Shai Hulud Scanner

Pure Node.js, read-only scanner for Shai Hulud indicators found in the local reference source. It uses only Node built-ins and does not install dependencies.

Usage

npm run scan
npm run scan:home
node index.js --path /some/project --json
node index.js --full --exclude /known/reference/source
node index.js --home --no-progress

The default scan checks active processes, known persistence and lock locations, and the current directory. --home is the practical broad scan for a developer machine. --full is slower and skips pseudo filesystems. Human scans show a Unicode progress loader on stderr; JSON output stays machine-readable.

What It Checks

• Active process command lines for known payload and monitor names.
• Known lock and persistence paths for the user-level token monitor.
• npm package backdoors that run a local setup loader.
• repository mutations under .claude, .vscode, and GitHub workflow paths.
• exact hashes of known loader, hook, workflow, and monitor assets.
• compound content patterns for secret-exfiltration workflows and Bun loaders.

Exit code 0 means no medium-or-higher findings. Exit code 1 means suspicious or high-confidence indicators were found. The scanner never deletes files or prints token contents.