secret-blast-radius 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Krrish Kumar
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,125 @@
-# Temporary Holding Version
+# secret-blast-radius
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![CI](https://github.com/Krrishkumar125/secret-blast-radius/actions/workflows/ci.yml/badge.svg)](https://github.com/Krrishkumar125/secret-blast-radius/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/secret-blast-radius)](https://www.npmjs.com/package/secret-blast-radius)
+
+**If a malicious `npm install` ran on this machine right now, what would it get, and what would you rotate first?**
+
+```bash
+npx secret-blast-radius
+```
+
+```
+✖ CRITICAL Plaintext npm credential for registry.npmjs.org
+  ~/.npmrc  sha256:3f1c9a0b
+  Any install script can read this and republish every package you maintain (this is how Shai-Hulud spreads).
+
+✖ CRITICAL GitHub CLI token stored in plaintext
+  ~/.config/gh/hosts.yml  sha256:a81d22e4
+  gh fell back to a plaintext file (no OS keyring). Install scripts can read it and push to every repo you can write to.
+
+▲ HIGH     MCP server "github" has a literal secret in env.GITHUB_PERSONAL_ACCESS_TOKEN
+  ~/.cursor/mcp.json  sha256:9b07e6c1
+
+● MEDIUM   2 secret(s) in apps/api/.env
+  Keys: DATABASE_URL, STRIPE_SECRET_KEY — recognised: connection string with password, Stripe live secret key.
+
+Summary: 2 critical, 1 high, 1 medium, 0 low.
+Rotation order if this machine is ever compromised: 1. npm  2. github  3. ai  4. dotenv
+```
+
+## Why
+
+October 2026 alone: `tensorlake@0.5.144` and other "Mini Shai-Hulud" releases ran a `preinstall` hook that harvested
+npm, GitHub, cloud, Kubernetes, SSH, `.env` **and coding-agent/MCP config** credentials, then used the npm token to
+republish itself ([advisory](https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2),
+[StepSecurity](https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm)). Railway told every
+customer to rotate secrets after env vars may have been decrypted
+([disclosure](https://blog.railway.com/p/security-disclosure-wednesday-october-21st)).
+
+Advisories say "rotate everything the machine could access". Few people know what that list is. This tool writes it
+for you, **before** an incident (so you can shrink it) and **during** one (so you rotate in the right order).
+
+What's different from existing tools:
+
+- **Not a malware/IOC scanner** ([shai-hulud-detect](https://github.com/cobenian/shai-hulud-detect) does that well) and
+  **not a repo secret scanner** (gitleaks, trufflehog scan git history). It inventories the credentials *reachable on the
+  machine or CI runner*, which is exactly what an install script can read.
+- **One report across every place:** npm, GitHub CLI and git, AWS/GCP/Azure, kubeconfig and docker, SSH keys, MCP configs for
+  Claude, Cursor, Windsurf, VS Code, Zed, Kiro and Gemini, project `.env` files, and the environment variables a CI step inherits.
+- **An ordered rotation runbook.** Order matters: the worm's `gh-token-monitor` wipes your home directory when you revoke
+  the stolen GitHub token, so persistence comes first, then the credentials a worm spreads with (npm, GitHub), then the rest.
+
+## Safety
+
+- Read-only. It never writes anywhere except an optional runbook file you name.
+- **No network requests**. Zero dependencies.
+- **Secret values are never printed.** Findings show a location and a `sha256:xxxxxxxx` fingerprint so you can tell keys apart.
+  The test suite checks every output format for leaks.
+
+## Usage
+
+```bash
+npx secret-blast-radius                       # scan home dir + current project
+npx secret-blast-radius ~/code/api ~/code/web # scan specific projects for .env files
+npx secret-blast-radius --runbook             # Markdown rotation checklist to stdout
+npx secret-blast-radius --runbook-file rotate.md --runbook
+npx secret-blast-radius --json                # machine-readable
+npx secret-blast-radius --fail-on high        # exit 1 if anything high or critical (CI gate)
+npx secret-blast-radius --only npm,github,ai  # pick scanners
+```
+
+| Option | Meaning |
+|---|---|
+| `--json` | JSON report including the ordered runbook |
+| `--runbook`, `--runbook-file <f>` | Markdown rotation checklist |
+| `--fail-on <level>` | `critical`, `high`, `medium`, `low` or `none` (default) |
+| `--only` / `--skip <list>` | `persistence,npm,github,cloud,kubernetes,env,ai,ssh,dotenv,hardening` |
+| `--no-env` | Skip environment variables |
+| `--depth <n>` | How deep to search project dirs for `.env*` (default 4; skips `node_modules`, `.git`, build dirs) |
+| `--home <dir>` | Inspect another home directory (e.g. a mounted disk image) |
+
+### In CI: what does `npm install` get to see?
+
+```yaml
+- run: npx secret-blast-radius@0 --only env,npm --fail-on critical
+```
+
+If that fails, a secret such as `NPM_TOKEN` is exposed to every dependency's install script in that job. Move it to the
+publish step only, or switch to [trusted publishing](https://docs.npmjs.com/trusted-publishers).
