secret-blast-radius 0.1.0 → 0.2.0

package/README.md

@@ -3,123 +3,152 @@
 [![CI](https://github.com/Krrishkumar125/secret-blast-radius/actions/workflows/ci.yml/badge.svg)](https://github.com/Krrishkumar125/secret-blast-radius/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/secret-blast-radius)](https://www.npmjs.com/package/secret-blast-radius)
 
-**If a malicious `npm install` ran on this machine right now, what would it get, and what would you rotate first?**
+**One bad `npm install` can read every secret on your laptop. This tells you what it would get, whether it already happened, and what to rotate first.**
 
 ```bash
 npx secret-blast-radius
 ```
 
 ```
+✖ CRITICAL Known-malicious package @subql/common@5.8.3 (subql)
+  ~/code/indexer/package-lock.json
+  Resolved in this lockfile. Treat every machine/CI runner that installed it as compromised…
+
 ✖ CRITICAL Plaintext npm credential for registry.npmjs.org
   ~/.npmrc  sha256:3f1c9a0b
   Any install script can read this and republish every package you maintain (this is how Shai-Hulud spreads).
 
-✖ CRITICAL GitHub CLI token stored in plaintext
-  ~/.config/gh/hosts.yml  sha256:a81d22e4
-  gh fell back to a plaintext file (no OS keyring). Install scripts can read it and push to every repo you can write to.
+✖ CRITICAL VS Code task "eslint-check" auto-runs on folder open and executes a non-code file
+  ~/code/old-portfolio/.vscode/tasks.json
+  Matches the GhostAction / PolinRider launcher (tasks.json → `node public/fonts/*.woff2`)…
 
 ▲ HIGH     MCP server "github" has a literal secret in env.GITHUB_PERSONAL_ACCESS_TOKEN
   ~/.cursor/mcp.json  sha256:9b07e6c1
 
-● MEDIUM   2 secret(s) in apps/api/.env
-  Keys: DATABASE_URL, STRIPE_SECRET_KEY — recognised: connection string with password, Stripe live secret key.
+● MEDIUM   api deploys to Railway (railway.toml)
+  Railway disclosed on Oct 21, 2026 that env vars may have been read and decrypted…
 
-Summary: 2 critical, 1 high, 1 medium, 0 low.
-Rotation order if this machine is ever compromised: 1. npm  2. github  3. ai  4. dotenv
+Summary: 3 critical, 1 high, 1 medium, 0 low.
+Rotation order if this machine is ever compromised: 1. persistence  2. npm  3. ai  4. paas
 ```
 
-## Why
+*(Illustrative output: fingerprints and paths are examples.)*
 
-October 2026 alone: `tensorlake@0.5.144` and other "Mini Shai-Hulud" releases ran a `preinstall` hook that harvested
-npm, GitHub, cloud, Kubernetes, SSH, `.env` **and coding-agent/MCP config** credentials, then used the npm token to
-republish itself ([advisory](https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2),
-[StepSecurity](https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm)). Railway told every
-customer to rotate secrets after env vars may have been decrypted
-([disclosure](https://blog.railway.com/p/security-disclosure-wednesday-october-21st)).
+## Why this exists
 
-Advisories say "rotate everything the machine could access". Few people know what that list is. This tool writes it
-for you, **before** an incident (so you can shrink it) and **during** one (so you rotate in the right order).
+The last few weeks, in order:
 
-What's different from existing tools:
+| When (2026) | What | What it took |
+|---|---|---|
+| Oct 5 | [`@subql/common@5.8.3`](https://osv.dev/vulnerability/MAL-2026-17571) shipped through the project's own trusted-publishing workflow | AWS (SSM + Secrets Manager, all regions), GitHub, npm, SSH, K8s, Vault. Runs on import too, so `--ignore-scripts` isn't enough |
+| Oct 7–15 | [GhostAction](https://thehackernews.com/2026/10/credential-stealing-github-actions.html): ~1,900 hijacked GitHub accounts pushed "security audit" workflows to 30,000+ repos, then a [VS Code fake-font stealer](https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file) | Actions secrets, everything in git history, `~/.npmrc`, `~/.aws`, `~/.netrc`, SSH keys, Claude/Gemini logins, plus a cron backdoor |
+| Oct 8 | [`tensorlake@0.5.144`](https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2) (Mini Shai-Hulud) | Everything above plus AI-tool and MCP configs. Installs `gh-token-monitor`, which **wipes your home directory if you revoke the stolen GitHub token** |
+| Oct 21 | [Railway](https://blog.railway.com/p/security-disclosure-wednesday-october-21st): customer env vars may have been decrypted | Every secret you stored on the platform |
+| Oct 21 | [PHP2Shell](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) (CVE-2026-109618/-109619), unauthenticated RCE | Whatever your PHP servers can reach |
 
-- **Not a malware/IOC scanner** ([shai-hulud-detect](https://github.com/cobenian/shai-hulud-detect) does that well) and
-  **not a repo secret scanner** (gitleaks, trufflehog scan git history). It inventories the credentials *reachable on the
-  machine or CI runner*, which is exactly what an install script can read.
-- **One report across every place:** npm, GitHub CLI and git, AWS/GCP/Azure, kubeconfig and docker, SSH keys, MCP configs for
-  Claude, Cursor, Windsurf, VS Code, Zed, Kiro and Gemini, project `.env` files, and the environment variables a CI step inherits.
-- **An ordered rotation runbook.** Order matters: the worm's `gh-token-monitor` wipes your home directory when you revoke
-  the stolen GitHub token, so persistence comes first, then the credentials a worm spreads with (npm, GitHub), then the rest.
+Every advisory ends the same way: *"rotate everything the machine could access."* Hardly anyone has that list. This tool builds it, checks for the known infections, and puts the steps in an order that won't make things worse.
 
