mirror of
https://github.com/affaan-m/everything-claude-code.git
synced 2026-05-15 13:23:13 +08:00
372 lines
11 KiB
JavaScript
Executable File
372 lines
11 KiB
JavaScript
Executable File
#!/usr/bin/env node
|
|
/**
|
|
* Scan dependency manifests, lockfiles, AI-tool configs, and installed package
|
|
* payload paths for active supply-chain incident indicators.
|
|
*/
|
|
|
|
const fs = require('fs');
|
|
const os = require('os');
|
|
const path = require('path');
|
|
|
|
const DEFAULT_ROOT = path.resolve(__dirname, '../..');
|
|
|
|
const MALICIOUS_PACKAGE_VERSIONS = {
|
|
'@mistralai/mistralai': ['2.2.3', '2.2.4'],
|
|
'@mistralai/mistralai-azure': ['1.7.2', '1.7.3'],
|
|
'@mistralai/mistralai-gcp': ['1.7.2', '1.7.3'],
|
|
'@opensearch-project/opensearch': ['3.6.2', '3.8.0'],
|
|
'@tanstack/arktype-adapter': ['1.166.12', '1.166.15'],
|
|
'@tanstack/eslint-plugin-router': ['1.161.9', '1.161.12'],
|
|
'@tanstack/eslint-plugin-start': ['0.0.4', '0.0.7'],
|
|
'@tanstack/history': ['1.161.9', '1.161.12'],
|
|
'@tanstack/nitro-v2-vite-plugin': ['1.154.12', '1.154.15'],
|
|
'@tanstack/react-router': ['1.169.5', '1.169.8'],
|
|
'@tanstack/react-router-devtools': ['1.166.16', '1.166.19'],
|
|
'@tanstack/react-router-ssr-query': ['1.166.15', '1.166.18'],
|
|
'@tanstack/react-start': ['1.167.68', '1.167.71'],
|
|
'@tanstack/react-start-client': ['1.166.51', '1.166.54'],
|
|
'@tanstack/react-start-rsc': ['0.0.47', '0.0.50'],
|
|
'@tanstack/react-start-server': ['1.166.55', '1.166.58'],
|
|
'@tanstack/router-cli': ['1.166.46', '1.166.49'],
|
|
'@tanstack/router-core': ['1.169.5', '1.169.8'],
|
|
'@tanstack/router-devtools': ['1.166.16', '1.166.19'],
|
|
'@tanstack/router-devtools-core': ['1.167.6', '1.167.9'],
|
|
'@tanstack/router-generator': ['1.166.45', '1.166.48'],
|
|
'@tanstack/router-plugin': ['1.167.38', '1.167.41'],
|
|
'@tanstack/router-ssr-query-core': ['1.168.3', '1.168.6'],
|
|
'@tanstack/router-utils': ['1.161.11', '1.161.14'],
|
|
'@tanstack/router-vite-plugin': ['1.166.53', '1.166.56'],
|
|
'@tanstack/solid-router': ['1.169.5', '1.169.8'],
|
|
'@tanstack/solid-router-devtools': ['1.166.16', '1.166.19'],
|
|
'@tanstack/solid-router-ssr-query': ['1.166.15', '1.166.18'],
|
|
'@tanstack/solid-start': ['1.167.65', '1.167.68'],
|
|
'@tanstack/solid-start-client': ['1.166.50', '1.166.53'],
|
|
'@tanstack/solid-start-server': ['1.166.54', '1.166.57'],
|
|
'@tanstack/start-client-core': ['1.168.5', '1.168.8'],
|
|
'@tanstack/start-fn-stubs': ['1.161.9', '1.161.12'],
|
|
'@tanstack/start-plugin-core': ['1.169.23', '1.169.26'],
|
|
'@tanstack/start-server-core': ['1.167.33', '1.167.36'],
|
|
'@tanstack/start-static-server-functions': ['1.166.44', '1.166.47'],
|
|
'@tanstack/start-storage-context': ['1.166.38', '1.166.41'],
|
|
'@tanstack/valibot-adapter': ['1.166.12', '1.166.15'],
|
|
'@tanstack/virtual-file-routes': ['1.161.10', '1.161.13'],
|
|
'@tanstack/vue-router': ['1.169.5', '1.169.8'],
|
|
'@tanstack/vue-router-devtools': ['1.166.16', '1.166.19'],
|
|
