secret-blast-radius 0.1.0 → 0.2.0

package/src/iocs.json

@@ -0,0 +1,251 @@
+{
+ "updated": "2026-10-22",
+ "packages": [
+  {
+   "ecosystem": "npm",
+   "name": "tensorlake",
+   "versions": [
+    "0.5.144"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "tensorlake",
+   "safe": "0.5.143 or 0.5.145+",
+   "ref": "https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "tensorlake-native-darwin-arm64",
+   "versions": [
+    "0.5.144"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "tensorlake",
+   "safe": "0.5.143",
+   "ref": "https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "tensorlake-native-linux-arm64-gnu",
+   "versions": [
+    "0.5.144"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "tensorlake",
+   "safe": "0.5.143",
+   "ref": "https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "tensorlake-native-linux-arm64-musl",
+   "versions": [
+    "0.5.144"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "tensorlake",
+   "safe": "0.5.143",
+   "ref": "https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "tensorlake-native-linux-x64-gnu",
+   "versions": [
+    "0.5.144"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "tensorlake",
+   "safe": "0.5.143",
+   "ref": "https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "tensorlake-native-linux-x64-musl",
+   "versions": [
+    "0.5.144"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "tensorlake",
+   "safe": "0.5.143",
+   "ref": "https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "tensorlake-native-win32-x64",
+   "versions": [
+    "0.5.144"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "tensorlake",
+   "safe": "0.5.143",
+   "ref": "https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "@subql/common",
+   "versions": [
+    "5.8.3"
+   ],
+   "campaign": "subql",
+   "incident": "subql",
+   "safe": "5.8.2",
+   "ref": "https://osv.dev/vulnerability/MAL-2026-17571"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "@7nohe/openapi-react-query-codegen",
+   "versions": [
+    "0.0.0-365d4eb738d3146583431948d3ba6e27a32556be",
+    "0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab",
+    "0.5.4",
+    "0.5.5",
+    "1.6.3",
+    "1.6.4",
+    "2.2.1",
+    "2.2.2",
+    "3.0.3",
+    "3.0.4"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "shai-hulud",
+   "safe": "0.5.3 / 1.6.2 / 2.2.0 / 3.0.2",
+   "ref": "https://socket.dev/blog/openapi-react-query-codegen-npm-compromise"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "keyv",
+   "versions": [
+    "6.0.0"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "shai-hulud",
+   "safe": "5.6.0",
+   "ref": "https://www.sonatype.com/blog/mini-shai-hulud-npm-attack-more-than-2200-components-impacted"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "cacheable",
+   "versions": [
+    "2.5.1"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "shai-hulud",
+   "safe": "2.5.0",
+   "ref": "https://www.sonatype.com/blog/mini-shai-hulud-npm-attack-more-than-2200-components-impacted"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "cacheable-request",
+   "versions": [
+    "13.0.20"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "shai-hulud",
+   "safe": "13.0.19",
+   "ref": "https://www.sonatype.com/blog/mini-shai-hulud-npm-attack-more-than-2200-components-impacted"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "cache-manager",
+   "versions": [
+    "7.2.10"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "shai-hulud",
+   "safe": "7.2.9",
+   "ref": "https://www.sonatype.com/blog/mini-shai-hulud-npm-attack-more-than-2200-components-impacted"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "flat-cache",
+   "versions": [
+    "6.1.24"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "shai-hulud",
+   "safe": "6.1.23",
+   "ref": "https://www.sonatype.com/blog/mini-shai-hulud-npm-attack-more-than-2200-components-impacted"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "file-entry-cache",
+   "versions": [
+    "11.1.6"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "shai-hulud",
+   "safe": "11.1.5",
+   "ref": "https://www.sonatype.com/blog/mini-shai-hulud-npm-attack-more-than-2200-components-impacted"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "@cacheable/utils",
+   "versions": [
+    "2.5.1"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "shai-hulud",
+   "safe": "the release before the listed version (see advisory)",
+   "ref": "https://www.sonatype.com/blog/mini-shai-hulud-npm-attack-more-than-2200-components-impacted"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "@cacheable/memory",
+   "versions": [
+    "2.2.1"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "shai-hulud",
+   "safe": "the release before the listed version (see advisory)",
+   "ref": "https://www.sonatype.com/blog/mini-shai-hulud-npm-attack-more-than-2200-components-impacted"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "@cacheable/node-cache",
+   "versions": [
+    "3.1.2"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "shai-hulud",
+   "safe": "the release before the listed version (see advisory)",
+   "ref": "https://www.sonatype.com/blog/mini-shai-hulud-npm-attack-more-than-2200-components-impacted"
+  },
+  {
+   "ecosystem": "npm",
+   "name": "@cacheable/net",
+   "versions": [
+    "2.1.1"
+   ],
+   "campaign": "mini-shai-hulud",
+   "incident": "shai-hulud",
+   "safe": "the release before the listed version (see advisory)",
+   "ref": "https://www.sonatype.com/blog/mini-shai-hulud-npm-attack-more-than-2200-components-impacted"
+  }
+ ],
+ "markers": {
+  "ips": [
+   "193.32.204.199"
+  ],
+  "domains": [
+   "iseekaigogo.com",
+   "ci-artifacts.dev",
+   "npm-cache.com",
+   "my-github.com"
+  ],
+  "files": [
+   "/tmp/tmp.ts018051808.lock"
+  ],
+  "cron": [
+   "#ghc2",
+   "193.32.204.199"
+  ],
+  "processes": [
+   "manifest-cache.js --warm",
+   "gh-token-monitor"
+  ],
+  "branches": [
+   "dependabot/github_actions/format/setup-formatter"
+  ],
+  "optionalDependencies": [
+   "@opensearch/setup"
+  ]
+ }
+}

