kenn · November 29, 2025 17:33
diff --git a/how-to-use.md b/how-to-use.md
diff --git a/list.md b/list.md
diff --git a/sha1hulud-scan.sh b/sha1hulud-scan.sh
 #!/usr/bin/env bash
 set -euo pipefail

 #############################################################################
 # SHA1-hulud Supply Chain Attack Scanner
 #############################################################################
 #
 # WHAT IS SHA1-HULUD?
 # -------------------
 # SHA1-hulud is a supply chain attack targeting npm packages discovered in
 # late 2025. The attack compromises legitimate npm packages by injecting
 # malicious code that executes during package installation.
 #
 # Reference: https://thehackernews.com/2025/11/second-sha1-hulud-wave-affects-25000.html
 #
 # HOW THE ATTACK WORKS:
 # ---------------------
 # 1. Attackers gain access to npm maintainer accounts (via credential theft,
 #    phishing, or token leakage)
 # 2. They publish new versions of legitimate packages with malicious payloads
 # 3. The malicious code runs via npm lifecycle scripts (preinstall, install,
 #    postinstall) during `npm install`
 # 4. The payload typically:
 #    - Exfiltrates environment variables (API keys, tokens, secrets)
 #    - Installs backdoors or reverse shells
 #    - Modifies other packages to spread further
 #
 # INDICATORS OF COMPROMISE (IOCs):
 # --------------------------------
 # - Lifecycle scripts that execute shell commands or download external code
 # - Files named: bun_environment, setup_bun, environment_setup, shell_execute
 # - Obfuscated JavaScript in package installation scripts
 # - Network calls (curl, wget, fetch) in installation scripts
 # - Unexpected .git directories inside node_modules (used for persistence)
 #
 # WHAT THIS SCANNER CHECKS:
 # -------------------------
 # 1. Installed packages against the known list of compromised packages
 # 2. Suspicious lifecycle hooks in package.json files
 # 3. Known malicious filenames used in SHA1-hulud payloads
 # 4. Nested git repos in node_modules (persistence mechanism)
 # 5. Network/shell execution patterns in project scripts
 # 6. Recently added executable files (potential IOCs)
 #
 # USAGE:
 # ------
 #   ./shaihulud-scan.sh [path-to-affected-packages-list.md]
 #
 # The affected packages list should be a markdown file with a table containing:
 # | Package Name | Vulnerable Versions |
 #
 # You can get the latest list from security advisories or create your own.
 #
 #############################################################################

 echo "🔎 SHA1-hulud Supply Chain Attack Scanner"
 echo "=========================================="
 echo ""

 #############################################################################
 # CONFIGURATION
 #############################################################################

 # Path to the affected packages list (markdown format)
 AFFECTED_LIST="${1:-}"

 #############################################################################
 # HELPER FUNCTIONS
 #############################################################################

 # print_matches: Displays results with appropriate status indicators
 # Arguments:
 #   $1 - matches (newline-separated list of findings)
 #   $2 - label (description of what was checked)
 # Output:
 #   ⚠️  if matches found (potential security issue)
 #   ✅ if clean (no issues found)
 print_matches() {
  local matches="$1"
  local label="$2"

  if [ -n "$matches" ]; then
    echo "⚠️  $label"
    echo "$matches" | sed 's/^/   → /'
  else
    echo "✅ $label — clean"
  fi
 }

 # detect_pkg_manager: Identifies which package manager is used in the project
 # Returns: pnpm, yarn, bun, npm, or unknown
 # Detection is based on lockfile presence (most reliable indicator)
 detect_pkg_manager() {
  if [ -f "pnpm-lock.yaml" ]; then
    echo "pnpm"
  elif [ -f "yarn.lock" ]; then
    echo "yarn"
  elif [ -f "bun.lockb" ] || [ -f "bun.lock" ]; then
    echo "bun"
  elif [ -f "package-lock.json" ]; then
    echo "npm"
  else
    echo "unknown"
  fi
 }