-## Safety
+## What it checks
+
+**Your credentials** (what a stealer reads first):
+
+| Scanner | Looks at |
+|---|---|
+| `npm` | `~/.npmrc`, project `.npmrc`, `~/.pypirc`: literal tokens (not `${VAR}`) |
+| `github` | gh `hosts.yml` (plaintext fallback), `~/.git-credentials`, `~/.netrc` |
+| `cloud` | `~/.aws/credentials` (long-lived vs session), gcloud ADC, Azure token cache |
+| `kubernetes` | `~/.kube/config` embedded tokens/keys, `~/.docker/config.json` without `credsStore` |
+| `ai` | MCP configs for Claude Code/Desktop, Cursor, Windsurf, VS Code, Zed, Kiro, Gemini; Claude, Gemini and Codex CLI logins |
+| `ssh` | Private keys without a passphrase (PEM, PKCS#8, OpenSSH) |
+| `dotenv` | `.env*` files in your projects (names only, never values) |
+| `env` | Variables a CI step inherits (`NPM_TOKEN`, `AWS_*`, recognised token formats) |
+| `paas` | Railway, Vercel, Fly, Render, Netlify CLI tokens; Heroku in `~/.netrc`; which projects deploy where |
+
+**Signs you're already hit:**
+
+| Scanner | Detects |
+|---|---|
+| `malicious` | Known-bad versions in `package-lock.json`, `npm-shrinkwrap.json`, `pnpm-lock.yaml` (v5–v9), `yarn.lock` (classic + Berry), `bun.lock`, and in `node_modules`: tensorlake + native packages, `@subql/common@5.8.3`, `@7nohe/openapi-react-query-codegen` (10 versions), the keyv/cacheable wave; the `@opensearch/setup` worm marker |
+| `persistence` | `gh-token-monitor` (systemd unit, LaunchAgent, Windows dir, script) |
+| `host-persistence` | Crontab lines that pipe a server into `bash` (GhostAction `#ghc2`), the `manifest-cache.js --warm` process and `/tmp/tmp.ts018051808.lock` (@subql) |
+| `repo` | Workflows that contact GhostAction infrastructure, dump `git log -p --all`, or serialise `toJSON(secrets)` to the network; `.vscode/tasks.json` that auto-runs a "font"/image; Claude Code hooks that run disguised files; the tensorlake worm branch |
+
+**Exposure to this month's other incidents:**
 
-- Read-only. It never writes anywhere except an optional runbook file you name.
-- **No network requests**. Zero dependencies.
-- **Secret values are never printed.** Findings show a location and a `sha256:xxxxxxxx` fingerprint so you can tell keys apart.
-  The test suite checks every output format for leaks.
+| Scanner | Detects |
+|---|---|
+| `php` | PHP2Shell-vulnerable PHP in Dockerfiles, compose files, `composer.json` platform pins and the local `php` binary. Distro builds are flagged *high, verify backport* rather than critical |
+| `certs` | PEM/CRT files and `NODE_EXTRA_CA_CERTS` bundles containing or chaining to the distrusted **emSign ECC Root CA - G3** (eMudhra) |
+| `install-scripts` | Which dependencies run install scripts, straight from the lockfile |
+| `hardening` | No `ignore-scripts`, no dependency cooldown (`min-release-age` / `minimumReleaseAge`) |
 
-## Usage
+## Incident mode
 
 ```bash
-npx secret-blast-radius                       # scan home dir + current project
-npx secret-blast-radius ~/code/api ~/code/web # scan specific projects for .env files
-npx secret-blast-radius --runbook             # Markdown rotation checklist to stdout
-npx secret-blast-radius --runbook-file rotate.md --runbook
-npx secret-blast-radius --json                # machine-readable
-npx secret-blast-radius --fail-on high        # exit 1 if anything high or critical (CI gate)
-npx secret-blast-radius --only npm,github,ai  # pick scanners
+npx secret-blast-radius --list-incidents
+npx secret-blast-radius --incident tensorlake     # or: shai-hulud, subql, ghostaction, railway, php2shell, emudhra, sbi
 ```
 
-| Option | Meaning |
-|---|---|
-| `--json` | JSON report including the ordered runbook |
-| `--runbook`, `--runbook-file <f>` | Markdown rotation checklist |
-| `--fail-on <level>` | `critical`, `high`, `medium`, `low` or `none` (default) |
-| `--only` / `--skip <list>` | `persistence,npm,github,cloud,kubernetes,env,ai,ssh,dotenv,hardening` |
-| `--no-env` | Skip environment variables |
-| `--depth <n>` | How deep to search project dirs for `.env*` (default 4; skips `node_modules`, `.git`, build dirs) |
-| `--home <dir>` | Inspect another home directory (e.g. a mounted disk image) |
+Runs only the checks that matter for that incident and prints a sourced checklist, marking what's confirmed and what's still under investigation. `--runbook` turns it into a Markdown checklist you can paste into an incident ticket.
 
