secret-blast-radius 0.3.0 → 0.4.1

package/README.md

@@ -34,6 +34,8 @@ Rotation order if this machine is ever compromised: 1. persistence  2. npm  3. a
 
 *(Illustrative output: fingerprints and paths are examples.)*
 
+**New in 0.4:** `--harden` audits the settings that would have blunted this month's attacks and prints the exact fix: cooldowns, `--require-hashes`, uv `exclude-newer`, digest-pinned images, OIDC instead of long-lived publish/cloud keys, unpinned MCP servers, `.env` files with secrets committed to git. Also new: Python lockfiles and virtualenvs (requirements, poetry.lock, uv.lock, Pipfile.lock, pylock.toml), Docker image references, and `--incident litellm` / `--incident zeabur`.
+
 **New in 0.3:** `--history` shows the dates a bad version sat in your lockfile; GlassWorm editor-extension check; npm cache check; RubyGems/Cargo/Composer/Terraform/Pulumi credential files; opt-in `--osv` malicious-package lookup; a rotation plan with verify steps and provider docs.
 
 ## Why this exists
@@ -75,6 +77,8 @@ Every advisory ends the same way: *"rotate everything the machine could access."
 | `extensions` | Installed VS Code / Cursor / Windsurf / VSCodium / Kiro / remote-server extensions against 149 GlassWorm IOCs from Socket (malicious, version-scoped, and flagged sleepers), including ones pulled in through `extensionPack` |
 | `npm-cache` | Tarballs of known-bad versions in the npm cache index: proof the machine downloaded one even if no lockfile shows it today |
 | `history` (`--history`) | **Exposure window.** Walks each lockfile's git history and reports when a known-bad version entered and left (`2026-10-08 → 2026-10-10`), so you know which CI runs and machines to treat as exposed. `--since 2026-09-01` narrows it |
+| `python` | Known-bad PyPI versions (litellm 1.107.0, 1.82.7/1.82.8) in requirements*.txt, poetry.lock, uv.lock, Pipfile.lock, pdm.lock, pylock.toml and project virtualenvs; the litellm `cook.pth` startup hook |
+| `images` | Dockerfile `FROM` and compose `image:` references to compromised image digests/tags, and floating tags (`latest`, `main-stable`) that pointed at a compromised image during a known window |
 | `persistence` | `gh-token-monitor` (systemd unit, LaunchAgent, Windows dir, script) |
 | `host-persistence` | Crontab lines that pipe a server into `bash` (GhostAction `#ghc2`), the `manifest-cache.js --warm` process and `/tmp/tmp.ts018051808.lock` (@subql) |
 | `repo` | Workflows that contact GhostAction infrastructure, dump `git log -p --all`, or serialise `toJSON(secrets)` to the network; `.vscode/tasks.json` that auto-runs a "font"/image; Claude Code hooks that run disguised files; the tensorlake worm branch |
@@ -92,6 +96,27 @@ Every advisory ends the same way: *"rotate everything the machine could access."
 
 **Small extras:** least-privilege hints from a token's public prefix (classic `ghp_` PAT, long-lived `AKIA` key), and MCP servers started with an unpinned `npx -y <pkg>`.
 
+## `--harden`: prevent the next one
+
+```bash
+npx secret-blast-radius --harden
+```
+
+Read-only audit of preventive settings. Every finding has a `fix:` line with the exact change:
+
+| Check | Why (Oct 2026 evidence) | Fix it prints |
+|---|---|---|
+| npm `ignore-scripts`, cooldown for npm/pnpm/Yarn/Bun | tensorlake ran from `preinstall` and was live under 2h | `ignore-scripts=true`, `min-release-age=3`, `minimumReleaseAge: 4320`, … |
+| pnpm `dangerouslyAllowAllBuilds: true` | pnpm blocks dependency builds by default; this turns that off | remove it, allow-list with `allowBuilds`/`onlyBuiltDependencies` |
+| requirements not pinned / no `--hash` | an unpinned `litellm` resolved to 1.107.0 | `uv pip compile --generate-hashes`, `pip install --require-hashes` |
+| uv without `exclude-newer` | litellm 1.107.0 was live ~2h | `exclude-newer = "3 days"` under `[tool.uv]` |
+| images not pinned by digest | litellm's `latest`/`main-stable` served a stealer for ~2.5h | `image:tag@sha256:…` + Renovate/Dependabot |
+| long-lived `NPM_TOKEN`, PyPI `password:`, AWS keys in workflows | stolen long-lived tokens drove LiteLLM, tensorlake, GhostAction | npm/PyPI trusted publishing, AWS `role-to-assume` (OIDC) |
+| MCP servers run with `npx -y <pkg>` | pulls whatever is latest on every start | pin `pkg@x.y.z` |
+| `.env` with secret-looking values committed or not ignored (needs git) | CERT-In Oct 15: agents got in via plaintext credentials in repos | `git rm --cached`, `.gitignore`, rotate |
+
+Checks only fire on files you have. Settings that are already safe by default (pnpm build blocking) are not nagged about. Cargo cooldowns land in Rust 1.100 (Nov 12), so they aren't checked yet.
+
 ## Rotation plan
 
 `--runbook` writes an ordered plan: stop the malware, then registry tokens (npm, PyPI, RubyGems, crates.io), GitHub, cloud and IaC, Kubernetes, deploy platforms, CI env, AI keys, SSH, app secrets. Each step has the exact commands, a **verify** check that the old credential is dead, a **redeploy** reminder where running processes keep old values, and links to the provider's own docs. One example of why the details matter: npm says token revocation can take up to an hour.
@@ -115,7 +140,7 @@ permissions:
   security-events: write
 steps:
   - uses: actions/checkout@v4
-  - uses: Krrishkumar125/secret-blast-radius@v0.3.0
+  - uses: Krrishkumar125/secret-blast-radius@v0.4.1
     with:
       fail-on: critical
   - uses: github/codeql-action/upload-sarif@v3

package/bin/cli.js

@@ -11,12 +11,14 @@ Read-only. Never prints secret values.
 