 # get_installed_packages: Lists all installed packages with their versions
 # Arguments:
 #   $1 - package manager name (pnpm, yarn, npm, bun)
 # Output: One package per line in format "package-name@version"
 # Note: Includes transitive dependencies (the full dependency tree)
 get_installed_packages() {
  local pm="$1"
  case "$pm" in
    pnpm)
      pnpm list --depth=Infinity 2>/dev/null | grep -E '^(│|├|└)' | \
        sed 's/[│├└─┬ ]//g' | sed 's/peer$//' | sort -u
      ;;
    yarn)
      yarn list --depth=1000 2>/dev/null | grep -E '^[├└]' | \
        sed 's/[├└─┬ ]//g' | sort -u
      ;;
    npm)
      npm list --all 2>/dev/null | grep -E '^[├└│ ]' | \
        sed 's/[├└─┬│ ]//g' | sed 's/deduped$//' | sort -u
      ;;
    bun)
      bun pm ls --all 2>/dev/null | grep -E '^[├└│ ]' | \
        sed 's/[├└─┬│ ]//g' | sort -u
      ;;
    *)
      echo ""
      ;;
  esac
 }

 # extract_package_name: Separates package name from version string
 # Arguments:
 #   $1 - package string like "@scope/name1.2.3" or "name1.2.3"
 # Output: Just the package name without version
 # Handles scoped packages (@org/name) correctly
 extract_package_name() {
  local pkg="$1"
  # Match @scope/name or name, followed by version number
  echo "$pkg" | sed -E 's/^(@[^/]+\/[^0-9]+|[^@0-9][^0-9]*)[0-9].*/\1/'
 }

 # extract_version: Extracts version number from package string
 # Arguments:
 #   $1 - package string like "@scope/name1.2.3" or "name1.2.3"
 # Output: Just the version number (e.g., "1.2.3")
 extract_version() {
  local pkg="$1"
  echo "$pkg" | sed -E 's/^(@[^/]+\/[^0-9]+|[^@0-9][^0-9]*)([0-9].*)/\2/'
 }

 #############################################################################
 # CHECK 1: KNOWN COMPROMISED PACKAGES
 #############################################################################
 # This is the most important check. It compares your installed packages
 # against a known list of compromised packages from the SHA1-hulud attack.
 #
 # WHY THIS MATTERS:
 # If you have a compromised package installed at a vulnerable version,
 # your system may have already been compromised. You should:
 # 1. Immediately rotate all secrets/tokens that were accessible during install
 # 2. Audit your systems for unauthorized access
 # 3. Update or remove the affected package
 #############################################################################

 echo "📦 Check 1: Known Compromised Packages"
 echo "---------------------------------------"

 if [ -n "$AFFECTED_LIST" ] && [ -f "$AFFECTED_LIST" ]; then
  echo "Using affected packages list: $AFFECTED_LIST"
  echo ""

  # Detect package manager
  PKG_MANAGER=$(detect_pkg_manager)
  echo "Detected package manager: $PKG_MANAGER"

  if [ "$PKG_MANAGER" = "unknown" ]; then
    echo "⚠️  Could not detect package manager. Skipping package check."
  else
    # Create temp files for processing
    TEMP_DIR=$(mktemp -d)
    trap "rm -rf $TEMP_DIR" EXIT

    # Parse affected packages from markdown table
    # Format: | package-name | vulnerable-versions |
    grep -E '^\| [^:]+\|' "$AFFECTED_LIST" | grep -v 'Package Name' | \
      awk -F'|' '{gsub(/^ +| +$/, "", $2); gsub(/^ +| +$/, "", $3); print $2 "|" $3}' \
      > "$TEMP_DIR/affected.txt"

    # Get installed packages
    get_installed_packages "$PKG_MANAGER" > "$TEMP_DIR/installed.txt"

    # Extract just package names for initial matching
    while IFS= read -r pkg; do
      extract_package_name "$pkg"
    done < "$TEMP_DIR/installed.txt" | sort -u > "$TEMP_DIR/installed_names.txt"

    # Check for matches
    VULNERABLE_COUNT=0
    SAFE_COUNT=0

    while IFS='|' read -r pkg_name vuln_versions; do
      [ -z "$pkg_name" ] && continue

      # Check if this package is installed
      if grep -qFx "$pkg_name" "$TEMP_DIR/installed_names.txt" 2>/dev/null; then
        # Get installed version(s)
        installed_versions=$(grep "^${pkg_name}[0-9]" "$TEMP_DIR/installed.txt" | \
          while read -r line; do extract_version "$line"; done)