+
+## What it checks
+
+| Scanner | Looks at | Flags |
+|---|---|---|
+| `persistence` | `gh-token-monitor` files (Linux, macOS, Windows) | Active Shai-Hulud "hostage token" service |
+| `npm` | `~/.npmrc`, project `.npmrc` | Literal `_authToken` / `_auth` / `_password` (not `${VAR}`) |
+| `github` | gh `hosts.yml`, `~/.git-credentials` | Tokens stored in plaintext instead of the keyring |
+| `cloud` | `~/.aws/credentials`, gcloud ADC, Azure token cache | Long-lived keys (critical) vs session keys |
+| `kubernetes` | `~/.kube/config`, `~/.docker/config.json` | Embedded tokens/client keys, registry auth without `credsStore` |
+| `env` | Current process environment | Known token formats and secret-named variables |
+| `ai` | MCP configs for Claude Code/Desktop, Cursor, Windsurf, VS Code, Zed, Kiro, Gemini; Codex auth | Literal keys in `env`, `headers`, `args`, URL query |
+| `ssh` | `~/.ssh/*` private keys | Keys without a passphrase (PEM, PKCS#8 and OpenSSH formats) |
+| `dotenv` | `.env*` in project dirs (not `.env.example`) | Secret-named keys and recognised tokens; URLs only when they embed a password |
+| `hardening` | `.npmrc`, `pnpm-workspace.yaml` | No `ignore-scripts`, no dependency cooldown (`min-release-age` / `minimumReleaseAge`) |
+
+Placeholders such as `${VAR}`, `${{ secrets.X }}`, `${env:X}`, `op://…`, `<token>`, `[YOUR_KEY]` and `your_api_key_here` are ignored.
+
+## Programmatic API
+
+```js
+import { scan, runbook, failsAt, formatMarkdown } from 'secret-blast-radius';
+
+const result = scan({ projects: ['.'], skip: ['env'] });
+console.log(result.counts);            // { critical, high, medium, low }
+console.log(runbook(result)[0].label); // first thing to rotate
+```
+
+## Limits
+
+It checks well-known locations; it can't see secrets in your OS keychain (which is the point), browser profiles, or files
+in unusual paths. A clean report shrinks your blast radius; it doesn't prove a machine is uncompromised.
+
+## License
+
+MIT © Krrish Kumar

package/bin/cli.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+import { parseArgs } from 'node:util';
+import { writeFileSync, readFileSync } from 'node:fs';
+import { scan, failsAt, formatText, formatMarkdown, runbook } from '../src/index.js';
+
+const HELP = `Usage: secret-blast-radius [options] [project-dir...]
+
+Lists every credential an npm install script (or any process you run) could read
+on this machine or CI runner, ranks it, and writes an ordered rotation runbook.
+Read-only. Never prints secret values.
+
+Options:
+  --json               Machine-readable output
+  --runbook [file]     Print (or write to file) a Markdown rotation runbook
+  --fail-on <level>    Exit 1 if any finding is at/above level: critical|high|medium|low|none (default: none)
+  --only <list>        Comma list of scanners: persistence,npm,github,cloud,kubernetes,env,ai,ssh,dotenv,hardening
+  --skip <list>        Comma list of scanners to skip
+  --no-env             Do not inspect environment variables
+  --depth <n>          How deep to look for .env files in project dirs (default 4)
+  --home <dir>         Home directory to inspect (default: your home)
+  --no-color           Disable colours
+  -v, --version        Print version
+  -h, --help           Show this help
+`;
+
+let args;
+try {
+  args = parseArgs({
+    allowPositionals: true,
+    options: {
+      json: { type: 'boolean' }, runbook: { type: 'boolean' }, 'runbook-file': { type: 'string' },
+      'fail-on': { type: 'string', default: 'none' }, only: { type: 'string' }, skip: { type: 'string' },
+      'no-env': { type: 'boolean' }, depth: { type: 'string' }, home: { type: 'string' },
+      'no-color': { type: 'boolean' }, version: { type: 'boolean', short: 'v' }, help: { type: 'boolean', short: 'h' },
+    },
+  });
+} catch (e) {
+  console.error(e.message + '\n\n' + HELP);
+  process.exit(2);
+}
+const { values: o, positionals } = args;
+if (o.help) { process.stdout.write(HELP); process.exit(0); }
+if (o.version) {
+  console.log(JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version);
+  process.exit(0);
+}
+// `--runbook out.md`: parseArgs treats the file as positional; detect a .md positional right after.
+let runbookFile = o['runbook-file'];
+let projects = positionals;
+if (o.runbook && !runbookFile && positionals.length && /\.md$/i.test(positionals[0])) { runbookFile = positionals[0]; projects = positionals.slice(1); }
+
+const list = (s) => (s ? s.split(',').map((x) => x.trim()).filter(Boolean) : undefined);
+const skip = list(o.skip) ?? [];
+if (o['no-env']) skip.push('env');
+
+let result;
+try {
+  result = scan({ projects, home: o.home, only: list(o.only), skip, depth: o.depth ? Number(o.depth) : undefined });
+  failsAt(result, o['fail-on']);
+} catch (e) {
+  console.error(`secret-blast-radius: ${e.message}`);
+  process.exit(2);
+}
+
+if (o.json) {
+  process.stdout.write(JSON.stringify({ ...result, runbook: runbook(result).map(({ items, ...r }) => ({ ...r, findings: items.map((i) => i.id) })) }, null, 2) + '\n');
+} else if (o.runbook) {
+  const md = formatMarkdown(result);
+  if (runbookFile) { writeFileSync(runbookFile, md); console.log(`Runbook written to ${runbookFile}`); } else process.stdout.write(md + '\n');
+} else {
+  const color = !o['no-color'] && process.stdout.isTTY && !process.env.NO_COLOR;
+  console.log(formatText(result, { color }));
+}
+process.exit(failsAt(result, o['fail-on']) ? 1 : 0);

package/package.json

@@ -1,6 +1,20 @@
 {
   "name": "secret-blast-radius",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "See every credential a malicious npm install script could steal from your machine or CI runner (npm/GitHub tokens, cloud keys, MCP configs, SSH keys, .env), ranked, with an ordered rotation runbook. Read-only; never prints secrets.",
+  "license": "MIT",
+  "author": "Krrish Kumar (https://github.com/Krrishkumar125)",
+  "repository": { "type": "git", "url": "git+https://github.com/Krrishkumar125/secret-blast-radius.git" },