 Options:
   --incident <name>    Tailored checklist + only the relevant checks. Names:
-                       php2shell, glassworm, railway, tensorlake, shai-hulud, subql, ghostaction, emudhra, sbi
+                       php2shell, litellm, zeabur, glassworm, railway, tensorlake, shai-hulud, subql, ghostaction, emudhra, sbi
   --list-incidents     Show incident names and status
   --json               Machine-readable output
   --sarif [file]       SARIF 2.1.0 for GitHub code scanning (stdout, or --sarif-file <f>)
   --ioc-file <f>       Extra IOC JSON (same shape as src/iocs.json); repeatable
   --no-exec            Never run helper commands (php -v, crontab -l, ps, git)
+  --harden             Audit preventive settings (cooldowns, hashes, digest pins, OIDC,
+                       unpinned MCP servers, .env in git) and print the exact fix
   --history            Exposure window: walk lockfile git history for known-bad versions (runs git)
   --since <date>       Limit --history to commits since a date (e.g. 2026-09-01)
   --osv                ONLINE, opt-in: send lockfile package names+versions (nothing else) to
@@ -25,7 +27,7 @@ Options:
   --fail-on <level>    Exit 1 if any finding is at/above level: critical|high|medium|low|none (default: none)
   --only <list>        Comma list of scanners: persistence,npm,github,cloud,kubernetes,env,ai,ssh,dotenv,
                        hardening,malicious,repo,host-persistence,php,paas,certs,install-scripts,
-                       ecosystems,extensions,npm-cache,history
+                       ecosystems,extensions,npm-cache,history,python,images,harden
   --skip <list>        Comma list of scanners to skip
   --no-env             Do not inspect environment variables
   --depth <n>          How deep to look for .env files in project dirs (default 4)
@@ -41,7 +43,7 @@ try {
     allowPositionals: true,
     options: {
       json: { type: 'boolean' }, sarif: { type: 'boolean' }, 'sarif-file': { type: 'string' },
-      incident: { type: 'string' }, 'list-incidents': { type: 'boolean' }, 'ioc-file': { type: 'string', multiple: true }, 'no-exec': { type: 'boolean' }, history: { type: 'boolean' }, since: { type: 'string' }, osv: { type: 'boolean' }, runbook: { type: 'boolean' }, 'runbook-file': { type: 'string' },
+      incident: { type: 'string' }, 'list-incidents': { type: 'boolean' }, 'ioc-file': { type: 'string', multiple: true }, 'no-exec': { type: 'boolean' }, history: { type: 'boolean' }, harden: { type: 'boolean' }, since: { type: 'string' }, osv: { type: 'boolean' }, runbook: { type: 'boolean' }, 'runbook-file': { type: 'string' },
       'fail-on': { type: 'string', default: 'none' }, only: { type: 'string' }, skip: { type: 'string' },
       'no-env': { type: 'boolean' }, depth: { type: 'string' }, home: { type: 'string' },
       'no-color': { type: 'boolean' }, version: { type: 'boolean', short: 'v' }, help: { type: 'boolean', short: 'h' },
@@ -73,7 +75,7 @@ if (o['no-env']) skip.push('env');
 let result;
 try {
   if (o.since && !/^\d{4}-\d{2}-\d{2}/.test(o.since)) throw new Error('--since expects a date like 2026-09-01');
-  result = await scanAsync({ osv: o.osv, history: o.history || o.since || list(o.only)?.includes('history') ? { since: o.since } : null, projects, home: o.home, only: list(o.only), skip, depth: o.depth ? Number(o.depth) : undefined, incident: o.incident, iocFiles: o['ioc-file'] ?? [], exec: o['no-exec'] ? false : undefined });
+  result = await scanAsync({ harden: o.harden, osv: o.osv, history: o.history || o.since || list(o.only)?.includes('history') ? { since: o.since } : null, projects, home: o.home, only: list(o.only), skip, depth: o.depth ? Number(o.depth) : undefined, incident: o.incident, iocFiles: o['ioc-file'] ?? [], exec: o['no-exec'] ? false : undefined });
   failsAt(result, o['fail-on']);
 } catch (e) {
   console.error(`secret-blast-radius: ${e.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secret-blast-radius",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "What would a malicious npm install steal from this machine or CI runner? Ranked inventory of reachable credentials, known-worm IOCs (Shai-Hulud, @subql, GhostAction), PHP2Shell and PaaS exposure checks, ordered rotation runbook, SARIF. Read-only, offline, never prints secrets.",
   "license": "MIT",
   "author": "Krrish Kumar (https://github.com/Krrishkumar125)",
@@ -32,7 +32,11 @@
     "osv",
     "rubygems",
     "cargo",
-    "terraform"
+    "terraform",
+    "pypi",
+    "litellm",
+    "docker",
+    "hardening"
   ],
   "type": "module",
   "bin": {
@@ -52,7 +56,7 @@
     "node": ">=18.18"
   },
   "scripts": {
-    "test": "node --test test/scanners.test.js test/supply.test.js test/cli.test.js test/v3.test.js",
+    "test": "node --test test/scanners.test.js test/supply.test.js test/cli.test.js test/v3.test.js test/v4.test.js",
     "check": "node --check bin/cli.js && npm test"
   }
 }

package/src/format.js

@@ -8,7 +8,7 @@ export function formatText(result, { color = false } = {}) {
   const sev = { critical: (s) => c('1;31', s), high: (s) => c('31', s), medium: (s) => c('33', s), low: (s) => c('2', s) };
   const lines = [];
   const { counts } = result;
-  lines.push(c('1', 'secret-blast-radius') + ' — what a malicious install script could steal from this machine right now');
+  lines.push(c('1', 'secret-blast-radius') + (result.harden ? ' --harden: settings that would have blunted this month\'s attacks' : ' — what a malicious install script could steal from this machine right now'));
   lines.push('');
   if (result.incident) {
     const inc = INCIDENTS[result.incident];
@@ -18,13 +18,14 @@ export function formatText(result, { color = false } = {}) {
   }
   if (result.osvQueried != null) lines.push(c('2', `OSV: checked ${result.osvQueried} package versions against MAL- advisories (online, opt-in).`), '');
   if (!result.findings.length) {
-    lines.push(result.incident ? 'Nothing relevant found by these checks.' : 'No reachable secrets found in the places checked. Nice.');
+    lines.push(result.harden ? 'All checked preventive settings are in place.' : result.incident ? 'Nothing relevant found by these checks.' : 'No reachable secrets found in the places checked. Nice.');
     return lines.join('\n');
   }
   for (const f of result.findings) {
     lines.push(`${sev[f.severity](`${ICON[f.severity]} ${f.severity.toUpperCase().padEnd(8)}`)} ${f.title}`);
     lines.push(`  ${c('2', f.location + (f.fingerprint ? `  ${f.fingerprint}` : '') + (f.ageDays != null ? `  (${f.ageDays}d old)` : ''))}`);
     lines.push(`  ${f.detail}`);
+    if (f.fix) lines.push(`  ${c('32', 'fix:')} ${f.fix}`);
     lines.push('');
   }
   lines.push(`Summary: ${counts.critical} critical, ${counts.high} high, ${counts.medium} medium, ${counts.low} low.`);

