secret-blast-radius 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Krrish Kumar
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,154 @@
-# Temporary Holding Version
+# secret-blast-radius
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![CI](https://github.com/Krrishkumar125/secret-blast-radius/actions/workflows/ci.yml/badge.svg)](https://github.com/Krrishkumar125/secret-blast-radius/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/secret-blast-radius)](https://www.npmjs.com/package/secret-blast-radius)
+
+**One bad `npm install` can read every secret on your laptop. This tells you what it would get, whether it already happened, and what to rotate first.**
+
+```bash
+npx secret-blast-radius
+```
+
+```
+✖ CRITICAL Known-malicious package @subql/common@5.8.3 (subql)
+  ~/code/indexer/package-lock.json
+  Resolved in this lockfile. Treat every machine/CI runner that installed it as compromised…
+
+✖ CRITICAL Plaintext npm credential for registry.npmjs.org
+  ~/.npmrc  sha256:3f1c9a0b
+  Any install script can read this and republish every package you maintain (this is how Shai-Hulud spreads).
+
+✖ CRITICAL VS Code task "eslint-check" auto-runs on folder open and executes a non-code file
+  ~/code/old-portfolio/.vscode/tasks.json
+  Matches the GhostAction / PolinRider launcher (tasks.json → `node public/fonts/*.woff2`)…
+
+▲ HIGH     MCP server "github" has a literal secret in env.GITHUB_PERSONAL_ACCESS_TOKEN
+  ~/.cursor/mcp.json  sha256:9b07e6c1
+
+● MEDIUM   api deploys to Railway (railway.toml)
+  Railway disclosed on Oct 21, 2026 that env vars may have been read and decrypted…
+
+Summary: 3 critical, 1 high, 1 medium, 0 low.
+Rotation order if this machine is ever compromised: 1. persistence  2. npm  3. ai  4. paas
+```
+
+*(Illustrative output: fingerprints and paths are examples.)*
+
+## Why this exists
+
+The last few weeks, in order:
+
+| When (2026) | What | What it took |
+|---|---|---|
+| Oct 5 | [`@subql/common@5.8.3`](https://osv.dev/vulnerability/MAL-2026-17571) shipped through the project's own trusted-publishing workflow | AWS (SSM + Secrets Manager, all regions), GitHub, npm, SSH, K8s, Vault. Runs on import too, so `--ignore-scripts` isn't enough |
+| Oct 7–15 | [GhostAction](https://thehackernews.com/2026/10/credential-stealing-github-actions.html): ~1,900 hijacked GitHub accounts pushed "security audit" workflows to 30,000+ repos, then a [VS Code fake-font stealer](https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file) | Actions secrets, everything in git history, `~/.npmrc`, `~/.aws`, `~/.netrc`, SSH keys, Claude/Gemini logins, plus a cron backdoor |
+| Oct 8 | [`tensorlake@0.5.144`](https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2) (Mini Shai-Hulud) | Everything above plus AI-tool and MCP configs. Installs `gh-token-monitor`, which **wipes your home directory if you revoke the stolen GitHub token** |
+| Oct 21 | [Railway](https://blog.railway.com/p/security-disclosure-wednesday-october-21st): customer env vars may have been decrypted | Every secret you stored on the platform |
+| Oct 21 | [PHP2Shell](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) (CVE-2026-109618/-109619), unauthenticated RCE | Whatever your PHP servers can reach |
+
+Every advisory ends the same way: *"rotate everything the machine could access."* Hardly anyone has that list. This tool builds it, checks for the known infections, and puts the steps in an order that won't make things worse.