+  "homepage": "https://github.com/Krrishkumar125/secret-blast-radius#readme",
+  "bugs": "https://github.com/Krrishkumar125/secret-blast-radius/issues",
+  "keywords": ["security", "supply-chain", "npm", "shai-hulud", "secrets", "credentials", "rotation", "incident-response", "mcp", "ci", "devsecops"],
+  "type": "module",
+  "bin": { "secret-blast-radius": "bin/cli.js" },
+  "exports": { ".": "./src/index.js" },
+  "files": ["bin", "src", "README.md", "LICENSE"],
+  "engines": { "node": ">=18.18" },
+  "scripts": {
+    "test": "node --test test/scanners.test.js test/cli.test.js",
+    "check": "node --check bin/cli.js && npm test"
+  }
+}

package/src/format.js

@@ -0,0 +1,40 @@
+import { runbook } from './index.js';
+
+const ICON = { critical: '✖', high: '▲', medium: '●', low: '·' };
+
+export function formatText(result, { color = false } = {}) {
+  const c = (code, s) => (color ? `\x1b[${code}m${s}\x1b[0m` : s);
+  const sev = { critical: (s) => c('1;31', s), high: (s) => c('31', s), medium: (s) => c('33', s), low: (s) => c('2', s) };
+  const lines = [];
+  const { counts } = result;
+  lines.push(c('1', 'secret-blast-radius') + ' — what a malicious install script could steal from this machine right now');
+  lines.push('');
+  if (!result.findings.length) {
+    lines.push('No reachable secrets found in the places checked. Nice.');
+    return lines.join('\n');
+  }
+  for (const f of result.findings) {
+    lines.push(`${sev[f.severity](`${ICON[f.severity]} ${f.severity.toUpperCase().padEnd(8)}`)} ${f.title}`);
+    lines.push(`  ${c('2', f.location + (f.fingerprint ? `  ${f.fingerprint}` : '') + (f.ageDays != null ? `  (${f.ageDays}d old)` : ''))}`);
+    lines.push(`  ${f.detail}`);
+    lines.push('');
+  }
+  lines.push(`Summary: ${counts.critical} critical, ${counts.high} high, ${counts.medium} medium, ${counts.low} low.`);
+  const rb = runbook(result);
+  if (rb.length) lines.push(`Rotation order if this machine is ever compromised: ${rb.map((r, i) => `${i + 1}. ${r.category}`).join('  ')}`);
+  lines.push('Run with --runbook for step-by-step rotation, --json for machine output. Secret values are never printed.');
+  return lines.join('\n');
+}
+
+export function formatMarkdown(result) {
+  const out = ['# Secret rotation runbook', '', `Generated ${result.scannedAt} by secret-blast-radius. Values are never included; fingerprints let you match items.`, ''];
+  const rb = runbook(result);
+  if (!rb.length) return out.concat('Nothing to rotate: no reachable secrets were found.').join('\n');
+  out.push('Work top to bottom. The order matters: stop persistence first, then the credentials a worm uses to spread (npm, GitHub), then everything else.', '');
+  rb.forEach((step, i) => {
+    out.push(`## ${i + 1}. ${step.label}`, '');
+    for (const it of step.items) out.push(`- [ ] **${it.title}** — \`${it.location}\`${it.fingerprint ? ` (${it.fingerprint})` : ''}`);
+    out.push('', ...step.steps.map((s) => `1. ${s}`), '', `Reference: ${step.url}`, '');
+  });
+  return out.join('\n');
+}

package/src/index.js

@@ -0,0 +1,91 @@
+import { homedir } from 'node:os';
+import { resolve } from 'node:path';
+import { SCANNERS } from './scanners.js';
+
+export const SEVERITY = ['critical', 'high', 'medium', 'low'];
+
+/** Order in which to rotate after a suspected compromise. Lower = earlier. */
+export const ROTATION = {
+  persistence: {
+    order: 0, label: 'Stop the worm first',
+    steps: [
+      'Disconnect the machine from the network.',
+      'Remove gh-token-monitor BEFORE revoking any GitHub token (revoking first triggers `rm -rf ~`). Linux: `systemctl --user disable --now gh-token-monitor.service`; macOS: `launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/com.user.gh-token-monitor.plist`; Windows: delete the gh-token-monitor scheduled task.',
+      'Do every rotation below from a different, clean machine, then rebuild this one.',
+    ],
+    url: 'https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2',
+  },
+  npm: {
+    order: 1, label: 'npm publish tokens (stops the worm republishing your packages)',
+    steps: ['Revoke every token: `npm token list` then `npm token revoke <id>`, or npmjs.com → Access Tokens.', 'Check your packages for versions you did not publish: `npm view <pkg> time`.', 'Move publishing to trusted publishing (OIDC) or granular tokens with expiry.'],
+    url: 'https://docs.npmjs.com/revoking-access-tokens',
+  },
+  github: {
+    order: 2, label: 'GitHub tokens and sessions',
+    steps: ['`gh auth logout` then `gh auth login` (stores the new token in the OS keyring).', 'Revoke old PATs and OAuth apps: github.com/settings/tokens and /settings/applications.', 'Look for commits you did not make (e.g. author "claude", message "chore: update dependencies") and unexpected workflows or branches.'],
+    url: 'https://github.com/settings/tokens',
+  },
+  cloud: {
+    order: 3, label: 'Cloud credentials',
+    steps: ['AWS: deactivate then delete the access key in IAM, create a new one, or better, switch to `aws sso login`.', 'GCP: `gcloud auth application-default revoke`; delete service-account keys in IAM.', 'Azure: `az logout`, revoke sessions in Entra ID.', 'Review CloudTrail / audit logs for activity from unknown IPs.'],
+    url: 'https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#rotating_access_keys_console',
+  },
+  kubernetes: {
+    order: 4, label: 'Kubernetes and container registries',
+    steps: ['Rotate service-account tokens / client certs referenced by your kubeconfig.', '`docker logout <registry>` and revoke the registry token in its UI; then set "credsStore".'],
+    url: 'https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/',
+  },
+  env: {
+    order: 5, label: 'Secrets present in the environment / CI',
+    steps: ['Rotate each listed variable at its provider and update the CI secret store.', 'In CI, pass secrets only to the steps that need them, never to `npm install`.'],
