
const options = parseArgs(process.argv.slice(2));
|
||||
const result = scanSupplyChainIocs(options);
|
||||
printReport(result, options.json);
|
||||
process.exit(result.findings.length > 0 ? 1 : 0);
|
||||
} catch (error) {
|
||||
console.error(error.message);
|
||||
process.exit(2);
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
CRITICAL_TEXT_INDICATORS,
|
||||
MALICIOUS_PACKAGE_VERSIONS,
|
||||
scanSupplyChainIocs,
|
||||
};
|
||||
@@ -291,7 +291,9 @@ function buildChecks(rootDir) {
|
||||
pass: fileExists(rootDir, 'docs/releases/2.0.0-rc.1/publication-readiness.md')
|
||||
&& fileExists(rootDir, 'docs/releases/2.0.0-rc.1/publication-evidence-2026-05-13-post-hardening.md')
|
||||
&& fileExists(rootDir, 'docs/security/supply-chain-incident-response.md')
|
||||
&& fileExists(rootDir, 'scripts/ci/scan-supply-chain-iocs.js')
|
||||
&& fileExists(rootDir, 'scripts/ci/validate-workflow-security.js')
|
||||
&& fileExists(rootDir, 'tests/ci/scan-supply-chain-iocs.test.js')
|
||||
&& fileExists(rootDir, 'tests/ci/validate-workflow-security.test.js')
|
||||
&& fileExists(rootDir, 'tests/scripts/npm-publish-surface.test.js')
|
||||
&& fileExists(rootDir, 'tests/docs/ecc2-release-surface.test.js')
|
||||
@@ -316,6 +318,10 @@ function buildChecks(rootDir) {
|
||||
&& includesAll(supplyChainIncidentResponse, [
|
||||
'TanStack',
|
||||
'Mini Shai-Hulud',
|
||||
'scan-supply-chain-iocs.js',
|
||||
'gh-token-monitor',
|
||||
'.claude/settings.json',
|
||||
'.vscode/tasks.json',
|
||||
'npm audit signatures',
|
||||
'trusted publishing',
|
||||
'pull_request_target',
|
||||
|
||||
Reference in New Issue
Block a user