        # Check if any installed version matches vulnerable versions
        is_vulnerable=false
        for installed_ver in $installed_versions; do
          # Check each vulnerable version
          for vuln_ver in $(echo "$vuln_versions" | tr ',' ' '); do
            vuln_ver=$(echo "$vuln_ver" | tr -d ' ')
            if [ "$installed_ver" = "$vuln_ver" ]; then
              is_vulnerable=true
              echo "🚨 VULNERABLE: $pkg_name@$installed_ver (affected: $vuln_versions)"
              VULNERABLE_COUNT=$((VULNERABLE_COUNT + 1))
              break 2
            fi
          done
        done

        if [ "$is_vulnerable" = false ]; then
          # Package exists but version is not vulnerable
          SAFE_COUNT=$((SAFE_COUNT + 1))
        fi
      fi
    done < "$TEMP_DIR/affected.txt"

    echo ""
    if [ "$VULNERABLE_COUNT" -gt 0 ]; then
      echo "⚠️  Found $VULNERABLE_COUNT vulnerable package(s)!"
      echo "   ACTION REQUIRED: Update these packages immediately and rotate secrets."
    else
      echo "✅ No vulnerable packages found"
      if [ "$SAFE_COUNT" -gt 0 ]; then
        echo "   ($SAFE_COUNT packages matched by name but have safe versions)"
      fi
    fi
  fi
 else
  echo "ℹ️  No affected packages list provided."
  echo "   Usage: $0 path/to/affected-packages.md"
  echo "   Skipping known package check..."
 fi

 #############################################################################
 # CHECK 2: LIFECYCLE HOOKS
 #############################################################################
 # NPM lifecycle scripts run automatically during package installation.
 # SHA1-hulud exploits these hooks to execute malicious code.
 #
 # LEGITIMATE VS MALICIOUS:
 # - Legitimate: Build native modules, compile TypeScript, run postinstall setup
 # - Malicious: Download external scripts, exfiltrate env vars, spawn shells
 #
 # If found, manually inspect these files to determine if the hooks are benign.
 #############################################################################

 echo ""
 echo "🔧 Check 2: Lifecycle Hooks"
 echo "---------------------------"
 echo "Looking for preinstall/install/postinstall scripts in package.json files..."
 echo "(These run automatically and are the primary attack vector)"
 echo ""

 matches=$(grep -Rl -E '"(preinstall|install|postinstall)"\s*:' \
  . --exclude-dir=node_modules 2>/dev/null || true)
 print_matches "$matches" "Files with lifecycle scripts"

 #############################################################################
 # CHECK 3: KNOWN MALICIOUS FILENAMES
 #############################################################################
 # The SHA1-hulud attack uses specific filenames for its payloads.
 # These names are designed to look legitimate (related to Bun runtime).
 #
 # FILES TO WATCH FOR:
 # - bun_environment: Pretends to be Bun environment setup
 # - setup_bun: Fake Bun installation script
 # - environment_setup: Generic-sounding config file
 # - shell_execute: Obvious shell execution utility
 #
 # These files typically contain obfuscated code that downloads and runs
 # additional malicious payloads from attacker-controlled servers.
 #############################################################################

 echo ""
 echo "📄 Check 3: Known Malicious Filenames"
 echo "--------------------------------------"
 echo "Searching for filenames used in SHA1-hulud payloads..."
 echo ""

 # Note: Exclude this script itself and common directories
 matches=$(find . -type f \
  -not -path "*/node_modules/*" \
  -not -path "*/.git/*" \
  -not -name "shaihulud-scan.sh" \
  -print0 2>/dev/null | xargs -0 grep -l -E 'bun_environment|setup_bun|environment_setup|shell_execute' 2>/dev/null || true)
 print_matches "$matches" "Suspicious filenames"

 #############################################################################
 # CHECK 4: PACKAGE.JSON RECENT CHANGES
 #############################################################################
 # If an attacker has access to your repo, they might add malicious
 # dependencies directly. This check uses git blame to show recent edits.
 #
 # WHAT TO LOOK FOR:
 # - Unexpected new dependencies you didn't add
 # - Version changes to existing dependencies (potential typosquatting)
 # - Dependencies added by unfamiliar contributors
 #############################################################################

 echo ""
 echo "📝 Check 4: Recent package.json Changes"
 echo "----------------------------------------"
 echo "Using git blame to identify recent dependency modifications..."
 echo "(Review any unfamiliar additions)"
 echo ""

 pkg_files=$(find . -name "package.json" -not -path "*/node_modules/*" 2>/dev/null)

 for f in $pkg_files; do
  if git ls-files --error-unmatch "$f" >/dev/null 2>&1; then
    echo "→ $f"
    git --no-pager blame --line-porcelain "$f" 2>/dev/null | \
      grep -E 'author-time|dependencies|devDependencies' | head -n 20 || true
    echo ""
  fi
 done