'@tanstack/vue-router-ssr-query': ['1.166.15', '1.166.18'],
|
|
'@tanstack/vue-start': ['1.167.61', '1.167.64'],
|
|
'@tanstack/vue-start-client': ['1.166.46', '1.166.49'],
|
|
'@tanstack/vue-start-server': ['1.166.50', '1.166.53'],
|
|
'@tanstack/zod-adapter': ['1.166.12', '1.166.15'],
|
|
'@uipath/agent.sdk': ['0.0.18'],
|
|
'@uipath/agent-sdk': ['1.0.2'],
|
|
'@uipath/apollo-core': ['5.9.2'],
|
|
'@uipath/cli': ['1.0.1'],
|
|
'@uipath/robot': ['1.3.4'],
|
|
'cmux-agent-mcp': ['0.1.3', '0.1.4', '0.1.5', '0.1.6', '0.1.7', '0.1.8'],
|
|
'guardrails-ai': ['0.10.1'],
|
|
'mistralai': ['2.4.6'],
|
|
'nextmove-mcp': ['0.1.3', '0.1.4', '0.1.5', '0.1.7'],
|
|
'safe-action': ['0.8.3', '0.8.4'],
|
|
};
|
|
|
|
const CRITICAL_TEXT_INDICATORS = [
|
|
'@tanstack/setup',
|
|
'github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c',
|
|
'router_init.js',
|
|
'router_runtime.js',
|
|
'tanstack_runner.js',
|
|
'gh-token-monitor',
|
|
'com.user.gh-token-monitor',
|
|
'filev2.getsession.org',
|
|
'seed1.getsession.org',
|
|
'seed2.getsession.org',
|
|
'seed3.getsession.org',
|
|
'git-tanstack.com',
|
|
'83.142.209.194',
|
|
'api.masscan.cloud',
|
|
'A Mini Shai-Hulud has Appeared',
|
|
'PUSH UR T3MPRR',
|
|
];
|
|
|
|
const DEPENDENCY_FILENAMES = new Set([
|
|
'package.json',
|
|
'package-lock.json',
|
|
'pnpm-lock.yaml',
|
|
'yarn.lock',
|
|
'bun.lock',
|
|
'pyproject.toml',
|
|
'poetry.lock',
|
|
'requirements.txt',
|
|
]);
|
|
|
|
const PERSISTENCE_FILENAMES = new Set([
|
|
'settings.json',
|
|
'tasks.json',
|
|
'router_runtime.js',
|
|
'setup.mjs',
|
|
'gh-token-monitor.sh',
|
|
'com.user.gh-token-monitor.plist',
|
|
'gh-token-monitor.service',
|
|
]);
|
|
|
|
const PAYLOAD_FILENAMES = new Set([
|
|
'router_init.js',
|
|
'router_runtime.js',
|
|
'tanstack_runner.js',
|
|
'gh-token-monitor.sh',
|
|
]);
|
|
|
|
const IGNORED_DIRS = new Set([
|
|
'.git',
|
|
'.next',
|
|
'.pytest_cache',
|
|
'__pycache__',
|
|
'coverage',
|
|
'dist',
|
|
'docs',
|
|
'target',
|
|
'tests',
|
|
]);
|
|
|
|
function normalizeForMatch(value) {
|
|
return value.toLowerCase();
|
|
}
|
|
|
|
function isInSpecialConfigPath(filePath) {
|
|
const normalized = filePath.split(path.sep).join('/');
|
|
return /\/\.claude\//.test(normalized)
|
|
|| /\/\.vscode\//.test(normalized)
|
|
|| /\/\.kiro\/settings\//.test(normalized)
|
|
|| /\/Library\/LaunchAgents\//.test(normalized)
|
|
|| /\/\.config\/systemd\/user\//.test(normalized)
|
|
|| /\/\.local\/bin\//.test(normalized);
|
|
}
|
|
|
|
function shouldInspectFile(filePath) {
|
|
const base = path.basename(filePath);
|
|
if (DEPENDENCY_FILENAMES.has(base)) return true;
|
|
if (PERSISTENCE_FILENAMES.has(base) && isInSpecialConfigPath(filePath)) return true;
|
|
if (PAYLOAD_FILENAMES.has(base) && filePath.includes(`${path.sep}node_modules${path.sep}`)) return true;
|
|
return false;
|
|
}
|
|
|
|
function walkFiles(rootDir, files = []) {
|
|
if (!fs.existsSync(rootDir)) return files;
|
|
|
|
const stat = fs.statSync(rootDir);
|
|
if (stat.isFile()) {
|
|
if (shouldInspectFile(rootDir)) files.push(rootDir);
