[](https://opensource.org/licenses/MIT)
Sign in to like and favorite skills
Detection and mitigation tools for npm supply chain attacks, specifically targeting the Shai-Hulud 2.0 worm (November 2025).
Shai-Hulud 2.0 is a self-propagating npm worm that:
| Script | Purpose |
|---|---|
| Scan systems for Shai-Hulud 2.0 IOCs |
| Apply security hardening to npm config |
| Monitor network activity during npm operations |
| CI/CD pipeline security checks |
# Clone the repository git clone https://gitlab.com/DrFrankieD2023/npm-security-tools.git cd npm-security-tools # Make all scripts executable chmod +x *.sh # Scan system for malware ./detect-shai-hulud.sh # Scan specific directory ./detect-shai-hulud.sh --scan-path /path/to/projects # Apply npm hardening (dry run) ./npm-hardening.sh # Apply npm hardening (for real) ./npm-hardening.sh --apply # Monitor npm install network activity ./monitor-npm-network.sh npm install # Run CI/CD security check ./ci-security-check.sh /path/to/project
ghjqScans for Shai-Hulud 2.0 indicators of compromise:
setup_bun.jsbun_environment.js~/.dev-env/node_modules/*/package.jsoncontents.jsonenvironment.jsoncloud.json# Full scan (recommended) - thorough, may take 10-15 minutes ./detect-shai-hulud.sh # Quick scan - skips ~/.cache, faster but less thorough ./detect-shai-hulud.sh --quick # Scan specific directory ./detect-shai-hulud.sh --scan-path /path/to/projects
Note: The full scan includes
~/.cache--quick| Code | Meaning |
|---|---|
| 0 | Clean - no malware detected |
| 1 | Warnings found - manual investigation recommended |
| 2 | Critical IOCs found - immediate action required |
Applies security best practices to npm configuration:
ignore-scripts=truestrict-ssl=trueaudit-level=moderatepackage-lock=trueReal-time network monitoring during npm operations:
# Monitor a specific command ./monitor-npm-network.sh npm install # Continuous monitoring for 60 seconds ./monitor-npm-network.sh --watch # Monitor for 5 minutes ./monitor-npm-network.sh --watch 300
Flags suspicious connections to:
raw.githubusercontent.compastebin.comhastebin.comngrok.iowebhook.siteCI/CD pipeline integration for pre-deployment security checks:
# GitLab CI example security-check: stage: test script: - ./ci-security-check.sh . allow_failure: false
Checks include:
npm token listnpm token revoke <id>npm access ls-packagesContributions are welcome! Please read our Contributing Guidelines and Code of Conduct before submitting a pull request.
For security concerns, please see our Security Policy. Do not open public issues for security vulnerabilities.
This project is licensed under the MIT License - see the LICENSE file for details.