webinventix-security-scan

Scans a repo for known indicators of the supply-chain dropper found across multiple WebInventix client repos in August 2026 (blockchain-based C2 resolution, self-spawning detached node processes, obfuscated payload injection appended to source files).

Covers JavaScript/TypeScript/shell files. It will not catch a non-JS port of this malware (e.g. in a .NET/C# project) — no known JS-based markers were found in any .NET repo checked so far, but the scanner can't see that language at all.

One-time setup (run this once per machine, not per repo)

This installs a global pre-push git hook that scans every push, on every repo on this machine — including repos that don't have the scanner as a dependency, and repos cloned fresh without running npm install. A per-repo-only hook (the kind that activates via a package.json prepare script) only protects that one repo, and only on a machine where install scripts actually ran — this closes that gap.

mkdir -p ~/.config/git-hooks
cat > ~/.config/git-hooks/pre-push << 'EOF'
#!/usr/bin/env bash
npx --yes webinventix-security-scan
EOF
chmod +x ~/.config/git-hooks/pre-push
git config --global core.hooksPath ~/.config/git-hooks

That's it. No per-repo step needed. If a specific repo already sets its own core.hooksPath (e.g. via a .githooks directory + prepare script), that repo's local setting takes precedence there — this global hook is the fallback for everything else.

On Windows

Run the setup block above in Git Bash (installed automatically with Git for Windows — if you have git, you have this; open it from the Start menu or right-click → "Git Bash Here" in a folder). The commands are plain POSIX shell (mkdir -p, a heredoc, chmod +x) and won't work pasted directly into PowerShell or cmd.exe.

You only need Git Bash for this one-time setup. After that, the hook fires correctly no matter what you use to actually run git push day-to-day — PowerShell, cmd, VS Code's terminal, all of it — because git always executes hooks through its own bundled shell, not whatever shell invoked the push.

Verify it worked

git config --global core.hooksPath
# macOS/Linux should print: /Users/<you>/.config/git-hooks
# Windows (Git Bash) should print: /c/Users/<you>/.config/git-hooks

Try a push in any repo — you should see [malware-scan] OK — scanned N files, no indicators found. before it goes through. If malware indicators are found, the push is blocked and the offending file/line is printed.

Manual scan (no push needed)

npx webinventix-security-scan

Run from anywhere inside the repo you want to check.

Limitations — read this

• Local-only. This only protects pushes that originate from a machine that has run the setup above. It does not protect a repo from a push coming from a different, unprotected machine. For that, the repo needs a server-side check (GitHub Actions CI) — ask about .github/workflows/security-scan.yml if a repo doesn't have one yet.
• JS-focused. See the note above about non-JS projects.
• Bypassable. git push --no-verify skips all hooks, as does a machine that's genuinely compromised and can just remove this config. This is defense-in-depth, not a guarantee — it catches accidents and unprotected fresh clones, not a determined bypass.