package/src/sarif.js

@@ -0,0 +1,37 @@
+const LEVEL = { critical: 'error', high: 'error', medium: 'warning', low: 'note' };
+const SCORE = { critical: '9.5', high: '7.5', medium: '5.0', low: '2.0' };
+
+import { relative, isAbsolute } from 'node:path';
+
+function repoRelative(result, loc) {
+  const abs = loc.startsWith('~') ? result.home + loc.slice(1) : loc;
+  if (!isAbsolute(abs)) return null;
+  for (const p of result.projects) {
+    const r = relative(p, abs);
+    if (r && !r.startsWith('..') && !isAbsolute(r)) return r.replace(/\\/g, '/');
+  }
+  return null;
+}
+
+export function toSarif(result, version) {
+  const rules = new Map();
+  for (const f of result.findings) if (!rules.has(f.id)) rules.set(f.id, f);
+  return {
+    $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+    version: '2.1.0',
+    runs: [{
+      tool: { driver: { name: 'secret-blast-radius', version, informationUri: 'https://github.com/Krrishkumar125/secret-blast-radius',
+        rules: [...rules.values()].map((f) => ({ id: f.id, name: f.id.replace(/[^a-z0-9]+/gi, '_'), shortDescription: { text: f.id }, properties: { 'security-severity': SCORE[f.severity], tags: ['security', f.category] } })) } },
+      results: result.findings.map((f) => {
+        // Only repo-relative paths are meaningful to code scanning; home-dir findings are reported without a file.
+        const uri = repoRelative(result, f.location);
+        return {
+          ruleId: f.id, level: LEVEL[f.severity],
+          message: { text: `${f.title}. ${f.detail}` },
+          ...(uri ? { locations: [{ physicalLocation: { artifactLocation: { uri, uriBaseId: '%SRCROOT%' } } }] } : {}),
+          partialFingerprints: { primary: `${f.id}:${f.location}:${f.fingerprint || f.title}` },
+        };
+      }),
+    }],
+  };
+}

package/src/scanners.js

@@ -61,6 +61,17 @@ export function scanNpmrc(ctx) {
   return out;
 }
 
+export function scanPypirc(ctx) {
+  const f = join(ctx.home, '.pypirc');
+  const t = readText(f);
+  if (!t) return [];
+  return [...t.matchAll(/^\s*password\s*[=:]\s*(\S+)/gm)].filter((m) => !isReference(m[1])).map((m) => ({
+    id: 'pypi.plaintext-token', category: 'npm', severity: m[1].startsWith('pypi-') ? 'critical' : 'high',
+    title: 'Plaintext PyPI credential in ~/.pypirc', location: tilde(ctx, f), fingerprint: fingerprint(m[1]),
+    detail: 'Lets a stealer publish to your PyPI projects. Revoke at pypi.org/manage/account/token and use trusted publishing.',
+  }));
+}
+
 /* ---------------- 2. GitHub ---------------- */
 export function scanGitHub(ctx) {
   const out = [];
@@ -287,6 +298,10 @@ export function scanAiConfigs(ctx) {
       }
     }
   }
+  for (const [rel, label] of [['.claude/.credentials.json', 'Claude Code login'], ['.gemini/oauth_creds.json', 'Gemini CLI OAuth tokens']]) {
+    const f = join(ctx.home, ...rel.split('/'));
+    if (readText(f)) out.push({ id: 'ai.cli-login', category: 'ai', severity: 'medium', title: `${label} stored in a file`, location: tilde(ctx, f), detail: 'Read verbatim by the GhostAction fake-font stealer. Sign out and back in to rotate if this machine is exposed.' });
+  }
   // Codex CLI auth file stores an API key / refresh token.
   for (const f of [join(ctx.home, '.codex', 'auth.json')]) {
     const t = readText(f);
@@ -362,7 +377,7 @@ export function scanDotenv(ctx) {
   for (const root of ctx.projects) {
     for (const f of walk(root, { maxDepth: ctx.depth, skip: SKIP_DIRS })) {
       const base = f.split(/[\\/]/).pop();
-      if (!/^\.env(\..+)?$/.test(base) || /\.(example|sample|template|dist|defaults)$/i.test(base)) continue;
+      if (!/^\.env(\..+)?$/.test(base) || /\.(example|sample|template|dist|defaults|demo)$/i.test(base)) continue;
       const text = readText(f);
       if (!text) continue;
       const secrets = parseDotenv(text).filter(([k, v]) => isSecretPair(k, v));
@@ -406,7 +421,7 @@ export function scanHardening(ctx) {
 
 export const SCANNERS = {
   persistence: scanPersistence,
-  npm: scanNpmrc,
+  npm: (ctx) => [...scanNpmrc(ctx), ...scanPypirc(ctx)],
   github: scanGitHub,
   cloud: scanCloud,
   kubernetes: scanKubeDocker,