 #############################################################################
 # CHECK 5: NESTED GIT REPOS IN NODE_MODULES
 #############################################################################
 # Normal npm packages should NOT contain .git directories.
 # Attackers use nested git repos to:
 # - Maintain persistence across npm cache clears
 # - Pull updates to malicious code
 # - Track which systems are compromised
 #
 # If found, this is a strong indicator of compromise.
 #############################################################################

 echo ""
 echo "📂 Check 5: Nested Git Repos in node_modules"
 echo "---------------------------------------------"
 echo "Normal packages should not contain .git directories..."
 echo "(If found, this is a strong indicator of compromise)"
 echo ""

 matches=$(find . -path "*/node_modules/*/.git" -type d 2>/dev/null | sed 's/\/.git$//' || true)
 print_matches "$matches" "Unexpected git repos inside node_modules"

 #############################################################################
 # CHECK 6: NETWORK AND SHELL EXECUTION PATTERNS
 #############################################################################
 # Checks your project code (not node_modules) for patterns commonly used
 # in supply chain attacks to download and execute malicious code.
 #
 # PATTERNS CHECKED:
 # - curl/wget: Command-line download utilities
 # - fetch: JavaScript fetch API (could download malicious code)
 # - spawn/exec: Node.js child process execution
 # - child_process: Node.js module for running shell commands
 #
 # NOTE: Many legitimate applications use these. This check helps identify
 # files to manually review, not definitive indicators of compromise.
 #############################################################################

 echo ""
 echo "🌐 Check 6: Network/Shell Execution in Project Code"
 echo "----------------------------------------------------"
 echo "Searching for curl/wget/fetch/exec/spawn patterns..."
 echo "(These are common in attacks but also legitimate code - review manually)"
 echo ""

 # Exclude node_modules, build artifacts, and this script
 matches=$(find . -type f \
  -not -path "*/node_modules/*" \
  -not -path "*/.git/*" \
  -not -path "*/build/*" \
  -not -path "*/dist/*" \
  -not -name "*.md" \
  -not -name "shaihulud-scan.sh" \
  -print0 2>/dev/null | xargs -0 grep -l -E 'curl |wget |\.fetch\(|spawn\(|child_process|exec\(' 2>/dev/null || true)
 print_matches "$matches" "Files with network/shell execution"

 #############################################################################
 # CHECK 7: RECENTLY ADDED EXECUTABLE FILES
 #############################################################################
 # Looks at git history for recently added .sh or .js files.
 # Attackers may add malicious scripts that persist in your repo.
 #
 # WHAT TO REVIEW:
 # - Any .sh files you didn't create
 # - Any .js files in unexpected locations (root, scripts/, etc.)
 # - Files added by unfamiliar contributors
 #############################################################################

 echo ""
 echo "🕐 Check 7: Recently Added Executable Files"
 echo "--------------------------------------------"
 echo "Checking git history for .sh/.js files added in the last 7 days..."
 echo ""

 if git rev-parse --git-dir > /dev/null 2>&1; then
  matches=$(git log --since="7 days ago" --name-only --pretty=format: --diff-filter=A 2>/dev/null | \
    grep -E '\.(sh|js)$' | sort -u || true)
  print_matches "$matches" "Recently added .js/.sh files"
 else
  echo "ℹ️  Not a git repository - skipping this check"
 fi

 #############################################################################
 # SUMMARY
 #############################################################################

 echo ""
 echo "=========================================="
 echo "📋 Scan Complete"
 echo "=========================================="
 echo ""
 echo "NEXT STEPS:"
 echo "-----------"
 echo "1. Investigate any items flagged with ⚠️ above"
 echo "2. If vulnerable packages found, update immediately and rotate secrets"
 echo "3. Review lifecycle scripts in flagged package.json files"
 echo "4. Check git history for unauthorized changes"
 echo ""
 echo "RESOURCES:"
 echo "----------"
 echo "• SHA1-hulud attack details: https://thehackernews.com/2025/11/second-sha1-hulud-wave-affects-25000.html"
 echo "• npm security advisories: https://www.npmjs.com/advisories"
 echo "• Socket.dev (real-time detection): https://socket.dev"
 echo ""
Check	Description	Severity
Known Compromised Packages	Compares your installed packages against the affected list	Critical
Lifecycle Hooks	Finds `preinstall`/`install`/`postinstall` scripts	High
Malicious Filenames	Searches for `bun_environment`, `setup_bun`, etc.	High
package.json Changes	Shows recent git blame for dependency files	Medium
Nested Git Repos	Finds `.git` directories inside node_modules	High
Network/Shell Patterns	Detects `curl`, `wget`, `spawn`, `exec` usage	Low
Recent Executables	Lists `.sh`/`.js` files added in last 7 days	Low
	#!/usr/bin/env bash
	set -euo pipefail