+    url: 'https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions',
+  },
+  ai: {
+    order: 6, label: 'AI provider keys and MCP servers',
+    steps: ['Revoke and reissue the keys in each provider console (OpenAI, Anthropic, etc.).', 'Replace literal values in MCP configs with "${ENV_VAR}" references.'],
+    url: 'https://blog.trailofbits.com/2025/04/30/insecure-credential-storage-plagues-mcp/',
+  },
+  ssh: {
+    order: 7, label: 'SSH keys',
+    steps: ['Generate a new key (`ssh-keygen -t ed25519`) with a passphrase.', 'Replace the public key on GitHub/GitLab and in every server\'s authorized_keys; remove the old one.'],
+    url: 'https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent',
+  },
+  dotenv: {
+    order: 8, label: 'Application secrets in .env files',
+    steps: ['Rotate database passwords, payment keys and webhook secrets at each provider.', 'Redeploy: most platforms only read env vars at process start.'],
+    url: 'https://12factor.net/config',
+  },
+};
+
+export function scan(options = {}) {
+  const ctx = {
+    home: resolve(options.home ?? homedir()),
+    projects: (options.projects?.length ? options.projects : [process.cwd()]).map((p) => resolve(p)),
+    env: options.env ?? process.env,
+    depth: options.depth ?? 4,
+  };
+  const only = options.only ? new Set(options.only) : null;
+  const skip = new Set(options.skip ?? []);
+  const findings = [];
+  for (const [name, fn] of Object.entries(SCANNERS)) {
+    if ((only && !only.has(name)) || skip.has(name)) continue;
+    findings.push(...fn(ctx));
+  }
+  findings.sort((a, b) => SEVERITY.indexOf(a.severity) - SEVERITY.indexOf(b.severity) || (ROTATION[a.category]?.order ?? 99) - (ROTATION[b.category]?.order ?? 99));
+  const counts = Object.fromEntries(SEVERITY.map((s) => [s, findings.filter((f) => f.severity === s).length]));
+  return { scannedAt: new Date().toISOString(), home: ctx.home, projects: ctx.projects, counts, findings };
+}
+
+export function runbook(result) {
+  const cats = [...new Set(result.findings.map((f) => f.category))].filter((c) => ROTATION[c]).sort((a, b) => ROTATION[a].order - ROTATION[b].order);
+  return cats.map((c) => ({ category: c, ...ROTATION[c], items: result.findings.filter((f) => f.category === c) }));
+}
+
+export function failsAt(result, level) {
+  if (!level || level === 'none') return false;
+  const idx = SEVERITY.indexOf(level);
+  if (idx < 0) throw new Error(`Unknown severity "${level}". Use one of: ${SEVERITY.join(', ')}, none`);
+  return result.findings.some((f) => SEVERITY.indexOf(f.severity) <= idx);
+}
+
+export { formatText, formatMarkdown } from './format.js';

package/src/scanners.js

@@ -0,0 +1,418 @@
+import { join, relative } from 'node:path';
+import {
+  fingerprint, readText, readBytes, listDir, exists, mtime,
+  isReference, looksLikeSecretName, isSecretPair, tokenKind, walk,
+} from './util.js';
+
+const days = (d) => (d ? Math.floor((Date.now() - d.getTime()) / 86400000) : null);
+const tilde = (ctx, p) => (p.startsWith(ctx.home) ? '~' + p.slice(ctx.home.length).replace(/\\/g, '/') : p);
+
+/* ---------------- 0. Active worm persistence (Shai-Hulud family) ---------------- */
+export function scanPersistence(ctx) {
+  const h = ctx.home;
+  const iocs = [
+    join(h, '.config', 'gh-token-monitor'),
+    join(h, '.local', 'bin', 'gh-token-monitor.sh'),
+    join(h, '.config', 'systemd', 'user', 'gh-token-monitor.service'),
+    join(h, 'Library', 'LaunchAgents', 'com.user.gh-token-monitor.plist'),
+    join(h, 'AppData', 'Local', 'gh-token-monitor'),
+  ];
+  return iocs.filter(exists).map((p) => ({
+    id: 'persistence.gh-token-monitor',
+    category: 'persistence',
+    severity: 'critical',
+    title: 'Worm persistence found: gh-token-monitor',
+    location: tilde(ctx, p),
+    detail:
+      'This is the "hostage token" service planted by the Mini Shai-Hulud npm worm (e.g. tensorlake@0.5.144). ' +
+      'It wipes your home directory if the stolen GitHub token is revoked. Remove it BEFORE revoking any GitHub token.',
+  }));
+}
+
+/* ---------------- 1. npm ---------------- */
+export function scanNpmrc(ctx) {
+  const files = [join(ctx.home, '.npmrc'), ...ctx.projects.map((p) => join(p, '.npmrc'))];
+  const out = [];
+  for (const f of new Set(files)) {
+    const text = readText(f);
+    if (!text) continue;
+    for (const line of text.split(/\r?\n/)) {
+      const m = line.match(/^\s*([^#;=\s]*(?:_authToken|_auth|_password))\s*=\s*(.+?)\s*$/);
+      if (!m) continue;
+      const [, key, value] = m;
+      if (isReference(value)) continue;
+      const registry = key.replace(/:?_(authToken|auth|password)$/, '').replace(/^\/\//, '') || 'registry.npmjs.org (default)';
+      const publishable = /registry\.npmjs\.org|^registry\.npmjs\.org \(default\)$/.test(registry);
+      out.push({
+        id: 'npm.plaintext-token',
+        category: 'npm',
+        severity: publishable ? 'critical' : 'high',
+        title: `Plaintext npm credential for ${registry}`,
+        location: tilde(ctx, f),
+        fingerprint: fingerprint(value),
+        detail:
+          (publishable
+            ? 'Any install script can read this and republish every package you maintain (this is how Shai-Hulud spreads). '
+            : 'Any install script can read this registry credential. ') +
+          'Prefer short-lived tokens or npm trusted publishing (OIDC) from CI.',
+      });
+    }
+  }
+  return out;
+}
+
+/* ---------------- 2. GitHub ---------------- */
+export function scanGitHub(ctx) {
+  const out = [];
+  const hosts = [join(ctx.home, '.config', 'gh', 'hosts.yml'), join(ctx.home, 'AppData', 'Roaming', 'GitHub CLI', 'hosts.yml')];
+  for (const f of hosts) {
+    const text = readText(f);
+    if (!text) continue;
+    const seen = new Set();
+    for (const m of text.matchAll(/oauth_token:\s*(\S+)/g)) {