-### In CI: what does `npm install` get to see?
+## In CI and GitHub code scanning
 
 ```yaml
-- run: npx secret-blast-radius@0 --only env,npm --fail-on critical
+permissions:
+  contents: read
+  security-events: write
+steps:
+  - uses: actions/checkout@v4
+  - uses: Krrishkumar125/secret-blast-radius@v0.2.0
+    with:
+      fail-on: critical
+  - uses: github/codeql-action/upload-sarif@v3
+    if: always()
+    with:
+      sarif_file: secret-blast-radius.sarif
 ```
 
-If that fails, a secret such as `NPM_TOKEN` is exposed to every dependency's install script in that job. Move it to the
-publish step only, or switch to [trusted publishing](https://docs.npmjs.com/trusted-publishers).
+Or without the action: `npx secret-blast-radius@0 --only malicious,repo,php,env --fail-on critical --sarif-file sbr.sarif`.
+SARIF only gets file locations for findings inside the repo. Home-directory findings are reported without a path.
 
-## What it checks
+## Safety
 
-| Scanner | Looks at | Flags |
-|---|---|---|
-| `persistence` | `gh-token-monitor` files (Linux, macOS, Windows) | Active Shai-Hulud "hostage token" service |
-| `npm` | `~/.npmrc`, project `.npmrc` | Literal `_authToken` / `_auth` / `_password` (not `${VAR}`) |
-| `github` | gh `hosts.yml`, `~/.git-credentials` | Tokens stored in plaintext instead of the keyring |
-| `cloud` | `~/.aws/credentials`, gcloud ADC, Azure token cache | Long-lived keys (critical) vs session keys |
-| `kubernetes` | `~/.kube/config`, `~/.docker/config.json` | Embedded tokens/client keys, registry auth without `credsStore` |
-| `env` | Current process environment | Known token formats and secret-named variables |
-| `ai` | MCP configs for Claude Code/Desktop, Cursor, Windsurf, VS Code, Zed, Kiro, Gemini; Codex auth | Literal keys in `env`, `headers`, `args`, URL query |
-| `ssh` | `~/.ssh/*` private keys | Keys without a passphrase (PEM, PKCS#8 and OpenSSH formats) |
-| `dotenv` | `.env*` in project dirs (not `.env.example`) | Secret-named keys and recognised tokens; URLs only when they embed a password |
-| `hardening` | `.npmrc`, `pnpm-workspace.yaml` | No `ignore-scripts`, no dependency cooldown (`min-release-age` / `minimumReleaseAge`) |
-
-Placeholders such as `${VAR}`, `${{ secrets.X }}`, `${env:X}`, `op://…`, `<token>`, `[YOUR_KEY]` and `your_api_key_here` are ignored.
+- **Read-only.** It only writes files you name (`--runbook-file`, `--sarif-file`).
+- **Offline.** It makes no network requests. The IOC list is bundled (`src/iocs.json`, dated). Add your own with `--ioc-file extra.json`.
+- **Secret values are never printed.** Findings show a location and a `sha256:xxxxxxxx` fingerprint. Every output format is tested for leaks.
+- **Zero dependencies.** Helper commands (`php -r`, `crontab -l`, `ps -eo args`) are run read-only with a timeout; `--no-exec` disables them.
 
-## Programmatic API
+## Options
 
-```js
-import { scan, runbook, failsAt, formatMarkdown } from 'secret-blast-radius';
+| Option | Meaning |
+|---|---|
+| `[project-dir…]` | Projects to scan for `.env`, lockfiles, Dockerfiles, workflows (default: cwd) |
+| `--incident <name>`, `--list-incidents` | Incident checklists |
+| `--json`, `--sarif`, `--sarif-file <f>` | Machine output |
+| `--runbook`, `--runbook-file <f>` | Markdown rotation checklist |
+| `--fail-on <level>` | Exit 1 at/above `critical`, `high`, `medium`, `low` (default `none`) |
+| `--only` / `--skip <list>` | Choose scanners (names in the tables above) |
+| `--ioc-file <f>` | Extra IOCs, same shape as `src/iocs.json` (repeatable) |
+| `--no-env`, `--no-exec`, `--depth <n>`, `--home <dir>`, `--no-color` | Tuning |
 
-const result = scan({ projects: ['.'], skip: ['env'] });
-console.log(result.counts);            // { critical, high, medium, low }
-console.log(runbook(result)[0].label); // first thing to rotate
-```
+Exit codes: `0` ok, `1` findings at/above `--fail-on`, `2` usage error.
+
+## Keeping false positives low
+
+These are skipped on purpose: `${VAR}`, `${{ secrets.X }}`, `op://…`, `[YOUR_KEY]`, `your_api_key_here`, `not-a-secret`, prose values like `this-is-a-secret-value`, credential-free URLs (`redis://localhost`, `file:./dev.db`), `.env.example/.sample/.template/.demo`, `node_modules`, ordinary `folderOpen` tasks, and Claude hooks that run normal tools. Every rule above came from running the tool on real repos (TanStack Router, symfony/demo, vercel/next.js, docker-library/wordpress, Railway templates). If you hit a false positive, please open an issue.
 