+
+## What it checks
+
+**Your credentials** (what a stealer reads first):
+
+| Scanner | Looks at |
+|---|---|
+| `npm` | `~/.npmrc`, project `.npmrc`, `~/.pypirc`: literal tokens (not `${VAR}`) |
+| `github` | gh `hosts.yml` (plaintext fallback), `~/.git-credentials`, `~/.netrc` |
+| `cloud` | `~/.aws/credentials` (long-lived vs session), gcloud ADC, Azure token cache |
+| `kubernetes` | `~/.kube/config` embedded tokens/keys, `~/.docker/config.json` without `credsStore` |
+| `ai` | MCP configs for Claude Code/Desktop, Cursor, Windsurf, VS Code, Zed, Kiro, Gemini; Claude, Gemini and Codex CLI logins |
+| `ssh` | Private keys without a passphrase (PEM, PKCS#8, OpenSSH) |
+| `dotenv` | `.env*` files in your projects (names only, never values) |
+| `env` | Variables a CI step inherits (`NPM_TOKEN`, `AWS_*`, recognised token formats) |
+| `paas` | Railway, Vercel, Fly, Render, Netlify CLI tokens; Heroku in `~/.netrc`; which projects deploy where |
+
+**Signs you're already hit:**
+
+| Scanner | Detects |
+|---|---|
+| `malicious` | Known-bad versions in `package-lock.json`, `npm-shrinkwrap.json`, `pnpm-lock.yaml` (v5–v9), `yarn.lock` (classic + Berry), `bun.lock`, and in `node_modules`: tensorlake + native packages, `@subql/common@5.8.3`, `@7nohe/openapi-react-query-codegen` (10 versions), the keyv/cacheable wave; the `@opensearch/setup` worm marker |
+| `persistence` | `gh-token-monitor` (systemd unit, LaunchAgent, Windows dir, script) |
+| `host-persistence` | Crontab lines that pipe a server into `bash` (GhostAction `#ghc2`), the `manifest-cache.js --warm` process and `/tmp/tmp.ts018051808.lock` (@subql) |
+| `repo` | Workflows that contact GhostAction infrastructure, dump `git log -p --all`, or serialise `toJSON(secrets)` to the network; `.vscode/tasks.json` that auto-runs a "font"/image; Claude Code hooks that run disguised files; the tensorlake worm branch |
+
+**Exposure to this month's other incidents:**
+
+| Scanner | Detects |
+|---|---|
+| `php` | PHP2Shell-vulnerable PHP in Dockerfiles, compose files, `composer.json` platform pins and the local `php` binary. Distro builds are flagged *high, verify backport* rather than critical |
+| `certs` | PEM/CRT files and `NODE_EXTRA_CA_CERTS` bundles containing or chaining to the distrusted **emSign ECC Root CA - G3** (eMudhra) |
+| `install-scripts` | Which dependencies run install scripts, straight from the lockfile |
+| `hardening` | No `ignore-scripts`, no dependency cooldown (`min-release-age` / `minimumReleaseAge`) |
+
+## Incident mode
+
+```bash
+npx secret-blast-radius --list-incidents
+npx secret-blast-radius --incident tensorlake     # or: shai-hulud, subql, ghostaction, railway, php2shell, emudhra, sbi
+```
+
+Runs only the checks that matter for that incident and prints a sourced checklist, marking what's confirmed and what's still under investigation. `--runbook` turns it into a Markdown checklist you can paste into an incident ticket.
+
+## In CI and GitHub code scanning
+
+```yaml
+permissions:
+  contents: read
+  security-events: write
+steps:
+  - uses: actions/checkout@v4
+  - uses: Krrishkumar125/secret-blast-radius@v0.2.0
+    with:
+      fail-on: critical
+  - uses: github/codeql-action/upload-sarif@v3
+    if: always()
+    with:
+      sarif_file: secret-blast-radius.sarif
+```
+
+Or without the action: `npx secret-blast-radius@0 --only malicious,repo,php,env --fail-on critical --sarif-file sbr.sarif`.
+SARIF only gets file locations for findings inside the repo. Home-directory findings are reported without a path.
+
+## Safety
+
+- **Read-only.** It only writes files you name (`--runbook-file`, `--sarif-file`).