package/src/incidents.js

@@ -13,6 +13,34 @@ export const INCIDENTS = {
     ],
     refs: ['https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/', 'https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching'],
   },
+  litellm: {
+    title: 'LiteLLM 1.107.0 release compromise: PyPI wheels + Docker images (Oct 21, 2026)',
+    status: 'Confirmed by LiteLLM ("contained, investigation in progress"). Root cause per vendor: GitHub CLI OAuth tokens leaked via logs of an internet-exposed internal LiteLLM deployment; how that deployment was accessed is not yet confirmed.',
+    scanners: ['python', 'images', 'host-persistence', 'cloud', 'github', 'npm', 'ai', 'kubernetes', 'ssh', 'dotenv', 'env', 'ecosystems'],
+    checklist: [
+      'Affected if you pip-installed litellm==1.107.0 (live 11:39–13:23 UTC Oct 21) or ran v1.107.0/latest/main-latest/main-stable images of ghcr.io/berriai/litellm{,-database,-non_root} or litellm/litellm between 11:46 and 14:20 UTC. Bad image index: sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e.',
+      'Do NOT start Python or pip in an affected environment first: cook.pth and sitecustomize.py run on every interpreter start.',
+      'From a shell, delete cook.pth, cook.py, sitecustomize.py and matching __pycache__/*.pyc in every affected site-packages; kill the daemon holding /tmp/remote_code_loader.lock.',
+      'Rebuild venvs and images from scratch pinned to litellm==1.106.2, images pinned by digest.',
+      '/tmp/.pc_once_72129118c59f5636c0bb means exfiltration succeeded; its absence proves nothing.',
+      'Rotate everything the host could reach: instance/task IAM role, every provider key stored in the LiteLLM proxy DB, master and virtual keys, the DATABASE_URL password, secrets in any process environment, gh/npm/PyPI tokens, SSH keys, AI-tool logins (Codex, Claude, Gemini, Cursor MCP).',
+      'Check CloudTrail for sts:GetCallerIdentity then bedrock:ListFoundationModels from unknown IPs (Wiz saw 168.100.8.57, 165.227.201.8). Block egress to www.litellm.dev.',
+      'Lesson: logs that store LLM response bodies can hold credentials. Do not log full response bodies; keep gh tokens in the OS keyring.',
+    ],
+    refs: ['https://docs.litellm.ai/blog/security-incident-oct-21-2026', 'https://github.com/BerriAI/litellm/issues/47826', 'https://socket.dev/blog/litellm-compromise', 'https://osv.dev/vulnerability/MAL-2026-2144'],
+  },
+  zeabur: {
+    title: 'Zeabur platform breach: env vars in the platform DB read (Oct 14–15, 2026)',
+    status: 'Confirmed by Zeabur (preliminary report). Zeabur has since announced it is shutting down.',
+    scanners: ['dotenv', 'env', 'github'],
+    checklist: [
+      'Replace every password and key stored in Zeabur env vars at its provider, even if you rotated after the August incident.',
+      'Recreate Zeabur access tokens and sign in again; review GitHub activity for the Zeabur GitHub App.',
+      'GCP Dedicated Server users: rebuild the server (at minimum remove unknown SSH keys and change root credentials).',
+      'Plan the migration off Zeabur.',
+    ],
+    refs: ['https://zeabur.com/blogs/october-2026-security-incident', 'https://zeabur.com/blogs/zeabur-is-shutting-down'],
+  },
   glassworm: {
     title: 'GlassWorm — malicious and sleeper Open VSX / VS Code extensions (Mar–Oct 2026)',
     status: 'Confirmed by Socket research; extensions removed from Open VSX after reports. Sleeper extensions were benign when published and are flagged as high risk, not proven malicious.',

package/src/index.js

@@ -5,8 +5,9 @@ import { SCANNERS } from './scanners.js';
 import { SUPPLY_SCANNERS, loadIocs } from './supply.js';
 import { INCIDENTS } from './incidents.js';
 import { V3_SCANNERS, osvMalicious } from './v3.js';
+import { V4_SCANNERS } from './v4.js';
 
-export const ALL_SCANNERS = { ...SCANNERS, ...SUPPLY_SCANNERS, ...V3_SCANNERS };
+export const ALL_SCANNERS = { ...SCANNERS, ...SUPPLY_SCANNERS, ...V3_SCANNERS, ...V4_SCANNERS };
 
 function defaultExec(cmd, args) {
   try {
@@ -132,8 +133,10 @@ export function scan(options = {}) {
     exec: options.exec === false ? null : options.exec ?? defaultExec,
     checkTmp: options.checkTmp ?? options.home === undefined,
     history: options.history ?? null, // {since?: string}
+    harden: !!options.harden || !!options.only?.includes('harden'),
   };
   let onlyList = options.only;
+  if (options.harden) onlyList = ['hardening', 'harden', 'ai'];
   if (options.incident) {
     const inc = INCIDENTS[options.incident];
     if (!inc) throw new Error(`Unknown incident "${options.incident}". Use one of: ${Object.keys(INCIDENTS).join(', ')}`);
@@ -147,7 +150,7 @@ export function scan(options = {}) {
     if ((only && !only.has(name)) || skip.has(name)) continue;
     findings.push(...fn(ctx));
   }
-  return finish(ctx, options, findings);
+  return finish(ctx, options, options.harden ? findings.filter((f) => f.category === 'hardening' || f.id === 'ai.mcp-unpinned') : findings);
 }
 