 ## Limits
 
-It checks well-known locations; it can't see secrets in your OS keychain (which is the point), browser profiles, or files
-in unusual paths. A clean report shrinks your blast radius; it doesn't prove a machine is uncompromised.
+- It checks well-known locations. It can't see your OS keychain (that's the point) or browser profiles.
+- The IOC list covers the incidents above, not every malicious package ever published. Pair it with `npm audit`, OSV or Socket.
+- For distro PHP builds it can't tell whether your vendor backported the fix.
+- A clean report shrinks your blast radius. It doesn't prove a machine is clean.
 
-## License
+## Programmatic API
+
+```js
+import { scan, runbook, toSarif, INCIDENTS } from 'secret-blast-radius';
+const result = scan({ projects: ['.'], incident: 'railway', exec: false });
+```
 
 MIT © Krrish Kumar

package/action.yml

@@ -0,0 +1,41 @@
+name: secret-blast-radius
+description: Find what a malicious install could steal in this job and repo (worm IOCs, GhostAction workflows, PHP2Shell, exposed CI secrets). Read-only; never prints secrets.
+author: Krrish Kumar
+branding:
+  icon: shield
+  color: red
+inputs:
+  only:
+    description: Comma list of scanners. Default is the set that makes sense on a CI runner.
+    default: malicious,repo,php,certs,install-scripts,env,npm,dotenv
+  fail-on:
+    description: critical | high | medium | low | none
+    default: critical
+  incident:
+    description: Optional incident name (php2shell, railway, tensorlake, shai-hulud, subql, ghostaction, emudhra, sbi)
+    default: ''
+  sarif-file:
+    description: Where to write SARIF (upload it with github/codeql-action/upload-sarif)
+    default: secret-blast-radius.sarif
+  version:
+    description: npm version or dist-tag of secret-blast-radius to run
+    default: '0'
+outputs:
+  sarif-file:
+    description: Path of the SARIF report
+    value: ${{ inputs.sarif-file }}
+runs:
+  using: composite
+  steps:
+    - name: Run secret-blast-radius
+      shell: bash
+      env:
+        SBR_ONLY: ${{ inputs.only }}
+        SBR_FAIL_ON: ${{ inputs.fail-on }}
+        SBR_INCIDENT: ${{ inputs.incident }}
+        SBR_SARIF: ${{ inputs.sarif-file }}
+        SBR_VERSION: ${{ inputs.version }}
+      run: |
+        args=(--only "$SBR_ONLY" --fail-on "$SBR_FAIL_ON" --sarif-file "$SBR_SARIF")
+        if [ -n "$SBR_INCIDENT" ]; then args+=(--incident "$SBR_INCIDENT"); fi
+        npx --yes "secret-blast-radius@${SBR_VERSION}" "${args[@]}" .

package/bin/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { parseArgs } from 'node:util';
 import { writeFileSync, readFileSync } from 'node:fs';
-import { scan, failsAt, formatText, formatMarkdown, runbook } from '../src/index.js';
+import { scan, failsAt, formatText, formatMarkdown, runbook, toSarif, INCIDENTS } from '../src/index.js';
 
 const HELP = `Usage: secret-blast-radius [options] [project-dir...]
 
@@ -10,10 +10,17 @@ on this machine or CI runner, ranks it, and writes an ordered rotation runbook.
 Read-only. Never prints secret values.
 
 Options:
+  --incident <name>    Tailored checklist + only the relevant checks. Names:
+                       php2shell, railway, tensorlake, shai-hulud, subql, ghostaction, emudhra, sbi
+  --list-incidents     Show incident names and status
   --json               Machine-readable output
+  --sarif [file]       SARIF 2.1.0 for GitHub code scanning (stdout, or --sarif-file <f>)
+  --ioc-file <f>       Extra IOC JSON (same shape as src/iocs.json); repeatable
+  --no-exec            Never run helper commands (php -r, crontab -l, ps)
   --runbook [file]     Print (or write to file) a Markdown rotation runbook
   --fail-on <level>    Exit 1 if any finding is at/above level: critical|high|medium|low|none (default: none)
-  --only <list>        Comma list of scanners: persistence,npm,github,cloud,kubernetes,env,ai,ssh,dotenv,hardening
+  --only <list>        Comma list of scanners: persistence,npm,github,cloud,kubernetes,env,ai,ssh,dotenv,
+                       hardening,malicious,repo,host-persistence,php,paas,certs,install-scripts
   --skip <list>        Comma list of scanners to skip
   --no-env             Do not inspect environment variables
   --depth <n>          How deep to look for .env files in project dirs (default 4)
@@ -28,7 +35,8 @@ try {
   args = parseArgs({
     allowPositionals: true,
     options: {
-      json: { type: 'boolean' }, runbook: { type: 'boolean' }, 'runbook-file': { type: 'string' },
+      json: { type: 'boolean' }, sarif: { type: 'boolean' }, 'sarif-file': { type: 'string' },
+      incident: { type: 'string' }, 'list-incidents': { type: 'boolean' }, 'ioc-file': { type: 'string', multiple: true }, 'no-exec': { type: 'boolean' }, runbook: { type: 'boolean' }, 'runbook-file': { type: 'string' },
       'fail-on': { type: 'string', default: 'none' }, only: { type: 'string' }, skip: { type: 'string' },
       'no-env': { type: 'boolean' }, depth: { type: 'string' }, home: { type: 'string' },
       'no-color': { type: 'boolean' }, version: { type: 'boolean', short: 'v' }, help: { type: 'boolean', short: 'h' },
@@ -49,20 +57,31 @@ let runbookFile = o['runbook-file'];
 let projects = positionals;
 if (o.runbook && !runbookFile && positionals.length && /\.md$/i.test(positionals[0])) { runbookFile = positionals[0]; projects = positionals.slice(1); }
 