+- **Offline.** It makes no network requests. The IOC list is bundled (`src/iocs.json`, dated). Add your own with `--ioc-file extra.json`.
+- **Secret values are never printed.** Findings show a location and a `sha256:xxxxxxxx` fingerprint. Every output format is tested for leaks.
+- **Zero dependencies.** Helper commands (`php -r`, `crontab -l`, `ps -eo args`) are run read-only with a timeout; `--no-exec` disables them.
+
+## Options
+
+| Option | Meaning |
+|---|---|
+| `[project-dir…]` | Projects to scan for `.env`, lockfiles, Dockerfiles, workflows (default: cwd) |
+| `--incident <name>`, `--list-incidents` | Incident checklists |
+| `--json`, `--sarif`, `--sarif-file <f>` | Machine output |
+| `--runbook`, `--runbook-file <f>` | Markdown rotation checklist |
+| `--fail-on <level>` | Exit 1 at/above `critical`, `high`, `medium`, `low` (default `none`) |
+| `--only` / `--skip <list>` | Choose scanners (names in the tables above) |
+| `--ioc-file <f>` | Extra IOCs, same shape as `src/iocs.json` (repeatable) |
+| `--no-env`, `--no-exec`, `--depth <n>`, `--home <dir>`, `--no-color` | Tuning |
+
+Exit codes: `0` ok, `1` findings at/above `--fail-on`, `2` usage error.
+
+## Keeping false positives low
+
+These are skipped on purpose: `${VAR}`, `${{ secrets.X }}`, `op://…`, `[YOUR_KEY]`, `your_api_key_here`, `not-a-secret`, prose values like `this-is-a-secret-value`, credential-free URLs (`redis://localhost`, `file:./dev.db`), `.env.example/.sample/.template/.demo`, `node_modules`, ordinary `folderOpen` tasks, and Claude hooks that run normal tools. Every rule above came from running the tool on real repos (TanStack Router, symfony/demo, vercel/next.js, docker-library/wordpress, Railway templates). If you hit a false positive, please open an issue.
+
+## Limits
+
+- It checks well-known locations. It can't see your OS keychain (that's the point) or browser profiles.
+- The IOC list covers the incidents above, not every malicious package ever published. Pair it with `npm audit`, OSV or Socket.
+- For distro PHP builds it can't tell whether your vendor backported the fix.
+- A clean report shrinks your blast radius. It doesn't prove a machine is clean.
+
+## Programmatic API
+
+```js
+import { scan, runbook, toSarif, INCIDENTS } from 'secret-blast-radius';
+const result = scan({ projects: ['.'], incident: 'railway', exec: false });
+```
+
+MIT © Krrish Kumar

package/action.yml

@@ -0,0 +1,41 @@
+name: secret-blast-radius
+description: Find what a malicious install could steal in this job and repo (worm IOCs, GhostAction workflows, PHP2Shell, exposed CI secrets). Read-only; never prints secrets.
+author: Krrish Kumar
+branding:
+  icon: shield
+  color: red
+inputs:
+  only:
+    description: Comma list of scanners. Default is the set that makes sense on a CI runner.
+    default: malicious,repo,php,certs,install-scripts,env,npm,dotenv
+  fail-on:
+    description: critical | high | medium | low | none
+    default: critical
+  incident:
+    description: Optional incident name (php2shell, railway, tensorlake, shai-hulud, subql, ghostaction, emudhra, sbi)
+    default: ''
+  sarif-file:
+    description: Where to write SARIF (upload it with github/codeql-action/upload-sarif)
+    default: secret-blast-radius.sarif
+  version:
+    description: npm version or dist-tag of secret-blast-radius to run
+    default: '0'
+outputs:
+  sarif-file:
+    description: Path of the SARIF report
+    value: ${{ inputs.sarif-file }}
+runs:
+  using: composite
+  steps:
+    - name: Run secret-blast-radius
+      shell: bash
+      env:
+        SBR_ONLY: ${{ inputs.only }}
+        SBR_FAIL_ON: ${{ inputs.fail-on }}
+        SBR_INCIDENT: ${{ inputs.incident }}
+        SBR_SARIF: ${{ inputs.sarif-file }}
+        SBR_VERSION: ${{ inputs.version }}
+      run: |
+        args=(--only "$SBR_ONLY" --fail-on "$SBR_FAIL_ON" --sarif-file "$SBR_SARIF")
+        if [ -n "$SBR_INCIDENT" ]; then args+=(--incident "$SBR_INCIDENT"); fi
+        npx --yes "secret-blast-radius@${SBR_VERSION}" "${args[@]}" .