 /** Same as scan(), plus the opt-in OSV lookup (network) when options.osv is set. */
@@ -156,7 +159,7 @@ export async function scanAsync(options = {}) {
   if (!options.osv) return result;
   const ctx = { home: result.home, projects: result.projects, depth: options.depth ?? 4, iocs: { updated: result.iocsUpdated } };
   const { findings: osv, queried } = await osvMalicious(ctx, options.osvOptions);
-  const known = new Set(result.findings.filter((f) => f.id === 'supply.malicious-version').map((f) => f.title.split(' ')[2] + '|' + f.location));
+  const known = new Set(result.findings.filter((f) => f.id === 'supply.malicious-version').map((f) => f.title.split(' ')[2].replace('==', '@') + '|' + f.location));
   const findings = osv.filter((f) => !known.has(f.title.split(' ')[2] + '|' + f.location));
   return { ...finish(ctx, options, [...result.findings, ...findings]), osvQueried: queried };
 }
@@ -164,7 +167,7 @@ export async function scanAsync(options = {}) {
 function finish(ctx, options, findings) {
   findings.sort((a, b) => SEVERITY.indexOf(a.severity) - SEVERITY.indexOf(b.severity) || (ROTATION[a.category]?.order ?? 99) - (ROTATION[b.category]?.order ?? 99));
   const counts = Object.fromEntries(SEVERITY.map((s) => [s, findings.filter((f) => f.severity === s).length]));
-  return { scannedAt: new Date().toISOString(), home: ctx.home, projects: ctx.projects, iocsUpdated: ctx.iocs?.updated ?? options.iocsUpdated, incident: options.incident, counts, findings };
+  return { scannedAt: new Date().toISOString(), home: ctx.home, projects: ctx.projects, iocsUpdated: ctx.iocs?.updated ?? options.iocsUpdated, incident: options.incident, harden: !!options.harden, counts, findings };
 }
 
 export function runbook(result) {

package/src/iocs.json

@@ -218,6 +218,29 @@
    "incident": "shai-hulud",
    "safe": "the release before the listed version (see advisory)",
    "ref": "https://www.sonatype.com/blog/mini-shai-hulud-npm-attack-more-than-2200-components-impacted"
+  },
+  {
+   "ecosystem": "PyPI",
+   "name": "litellm",
+   "versions": [
+    "1.107.0"
+   ],
+   "campaign": "litellm release compromise (Oct 21, 2026)",
+   "incident": "litellm",
+   "safe": "1.106.2",
+   "ref": "https://docs.litellm.ai/blog/security-incident-oct-21-2026"
+  },
+  {
+   "ecosystem": "PyPI",
+   "name": "litellm",
+   "versions": [
+    "1.82.7",
+    "1.82.8"
+   ],
+   "campaign": "litellm compromise (Mar 2026)",
+   "incident": "litellm",
+   "safe": "1.106.2",
+   "ref": "https://osv.dev/vulnerability/MAL-2026-2144"
   }
  ],
  "markers": {
@@ -228,10 +251,13 @@
    "iseekaigogo.com",
    "ci-artifacts.dev",
    "npm-cache.com",
-   "my-github.com"
+   "my-github.com",
+   "www.litellm.dev"
   ],
   "files": [
-   "/tmp/tmp.ts018051808.lock"
+   "/tmp/tmp.ts018051808.lock",
+   "/tmp/remote_code_loader.lock",
+   "/tmp/.pc_once_72129118c59f5636c0bb"
   ],
   "cron": [
    "#ghc2",
@@ -247,5 +273,37 @@
   "optionalDependencies": [
    "@opensearch/setup"
   ]
- }
+ },
+ "images": [
+  {
+   "incident": "litellm",
+   "repos": [
+    "ghcr.io/berriai/litellm",
+    "ghcr.io/berriai/litellm-database",
+    "ghcr.io/berriai/litellm-non_root",
+    "docker.io/litellm/litellm",
+    "litellm/litellm"
+   ],
+   "badTags": [
+    "v1.107.0"
+   ],
+   "floatingTags": [
+    "latest",
+    "main-latest",
+    "main-stable"
+   ],
+   "digests": [
+    "sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e",
+    "sha256:bd1aeee419ea36da9aa2b657288da4101887be468f020ac63d22ba6ed84a3ea5",
+    "sha256:56b74573eed6e4aafe4b50603dbe7853e0345f188c8e44a09f1098caf1f4bcdf"
+   ],
+   "digestPrefixes": [
+    "sha256:c00f9d92c427",
+    "sha256:7b00e91cd2fe"
+   ],
+   "window": "2026-10-21 11:46\u201314:20 UTC",
+   "safe": "v1.106.2 pinned by digest",
+   "ref": "https://docs.litellm.ai/blog/security-incident-oct-21-2026"
+  }
+ ]
 }

package/src/scanners.js

@@ -308,7 +308,7 @@ export function scanAiConfigs(ctx) {
     try { json = JSON.parse(text); } catch { continue; }
     for (const { name, server } of mcpServersFrom(json)) {
       const pkg = unpinnedNpx(server);
-      if (pkg) out.push({ id: 'ai.mcp-unpinned', category: 'ai', severity: 'low', title: `MCP server "${name}" runs an unpinned package (${pkg})`, location: tilde(ctx, f),
+      if (pkg) out.push({ id: 'ai.mcp-unpinned', category: 'ai', severity: 'low', title: `MCP server "${name}" runs an unpinned package (${pkg})`, location: tilde(ctx, f), fix: `Change the arg to "${pkg}@<exact version>" (find it with \`npm view ${pkg} version\`).`,
         detail: '`npx -y <pkg>` fetches whatever version is latest every time the agent starts, with your agent\'s environment. Pin an exact version (pkg@1.2.3) so a hijacked release is not pulled in automatically.' });
       for (const hit of literalSecretsInServer(server)) {
         out.push({
@@ -428,6 +428,7 @@ export function scanHardening(ctx) {
       id: 'hardening.ignore-scripts', category: 'hardening', severity: 'low',
       title: 'npm runs dependency install scripts', location: '~/.npmrc',
       detail: 'Every malicious package this year ran from preinstall/postinstall. Consider `ignore-scripts=true` (or pnpm, which blocks dependency builds by default) and allow-list the few that need it.',
+      fix: '`npm config set ignore-scripts true` (user-wide) or add `ignore-scripts=true` to the project .npmrc; run needed builds explicitly (`npm rebuild <pkg>`).',
     });
   }
   const pnpmWs = ctx.projects.map((p) => readText(join(p, 'pnpm-workspace.yaml'))).filter(Boolean).join('\n');
@@ -444,7 +445,8 @@ export function scanHardening(ctx) {
     out.push({
       id: 'hardening.release-age', category: 'hardening', severity: 'low',
       title: 'No dependency cooldown configured', location: 'package manager config',
-      detail: `Malicious versions are usually pulled within hours. ${tips.join('; ')}. A cooldown would not have caught a compromise that went unnoticed for longer.`,
+      detail: 'Malicious versions are usually pulled within hours (litellm 1.107.0: under 2h; tensorlake 0.5.144: under 2h). A cooldown would not catch a compromise that goes unnoticed for longer.',
+      fix: tips.join('; ') + '.',
     });
   }
   return out;

