anti-shai-hulud

anti-shai-hulud is a zero-dependency CLI that scans package manifests (package.json) and lock files (package-lock.json) for packages that were compromised in the "Shai Hulud 2.0" supply-chain attack. Run it at the root of any JavaScript/TypeScript project to quickly learn whether any locally declared dependencies or transitive lockfile entries match the published IOC list.

Usage

npx anti-shai-hulud        # scan the current working directory
npx anti-shai-hulud ..     # scan a different directory
npx anti-shai-hulud --json # emit JSON so you can pipe to jq or CI tooling

The command exits with:

• 0 when nothing was found
• 1 when one or more banned packages were discovered
• 2 if the scan fails (invalid path, unreadable JSON, etc.)

How it works

• The embedded IOC list is sourced from the CSV published by Wiz (shai-hulud-2-packages.csv).
• Direct dependency sections in package.json are scanned first so that high-signal hits (banned package declared explicitly) can be surfaced with HIGH severity.
• Lockfiles are scanned via both packages and dependencies sections to catch nested modules.

You can extend the list of banned packages by editing src/bannedPackages.data.js and re-running the CLI. When published to npm, only the files declared in package.json#files are shipped, so the package is lightweight and portable.