package/bin/cli.js

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import { parseArgs } from 'node:util';
+import { writeFileSync, readFileSync } from 'node:fs';
+import { scan, failsAt, formatText, formatMarkdown, runbook, toSarif, INCIDENTS } from '../src/index.js';
+
+const HELP = `Usage: secret-blast-radius [options] [project-dir...]
+
+Lists every credential an npm install script (or any process you run) could read
+on this machine or CI runner, ranks it, and writes an ordered rotation runbook.
+Read-only. Never prints secret values.
+
+Options:
+  --incident <name>    Tailored checklist + only the relevant checks. Names:
+                       php2shell, railway, tensorlake, shai-hulud, subql, ghostaction, emudhra, sbi
+  --list-incidents     Show incident names and status
+  --json               Machine-readable output
+  --sarif [file]       SARIF 2.1.0 for GitHub code scanning (stdout, or --sarif-file <f>)
+  --ioc-file <f>       Extra IOC JSON (same shape as src/iocs.json); repeatable
+  --no-exec            Never run helper commands (php -r, crontab -l, ps)
+  --runbook [file]     Print (or write to file) a Markdown rotation runbook
+  --fail-on <level>    Exit 1 if any finding is at/above level: critical|high|medium|low|none (default: none)
+  --only <list>        Comma list of scanners: persistence,npm,github,cloud,kubernetes,env,ai,ssh,dotenv,
+                       hardening,malicious,repo,host-persistence,php,paas,certs,install-scripts
+  --skip <list>        Comma list of scanners to skip
+  --no-env             Do not inspect environment variables
+  --depth <n>          How deep to look for .env files in project dirs (default 4)
+  --home <dir>         Home directory to inspect (default: your home)
+  --no-color           Disable colours
+  -v, --version        Print version
+  -h, --help           Show this help
+`;
+
+let args;
+try {
+  args = parseArgs({
+    allowPositionals: true,
+    options: {
+      json: { type: 'boolean' }, sarif: { type: 'boolean' }, 'sarif-file': { type: 'string' },
+      incident: { type: 'string' }, 'list-incidents': { type: 'boolean' }, 'ioc-file': { type: 'string', multiple: true }, 'no-exec': { type: 'boolean' }, runbook: { type: 'boolean' }, 'runbook-file': { type: 'string' },
+      'fail-on': { type: 'string', default: 'none' }, only: { type: 'string' }, skip: { type: 'string' },
+      'no-env': { type: 'boolean' }, depth: { type: 'string' }, home: { type: 'string' },
+      'no-color': { type: 'boolean' }, version: { type: 'boolean', short: 'v' }, help: { type: 'boolean', short: 'h' },
+    },
+  });
+} catch (e) {
+  console.error(e.message + '\n\n' + HELP);
+  process.exit(2);
+}
+const { values: o, positionals } = args;
+if (o.help) { process.stdout.write(HELP); process.exit(0); }
+if (o.version) {
+  console.log(JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version);
+  process.exit(0);
+}
+// `--runbook out.md`: parseArgs treats the file as positional; detect a .md positional right after.