package/src/supply.js

@@ -9,11 +9,12 @@ const rel = (root, p) => relative(root, p).replace(/\\/g, '/') || basename(p);
 const tilde = (ctx, p) => (p.startsWith(ctx.home) ? '~' + p.slice(ctx.home.length).replace(/\\/g, '/') : p);
 
 export function loadIocs(extraFiles = []) {
-  const merged = { updated: BUNDLED.updated, packages: [...BUNDLED.packages], extensions: [], markers: structuredClone(BUNDLED.markers) };
+  const merged = { updated: BUNDLED.updated, packages: [...BUNDLED.packages], extensions: [], images: [...(BUNDLED.images || [])], markers: structuredClone(BUNDLED.markers) };
   for (const f of extraFiles) {
     const j = JSON.parse(readFileSync(f, 'utf8'));
     merged.packages.push(...(j.packages || []));
     merged.extensions.push(...(j.extensions || []));
+    merged.images.push(...(j.images || []));
     for (const [k, v] of Object.entries(j.markers || {})) merged.markers[k] = [...new Set([...(merged.markers[k] || []), ...v])];
     if (j.updated && j.updated > merged.updated) merged.updated = j.updated;
   }
@@ -207,7 +208,10 @@ export function scanHostPersistence(ctx) {
   const out = [];
   const m = ctx.iocs.markers;
   for (const f of m.files || []) {
-    if (process.platform !== 'win32' && ctx.checkTmp && exists(f)) out.push({ id: 'persistence.ioc-file', category: 'persistence', severity: 'critical', incident: 'subql', title: `Infection marker ${f} present`, location: f, detail: '@subql/common@5.8.3 leaves this lock file. Its detached stealer survives `npm uninstall`; isolate and rebuild the host.' });
+    if (process.platform === 'win32' || !ctx.checkTmp || !exists(f)) continue;
+    const ll = /remote_code_loader|\.pc_once_/.test(f);
+    out.push({ id: 'persistence.ioc-file', category: 'persistence', severity: 'critical', incident: ll ? 'litellm' : 'subql', title: `Infection marker ${f} present`, location: f,
+      detail: ll ? 'Left by the litellm 1.107.0 payload (loader lock or upload marker). The upload marker means exfiltration succeeded. Do not start Python/pip first: delete cook.pth, cook.py, sitecustomize.py from site-packages, kill the loader, rebuild, then rotate.' : '@subql/common@5.8.3 leaves this lock file. Its detached stealer survives `npm uninstall`; isolate and rebuild the host.' });
   }
   if (!ctx.exec) return out;
   const cron = ctx.exec('crontab', ['-l']);

package/src/util.js

@@ -64,6 +64,7 @@ export function isReference(value) {
   if (/^(your|enter|insert|replace|add)[-_ ]?(your[-_ ]?)?[a-z_ -]*(here)?$/i.test(v) || /_here$/i.test(v)) return true;
   if (/^\$\{\{.*\}\}$/.test(v)) return true; // ${{ secrets.X }} (GitHub Actions)
   if (/^(x{4,}|\*{4,}|your[-_ ].*|changeme|placeholder|todo|redacted)$/i.test(v)) return true;
+  if (/^(fake|dummy|mock)[-_]/i.test(v) || /:\/\/[^:@\s]*:(fake|dummy|mock)[-_][^@]*@/i.test(v)) return true;
   if (/not[-_ ]?a[-_ ]?(real[-_ ]?)?secret|^change[-_ ]?me|^dummy|^placeholder|^replace[-_ ]?(me|this)|^example|^sample/i.test(v)) return true;
   return false;
 }
@@ -76,16 +77,22 @@ export function looksLikeSecretName(name) {
   return SECRET_NAME.test(name) && !NOT_SECRET_NAME.test(name);
 }
 
+const EXAMPLE_WORD = /^(secret|secrets|password|passwd|pass|token|key|apikey|api|jwt|session|cookie|signing|local|localhost|dev|development|test|testing|tests|example|examples|sample|demo|dummy|fake|mock|placeholder|change|changeme|replace|me|xxx|todo|redacted|default|insecure|value|your|here|this|not|real|keyboard|cat|foo|bar|baz|my|super|unsafe|temp|tmp|ci)$/i;
 const URL_NAME = /(_url|_uri|_dsn)$|^(dsn)$/i;
 
 /** Does this name/value pair hold a literal secret? URL-style names only count when they embed credentials. */
 export function isSecretPair(name, value) {
   if (value == null || isReference(value)) return false;
   const v = String(value);
+  // Credentials for a database on this machine (docker-compose dev defaults) are not reachable secrets.
+  if (/^[a-z][a-z0-9+.-]*:\/\/[^/\s@]+@(localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|host\.docker\.internal)([:/?]|$)/i.test(v)) return false;
   if (tokenKind(v)) return true;
   // Prose like "local-secret" or "this-is-a-secret-value-..." is a committed example, not a credential.
+  // Word shape alone is not enough: "correct-horse-battery-staple" is a real passphrase. Only discard
+  // all-word values that also contain a placeholder/example word.
   const words = v.replace(/[!.]+$/, '').split(/[-_ .]+/);
-  if (words.length >= 2 && words.every((w) => /^[a-z]+$|^[A-Z]+$|^\d+$/.test(w)) && words.some((w) => /^[a-z]{3,}$/i.test(w))) return false;
+  if (words.length >= 2 && words.every((w) => /^[a-z]+$|^[A-Z]+$|^\d+$/.test(w)) && words.some((w) => /^[a-z]{3,}$/i.test(w))
+    && words.some((w) => EXAMPLE_WORD.test(w))) return false;
   if (URL_NAME.test(name)) return /^[a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:[^@\s]+@/i.test(v) || /[?&](password|token|key|secret)=[^&\s]+/i.test(v);
   return looksLikeSecretName(name) && v.length >= 8;
 }

package/src/v3.js

@@ -5,6 +5,7 @@ import { readFileSync, realpathSync } from 'node:fs';
 const real = (p) => { try { return realpathSync.native(p); } catch { return p; } };
 import { readText, listDir, exists, walk, isReference, fingerprint } from './util.js';
 import { parseLockfile } from './supply.js';
+import { isPyLock, parsePyLock } from './v4.js';
 
 const EXT_IOCS = JSON.parse(readFileSync(new URL('./extension-iocs.json', import.meta.url), 'utf8'));
 const tilde = (ctx, p) => (p.startsWith(ctx.home) ? '~' + p.slice(ctx.home.length).replace(/\\/g, '/') : p);
@@ -200,14 +201,16 @@ export function scanHistory(ctx) {
 }
 