|
|
return files;
|
|
}
|
|
|
|
for (const entry of fs.readdirSync(rootDir, { withFileTypes: true })) {
|
|
const fullPath = path.join(rootDir, entry.name);
|
|
if (entry.isDirectory()) {
|
|
if (IGNORED_DIRS.has(entry.name) && entry.name !== 'node_modules') continue;
|
|
if (entry.name === 'node_modules') {
|
|
walkNodeModules(fullPath, files);
|
|
} else {
|
|
walkFiles(fullPath, files);
|
|
}
|
|
} else if (entry.isFile() && shouldInspectFile(fullPath)) {
|
|
files.push(fullPath);
|
|
}
|
|
}
|
|
|
|
return files;
|
|
}
|
|
|
|
function walkNodeModules(nodeModulesDir, files) {
|
|
if (!fs.existsSync(nodeModulesDir)) return;
|
|
|
|
for (const entry of fs.readdirSync(nodeModulesDir, { withFileTypes: true })) {
|
|
if (entry.name.startsWith('.')) continue;
|
|
const fullPath = path.join(nodeModulesDir, entry.name);
|
|
if (entry.isDirectory()) {
|
|
if (entry.name.startsWith('@')) {
|
|
for (const scopedEntry of fs.readdirSync(fullPath, { withFileTypes: true })) {
|
|
if (scopedEntry.isDirectory()) {
|
|
inspectPackageDir(path.join(fullPath, scopedEntry.name), files);
|
|
}
|
|
}
|
|
} else {
|
|
inspectPackageDir(fullPath, files);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
function inspectPackageDir(packageDir, files) {
|
|
for (const filename of [...DEPENDENCY_FILENAMES, ...PAYLOAD_FILENAMES, 'setup.mjs', 'execution.js']) {
|
|
const candidate = path.join(packageDir, filename);
|
|
if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) {
|
|
files.push(candidate);
|
|
}
|
|
}
|
|
}
|
|
|
|
function readText(filePath) {
|
|
try {
|
|
return fs.readFileSync(filePath, 'utf8');
|
|
} catch {
|
|
return '';
|
|
}
|
|
}
|
|
|
|
function lineForIndex(text, index) {
|
|
return text.slice(0, index).split(/\r?\n/).length;
|
|
}
|
|
|
|
function escapeRegExp(value) {
|
|
return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
|
|
}
|
|
|
|
function addFinding(findings, severity, filePath, line, indicator, message) {
|
|
findings.push({ severity, filePath, line, indicator, message });
|
|
}
|
|
|
|
function scanFile(filePath, rootDir, findings) {
|
|
const base = path.basename(filePath);
|
|
const relativePath = path.relative(rootDir, filePath) || filePath;
|
|
const text = readText(filePath);
|
|
const lowerText = normalizeForMatch(text);
|
|
|
|
if (PAYLOAD_FILENAMES.has(base)) {
|
|
addFinding(
|
|
findings,
|
|
'critical',
|
|
relativePath,
|
|
1,
|
|
base,
|
|
'Known Mini Shai-Hulud/TanStack payload or persistence filename is present',
|
|
);
|
|
}
|
|
|
|
for (const indicator of CRITICAL_TEXT_INDICATORS) {
|
|
const index = lowerText.indexOf(normalizeForMatch(indicator));
|
|
if (index !== -1) {
|
|
addFinding(
|
|
findings,
|
|
'critical',
|
|
relativePath,
|
|
lineForIndex(text, index),
|
|
indicator,
|
|
'Known active supply-chain IOC is present',
|
|
);
|
|
}
|
|
}
|
|
|
|
if (!DEPENDENCY_FILENAMES.has(base)) return;
|
|
|
|
for (const [packageName, versions] of Object.entries(MALICIOUS_PACKAGE_VERSIONS)) {
|
|