+let runbookFile = o['runbook-file'];
+let projects = positionals;
+if (o.runbook && !runbookFile && positionals.length && /\.md$/i.test(positionals[0])) { runbookFile = positionals[0]; projects = positionals.slice(1); }
+
+if (o['list-incidents']) {
+  for (const [k, v] of Object.entries(INCIDENTS)) console.log(`${k.padEnd(12)} ${v.title}\n${' '.repeat(13)}${v.status}`);
+  process.exit(0);
+}
+const list = (s) => (s ? s.split(',').map((x) => x.trim()).filter(Boolean) : undefined);
+const skip = list(o.skip) ?? [];
+if (o['no-env']) skip.push('env');
+
+let result;
+try {
+  result = scan({ projects, home: o.home, only: list(o.only), skip, depth: o.depth ? Number(o.depth) : undefined, incident: o.incident, iocFiles: o['ioc-file'] ?? [], exec: o['no-exec'] ? false : undefined });
+  failsAt(result, o['fail-on']);
+} catch (e) {
+  console.error(`secret-blast-radius: ${e.message}`);
+  process.exit(2);
+}
+
+const version = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
+if (o.sarif || o['sarif-file']) {
+  const sarif = JSON.stringify(toSarif(result, version), null, 2) + '\n';
+  if (o['sarif-file']) { writeFileSync(o['sarif-file'], sarif); if (!o.json) console.error(`SARIF written to ${o['sarif-file']}`); } else process.stdout.write(sarif);
+}
+if (o.sarif && !o['sarif-file']) {
+  // stdout already used for SARIF
+} else if (o.json) {
+  process.stdout.write(JSON.stringify({ ...result, runbook: runbook(result).map(({ items, ...r }) => ({ ...r, findings: items.map((i) => i.id) })) }, null, 2) + '\n');
+} else if (o.runbook) {
+  const md = formatMarkdown(result);
+  if (runbookFile) { writeFileSync(runbookFile, md); console.log(`Runbook written to ${runbookFile}`); } else process.stdout.write(md + '\n');
+} else {
+  const color = !o['no-color'] && process.stdout.isTTY && !process.env.NO_COLOR;
+  console.log(formatText(result, { color }));
+}
+process.exit(failsAt(result, o['fail-on']) ? 1 : 0);

package/package.json

@@ -1,6 +1,52 @@
 {
   "name": "secret-blast-radius",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "What would a malicious npm install steal from this machine or CI runner? Ranked inventory of reachable credentials, known-worm IOCs (Shai-Hulud, @subql, GhostAction), PHP2Shell and PaaS exposure checks, ordered rotation runbook, SARIF. Read-only, offline, never prints secrets.",
+  "license": "MIT",
+  "author": "Krrish Kumar (https://github.com/Krrishkumar125)",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Krrishkumar125/secret-blast-radius.git"
+  },
+  "homepage": "https://github.com/Krrishkumar125/secret-blast-radius#readme",
+  "bugs": "https://github.com/Krrishkumar125/secret-blast-radius/issues",
+  "keywords": [
+    "security",
+    "supply-chain",
+    "npm",
+    "shai-hulud",
+    "secrets",
+    "credentials",
+    "rotation",
+    "incident-response",
+    "mcp",
+    "ci",
+    "devsecops",
+    "sarif",
+    "php2shell",
+    "ghostaction",
+    "railway",
+    "github-action"
+  ],
+  "type": "module",
+  "bin": {
+    "secret-blast-radius": "bin/cli.js"
+  },
+  "exports": {
+    ".": "./src/index.js"
+  },
+  "files": [
+    "bin",
+    "src",
+    "action.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18.18"
+  },
+  "scripts": {
+    "test": "node --test test/scanners.test.js test/supply.test.js test/cli.test.js",
+    "check": "node --check bin/cli.js && npm test"
+  }
+}

package/src/format.js

@@ -0,0 +1,51 @@
+import { runbook } from './index.js';
+import { INCIDENTS } from './incidents.js';
+
+const ICON = { critical: '✖', high: '▲', medium: '●', low: '·' };
+
+export function formatText(result, { color = false } = {}) {