 /* ---------- 5. Opt-in OSV lookup for MAL- advisories (network) ---------- */
-const OSV_ECOSYSTEM = { npm: 'npm' };
+const OSV_ECOSYSTEM = { npm: 'npm', PyPI: 'PyPI' };
 export function collectPackages(ctx) {
   const pkgs = new Map();
   for (const root of ctx.projects) {
     for (const f of walk(root, { maxDepth: ctx.depth, skip: SKIP })) {
-      if (!LOCKFILES.has(basename(f))) continue;
+      const py = isPyLock(f);
+      if (!LOCKFILES.has(basename(f)) && !py) continue;
       const t = readText(f);
       if (!t) continue;
+      if (py) { for (const { name, version } of parsePyLock(f, t)) if (version && /^\d/.test(version)) pkgs.set(`PyPI:${name}@${version}`, { name, version, ecosystem: 'PyPI', file: tilde(ctx, f) }); continue; }
       for (const { name, version } of parseLockfile(f, t)) if (name && /^\d/.test(version)) pkgs.set(`${name}@${version}`, { name, version, ecosystem: 'npm', file: tilde(ctx, f) });
     }
   }

package/src/v4.js

@@ -0,0 +1,219 @@
+// v0.4: Python lockfiles + installed environments, container image references, and --harden checks.
+import { join, basename, relative } from 'node:path';
+import { readText, listDir, exists, walk, isSecretPair } from './util.js';
+import { parseDotenv } from './scanners.js';
+
+const tilde = (ctx, p) => (p.startsWith(ctx.home) ? '~' + p.slice(ctx.home.length).replace(/\\/g, '/') : p);
+const SKIP = new Set(['node_modules', '.git', 'dist', 'build', '.next', '.turbo', 'vendor', '.venv', 'venv', '__pycache__', 'coverage', '.cache', '.tox', 'site-packages']);
+const files = (ctx, root) => walk(root, { maxDepth: ctx.depth, skip: SKIP });
+
+/** PEP 503 normalised name. */
+export const pyName = (n) => String(n).toLowerCase().replace(/[-_.]+/g, '-');
+
+/* ---------- Python lockfiles ---------- */
+export const isPyLock = (f) => /^requirements[\w.-]*\.(txt|in)$|^constraints[\w.-]*\.txt$/i.test(basename(f)) || ['poetry.lock', 'uv.lock', 'Pipfile.lock', 'pdm.lock', 'pylock.toml'].includes(basename(f));
+
+export function parsePyLock(file, text) {
+  const base = basename(file);
+  const out = [];
+  if (base === 'Pipfile.lock') {
+    let j; try { j = JSON.parse(text); } catch { return out; }
+    for (const sec of ['default', 'develop']) for (const [n, v] of Object.entries(j[sec] || {})) { const m = String(v?.version || '').match(/^==\s*(\S+)$/); if (m) out.push({ name: pyName(n), version: m[1], hashed: !!v.hashes?.length }); }
+  } else if (/\.(lock|toml)$/.test(base)) {
+    // poetry.lock / uv.lock / pdm.lock / pylock.toml: [[package]] blocks with name = "..." and version = "..."
+    for (const block of text.split(/^\[\[packages?\]\]\s*$/m).slice(1)) {
+      const n = block.match(/^name\s*=\s*"([^"]+)"/m);
+      const v = block.match(/^version\s*=\s*"([^"]+)"/m);
+      if (n && v) out.push({ name: pyName(n[1]), version: v[1], hashed: /hash\s*=\s*"sha256:|"sha256:/.test(block) });
+    }
+  } else {
+    // requirements.txt: join continuation lines; "name[extra]==1.2.3 ; marker --hash=..."
+    for (const raw of text.replace(/\\\r?\n/g, ' ').split(/\r?\n/)) {
+      const line = raw.replace(/(^|\s)#.*$/, '').trim();
+      if (!line || line.startsWith('-')) continue;
+      const m = line.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)(\[[^\]]*\])?\s*(===?|~=|>=|<=|!=|>|<)?\s*([^\s;,]+)?/);
+      if (!m) continue;
+      out.push({ name: pyName(m[1]), version: m[3] === '==' || m[3] === '===' ? m[4] : null, spec: m[3] || null, hashed: /--hash[= ]sha256:/.test(line) });
+    }
+  }
+  return out;
+}
+
+function sitePackages(root) {
+  const out = [];
+  for (const env of ['.venv', 'venv', 'env', '.env']) {
+    const base = join(root, env);
+    if (!exists(join(base, 'pyvenv.cfg'))) continue;
+    for (const py of listDir(join(base, 'lib'))) if (py.isDirectory() && /^python3/.test(py.name)) out.push(join(base, 'lib', py.name, 'site-packages'));
+    out.push(join(base, 'Lib', 'site-packages'));
+  }
+  return out.filter(exists);
+}
+
+export function scanPython(ctx) {
+  const bad = new Map();
+  for (const p of ctx.iocs.packages.filter((x) => x.ecosystem === 'PyPI')) { const k = pyName(p.name); bad.set(k, [...(bad.get(k) || []), p]); }
+  const out = [];
+  const seen = new Set();
+  const hit = (p, version, where, how) => {
+    const key = `${p.name}@${version}|${where}`;
+    if (seen.has(key)) return; seen.add(key);
+    out.push({ id: 'supply.malicious-version', category: 'persistence', severity: 'critical', incident: p.incident,
+      title: `Known-malicious package ${p.name}==${version} (${p.campaign})`, location: where,
+      detail: `${how}. Python runs its startup hooks on every interpreter start, including pip, so don't run Python in that environment first. Rebuild it from scratch pinned to ${p.safe}, then rotate everything the host could reach from a clean machine. ${p.ref}` });
+  };
+  const find = (name, version) => (bad.get(name) || []).find((p) => p.versions.includes(version));
+  for (const root of ctx.projects) {
+    for (const f of files(ctx, root)) {
+      if (!isPyLock(f)) continue;
+      const t = readText(f);
+      if (!t) continue;
+      for (const { name, version } of parsePyLock(f, t)) { const p = version && find(name, version); if (p) hit(p, version, tilde(ctx, f), 'Pinned in this file'); }
+    }
+    for (const sp of sitePackages(root)) {
+      for (const ent of listDir(sp)) {
+        const m = ent.name.match(/^(.+)-([^-]+)\.dist-info$/);
+        if (m) { const p = find(pyName(m[1]), m[2]); if (p) hit(p, m[2], tilde(ctx, join(sp, ent.name)), 'Installed in this virtualenv'); }