const packageIndex = lowerText.indexOf(normalizeForMatch(packageName));
|
|
if (packageIndex === -1) continue;
|
|
|
|
for (const version of versions) {
|
|
const versionPattern = new RegExp(`(^|[^0-9a-z.])${escapeRegExp(version)}([^0-9a-z.]|$)`, 'i');
|
|
if (versionPattern.test(text) || lowerText.includes(`@${version}`)) {
|
|
addFinding(
|
|
findings,
|
|
'critical',
|
|
relativePath,
|
|
lineForIndex(text, packageIndex),
|
|
`${packageName}@${version}`,
|
|
'Dependency manifest or lockfile references a known compromised package version',
|
|
);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
function homeTargets(homeDir) {
|
|
return [
|
|
'.claude/settings.json',
|
|
'.claude/router_runtime.js',
|
|
'.claude/setup.mjs',
|
|
'.vscode/tasks.json',
|
|
'.vscode/setup.mjs',
|
|
'Library/LaunchAgents/com.user.gh-token-monitor.plist',
|
|
'.config/systemd/user/gh-token-monitor.service',
|
|
'.local/bin/gh-token-monitor.sh',
|
|
].map(relativePath => path.join(homeDir, relativePath));
|
|
}
|
|
|
|
function scanSupplyChainIocs(options = {}) {
|
|
const rootDir = path.resolve(options.rootDir || DEFAULT_ROOT);
|
|
const files = walkFiles(rootDir);
|
|
const findings = [];
|
|
|
|
if (options.home) {
|
|
for (const target of homeTargets(options.homeDir || os.homedir())) {
|
|
if (fs.existsSync(target)) files.push(target);
|
|
}
|
|
}
|
|
|
|
for (const filePath of [...new Set(files)].sort()) {
|
|
scanFile(filePath, rootDir, findings);
|
|
}
|
|
|
|
return {
|
|
rootDir,
|
|
scannedFiles: files.length,
|
|
findings,
|
|
};
|
|
}
|
|
|
|
function parseArgs(argv) {
|
|
const options = {};
|
|
for (let i = 0; i < argv.length; i++) {
|
|
const arg = argv[i];
|
|
if (arg === '--root') {
|
|
options.rootDir = argv[++i];
|
|
} else if (arg === '--home') {
|
|
options.home = true;
|
|
} else if (arg === '--home-dir') {
|
|
options.home = true;
|
|
options.homeDir = argv[++i];
|
|
} else if (arg === '--json') {
|
|
options.json = true;
|
|
} else {
|
|
throw new Error(`Unknown argument: ${arg}`);
|
|
}
|
|
}
|
|
return options;
|
|
}
|
|
|
|
function printReport(result, json = false) {
|
|
if (json) {
|
|
console.log(JSON.stringify(result, null, 2));
|
|
return;
|
|
}
|
|
|
|
if (result.findings.length === 0) {
|
|
console.log(`Supply-chain IOC scan passed for ${result.rootDir} (${result.scannedFiles} files inspected)`);
|
|
return;
|
|
}
|
|
|
|
for (const finding of result.findings) {
|
|
console.error(
|
|
`${finding.severity.toUpperCase()}: ${finding.filePath}:${finding.line} ${finding.indicator}`,
|
|
);
|
|
console.error(` ${finding.message}`);
|
|
}
|
|
}
|
|
|
|
if (require.main === module) {
|
|
try {
|
|
const options = parseArgs(process.argv.slice(2));
|
|
const result = scanSupplyChainIocs(options);
|
|
printReport(result, options.json);
|
|
process.exit(result.findings.length > 0 ? 1 : 0);
|
|
} catch (error) {
|
|
console.error(error.message);
|
|
process.exit(2);
|
|
}
|
|
}
|
|
|
|
module.exports = {
|
|
CRITICAL_TEXT_INDICATORS,
|
|
MALICIOUS_PACKAGE_VERSIONS,
|
|
scanSupplyChainIocs,
|
|
};
|