shaiscan - vulnerability scanner for the shai-hulud worm, sin

项目说明

shaiscan

scanner for the shai-hulud worm, single sh script, deep fast scanning with ripgrep on linux and mac

make it executable, you dont need root ( you can for full system scan )
it will scan whate it is on, you can put it on your ~home folder or your project

for the healp file just run ./shaiscan.sh -h

Read-only, passi for Mini Shai-Hulud — the npm/PyPI supply-chain
worm disclosed 2026-05-11 (C / GHSA-g7c).

One POSIX shell script. No dependencies beyond awk, find, grep. Works on
Linux, macOS, and any system with a POSIX shell. Ne anything,
ne the worm's C2, ne pri.

---

Quickstart — block the C2 in your hosts file (do this first, takes 30 seconds)

Even if you never run the scanner, **just blackholing the worm's command-and-
control domains in /etc/hosts neutralises it** on the machine you do this on.
The payload can still drop, but every connection attempt to its C2 fails
instantly. The exfil ne. Your tokens ne.

Copy-paste the block for your OS. The lines all start with 0.0.0.0 (IPv4
black hole) and :: (IPv6 black hole) — no real address, no traffic.

Linux

Open the file:

Paste these lines at the bottom, save (Ctrl+O, Enter), exit (Ctrl+X):

Done. No restart needed.

macOS

Open the file:

Paste the same block as Linux above. Save, exit. Then flush the DNS cache:

Windows

1. Press the Start button, type notepad, right-click Notepad, choose
Run as administrator.
2. In Notepad: File → Open, paste this path into the file-name box and
press Enter:

(If you see no file, change the file-type dropdown from "Text Documents"
to "All Files".)

3. Scroll to the bottom. Paste the same block as Linux above.
4. File → Save.

Done. No restart needed.

it worked

On any OS, this should now print 0.0.0.0 (or fail to resolve):

If it shows the real IP, the file did not save — re-open as admin / with
sudo and try again.

---

Why these six domains?

They are the worm's confirmed command-and-control endpoints. Sources: GHSA-
g7c and the upstream research published 2026-05-11.

| Domain | Role |
|---|---|
| git-tanstack.com | Payload host (typosquat of tanstack.com) |
| seed1.getsession.org | Covert C2 (abuses Session messenger network) |
| seed2.getsession.org | Covert C2 (same) |
| seed3.getsession.org | Covert C2 (same) |
| filev2.getsession.org | Exfil endpoint |
| api.masscan.cloud | Token- watcher |

Note: the seed*.getsession.org and filev2.getsession.org domains also
belong to the legitimate Session messenger project. The worm just abuses
that network as a covert channel. If you use Session messenger on this
machine, do not add these entries — pick a different defense (network
egress filter, separate VLAN).

---

Why 0.0.0.0 and not 127.0.0.1?

Both work. 0.0.0.0 is better:

The connect call fails instantly with EADDRNOTAVAIL instead of hitting

your loopback interface.

It does not pollute logs of any local web server / de you happen

to be running.

---

Run the scanner

After you' the C2 (above), run the scanner to check for
existing infection.

That scans the current directory. The report is written to
./shaiscan-YYYY-MM-DD.md.

To scan the whole user account:

To scan the whole system as root (catches root-owned persistence):

The script needs no sudo to be useful — it just sees less under directories
that are root-only readable.

What it checks

1. Running processes for worm names (gh-token-monitor, __DAEMONIZED,
transformers.pyz, ctf-scramble*).
2. Persistence drops in /tmp, ~/.config, ~/.claude, ~/.,
~/Library/LaunchAgents, ~/.config/systemd/user, crontabs, ~/.npmrc,
shell histories.
3. Network state: acti to the C2 IP, /etc/hosts entries
(blackhole = [OK], real-IP o = [CRIT]), DNS resolution probe
(informational only).
4. Editor / CI hook tampering: .claude/settings.json SessionStart hooks,
./tasks.json folderOpen, .github/workflows/*.yml
exfil pattern.
5. Lockfiles (package-lock.json, npm-shrinkwrap.json, bun.lock,
bun.lockb, yarn.lock, pnpm-lock.yaml) and package.json against
the embedded IOC table (~110 packages, exact pinned ).
6. Git-URL audit for the malicious commit hash that pinned a payload host.
7. Installed node_modules .
8. Package-manager caches (bun, npm, yarn, pnpm).
9. Python site-packages, pipx venvs, and Python lockfiles
(Pipfile.lock, poetry.lock, uv.lock, requirements*.txt).
10. Registry-config sanity (.npmrc, .bunfig.toml, .yarnrc{,.yml}).
11. SSH authorized_keys and attack-window file mtimes (informational).
12. Filesystem IOC string scan (ripgrep fast path, find + grep fallback).

Se tiers

| Tag | Meaning |
|---|---|
| [CRIT] | Confirmed compromise. Act now. |
| [REVIEW] | Suspicious but ambiguous (e.g. a worm IOC string in a file that might be a security blog post you saved). Open the file and read context. |
| [CACHED] | A bad tarball lives in a package-manager cache. Cache files do not run on their own; clean the cache. |
| [OK] | A defensi was already in place on this host (e.g. /etc/hosts blackhole). Keep it. |
| [i] | Informational context. Not a finding. |

Exit codes

0 — no CRIT and no REVIEW (clean, or CACHED-only).

1 — CRIT or REVIEW present (read the report).

2 — usage error.

CACHED does not fail the run — a tarball lingering on disk is not an
infection on its own.

---

Run your package manager's audit too

shaiscan only knows the IOCs embedded in its own table. Your package
manager pulls the li feed and may flag ad shaiscan does
not have yet. Run both:

---

What the scanner will NOT do

It will not contact the C2, ever. No curl, no wget, no DNS query

outside what your local resolver does on its own.

It will not modify any file on the system.

It will not delete a worm artifact for you. **Image the disk before you

start cleaning** — the dropped files ha value.

It will not rotate any credentials. Read the dead-man-switch warning

printed at the top of every run before you rotate anything.

---

If the scanner finds something

The scanner prints a red banner before any output explaining the **safe
order of operations**:

1. Disconnect the network first.
2. Image the disk if forensics matter.
3. Kill the worm processes.
4. Remove the persistence hooks.
5. Then rotate every credential — from a different, clean PC.

The worm includes the bluff string
IfYouReheComputerOfTheOwner in stolen npm tokens
to discourage rotation, and installs a watcher (api.masscan.cloud) that
polls token and reacts on re. Do not revoke from a
network-connected, possibly-infected machine.

---

Authorised use

Scan systems you own or ha written permission to assess. Do not
run against someone else's infrastructure.

---

License

MIT. See LICENSE.

Authority

IOCs sourced from the public GHSA-g7c ad and the
upstream research disclosed 2026-05-11. No proprietary intel.

项目信息

开发语言：Shell

Star 数：20

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕vulnerability scanner for the shai-hulud worm, single sh script, deep fast scanning with ripgrep on linux and mac展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。