+      }
+      const pth = readText(join(sp, 'cook.pth'));
+      if (pth && /^\s*import\s+cook\b/m.test(pth)) out.push({ id: 'persistence.python-startup-hook', category: 'persistence', severity: 'critical', incident: 'litellm',
+        title: 'litellm 1.107.0 startup hook cook.pth is installed', location: tilde(ctx, join(sp, 'cook.pth')),
+        detail: 'Runs the credential stealer at every Python start. From a shell (not Python): delete cook.pth, cook.py, sitecustomize.py and their __pycache__ entries, kill the process holding /tmp/remote_code_loader.lock, rebuild the venv, rotate. https://docs.litellm.ai/blog/security-incident-oct-21-2026' });
+    }
+  }
+  return out;
+}
+
+/* ---------- Container image references (Dockerfile FROM, compose image:) ---------- */
+export function imageRefs(file, text) {
+  const out = [];
+  const base = basename(file);
+  const stages = new Set();
+  if (/^(Dockerfile|Containerfile)(\..+)?$|\.(dockerfile|containerfile)$/i.test(base)) {
+    for (const [i, line] of text.split(/\r?\n/).entries()) {
+      const m = line.match(/^\s*FROM\s+(?:--platform=\S+\s+)?(\S+)(?:\s+AS\s+(\S+))?/i);
+      if (!m) continue;
+      if (!stages.has(m[1].toLowerCase())) out.push({ ref: m[1], line: i + 1 });
+      if (m[2]) stages.add(m[2].toLowerCase());
+    }
+    return out;
+  }
+  if (/^(docker-)?compose(\.[\w-]+)?\.ya?ml$/i.test(base)) {
+    for (const [i, line] of text.split(/\r?\n/).entries()) {
+      const m = line.match(/^\s+image:\s*["']?([^"'\s#]+)/);
+      if (m) out.push({ ref: m[1], line: i + 1 });
+    }
+  }
+  return out;
+}
+
+export function parseImage(ref) {
+  const [nameTag, digest] = ref.split('@');
+  const slash = nameTag.lastIndexOf('/');
+  const colon = nameTag.lastIndexOf(':');
+  const hasTag = colon > slash;
+  let repo = (hasTag ? nameTag.slice(0, colon) : nameTag).toLowerCase();
+  const tag = hasTag ? nameTag.slice(colon + 1) : digest ? null : 'latest';
+  if (!/^[^/]+[.:][^/]*\//.test(repo) && !repo.startsWith('localhost/')) repo = 'docker.io/' + (repo.includes('/') ? repo : 'library/' + repo);
+  return { repo, tag, digest: digest || null, variable: /\$/.test(ref) };
+}
+
+export function scanImages(ctx) {
+  const rules = ctx.iocs.images || [];
+  const out = [];
+  for (const root of ctx.projects) {
+    for (const f of files(ctx, root)) {
+      if (!/docker|compose|containerfile/i.test(basename(f))) continue;
+      const t = readText(f);
+      if (!t) continue;
+      for (const { ref, line } of imageRefs(f, t)) {
+        const img = parseImage(ref);
+        for (const r of rules) {
+          const repos = r.repos.map((x) => parseImage(x + ':x').repo);
+          if (!repos.includes(img.repo)) continue;
+          const badDigest = img.digest && (r.digests.includes(img.digest) || (r.digestPrefixes || []).some((p) => img.digest.startsWith(p)));
+          const where = `${tilde(ctx, f)}:${line}`;
+          if (badDigest || (!img.digest && r.badTags.includes(img.tag))) {
+            out.push({ id: 'supply.malicious-image', category: 'persistence', severity: 'critical', incident: r.incident, title: `Compromised image ${ref}`, location: where,
+              detail: `This image ran the ${r.incident} stealer. Treat every container started from it as compromised and rotate what it could reach. Use ${r.safe}. ${r.ref}` });
+          } else if (!img.digest && r.floatingTags.includes(img.tag)) {
+            out.push({ id: 'supply.floating-image-exposed', category: 'persistence', severity: 'high', incident: r.incident, title: `${ref} pointed at the compromised image during ${r.window}`, location: where,
+              detail: `Any container that pulled this floating tag in that window ran the stealer. Check pull/start times (\`docker image inspect\`, k8s events). Pin ${r.safe}. ${r.ref}` });
+          }
+        }
+      }
+    }
+  }
+  return out;
+}
+
+/* ---------- --harden: preventive settings, each with the exact fix ---------- */
+const H = (title, location, detail, fix, severity = 'low', id = 'hardening.config') => ({ id, category: 'hardening', severity, title, location, detail, fix });
+
+export function scanHarden(ctx) {
+  const out = [];
+  if (!ctx.harden) return out;
+  for (const root of ctx.projects) {
+    const all = files(ctx, root);
+    const rel = (f) => relative(root, f).replace(/\\/g, '/') || basename(f);
+    // Docker images not pinned by digest (one finding per file).
+    for (const f of all) {
+      if (!/docker|compose|containerfile/i.test(basename(f))) continue;
+      const t = readText(f);
+      if (!t) continue;
+      const loose = imageRefs(f, t).map((r) => ({ ...r, img: parseImage(r.ref) })).filter((r) => !r.img.digest && !r.img.variable && r.ref !== 'scratch');
+      if (loose.length) out.push(H(`${loose.length} image reference(s) not pinned by digest in ${rel(f)}`, tilde(ctx, f),
+        `Tags are mutable: LiteLLM's latest/main-stable pointed at a stealer for ~2.5 hours on Oct 21. Unpinned: ${loose.slice(0, 5).map((r) => r.ref).join(', ')}${loose.length > 5 ? ', …' : ''}.`,
+        'Pin as image:tag@sha256:<digest> (get it with `docker buildx imagetools inspect <image:tag>`) and let Dependabot/Renovate bump digests.', 'low', 'hardening.image-digest'));
+    }
+    // Python: requirements without hashes / unpinned; uv without exclude-newer.
+    const hasUvLock = exists(join(root, 'uv.lock'));
+    const pyproject = readText(join(root, 'pyproject.toml')) || '';