+      if (isReference(m[1]) || seen.has(m[1])) continue;
+      seen.add(m[1]);
+      out.push({
+        id: 'github.gh-cli-plaintext',
+        category: 'github',
+        severity: 'critical',
+        title: 'GitHub CLI token stored in plaintext',
+        location: tilde(ctx, f),
+        fingerprint: fingerprint(m[1]),
+        detail: 'gh fell back to a plaintext file (no OS keyring). Install scripts can read it and push to every repo you can write to.',
+      });
+    }
+  }
+  const gitCreds = join(ctx.home, '.git-credentials');
+  const gc = readText(gitCreds);
+  if (gc) {
+    for (const line of gc.split(/\r?\n/)) {
+      const m = line.match(/^https?:\/\/([^:]+):([^@]+)@([^/\s]+)/);
+      if (!m) continue;
+      out.push({
+        id: 'github.git-credentials',
+        category: 'github',
+        severity: 'high',
+        title: `Plaintext git credential for ${m[3]}`,
+        location: tilde(ctx, gitCreds),
+        fingerprint: fingerprint(m[2]),
+        detail: 'git credential.helper=store keeps passwords/tokens unencrypted. Switch to the OS credential manager.',
+      });
+    }
+  }
+  return out;
+}
+
+/* ---------------- 3. Cloud ---------------- */
+export function scanCloud(ctx) {
+  const out = [];
+  const awsF = join(ctx.home, '.aws', 'credentials');
+  const aws = readText(awsF);
+  if (aws) {
+    let profile = 'default';
+    for (const line of aws.split(/\r?\n/)) {
+      const p = line.match(/^\s*\[([^\]]+)\]/);
+      if (p) profile = p[1];
+      const k = line.match(/^\s*aws_access_key_id\s*=\s*(\S+)/);
+      if (k && !isReference(k[1])) {
+        const permanent = k[1].startsWith('AKIA');
+        out.push({
+          id: 'cloud.aws-static-key',
+          category: 'cloud',
+          severity: permanent ? 'critical' : 'medium',
+          title: `AWS ${permanent ? 'long-lived' : 'session'} access key (profile "${profile}")`,
+          location: tilde(ctx, awsF),
+          fingerprint: fingerprint(k[1]),
+          ageDays: days(mtime(awsF)),
+          detail: permanent
+            ? 'Long-lived IAM user keys never expire. Prefer `aws sso login` / IAM Identity Center so a stolen file is useless within hours.'
+            : 'Temporary credentials: lower risk, but still usable until they expire.',
+        });
+      }
+    }
+  }
+  const gcpF = join(ctx.home, '.config', 'gcloud', 'application_default_credentials.json');
+  const gcp = readText(gcpF);
+  if (gcp) {
+    let type = 'unknown';
+    try { type = JSON.parse(gcp).type || type; } catch {}
+    out.push({
+      id: 'cloud.gcp-adc',
+      category: 'cloud',
+      severity: type === 'service_account' ? 'critical' : 'high',
+      title: `Google Cloud application default credentials (${type})`,
+      location: tilde(ctx, gcpF),
+      detail: type === 'service_account'
+        ? 'A service-account key file never expires. Delete it and use workload identity or impersonation.'
+        : 'A refresh token: valid until revoked with `gcloud auth application-default revoke`.',
+    });
+  }
+  const azF = join(ctx.home, '.azure', 'msal_token_cache.json');
+  if (exists(azF)) {
+    out.push({
+      id: 'cloud.azure-token-cache', category: 'cloud', severity: 'high',
+      title: 'Azure CLI token cache', location: tilde(ctx, azF),
+      detail: 'Refresh tokens for your Azure tenant(s). Revoke sessions with `az logout` and in Entra ID if exposed.',
+    });
+  }
+  return out;
+}
+
+/* ---------------- 4. Kubernetes & container registries ---------------- */
+export function scanKubeDocker(ctx) {
+  const out = [];
+  const kubeF = join(ctx.home, '.kube', 'config');
+  const kube = readText(kubeF);
+  if (kube) {
+    const embedded = (kube.match(/^\s*(token|client-key-data|password):\s*\S+/gm) || []).length;
+    if (embedded) {
+      out.push({
+        id: 'k8s.embedded-credentials', category: 'kubernetes', severity: 'high',
+        title: `kubeconfig with ${embedded} embedded credential(s)`, location: tilde(ctx, kubeF),
+        detail: 'Static tokens or client keys give cluster access to anyone who copies this file. Prefer exec-based auth plugins (short-lived).',
+      });
+    }
+  }
+  const dockerF = join(ctx.home, '.docker', 'config.json');
+  const docker = readText(dockerF);
+  if (docker) {
+    try {
+      const cfg = JSON.parse(docker);
+      for (const [registry, v] of Object.entries(cfg.auths || {})) {
+        if (v && (v.auth || v.identitytoken)) {
+          out.push({
+            id: 'registry.docker-plaintext', category: 'kubernetes', severity: 'high',
+            title: `Container registry credential for ${registry} (base64, not encrypted)`,
+            location: tilde(ctx, dockerF), fingerprint: fingerprint(v.auth || v.identitytoken),
+            detail: 'Set "credsStore" (osxkeychain / wincred / pass / secretservice) so docker keeps this out of the file.',
+          });
+        }
+      }
+    } catch {}
+  }
+  return out;
+}
+
+/* ---------------- 5. Environment variables (what a CI install step sees) ---------------- */
+export function scanEnv(ctx) {
+  const out = [];
+  for (const [name, value] of Object.entries(ctx.env)) {
+    if (!value || isReference(value)) continue;
+    const kind = tokenKind(value);
+    if (!isSecretPair(name, value)) continue;
+    out.push({
+      id: 'env.secret', category: 'env', severity: kind && /npm|GitHub|AWS/.test(kind) ? 'critical' : 'high',
+      title: `Secret in environment: ${name}${kind ? ` (${kind})` : ''}`,
+      location: 'process environment', fingerprint: fingerprint(value),
+      detail: 'Every install script and child process inherits this. In CI, scope secrets to the steps that need them, not the install step.',
+    });
+  }
+  return out;
+}
+
+/* ---------------- 6. AI tools & MCP configs ---------------- */
+function mcpServersFrom(obj, path = []) {
+  // Collect {name, env, headers, args} objects found under any "mcpServers" / "servers" / "mcp_servers" key.