+  const c = (code, s) => (color ? `\x1b[${code}m${s}\x1b[0m` : s);
+  const sev = { critical: (s) => c('1;31', s), high: (s) => c('31', s), medium: (s) => c('33', s), low: (s) => c('2', s) };
+  const lines = [];
+  const { counts } = result;
+  lines.push(c('1', 'secret-blast-radius') + ' — what a malicious install script could steal from this machine right now');
+  lines.push('');
+  if (result.incident) {
+    const inc = INCIDENTS[result.incident];
+    lines.push(c('1', inc.title), c('2', inc.status), '');
+    inc.checklist.forEach((x, i) => lines.push(`  ${i + 1}. ${x}`));
+    lines.push('', ...inc.refs.map((r) => `  ${c('2', r)}`), '', c('1', 'What this machine/project has that matters for this incident:'), '');
+  }
+  if (!result.findings.length) {
+    lines.push(result.incident ? 'Nothing relevant found by these checks.' : 'No reachable secrets found in the places checked. Nice.');
+    return lines.join('\n');
+  }
+  for (const f of result.findings) {
+    lines.push(`${sev[f.severity](`${ICON[f.severity]} ${f.severity.toUpperCase().padEnd(8)}`)} ${f.title}`);
+    lines.push(`  ${c('2', f.location + (f.fingerprint ? `  ${f.fingerprint}` : '') + (f.ageDays != null ? `  (${f.ageDays}d old)` : ''))}`);
+    lines.push(`  ${f.detail}`);
+    lines.push('');
+  }
+  lines.push(`Summary: ${counts.critical} critical, ${counts.high} high, ${counts.medium} medium, ${counts.low} low.`);
+  const rb = runbook(result);
+  if (rb.length) lines.push(`Rotation order if this machine is ever compromised: ${rb.map((r, i) => `${i + 1}. ${r.category}`).join('  ')}`);
+  lines.push('Run with --runbook for step-by-step rotation, --json for machine output. Secret values are never printed.');
+  return lines.join('\n');
+}
+
+export function formatMarkdown(result) {
+  const out = ['# Secret rotation runbook', '', `Generated ${result.scannedAt} by secret-blast-radius. Values are never included; fingerprints let you match items.`, ''];
+  if (result.incident) {
+    const inc = INCIDENTS[result.incident];
+    out.push(`## Incident: ${inc.title}`, '', `_${inc.status}_`, '', ...inc.checklist.map((x) => `- [ ] ${x}`), '', ...inc.refs.map((r) => `- ${r}`), '');
+  }
+  const rb = runbook(result);
+  if (!rb.length) return out.concat('Nothing to rotate: no reachable secrets were found.').join('\n');
+  out.push('Work top to bottom. The order matters: stop persistence first, then the credentials a worm uses to spread (npm, GitHub), then everything else.', '');
+  rb.forEach((step, i) => {
+    out.push(`## ${i + 1}. ${step.label}`, '');
+    for (const it of step.items) out.push(`- [ ] **${it.title}** — \`${it.location}\`${it.fingerprint ? ` (${it.fingerprint})` : ''}`);
+    out.push('', ...step.steps.map((s) => `1. ${s}`), '', `Reference: ${step.url}`, '');
+  });
+  return out.join('\n');
+}

package/src/incidents.js

@@ -0,0 +1,92 @@
+/** Incident playbooks. Every claim here is sourced; `status` marks what is confirmed vs still under investigation. */
+export const INCIDENTS = {
+  php2shell: {
+    title: 'PHP2Shell — CVE-2026-109618 / CVE-2026-109619 (Oct 21, 2026)',
+    status: 'Confirmed by the PHP project and CISA. CISA had not observed exploitation at publication; public PoCs were circulating.',
+    scanners: ['php'],
+    checklist: [
+      'Inventory every PHP runtime: servers, containers, base images, and products that bundle PHP (CISA: "prevalence may not be directly observable").',
+      'Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distro\'s patched build) and restart every PHP-FPM pool / Apache worker.',