+    const uvToml = readText(join(root, 'uv.toml')) || '';
+    for (const f of all.filter((x) => /^requirements[\w.-]*\.txt$/i.test(basename(x)))) {
+      const reqs = parsePyLock(f, readText(f) || '');
+      if (!reqs.length) continue;
+      const unpinned = reqs.filter((r) => !r.version);
+      if (unpinned.length) out.push(H(`${unpinned.length} of ${reqs.length} requirement(s) not pinned with == in ${rel(f)}`, tilde(ctx, f),
+        `An unpinned \`litellm\` resolved to the malicious 1.107.0 for ~2 hours on Oct 21. Unpinned: ${unpinned.slice(0, 5).map((r) => r.name).join(', ')}${unpinned.length > 5 ? ', …' : ''}.`,
+        'Compile a lock: `uv pip compile requirements.in --generate-hashes -o requirements.txt` (or pip-tools `pip-compile --generate-hashes`).', 'low', 'hardening.python-pin'));
+      else if (!reqs.every((r) => r.hashed)) out.push(H(`${rel(f)} is pinned but has no --hash entries`, tilde(ctx, f),
+        'Hashes make pip refuse any file that differs from the one you locked (pip turns on hash-checking mode when any requirement has --hash).',
+        'Regenerate with `--generate-hashes` and install with `pip install --require-hashes -r requirements.txt`.', 'low', 'hardening.python-hashes'));
+    }
+    if ((hasUvLock || /\[tool\.uv\]/.test(pyproject)) && !/exclude-newer\s*=/.test(pyproject + uvToml)) out.push(H('uv has no release-age cooldown', tilde(ctx, join(root, 'pyproject.toml')),
+      'uv can ignore files uploaded too recently; the malicious litellm was live for under 2 hours.',
+      'Add `exclude-newer = "3 days"` under [tool.uv] in pyproject.toml (or uv.toml). With pip, where your version supports it: `pip install --uploaded-prior-to P3D`.', 'low', 'hardening.python-cooldown'));
+    // pnpm: builds allowed for everything
+    const ws = readText(join(root, 'pnpm-workspace.yaml')) || '';
+    if (/^\s*dangerouslyAllowAllBuilds\s*:\s*true/m.test(ws)) out.push(H('pnpm runs every dependency\'s build scripts', tilde(ctx, join(root, 'pnpm-workspace.yaml')),
+      'pnpm blocks dependency build scripts by default; dangerouslyAllowAllBuilds turns that off, which is how preinstall worms like tensorlake run.',
+      'Remove dangerouslyAllowAllBuilds and allow-list only what needs to build (`allowBuilds` / `onlyBuiltDependencies`, or `pnpm approve-builds`).', 'medium', 'hardening.pnpm-builds'));
+    // Long-lived publish/cloud secrets in workflows where OIDC exists
+    for (const f of all.filter((x) => /[\\/]\.github[\\/]workflows[\\/][^\\/]+\.ya?ml$/.test(x))) {
+      const t = readText(f) || '';
+      const r = rel(f);
+      if (/npm publish|pnpm publish|yarn npm publish/.test(t) && /NODE_AUTH_TOKEN:\s*\$\{\{\s*secrets\./.test(t)) out.push(H(`npm publish uses a long-lived token in ${r}`, tilde(ctx, f), 'A stolen NPM_TOKEN can publish from anywhere. npm trusted publishing uses short-lived OIDC credentials bound to this workflow.', 'Configure a trusted publisher on npmjs.com (package → Settings), add `permissions: id-token: write`, and drop NODE_AUTH_TOKEN. Provenance says where a package was built, not that it is safe.', 'low', 'hardening.oidc'));
+      if (/pypa\/gh-action-pypi-publish/.test(t) && /password:\s*\$\{\{\s*secrets\./.test(t)) out.push(H(`PyPI publish uses an API token in ${r}`, tilde(ctx, f), 'PyPI recommends Trusted Publishing over API tokens from CI.', 'Add a trusted publisher on pypi.org, set `permissions: id-token: write`, and remove `password:`.', 'low', 'hardening.oidc'));
+      if (/aws-actions\/configure-aws-credentials/.test(t) && /aws-secret-access-key:\s*\$\{\{\s*secrets\./.test(t)) out.push(H(`AWS access keys stored as secrets in ${r}`, tilde(ctx, f), 'Long-lived IAM keys in CI are what GhostAction-style workflows exfiltrate.', 'Use `role-to-assume` with GitHub OIDC (`permissions: id-token: write`) and delete the IAM user keys.', 'low', 'hardening.oidc'));
+    }
+    // .env files tracked by git or not ignored (needs git)
+    if (ctx.exec) {
+      const envs = all.filter((f) => /^\.env(\..+)?$/.test(basename(f)) && !/\.(example|sample|template|dist|defaults|demo|emulated|emulator|mock)$/i.test(basename(f)));
+      if (envs.length && ctx.exec('git', ['-C', root, 'rev-parse', '--is-inside-work-tree'])) {
+        const tracked = new Set((ctx.exec('git', ['-C', root, 'ls-files', '--', ...envs.map(rel)]) || '').split(/\r?\n/).filter(Boolean));
+        for (const f of envs) {
+          const r = rel(f);
+          // Committed env files with only public config (NEXT_PUBLIC_*, URLs, fakes) are normal; flag only real-looking secrets.
+          const n = parseDotenv(readText(f) || '').filter(([k, v]) => isSecretPair(k, v)).length;
+          if (!n) continue;
+          if (tracked.has(r)) out.push(H(`${r} is committed to git with ${n} secret-looking value(s)`, tilde(ctx, f), 'Anyone with repo access (and every fork/clone) has these values, including in history.', `\`git rm --cached ${r}\`, add it to .gitignore, rotate every value in it, and scan history with gitleaks/TruffleHog.`, 'high', 'hardening.env-tracked'));
+          else if (ctx.exec('git', ['-C', root, 'check-ignore', '-q', r]) === null) out.push(H(`${r} holds ${n} secret-looking value(s) and is not in .gitignore`, tilde(ctx, f), 'One `git add .` away from being committed.', `Add \`${basename(f)}\` (or \`.env*\` with \`!.env.example\`) to .gitignore.`, 'medium', 'hardening.env-ignore'));
+        }
+      }
+    }
+  }
+  return out;
+}
+
+export const V4_SCANNERS = { python: scanPython, images: scanImages, harden: scanHarden };