+if (o['list-incidents']) {
+  for (const [k, v] of Object.entries(INCIDENTS)) console.log(`${k.padEnd(12)} ${v.title}\n${' '.repeat(13)}${v.status}`);
+  process.exit(0);
+}
 const list = (s) => (s ? s.split(',').map((x) => x.trim()).filter(Boolean) : undefined);
 const skip = list(o.skip) ?? [];
 if (o['no-env']) skip.push('env');
 
 let result;
 try {
-  result = scan({ projects, home: o.home, only: list(o.only), skip, depth: o.depth ? Number(o.depth) : undefined });
+  result = scan({ projects, home: o.home, only: list(o.only), skip, depth: o.depth ? Number(o.depth) : undefined, incident: o.incident, iocFiles: o['ioc-file'] ?? [], exec: o['no-exec'] ? false : undefined });
   failsAt(result, o['fail-on']);
 } catch (e) {
   console.error(`secret-blast-radius: ${e.message}`);
   process.exit(2);
 }
 
-if (o.json) {
+const version = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
+if (o.sarif || o['sarif-file']) {
+  const sarif = JSON.stringify(toSarif(result, version), null, 2) + '\n';
+  if (o['sarif-file']) { writeFileSync(o['sarif-file'], sarif); if (!o.json) console.error(`SARIF written to ${o['sarif-file']}`); } else process.stdout.write(sarif);
+}
+if (o.sarif && !o['sarif-file']) {
+  // stdout already used for SARIF
+} else if (o.json) {
   process.stdout.write(JSON.stringify({ ...result, runbook: runbook(result).map(({ items, ...r }) => ({ ...r, findings: items.map((i) => i.id) })) }, null, 2) + '\n');
 } else if (o.runbook) {
   const md = formatMarkdown(result);

package/package.json

@@ -1,20 +1,52 @@
 {
   "name": "secret-blast-radius",
-  "version": "0.1.0",
-  "description": "See every credential a malicious npm install script could steal from your machine or CI runner (npm/GitHub tokens, cloud keys, MCP configs, SSH keys, .env), ranked, with an ordered rotation runbook. Read-only; never prints secrets.",
+  "version": "0.2.0",
+  "description": "What would a malicious npm install steal from this machine or CI runner? Ranked inventory of reachable credentials, known-worm IOCs (Shai-Hulud, @subql, GhostAction), PHP2Shell and PaaS exposure checks, ordered rotation runbook, SARIF. Read-only, offline, never prints secrets.",
   "license": "MIT",
   "author": "Krrish Kumar (https://github.com/Krrishkumar125)",
-  "repository": { "type": "git", "url": "git+https://github.com/Krrishkumar125/secret-blast-radius.git" },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Krrishkumar125/secret-blast-radius.git"
+  },
   "homepage": "https://github.com/Krrishkumar125/secret-blast-radius#readme",
   "bugs": "https://github.com/Krrishkumar125/secret-blast-radius/issues",
-  "keywords": ["security", "supply-chain", "npm", "shai-hulud", "secrets", "credentials", "rotation", "incident-response", "mcp", "ci", "devsecops"],
+  "keywords": [
+    "security",
+    "supply-chain",
+    "npm",
+    "shai-hulud",
+    "secrets",
+    "credentials",
+    "rotation",
+    "incident-response",
+    "mcp",
+    "ci",
+    "devsecops",
+    "sarif",
+    "php2shell",
+    "ghostaction",
+    "railway",
+    "github-action"
+  ],
   "type": "module",
-  "bin": { "secret-blast-radius": "bin/cli.js" },
-  "exports": { ".": "./src/index.js" },
-  "files": ["bin", "src", "README.md", "LICENSE"],
-  "engines": { "node": ">=18.18" },
+  "bin": {
+    "secret-blast-radius": "bin/cli.js"
+  },
+  "exports": {
+    ".": "./src/index.js"
+  },
+  "files": [
+    "bin",
+    "src",
+    "action.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18.18"
+  },
   "scripts": {
-    "test": "node --test test/scanners.test.js test/cli.test.js",
+    "test": "node --test test/scanners.test.js test/supply.test.js test/cli.test.js",
     "check": "node --check bin/cli.js && npm test"
   }
 }

package/src/format.js

@@ -1,4 +1,5 @@
 import { runbook } from './index.js';
+import { INCIDENTS } from './incidents.js';
 
 const ICON = { critical: '✖', high: '▲', medium: '●', low: '·' };
 