+      'PHP 8.1 and older get no fix: upgrade, or take internet-facing systems offline until you can (CISA).',
+      'Rebuild images with `--pull --no-cache`; a floating `php:8.3` tag does not update images you already built.',
+      'Watch for PHP worker processes spawning shells or downloading tools.',
+    ],
+    refs: ['https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/', 'https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching'],
+  },
+  railway: {
+    title: 'Railway environment-variable exposure (disclosed Oct 21, 2026)',
+    status: 'Confirmed by Railway; scope still being determined ("may be limited to a subset of users"). Railway advises all users to act.',
+    scanners: ['paas', 'dotenv', 'env'],
+    checklist: [
+      'Roll every environment variable stored in Railway: API keys, database passwords, webhook secrets, OAuth client secrets.',
+      'Rotate private container-registry credentials configured in Railway.',
+      'Review provider logs (database, Stripe, cloud, AI providers) for use of the old keys from unknown IPs.',
+      'Redeploy once builds resume: running services keep the old values until restart.',
+      'Watch for Railway\'s direct email if your account is in the confirmed set, and status.railway.com for updates.',
+    ],
+    refs: ['https://blog.railway.com/p/security-disclosure-wednesday-october-21st'],
+  },
+  tensorlake: {
+    title: 'tensorlake@0.5.144 — Mini Shai-Hulud worm with gh-token-monitor dead-man\'s switch (Oct 8, 2026)',
+    status: 'Confirmed by the maintainer (GHSA-8g63-53c9-65j2), Socket, StepSecurity and Aikido.',
+    scanners: ['malicious', 'persistence', 'host-persistence', 'repo', 'npm', 'github', 'cloud', 'kubernetes', 'ssh', 'ai', 'dotenv', 'env'],
+    checklist: [
+      'Search lockfiles and CI logs for tensorlake@0.5.144 and tensorlake-native-*@0.5.144 (live 01:12–02:54 UTC, Oct 8).',
+      'If it ran: disconnect, then REMOVE gh-token-monitor before revoking any GitHub token (revocation triggers `rm -rf ~`).',
+      'From a clean machine rotate npm, GitHub, cloud, Kubernetes, Vault, SSH/GPG, .env, AI-tool/MCP credentials.',
+      'Check packages you publish for versions you did not release; check repos for commits by claude@users.noreply.github.com and the branch dependabot/github_actions/format/setup-formatter.',
+      'Rebuild the machine from a trusted image.',
+    ],
+    refs: ['https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2', 'https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm'],
+  },
+  subql: {
+    title: '@subql/common@5.8.3 — credential stealer + remote shell (Oct 5, 2026)',
+    status: 'Confirmed: GHSA-9333-3c4x-x3h5 / MAL-2026-17571; analysed by StepSecurity and GMO Flatt Security.',
+    scanners: ['malicious', 'host-persistence', 'cloud', 'github', 'npm', 'ssh', 'kubernetes', 'env', 'dotenv'],
+    checklist: [
+      'Search lockfiles, caches and CI logs for @subql/common@5.8.3. 5.8.2 is the last known-good release.',
+      '`--ignore-scripts` is NOT enough: importing the package also starts the payload.',
+      'Look for a running `manifest-cache.js --warm` process and /tmp/tmp.ts018051808.lock; block ci-artifacts.dev.',
+      'Rotate AWS credentials first (SSM Parameter Store and Secrets Manager were read across all regions), then GitHub, npm, SSH, Kubernetes, Vault.',
+      'Rebuild affected hosts/runners; uninstalling does not stop the detached worker.',
+    ],
+    refs: ['https://osv.dev/vulnerability/MAL-2026-17571', 'https://www.stepsecurity.io/blog/subql-ecosystem-compromised', 'https://flatt.tech/research/posts/subql-common-npm-supply-chain-attack/'],