	#############################################################################
	# SHA1-hulud Supply Chain Attack Scanner
	#############################################################################
	#
	# WHAT IS SHA1-HULUD?
	# -------------------
	# SHA1-hulud is a supply chain attack targeting npm packages discovered in
	# late 2025. The attack compromises legitimate npm packages by injecting
	# malicious code that executes during package installation.
	#
	# Reference: https://thehackernews.com/2025/11/second-sha1-hulud-wave-affects-25000.html
	#
	# HOW THE ATTACK WORKS:
	# ---------------------
	# 1. Attackers gain access to npm maintainer accounts (via credential theft,
	# phishing, or token leakage)
	# 2. They publish new versions of legitimate packages with malicious payloads
	# 3. The malicious code runs via npm lifecycle scripts (preinstall, install,
	# postinstall) during `npm install`
	# 4. The payload typically:
	# - Exfiltrates environment variables (API keys, tokens, secrets)
	# - Installs backdoors or reverse shells
	# - Modifies other packages to spread further
	#
	# INDICATORS OF COMPROMISE (IOCs):
	# --------------------------------
	# - Lifecycle scripts that execute shell commands or download external code
	# - Files named: bun_environment, setup_bun, environment_setup, shell_execute
	# - Obfuscated JavaScript in package installation scripts
	# - Network calls (curl, wget, fetch) in installation scripts
	# - Unexpected .git directories inside node_modules (used for persistence)
	#
	# WHAT THIS SCANNER CHECKS:
	# -------------------------
	# 1. Installed packages against the known list of compromised packages
	# 2. Suspicious lifecycle hooks in package.json files
	# 3. Known malicious filenames used in SHA1-hulud payloads
	# 4. Nested git repos in node_modules (persistence mechanism)
	# 5. Network/shell execution patterns in project scripts
	# 6. Recently added executable files (potential IOCs)
	#
	# USAGE:
	# ------
	# ./shaihulud-scan.sh [path-to-affected-packages-list.md]
	#
	# The affected packages list should be a markdown file with a table containing:
	# \| Package Name \| Vulnerable Versions \|
	#
	# You can get the latest list from security advisories or create your own.
	#
	#############################################################################

	echo "🔎 SHA1-hulud Supply Chain Attack Scanner"
	echo "=========================================="
	echo ""

	#############################################################################
	# CONFIGURATION
	#############################################################################

	# Path to the affected packages list (markdown format)
	AFFECTED_LIST="${1:-}"

	#############################################################################
	# HELPER FUNCTIONS
	#############################################################################

	# print_matches: Displays results with appropriate status indicators
	# Arguments:
	# $1 - matches (newline-separated list of findings)
	# $2 - label (description of what was checked)
	# Output:
	# ⚠️ if matches found (potential security issue)
	# ✅ if clean (no issues found)
	print_matches() {
	local matches="$1"
	local label="$2"

	if [ -n "$matches" ]; then
	echo "⚠️ $label"
	echo "$matches" \| sed 's/^/ → /'
	else
	echo "✅ $label — clean"
	fi
	}

	# detect_pkg_manager: Identifies which package manager is used in the project
	# Returns: pnpm, yarn, bun, npm, or unknown
	# Detection is based on lockfile presence (most reliable indicator)
	detect_pkg_manager() {
	if [ -f "pnpm-lock.yaml" ]; then
	echo "pnpm"
	elif [ -f "yarn.lock" ]; then
	echo "yarn"
	elif [ -f "bun.lockb" ] \|\| [ -f "bun.lock" ]; then
	echo "bun"
	elif [ -f "package-lock.json" ]; then
	echo "npm"
	else
	echo "unknown"
	fi
	}