@@ -9,8 +10,14 @@ export function formatText(result, { color = false } = {}) {
   const { counts } = result;
   lines.push(c('1', 'secret-blast-radius') + ' — what a malicious install script could steal from this machine right now');
   lines.push('');
+  if (result.incident) {
+    const inc = INCIDENTS[result.incident];
+    lines.push(c('1', inc.title), c('2', inc.status), '');
+    inc.checklist.forEach((x, i) => lines.push(`  ${i + 1}. ${x}`));
+    lines.push('', ...inc.refs.map((r) => `  ${c('2', r)}`), '', c('1', 'What this machine/project has that matters for this incident:'), '');
+  }
   if (!result.findings.length) {
-    lines.push('No reachable secrets found in the places checked. Nice.');
+    lines.push(result.incident ? 'Nothing relevant found by these checks.' : 'No reachable secrets found in the places checked. Nice.');
     return lines.join('\n');
   }
   for (const f of result.findings) {
@@ -28,6 +35,10 @@ export function formatText(result, { color = false } = {}) {
 
 export function formatMarkdown(result) {
   const out = ['# Secret rotation runbook', '', `Generated ${result.scannedAt} by secret-blast-radius. Values are never included; fingerprints let you match items.`, ''];
+  if (result.incident) {
+    const inc = INCIDENTS[result.incident];
+    out.push(`## Incident: ${inc.title}`, '', `_${inc.status}_`, '', ...inc.checklist.map((x) => `- [ ] ${x}`), '', ...inc.refs.map((r) => `- ${r}`), '');
+  }
   const rb = runbook(result);
   if (!rb.length) return out.concat('Nothing to rotate: no reachable secrets were found.').join('\n');
   out.push('Work top to bottom. The order matters: stop persistence first, then the credentials a worm uses to spread (npm, GitHub), then everything else.', '');