+  const found = [];
+  if (!obj || typeof obj !== 'object') return found;
+  for (const [k, v] of Object.entries(obj)) {
+    if (/^(mcpServers|mcp_servers|servers)$/.test(k) && v && typeof v === 'object' && !Array.isArray(v)) {
+      for (const [name, s] of Object.entries(v)) if (s && typeof s === 'object') found.push({ name, server: s, path: [...path, k, name] });
+    } else if (v && typeof v === 'object') {
+      found.push(...mcpServersFrom(v, [...path, k]));
+    }
+  }
+  return found;
+}
+
+function literalSecretsInServer(server) {
+  const hits = [];
+  for (const bag of ['env', 'headers', 'http_headers']) {
+    for (const [k, v] of Object.entries(server[bag] || {})) {
+      if (typeof v !== 'string' || isReference(v)) continue;
+      const val = v.replace(/^Bearer\s+/i, '');
+      if (isReference(val)) continue;
+      if (isSecretPair(k, val) || /^authorization$/i.test(k)) hits.push({ key: `${bag}.${k}`, value: val });
+    }
+  }
+  for (const a of server.args || []) {
+    if (typeof a !== 'string') continue;
+    const m = a.match(/^--?[\w-]*(key|token|secret)[\w-]*=(.+)$/i);
+    const val = m ? m[2] : a;
+    if ((m && !isReference(val)) || tokenKind(a)) hits.push({ key: 'args', value: val });
+  }
+  if (typeof server.url === 'string') {
+    const m = server.url.match(/[?&](api[_-]?key|token|key)=([^&]+)/i);
+    if (m && !isReference(m[2])) hits.push({ key: 'url query', value: m[2] });
+  }
+  return hits;
+}
+
+export function aiConfigPaths(ctx) {
+  const h = ctx.home;
+  const appData = join(h, 'AppData', 'Roaming');
+  return [
+    join(h, '.claude.json'),
+    join(h, '.claude', 'settings.json'),
+    join(h, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json'),
+    join(appData, 'Claude', 'claude_desktop_config.json'),
+    join(h, '.config', 'Claude', 'claude_desktop_config.json'),
+    join(h, '.cursor', 'mcp.json'),
+    join(h, '.codeium', 'windsurf', 'mcp_config.json'),
+    join(h, '.config', 'zed', 'settings.json'),
+    join(h, '.kiro', 'settings', 'mcp.json'),
+    join(h, '.gemini', 'settings.json'),
+    join(h, 'Library', 'Application Support', 'Code', 'User', 'mcp.json'),
+    join(appData, 'Code', 'User', 'mcp.json'),
+    join(h, '.config', 'Code', 'User', 'mcp.json'),
+    ...ctx.projects.flatMap((p) => [join(p, '.mcp.json'), join(p, '.cursor', 'mcp.json'), join(p, '.vscode', 'mcp.json')]),
+  ];
+}
+
+export function scanAiConfigs(ctx) {
+  const out = [];
+  for (const f of new Set(aiConfigPaths(ctx))) {
+    const text = readText(f);
+    if (!text) continue;
+    let json;
+    try { json = JSON.parse(text); } catch { continue; }
+    for (const { name, server } of mcpServersFrom(json)) {
+      for (const hit of literalSecretsInServer(server)) {
+        out.push({
+          id: 'ai.mcp-literal-secret', category: 'ai', severity: 'high',
+          title: `MCP server "${name}" has a literal secret in ${hit.key}`,
+          location: tilde(ctx, f), fingerprint: fingerprint(hit.value),
+          detail: 'Coding-agent and MCP configs are now an explicit target of npm worms. Reference an env var (e.g. "${VAR}") or your OS keychain instead.',
+        });
+      }
+    }
+  }
+  // Codex CLI auth file stores an API key / refresh token.