	# get_installed_packages: Lists all installed packages with their versions
	# Arguments:
	# $1 - package manager name (pnpm, yarn, npm, bun)
	# Output: One package per line in format "package-name@version"
	# Note: Includes transitive dependencies (the full dependency tree)
	get_installed_packages() {
	local pm="$1"
	case "$pm" in
	pnpm)
	pnpm list --depth=Infinity 2>/dev/null \| grep -E '^(│\|├\|└)' \| \
	sed 's/[│├└─┬ ]//g' \| sed 's/peer$//' \| sort -u
	;;
	yarn)
	yarn list --depth=1000 2>/dev/null \| grep -E '^[├└]' \| \
	sed 's/[├└─┬ ]//g' \| sort -u
	;;
	npm)
	npm list --all 2>/dev/null \| grep -E '^[├└│ ]' \| \
	sed 's/[├└─┬│ ]//g' \| sed 's/deduped$//' \| sort -u
	;;
	bun)
	bun pm ls --all 2>/dev/null \| grep -E '^[├└│ ]' \| \
	sed 's/[├└─┬│ ]//g' \| sort -u
	;;
	*)
	echo ""
	;;
	esac
	}

	# extract_package_name: Separates package name from version string
	# Arguments:
	# $1 - package string like "@scope/name1.2.3" or "name1.2.3"
	# Output: Just the package name without version
	# Handles scoped packages (@org/name) correctly
	extract_package_name() {
	local pkg="$1"
	# Match @scope/name or name, followed by version number
	echo "$pkg" \| sed -E 's/^(@[^/]+\/[^0-9]+\|[^@0-9][^0-9])[0-9]./\1/'
	}

	# extract_version: Extracts version number from package string
	# Arguments:
	# $1 - package string like "@scope/name1.2.3" or "name1.2.3"
	# Output: Just the version number (e.g., "1.2.3")
	extract_version() {
	local pkg="$1"
	echo "$pkg" \| sed -E 's/^(@[^/]+\/[^0-9]+\|[^@0-9][^0-9])([0-9].)/\2/'
	}

	#############################################################################
	# CHECK 1: KNOWN COMPROMISED PACKAGES
	#############################################################################
	# This is the most important check. It compares your installed packages
	# against a known list of compromised packages from the SHA1-hulud attack.
	#
	# WHY THIS MATTERS:
	# If you have a compromised package installed at a vulnerable version,
	# your system may have already been compromised. You should:
	# 1. Immediately rotate all secrets/tokens that were accessible during install
	# 2. Audit your systems for unauthorized access
	# 3. Update or remove the affected package
	#############################################################################

	echo "📦 Check 1: Known Compromised Packages"
	echo "---------------------------------------"

	if [ -n "$AFFECTED_LIST" ] && [ -f "$AFFECTED_LIST" ]; then
	echo "Using affected packages list: $AFFECTED_LIST"
	echo ""

	# Detect package manager
	PKG_MANAGER=$(detect_pkg_manager)
	echo "Detected package manager: $PKG_MANAGER"

	if [ "$PKG_MANAGER" = "unknown" ]; then
	echo "⚠️ Could not detect package manager. Skipping package check."
	else
	# Create temp files for processing
	TEMP_DIR=$(mktemp -d)
	trap "rm -rf $TEMP_DIR" EXIT

	# Parse affected packages from markdown table
	# Format: \| package-name \| vulnerable-versions \|
	grep -E '^\\| [^:]+\\|' "$AFFECTED_LIST" \| grep -v 'Package Name' \| \
	awk -F'\|' '{gsub(/^ +\| +$/, "", $2); gsub(/^ +\| +$/, "", $3); print $2 "\|" $3}' \
	> "$TEMP_DIR/affected.txt"

	# Get installed packages
	get_installed_packages "$PKG_MANAGER" > "$TEMP_DIR/installed.txt"

	# Extract just package names for initial matching
	while IFS= read -r pkg; do
	extract_package_name "$pkg"
	done < "$TEMP_DIR/installed.txt" \| sort -u > "$TEMP_DIR/installed_names.txt"

	# Check for matches
	VULNERABLE_COUNT=0
	SAFE_COUNT=0

	while IFS='\|' read -r pkg_name vuln_versions; do
	[ -z "$pkg_name" ] && continue

	# Check if this package is installed
	if grep -qFx "$pkg_name" "$TEMP_DIR/installed_names.txt" 2>/dev/null; then
	# Get installed version(s)
	installed_versions=$(grep "^${pkg_name}[0-9]" "$TEMP_DIR/installed.txt" \| \
	while read -r line; do extract_version "$line"; done)