+  },
+  ghostaction: {
+    title: 'GhostAction — malicious "security audit" workflows + VS Code fake-font stealer (Oct 7–15, 2026)',
+    status: 'Confirmed by StepSecurity, Socket, GitGuardian and OpenSourceMalware. ~1,900 accounts, 30,000+ repos targeted.',
+    scanners: ['repo', 'host-persistence', 'github', 'npm', 'cloud', 'kubernetes', 'ssh', 'ai'],
+    checklist: [
+      'Revoke GitHub sessions, PATs, OAuth grants (incl. client ID Ov23ctrqCqZ79UaYKwyq), SSH and deploy keys FIRST: deleting the workflow does not revoke the token that pushed it.',
+      'In every repo you can write to, remove workflows contacting 193.32.204.199 (security-audit.yml, lint.yml, ci-check.yml, …), .vscode/tasks.json "eslint-check" tasks and public/fonts/*.woff2 files that are really JS.',
+      'Rotate the repo\'s Actions secrets and every credential ever committed to any branch (Stage 1 reads `git log -p --all`).',
+      'If you opened an infected repo in VS Code with automatic tasks allowed: run `crontab -l` and remove lines ending in #ghc2, then rotate from a clean device.',
+      'Require approval for workflow runs and protect .github/workflows with required reviews.',
+    ],
+    refs: ['https://thehackernews.com/2026/10/credential-stealing-github-actions.html', 'https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file', 'https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/'],
+  },
+  emudhra: {
+    title: 'eMudhra — weak keys in 8 intermediates under emSign ECC Root CA - G3 (reported Oct 17–18, 2026)',
+    status: 'Confirmed by Google, Mozilla and eMudhra. eMudhra says no certificates were issued from the intermediates; root cause still under investigation.',
+    scanners: ['certs'],
+    checklist: [
+      'Website operators: if your TLS chain ends at emSign ECC Root CA - G3, get a certificate from another CA before Chrome removes the root (Oct 27, 2026 PDT).',
+      'Remove emSign ECC Root CA - G3 from custom CA bundles (NODE_EXTRA_CA_CERTS, Java truststores, pinned bundles in apps/IoT).',
+      'Clients that do not enforce Certificate Transparency or consume CRLSets/OneCRL need a trust-store update to stop trusting the intermediates.',
+      'eMudhra states its Indian DSC/eSign services run on separate hierarchies and are unaffected.',
+    ],
+    refs: ['https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/', 'https://emudhra.com/en/post/certificate-security-incident/'],
+  },
+  sbi: {
+    title: 'SBI — customer records found on the dark web (disclosed Oct 21, 2026)',
+    status: 'Under investigation. SBI\'s preliminary analysis of ~375,000 records found 3,897 customer records with PII; source not yet determined.',
+    scanners: ['dotenv', 'env', 'ai'],
+    checklist: [
+      'Nothing to scan on a developer machine for this one: it is a data exposure, not a software flaw.',
+      'Customers: expect targeted calls/SMS using real names, phone numbers, addresses and loan details. Banks never ask for OTP, PIN or remote-access apps.',
+      'Fintech/lending developers: CERT-In\'s Oct 9 and Oct 15 advisories cite exposed credentials, test APIs and plaintext payment-API keys. The secrets inventory below is where to start.',
+    ],
+    refs: ['https://economictimes.indiatimes.com/industry/banking/finance/banking/sbi-probes-suspected-data-breach-after-3-75-lakh-records-surface-on-dark-web/articleshow/135083347.cms'],
+  },
+};
+INCIDENTS['shai-hulud'] = { ...INCIDENTS.tensorlake, title: 'Mini Shai-Hulud npm worm family (keyv/cacheable Aug 2026, @7nohe/openapi-react-query-codegen, tensorlake Oct 2026)' };