+  for (const f of [join(ctx.home, '.codex', 'auth.json')]) {
+    const t = readText(f);
+    if (!t) continue;
+    try {
+      const j = JSON.parse(t);
+      if (j.OPENAI_API_KEY || j.tokens) {
+        out.push({
+          id: 'ai.codex-auth', category: 'ai', severity: 'medium',
+          title: 'Codex CLI credentials file', location: tilde(ctx, f),
+          detail: 'Contains an API key or refresh token. Sign out (`codex logout`) and back in to rotate if exposed.',
+        });
+      }
+    } catch {}
+  }
+  return out;
+}
+
+/* ---------------- 7. SSH keys ---------------- */
+export function sshKeyEncrypted(buf) {
+  const text = buf.toString('latin1');
+  if (/-----BEGIN (RSA|EC|DSA) PRIVATE KEY-----/.test(text)) return /Proc-Type:\s*4,ENCRYPTED/.test(text);
+  if (/-----BEGIN ENCRYPTED PRIVATE KEY-----/.test(text)) return true;
+  if (/-----BEGIN PRIVATE KEY-----/.test(text)) return false;
+  const m = text.match(/-----BEGIN OPENSSH PRIVATE KEY-----([\s\S]+?)-----END OPENSSH PRIVATE KEY-----/);
+  if (!m) return null;
+  const raw = Buffer.from(m[1].replace(/\s+/g, ''), 'base64');
+  const magic = 'openssh-key-v1\0';
+  if (raw.subarray(0, magic.length).toString('latin1') !== magic) return null;
+  const len = raw.readUInt32BE(magic.length);
+  const cipher = raw.subarray(magic.length + 4, magic.length + 4 + len).toString('latin1');
+  return cipher !== 'none';
+}
+
+export function scanSsh(ctx) {
+  const out = [];
+  const dir = join(ctx.home, '.ssh');
+  for (const ent of listDir(dir)) {
+    if (!ent.isFile() || ent.name.endsWith('.pub') || /^(known_hosts|config|authorized_keys)/.test(ent.name)) continue;
+    const p = join(dir, ent.name);
+    const buf = readBytes(p);
+    if (!buf || !buf.includes('PRIVATE KEY-----')) continue;
+    const enc = sshKeyEncrypted(buf);
+    if (enc) continue;
+    out.push({
+      id: 'ssh.unencrypted-key', category: 'ssh', severity: 'high',
+      title: `SSH private key without a passphrase: ${ent.name}`, location: tilde(ctx, p),
+      ageDays: days(mtime(p)),
+      detail: 'A copied file is a working key. Add a passphrase (`ssh-keygen -p -f <key>`) and use ssh-agent, or a hardware-backed key.',
+    });
+  }
+  return out;
+}
+
+/* ---------------- 8. .env files in your projects ---------------- */
+const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', '.next', '.turbo', 'vendor', '.venv', 'venv', '__pycache__', 'coverage', '.cache']);
+
+export function parseDotenv(text) {
+  const pairs = [];
+  for (const line of text.split(/\r?\n/)) {
+    const m = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_.-]*)\s*=\s*(.*)$/);
+    if (!m) continue;
+    let v = m[2].trim();
+    if (/^(['"]).*\1$/.test(v)) v = v.slice(1, -1);
+    else v = v.replace(/\s+#.*$/, '');
+    pairs.push([m[1], v]);
+  }
+  return pairs;
+}
+
+export function scanDotenv(ctx) {
+  const out = [];
+  for (const root of ctx.projects) {
+    for (const f of walk(root, { maxDepth: ctx.depth, skip: SKIP_DIRS })) {
+      const base = f.split(/[\\/]/).pop();
+      if (!/^\.env(\..+)?$/.test(base) || /\.(example|sample|template|dist|defaults)$/i.test(base)) continue;
+      const text = readText(f);
+      if (!text) continue;
+      const secrets = parseDotenv(text).filter(([k, v]) => isSecretPair(k, v));
+      if (!secrets.length) continue;
+      const kinds = [...new Set(secrets.map(([, v]) => tokenKind(v)).filter(Boolean))];
+      const live = kinds.some((k) => /live|AWS|npm|GitHub|connection string/.test(k));
+      out.push({
+        id: 'dotenv.secrets', category: 'dotenv', severity: live ? 'high' : 'medium',
+        title: `${secrets.length} secret(s) in ${relative(root, f).replace(/\\/g, '/') || base}`,
+        location: tilde(ctx, f),
+        names: secrets.map(([k]) => k),
+        detail: `Keys: ${secrets.map(([k]) => k).join(', ')}${kinds.length ? ` — recognised: ${kinds.join(', ')}` : ''}. ` +
+          'Install scripts run with your project as cwd, so .env files are the first thing they read.',
+      });
+    }
+  }
+  return out;
+}
+
+/* ---------------- Hardening checks (not secrets, but they shrink the blast radius) ---------------- */
+export function scanHardening(ctx) {
+  const out = [];
+  const npmrcs = [join(ctx.home, '.npmrc'), ...ctx.projects.map((p) => join(p, '.npmrc'))].map(readText).filter(Boolean).join('\n');
+  if (!/^\s*ignore-scripts\s*=\s*true/m.test(npmrcs)) {
+    out.push({
+      id: 'hardening.ignore-scripts', category: 'hardening', severity: 'low',
+      title: 'npm runs dependency install scripts', location: '~/.npmrc',
+      detail: 'Every malicious package this year ran from preinstall/postinstall. Consider `ignore-scripts=true` (or pnpm, which blocks dependency builds by default) and allow-list the few that need it.',
+    });
+  }
+  const pnpmWs = ctx.projects.map((p) => readText(join(p, 'pnpm-workspace.yaml'))).filter(Boolean).join('\n');
+  if (!/min-release-age|minimum-release-age/.test(npmrcs) && !/minimumReleaseAge/.test(pnpmWs)) {
+    out.push({
+      id: 'hardening.release-age', category: 'hardening', severity: 'low',
+      title: 'No dependency cooldown configured', location: '.npmrc',
+      detail: 'Malicious versions are usually pulled within hours. `min-release-age=3` (npm ≥ 11.10, days) or `minimumReleaseAge: 4320` (pnpm, minutes) keeps you out of that window.',