	# Check if any installed version matches vulnerable versions
	is_vulnerable=false
	for installed_ver in $installed_versions; do
	# Check each vulnerable version
	for vuln_ver in $(echo "$vuln_versions" \| tr ',' ' '); do
	vuln_ver=$(echo "$vuln_ver" \| tr -d ' ')
	if [ "$installed_ver" = "$vuln_ver" ]; then
	is_vulnerable=true
	echo "🚨 VULNERABLE: $pkg_name@$installed_ver (affected: $vuln_versions)"
	VULNERABLE_COUNT=$((VULNERABLE_COUNT + 1))
	break 2
	fi
	done
	done

	if [ "$is_vulnerable" = false ]; then
	# Package exists but version is not vulnerable
	SAFE_COUNT=$((SAFE_COUNT + 1))
	fi
	fi
	done < "$TEMP_DIR/affected.txt"

	echo ""
	if [ "$VULNERABLE_COUNT" -gt 0 ]; then
	echo "⚠️ Found $VULNERABLE_COUNT vulnerable package(s)!"
	echo " ACTION REQUIRED: Update these packages immediately and rotate secrets."
	else
	echo "✅ No vulnerable packages found"
	if [ "$SAFE_COUNT" -gt 0 ]; then
	echo " ($SAFE_COUNT packages matched by name but have safe versions)"
	fi
	fi
	fi
	else
	echo "ℹ️ No affected packages list provided."
	echo " Usage: $0 path/to/affected-packages.md"
	echo " Skipping known package check..."
	fi

	#############################################################################
	# CHECK 2: LIFECYCLE HOOKS
	#############################################################################
	# NPM lifecycle scripts run automatically during package installation.
	# SHA1-hulud exploits these hooks to execute malicious code.
	#
	# LEGITIMATE VS MALICIOUS:
	# - Legitimate: Build native modules, compile TypeScript, run postinstall setup
	# - Malicious: Download external scripts, exfiltrate env vars, spawn shells
	#
	# If found, manually inspect these files to determine if the hooks are benign.
	#############################################################################

	echo ""
	echo "🔧 Check 2: Lifecycle Hooks"
	echo "---------------------------"
	echo "Looking for preinstall/install/postinstall scripts in package.json files..."
	echo "(These run automatically and are the primary attack vector)"
	echo ""

	matches=$(grep -Rl -E '"(preinstall\|install\|postinstall)"\s*:' \
	. --exclude-dir=node_modules 2>/dev/null \|\| true)
	print_matches "$matches" "Files with lifecycle scripts"

	#############################################################################
	# CHECK 3: KNOWN MALICIOUS FILENAMES
	#############################################################################
	# The SHA1-hulud attack uses specific filenames for its payloads.
	# These names are designed to look legitimate (related to Bun runtime).
	#
	# FILES TO WATCH FOR:
	# - bun_environment: Pretends to be Bun environment setup
	# - setup_bun: Fake Bun installation script
	# - environment_setup: Generic-sounding config file
	# - shell_execute: Obvious shell execution utility
	#
	# These files typically contain obfuscated code that downloads and runs
	# additional malicious payloads from attacker-controlled servers.
	#############################################################################

	echo ""
	echo "📄 Check 3: Known Malicious Filenames"
	echo "--------------------------------------"
	echo "Searching for filenames used in SHA1-hulud payloads..."
	echo ""

	# Note: Exclude this script itself and common directories
	matches=$(find . -type f \
	-not -path "/node_modules/" \
	-not -path "/.git/" \
	-not -name "shaihulud-scan.sh" \
	-print0 2>/dev/null \| xargs -0 grep -l -E 'bun_environment\|setup_bun\|environment_setup\|shell_execute' 2>/dev/null \|\| true)
	print_matches "$matches" "Suspicious filenames"

	#############################################################################
	# CHECK 4: PACKAGE.JSON RECENT CHANGES
	#############################################################################
	# If an attacker has access to your repo, they might add malicious
	# dependencies directly. This check uses git blame to show recent edits.
	#
	# WHAT TO LOOK FOR:
	# - Unexpected new dependencies you didn't add
	# - Version changes to existing dependencies (potential typosquatting)
	# - Dependencies added by unfamiliar contributors
	#############################################################################

	echo ""
	echo "📝 Check 4: Recent package.json Changes"
	echo "----------------------------------------"
	echo "Using git blame to identify recent dependency modifications..."
	echo "(Review any unfamiliar additions)"
	echo ""

	pkg_files=$(find . -name "package.json" -not -path "/node_modules/" 2>/dev/null)

	for f in $pkg_files; do
	if git ls-files --error-unmatch "$f" >/dev/null 2>&1; then
	echo "→ $f"
	git --no-pager blame --line-porcelain "$f" 2>/dev/null \| \
	grep -E 'author-time\|dependencies\|devDependencies' \| head -n 20 \|\| true
	echo ""
	fi
	done