package/src/incidents.js

@@ -0,0 +1,92 @@
+/** Incident playbooks. Every claim here is sourced; `status` marks what is confirmed vs still under investigation. */
+export const INCIDENTS = {
+  php2shell: {
+    title: 'PHP2Shell — CVE-2026-109618 / CVE-2026-109619 (Oct 21, 2026)',
+    status: 'Confirmed by the PHP project and CISA. CISA had not observed exploitation at publication; public PoCs were circulating.',
+    scanners: ['php'],
+    checklist: [
+      'Inventory every PHP runtime: servers, containers, base images, and products that bundle PHP (CISA: "prevalence may not be directly observable").',
+      'Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distro\'s patched build) and restart every PHP-FPM pool / Apache worker.',
+      'PHP 8.1 and older get no fix: upgrade, or take internet-facing systems offline until you can (CISA).',
+      'Rebuild images with `--pull --no-cache`; a floating `php:8.3` tag does not update images you already built.',
+      'Watch for PHP worker processes spawning shells or downloading tools.',
+    ],
+    refs: ['https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/', 'https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching'],
+  },
+  railway: {
+    title: 'Railway environment-variable exposure (disclosed Oct 21, 2026)',
+    status: 'Confirmed by Railway; scope still being determined ("may be limited to a subset of users"). Railway advises all users to act.',
+    scanners: ['paas', 'dotenv', 'env'],
+    checklist: [
+      'Roll every environment variable stored in Railway: API keys, database passwords, webhook secrets, OAuth client secrets.',
+      'Rotate private container-registry credentials configured in Railway.',
+      'Review provider logs (database, Stripe, cloud, AI providers) for use of the old keys from unknown IPs.',
+      'Redeploy once builds resume: running services keep the old values until restart.',
+      'Watch for Railway\'s direct email if your account is in the confirmed set, and status.railway.com for updates.',
+    ],
+    refs: ['https://blog.railway.com/p/security-disclosure-wednesday-october-21st'],
+  },
+  tensorlake: {
+    title: 'tensorlake@0.5.144 — Mini Shai-Hulud worm with gh-token-monitor dead-man\'s switch (Oct 8, 2026)',
+    status: 'Confirmed by the maintainer (GHSA-8g63-53c9-65j2), Socket, StepSecurity and Aikido.',
+    scanners: ['malicious', 'persistence', 'host-persistence', 'repo', 'npm', 'github', 'cloud', 'kubernetes', 'ssh', 'ai', 'dotenv', 'env'],
+    checklist: [
+      'Search lockfiles and CI logs for tensorlake@0.5.144 and tensorlake-native-*@0.5.144 (live 01:12–02:54 UTC, Oct 8).',
+      'If it ran: disconnect, then REMOVE gh-token-monitor before revoking any GitHub token (revocation triggers `rm -rf ~`).',
+      'From a clean machine rotate npm, GitHub, cloud, Kubernetes, Vault, SSH/GPG, .env, AI-tool/MCP credentials.',
+      'Check packages you publish for versions you did not release; check repos for commits by claude@users.noreply.github.com and the branch dependabot/github_actions/format/setup-formatter.',
+      'Rebuild the machine from a trusted image.',
+    ],
+    refs: ['https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2', 'https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm'],
+  },
+  subql: {
+    title: '@subql/common@5.8.3 — credential stealer + remote shell (Oct 5, 2026)',
+    status: 'Confirmed: GHSA-9333-3c4x-x3h5 / MAL-2026-17571; analysed by StepSecurity and GMO Flatt Security.',
+    scanners: ['malicious', 'host-persistence', 'cloud', 'github', 'npm', 'ssh', 'kubernetes', 'env', 'dotenv'],
+    checklist: [
+      'Search lockfiles, caches and CI logs for @subql/common@5.8.3. 5.8.2 is the last known-good release.',
+      '`--ignore-scripts` is NOT enough: importing the package also starts the payload.',
+      'Look for a running `manifest-cache.js --warm` process and /tmp/tmp.ts018051808.lock; block ci-artifacts.dev.',
+      'Rotate AWS credentials first (SSM Parameter Store and Secrets Manager were read across all regions), then GitHub, npm, SSH, Kubernetes, Vault.',
+      'Rebuild affected hosts/runners; uninstalling does not stop the detached worker.',
+    ],
+    refs: ['https://osv.dev/vulnerability/MAL-2026-17571', 'https://www.stepsecurity.io/blog/subql-ecosystem-compromised', 'https://flatt.tech/research/posts/subql-common-npm-supply-chain-attack/'],
+  },
+  ghostaction: {
+    title: 'GhostAction — malicious "security audit" workflows + VS Code fake-font stealer (Oct 7–15, 2026)',
+    status: 'Confirmed by StepSecurity, Socket, GitGuardian and OpenSourceMalware. ~1,900 accounts, 30,000+ repos targeted.',
+    scanners: ['repo', 'host-persistence', 'github', 'npm', 'cloud', 'kubernetes', 'ssh', 'ai'],
+    checklist: [
+      'Revoke GitHub sessions, PATs, OAuth grants (incl. client ID Ov23ctrqCqZ79UaYKwyq), SSH and deploy keys FIRST: deleting the workflow does not revoke the token that pushed it.',
+      'In every repo you can write to, remove workflows contacting 193.32.204.199 (security-audit.yml, lint.yml, ci-check.yml, …), .vscode/tasks.json "eslint-check" tasks and public/fonts/*.woff2 files that are really JS.',
+      'Rotate the repo\'s Actions secrets and every credential ever committed to any branch (Stage 1 reads `git log -p --all`).',
+      'If you opened an infected repo in VS Code with automatic tasks allowed: run `crontab -l` and remove lines ending in #ghc2, then rotate from a clean device.',
+      'Require approval for workflow runs and protect .github/workflows with required reviews.',
+    ],
+    refs: ['https://thehackernews.com/2026/10/credential-stealing-github-actions.html', 'https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file', 'https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/'],
+  },
+  emudhra: {
+    title: 'eMudhra — weak keys in 8 intermediates under emSign ECC Root CA - G3 (reported Oct 17–18, 2026)',
+    status: 'Confirmed by Google, Mozilla and eMudhra. eMudhra says no certificates were issued from the intermediates; root cause still under investigation.',
+    scanners: ['certs'],
+    checklist: [
+      'Website operators: if your TLS chain ends at emSign ECC Root CA - G3, get a certificate from another CA before Chrome removes the root (Oct 27, 2026 PDT).',
+      'Remove emSign ECC Root CA - G3 from custom CA bundles (NODE_EXTRA_CA_CERTS, Java truststores, pinned bundles in apps/IoT).',
+      'Clients that do not enforce Certificate Transparency or consume CRLSets/OneCRL need a trust-store update to stop trusting the intermediates.',
+      'eMudhra states its Indian DSC/eSign services run on separate hierarchies and are unaffected.',
+    ],
+    refs: ['https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/', 'https://emudhra.com/en/post/certificate-security-incident/'],
+  },
+  sbi: {
+    title: 'SBI — customer records found on the dark web (disclosed Oct 21, 2026)',
+    status: 'Under investigation. SBI\'s preliminary analysis of ~375,000 records found 3,897 customer records with PII; source not yet determined.',
+    scanners: ['dotenv', 'env', 'ai'],
+    checklist: [
+      'Nothing to scan on a developer machine for this one: it is a data exposure, not a software flaw.',
+      'Customers: expect targeted calls/SMS using real names, phone numbers, addresses and loan details. Banks never ask for OTP, PIN or remote-access apps.',
+      'Fintech/lending developers: CERT-In\'s Oct 9 and Oct 15 advisories cite exposed credentials, test APIs and plaintext payment-API keys. The secrets inventory below is where to start.',
+    ],
+    refs: ['https://economictimes.indiatimes.com/industry/banking/finance/banking/sbi-probes-suspected-data-breach-after-3-75-lakh-records-surface-on-dark-web/articleshow/135083347.cms'],
+  },
+};
+INCIDENTS['shai-hulud'] = { ...INCIDENTS.tensorlake, title: 'Mini Shai-Hulud npm worm family (keyv/cacheable Aug 2026, @7nohe/openapi-react-query-codegen, tensorlake Oct 2026)' };