+    });
+  }
+  return out;
+}
+
+export const SCANNERS = {
+  persistence: scanPersistence,
+  npm: scanNpmrc,
+  github: scanGitHub,
+  cloud: scanCloud,
+  kubernetes: scanKubeDocker,
+  env: scanEnv,
+  ai: scanAiConfigs,
+  ssh: scanSsh,
+  dotenv: scanDotenv,
+  hardening: scanHardening,
+};

package/src/util.js

@@ -0,0 +1,126 @@
+import { createHash } from 'node:crypto';
+import { readFileSync, statSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+/** Short, non-reversible fingerprint so users can tell secrets apart without seeing them. */
+export function fingerprint(value) {
+  return 'sha256:' + createHash('sha256').update(String(value)).digest('hex').slice(0, 8);
+}
+
+export function readText(path) {
+  try {
+    const st = statSync(path);
+    if (!st.isFile() || st.size > 5 * 1024 * 1024) return null;
+    return readFileSync(path, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+export function readBytes(path) {
+  try {
+    const st = statSync(path);
+    if (!st.isFile() || st.size > 1024 * 1024) return null;
+    return readFileSync(path);
+  } catch {
+    return null;
+  }
+}
+
+export function listDir(path) {
+  try {
+    return readdirSync(path, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+}
+
+export function exists(path) {
+  try {
+    statSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function mtime(path) {
+  try {
+    return statSync(path).mtime;
+  } catch {
+    return null;
+  }
+}
+
+/** True when a value is an indirection (env reference, keychain helper, empty) rather than a literal secret. */
+export function isReference(value) {
+  if (value == null) return true;
+  const v = String(value).trim();
+  if (v === '') return true;
+  if (/^\$\{?[A-Za-z_][A-Za-z0-9_]*\}?$/.test(v)) return true; // $VAR or ${VAR}
+  if (/^\$\{(env|input):[^}]+\}$/.test(v)) return true; // ${env:VAR} / ${input:id} (VS Code)
+  if (/^(op|vault|keychain|secret|1password):\/\//i.test(v)) return true;
+  if (/^<[^>]+>$/.test(v) || /^\[[^\]]+\]$/.test(v)) return true; // <placeholder> / [YOUR_KEY]
+  if (/^(your|enter|insert|replace|add)[-_ ]?(your[-_ ]?)?[a-z_ -]*(here)?$/i.test(v) || /_here$/i.test(v)) return true;
+  if (/^\$\{\{.*\}\}$/.test(v)) return true; // ${{ secrets.X }} (GitHub Actions)
+  if (/^(x{4,}|\*{4,}|your[-_ ].*|changeme|placeholder|todo|redacted)$/i.test(v)) return true;
+  return false;
+}
+
+const SECRET_NAME = /(^|_|-)(api[-_]?key|apikey|token|secret|password|passwd|pwd|private[-_]?key|access[-_]?key|auth|credentials?|dsn|webhook[-_]?secret|client[-_]?secret|session[-_]?key)($|_|-)|^(database_url|db_url|redis_url|mongodb_uri|mongo_url|postgres_url|pg_url|amqp_url|supabase_service_role_key|stripe_.*|openai_.*key|anthropic_.*key)$/i;
+const NOT_SECRET_NAME = /(^|_)(public|publishable|anon|pk|next_public|vite|expo_public|token_url|auth_url|auth_domain|endpoint|region|ttl|expir[a-z]*|length|limit|max|timeout|path|file|enabled|disable|issuer|audience)(_|$)/i;
+
+export function looksLikeSecretName(name) {
+  return SECRET_NAME.test(name) && !NOT_SECRET_NAME.test(name);
+}
+
+const URL_NAME = /(_url|_uri|_dsn)$|^(dsn)$/i;
+
+/** Does this name/value pair hold a literal secret? URL-style names only count when they embed credentials. */
+export function isSecretPair(name, value) {
+  if (value == null || isReference(value)) return false;
+  const v = String(value);
+  if (tokenKind(v)) return true;
+  if (URL_NAME.test(name)) return /^[a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:[^@\s]+@/i.test(v) || /[?&](password|token|key|secret)=[^&\s]+/i.test(v);
+  return looksLikeSecretName(name) && v.length >= 8;
+}
+
+/** Recognise well-known token formats. Returns a provider label or null. */
+export function tokenKind(value) {
+  const v = String(value);
+  const rules = [
+    [/^npm_[A-Za-z0-9]{36}$/, 'npm token'],
+    [/^gh[pousr]_[A-Za-z0-9]{36,}$/, 'GitHub token'],
+    [/^github_pat_[A-Za-z0-9_]{60,}$/, 'GitHub fine-grained token'],
+    [/^(AKIA|ASIA)[A-Z0-9]{16}$/, 'AWS access key'],
+    [/^sk-ant-[A-Za-z0-9_-]{20,}$/, 'Anthropic key'],
+    [/^sk-(proj-)?[A-Za-z0-9_-]{20,}$/, 'OpenAI-style key'],
+    [/^sk_live_[A-Za-z0-9]{16,}$/, 'Stripe live secret key'],
+    [/^rk_live_[A-Za-z0-9]{16,}$/, 'Stripe restricted key'],
+    [/^whsec_[A-Za-z0-9]{16,}$/, 'Stripe webhook secret'],
+    [/^xox[baprs]-[A-Za-z0-9-]{10,}$/, 'Slack token'],
+    [/^AIza[0-9A-Za-z_-]{35}$/, 'Google API key'],
+    [/^glpat-[A-Za-z0-9_-]{20,}$/, 'GitLab token'],
+    [/^hf_[A-Za-z0-9]{30,}$/, 'Hugging Face token'],
+    [/^(postgres(ql)?|mysql|mongodb(\+srv)?|redis|rediss|amqps?):\/\/[^:\s]+:[^@\s]+@/, 'connection string with password'],
+  ];
+  for (const [re, label] of rules) if (re.test(v)) return label;
+  return null;
+}
+
+export function walk(root, { maxDepth = 4, skip = new Set() } = {}) {
+  const out = [];
+  const stack = [[root, 0]];
+  while (stack.length) {
+    const [dir, depth] = stack.pop();
+    for (const ent of listDir(dir)) {
+      const p = join(dir, ent.name);
+      if (ent.isDirectory()) {
+        if (depth < maxDepth && !skip.has(ent.name)) stack.push([p, depth + 1]);
+      } else if (ent.isFile()) {
+        out.push(p);
+      }
+    }
+  }
+  return out;
+}