	#############################################################################
	# CHECK 5: NESTED GIT REPOS IN NODE_MODULES
	#############################################################################
	# Normal npm packages should NOT contain .git directories.
	# Attackers use nested git repos to:
	# - Maintain persistence across npm cache clears
	# - Pull updates to malicious code
	# - Track which systems are compromised
	#
	# If found, this is a strong indicator of compromise.
	#############################################################################

	echo ""
	echo "📂 Check 5: Nested Git Repos in node_modules"
	echo "---------------------------------------------"
	echo "Normal packages should not contain .git directories..."
	echo "(If found, this is a strong indicator of compromise)"
	echo ""

	matches=$(find . -path "/node_modules//.git" -type d 2>/dev/null \| sed 's/\/.git$//' \|\| true)
	print_matches "$matches" "Unexpected git repos inside node_modules"

	#############################################################################
	# CHECK 6: NETWORK AND SHELL EXECUTION PATTERNS
	#############################################################################
	# Checks your project code (not node_modules) for patterns commonly used
	# in supply chain attacks to download and execute malicious code.
	#
	# PATTERNS CHECKED:
	# - curl/wget: Command-line download utilities
	# - fetch: JavaScript fetch API (could download malicious code)
	# - spawn/exec: Node.js child process execution
	# - child_process: Node.js module for running shell commands
	#
	# NOTE: Many legitimate applications use these. This check helps identify
	# files to manually review, not definitive indicators of compromise.
	#############################################################################

	echo ""
	echo "🌐 Check 6: Network/Shell Execution in Project Code"
	echo "----------------------------------------------------"
	echo "Searching for curl/wget/fetch/exec/spawn patterns..."
	echo "(These are common in attacks but also legitimate code - review manually)"
	echo ""

	# Exclude node_modules, build artifacts, and this script
	matches=$(find . -type f \
	-not -path "/node_modules/" \
	-not -path "/.git/" \
	-not -path "/build/" \
	-not -path "/dist/" \
	-not -name "*.md" \
	-not -name "shaihulud-scan.sh" \
	-print0 2>/dev/null \| xargs -0 grep -l -E 'curl \|wget \|\.fetch\(\|spawn\(\|child_process\|exec\(' 2>/dev/null \|\| true)
	print_matches "$matches" "Files with network/shell execution"

	#############################################################################
	# CHECK 7: RECENTLY ADDED EXECUTABLE FILES
	#############################################################################
	# Looks at git history for recently added .sh or .js files.
	# Attackers may add malicious scripts that persist in your repo.
	#
	# WHAT TO REVIEW:
	# - Any .sh files you didn't create
	# - Any .js files in unexpected locations (root, scripts/, etc.)
	# - Files added by unfamiliar contributors
	#############################################################################

	echo ""
	echo "🕐 Check 7: Recently Added Executable Files"
	echo "--------------------------------------------"
	echo "Checking git history for .sh/.js files added in the last 7 days..."
	echo ""

	if git rev-parse --git-dir > /dev/null 2>&1; then
	matches=$(git log --since="7 days ago" --name-only --pretty=format: --diff-filter=A 2>/dev/null \| \
	grep -E '\.(sh\|js)$' \| sort -u \|\| true)
	print_matches "$matches" "Recently added .js/.sh files"
	else
	echo "ℹ️ Not a git repository - skipping this check"
	fi

	#############################################################################
	# SUMMARY
	#############################################################################

	echo ""
	echo "=========================================="
	echo "📋 Scan Complete"
	echo "=========================================="
	echo ""
	echo "NEXT STEPS:"
	echo "-----------"
	echo "1. Investigate any items flagged with ⚠️ above"
	echo "2. If vulnerable packages found, update immediately and rotate secrets"
	echo "3. Review lifecycle scripts in flagged package.json files"
	echo "4. Check git history for unauthorized changes"
	echo ""
	echo "RESOURCES:"
	echo "----------"
	echo "• SHA1-hulud attack details: https://thehackernews.com/2025/11/second-sha1-hulud-wave-affects-25000.html"
	echo "• npm security advisories: https://www.npmjs.com/advisories"
	echo "• Socket.dev (real-time detection): https://socket.dev"
	echo ""