package/src/index.js

@@ -1,6 +1,20 @@
 import { homedir } from 'node:os';
 import { resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
 import { SCANNERS } from './scanners.js';
+import { SUPPLY_SCANNERS, loadIocs } from './supply.js';
+import { INCIDENTS } from './incidents.js';
+
+export const ALL_SCANNERS = { ...SCANNERS, ...SUPPLY_SCANNERS };
+
+function defaultExec(cmd, args) {
+  try {
+    const r = spawnSync(cmd, args, { encoding: 'utf8', timeout: 4000, windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] });
+    return r.status === 0 ? r.stdout : null;
+  } catch {
+    return null;
+  }
+}
 
 export const SEVERITY = ['critical', 'high', 'medium', 'low'];
 
@@ -50,6 +64,21 @@ export const ROTATION = {
     steps: ['Generate a new key (`ssh-keygen -t ed25519`) with a passphrase.', 'Replace the public key on GitHub/GitLab and in every server\'s authorized_keys; remove the old one.'],
     url: 'https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent',
   },
+  paas: {
+    order: 5.5, label: 'Deploy platforms (Railway, Vercel, Fly, Render, Heroku, Netlify)',
+    steps: ['Rotate every secret stored in the platform\'s env store at its provider (DB, Stripe, AI keys), then update the variable.', 'Redeploy: services read env vars at start-up.', 'Log the CLI out and back in, and revoke old platform tokens.'],
+    url: 'https://blog.railway.com/p/security-disclosure-wednesday-october-21st',
+  },
+  php: {
+    order: 9, label: 'Patch PHP (PHP2Shell)',
+    steps: ['Update to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or later; PHP ≤ 8.1 must be upgraded.', 'Rebuild images with --pull --no-cache and restart all PHP workers.'],
+    url: 'https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching',
+  },
+  certs: {
+    order: 10, label: 'Replace certificates under emSign ECC Root CA - G3',
+    steps: ['Issue a replacement certificate from another CA before Oct 27, 2026.', 'Remove the root from custom trust bundles.'],
+    url: 'https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/',
+  },
   dotenv: {
     order: 8, label: 'Application secrets in .env files',
     steps: ['Rotate database passwords, payment keys and webhook secrets at each provider.', 'Redeploy: most platforms only read env vars at process start.'],
@@ -63,17 +92,27 @@ export function scan(options = {}) {
     projects: (options.projects?.length ? options.projects : [process.cwd()]).map((p) => resolve(p)),
     env: options.env ?? process.env,
     depth: options.depth ?? 4,
+    iocs: options.iocs ?? loadIocs(options.iocFiles ?? []),
+    exec: options.exec === false ? null : options.exec ?? defaultExec,
+    checkTmp: options.checkTmp ?? options.home === undefined,
   };
-  const only = options.only ? new Set(options.only) : null;
+  let onlyList = options.only;
+  if (options.incident) {
+    const inc = INCIDENTS[options.incident];
+    if (!inc) throw new Error(`Unknown incident "${options.incident}". Use one of: ${Object.keys(INCIDENTS).join(', ')}`);
+    onlyList = onlyList ? onlyList.filter((s) => inc.scanners.includes(s)) : inc.scanners;
+  }
+  for (const s of [...(onlyList ?? []), ...(options.skip ?? [])]) if (!ALL_SCANNERS[s]) throw new Error(`Unknown scanner "${s}". Use: ${Object.keys(ALL_SCANNERS).join(', ')}`);
+  const only = onlyList ? new Set(onlyList) : null;
   const skip = new Set(options.skip ?? []);
   const findings = [];
-  for (const [name, fn] of Object.entries(SCANNERS)) {
+  for (const [name, fn] of Object.entries(ALL_SCANNERS)) {
     if ((only && !only.has(name)) || skip.has(name)) continue;
     findings.push(...fn(ctx));
   }
   findings.sort((a, b) => SEVERITY.indexOf(a.severity) - SEVERITY.indexOf(b.severity) || (ROTATION[a.category]?.order ?? 99) - (ROTATION[b.category]?.order ?? 99));
   const counts = Object.fromEntries(SEVERITY.map((s) => [s, findings.filter((f) => f.severity === s).length]));
-  return { scannedAt: new Date().toISOString(), home: ctx.home, projects: ctx.projects, counts, findings };
+  return { scannedAt: new Date().toISOString(), home: ctx.home, projects: ctx.projects, iocsUpdated: ctx.iocs.updated, incident: options.incident, counts, findings };
 }
 
 export function runbook(result) {
@@ -89,3 +128,6 @@ export function failsAt(result, level) {
 }
 
 export { formatText, formatMarkdown } from './format.js';
+export { toSarif } from './sarif.js';
+export { INCIDENTS } from './incidents.js';
+export { loadIocs, parseLockfile, phpStatus } from './supply.js';