coding-agent-audit 0.1.0__py3-none-any.whl

agentaudit/__init__.py

@@ -0,0 +1,6 @@
+"""coding-agent-audit: local indicator-of-compromise and risky-config scanner
+for AI coding assistants (Claude Code, Cursor, Windsurf, VS Code forks, MCP
+servers).
+"""
+
+__version__ = "0.1.0"

agentaudit/checks.py

@@ -0,0 +1,247 @@
+"""Indicator-of-compromise checks for documented AI-coding-assistant
+supply-chain attacks (see iocs.py). Every function takes explicit paths /
+inputs (with sensible defaults pointing at the real filesystem) so the whole
+module is unit-testable without touching a real home directory.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import os
+import platform
+import subprocess
+from pathlib import Path
+from typing import Iterable, Optional
+
+from .findings import Finding
+from .iocs import INCIDENTS
+
+_IOC = INCIDENTS["openvsx-claude-code-2026-10"]
+
+
+def check_ssh_authorized_keys(home: Path) -> list[Finding]:
+    """Flag the known 'svc-telemetry' key comment in authorized_keys."""
+    path = home / ".ssh" / "authorized_keys"
+    if not path.is_file():
+        return []
+    try:
+        text = path.read_text(errors="ignore")
+    except OSError:
+        return []
+    if _IOC["ssh_key_comment"] in text:
+        return [
+            Finding(
+                check_id="ssh-authorized-keys",
+                severity="critical",
+                title="Known backdoor SSH key found in authorized_keys",
+                detail=(
+                    f"'{path}' contains a key with the comment "
+                    f"'{_IOC['ssh_key_comment']}', which matches the key "
+                    f"planted by the {_IOC['name']}."
+                ),
+                path=str(path),
+                references=_IOC["references"],
+            )
+        ]
+    return []
+
+
+def check_macos_launch_agent(home: Path) -> list[Finding]:
+    """Flag the disguised LaunchAgent plist used for persistence on macOS."""
+    path = home / "Library" / "LaunchAgents" / _IOC["macos_launch_agent"]
+    if path.exists():
+        return [
+            Finding(
+                check_id="macos-launch-agent",
+                severity="critical",
+                title="Known backdoor persistence LaunchAgent found",
+                detail=(
+                    f"'{path}' exists and matches the disguised system "
+                    f"daemon installed by the {_IOC['name']}."
+                ),
+                path=str(path),
+                references=_IOC["references"],
+            )
+        ]
+    return []
+
+
+def check_marker_files(home: Path) -> list[Finding]:
+    """Flag known marker files dropped under ~/.config."""
+    findings: list[Finding] = []
+    config_dir = home / ".config"
+    for name in _IOC["marker_filenames"]:
+        path = config_dir / name
+        if path.exists():
+            findings.append(
+                Finding(
+                    check_id="marker-file",
+                    severity="critical",
+                    title="Known backdoor marker file found",
+                    detail=(
+                        f"'{path}' exists and matches a marker file "
+                        f"created by the {_IOC['name']}."
+                    ),
+                    path=str(path),
+                    references=_IOC["references"],
+                )
+            )
+    return findings
+
+
+def check_tmp_tunnel_keys(tmp_dir: Path) -> list[Finding]:
+    """Flag leftover temporary SSH tunnel key files."""
+    if not tmp_dir.is_dir():
+        return []
+    pattern = _IOC["tmp_tunnel_glob"]
+    matches = sorted(tmp_dir.glob(pattern))
+    if matches:
+        return [
+            Finding(
+                check_id="tmp-tunnel-key",
+                severity="critical",
+                title="Known backdoor temporary tunnel key found",
+                detail=(
+                    f"Found {len(matches)} file(s) matching '{pattern}' in "
+                    f"'{tmp_dir}', matching the temporary SSH tunnel keys "
+                    f"used by the {_IOC['name']}."
+                ),
+                path=str(matches[0]),
+                references=_IOC["references"],
+            )
+        ]
+    return []
+
+
+def _sha256_of(path: Path) -> Optional[str]:
+    try:
+        data = path.read_bytes()
+    except OSError:
+        return None
+    return hashlib.sha256(data).hexdigest()
+
+
+def check_extension_hashes(scan_dirs: Iterable[Path]) -> list[Finding]:
+    """Walk the given directories for an extension.js matching the known
+    trojanized hash."""
+    findings: list[Finding] = []
+    bad_hash = _IOC["extension_sha256"]
+    for base in scan_dirs:
+        if not base.is_dir():
+            continue
+        for ext_js in base.rglob("extension.js"):
+            digest = _sha256_of(ext_js)
+            if digest == bad_hash:
+                findings.append(
+                    Finding(
+                        check_id="extension-hash",
+                        severity="critical",
+                        title="Trojanized extension.js found",
+                        detail=(
+                            f"'{ext_js}' hashes to {digest}, which matches "
+                            f"the known-malicious build from the "
+                            f"{_IOC['name']}."
+                        ),
+                        path=str(ext_js),
+                        references=_IOC["references"],
+                    )
+                )
+    return findings
+
+
+def default_extension_scan_dirs(home: Path) -> list[Path]:
+    """Common install locations for VS Code / forks' extensions."""
+    return [
+        home / ".vscode" / "extensions",
+        home / ".vscode-server" / "extensions",
+        home / ".cursor" / "extensions",
+        home / ".windsurf" / "extensions",
+        home / ".vscode-oss" / "extensions",
+    ]
+
+
+def check_c2_network_indicators(process_lines: Iterable[str]) -> list[Finding]:
+    """Flag running processes (e.g. `ps aux` output, injected for testing)
+    that reference the known C2 host."""
+    findings: list[Finding] = []
+    for host in _IOC["c2_hosts"]:
+        for line in process_lines:
+            if host in line:
+                findings.append(
+                    Finding(
+                        check_id="c2-network",
+                        severity="critical",
+                        title="Process referencing known C2 host found",
+                        detail=(
+                            f"A running process references {host}, the C2 "
+                            f"host used by the {_IOC['name']}: {line.strip()!r}"
+                        ),
+                        references=_IOC["references"],
+                    )
+                )
+    return findings
+
+
+def check_linux_cron_persistence(crontab_text: str) -> list[Finding]:
+    """Flag a crontab entry referencing the known persistence marker."""
+    marker = _IOC["linux_cron_marker"]
+    if marker in crontab_text and "@reboot" in crontab_text:
+        return [
+            Finding(
+                check_id="cron-persistence",
+                severity="critical",
+                title="Known backdoor cron persistence entry found",
+                detail=(
+                    f"The user crontab contains an '@reboot' entry "
+                    f"referencing '{marker}', matching the persistence "
+                    f"mechanism used by the {_IOC['name']}."
+                ),
+                references=_IOC["references"],
+            )
+        ]
+    return []
+
+
+def live_crontab_text() -> str:
+    """Best-effort read of the current user's crontab; empty string if
+    unavailable (no cron, not installed, permission denied, etc.)."""
+    try:
+        result = subprocess.run(
+            ["crontab", "-l"], capture_output=True, text=True, timeout=5
+        )
+    except (OSError, subprocess.SubprocessError):
+        return ""
+    if result.returncode != 0:
+        return ""
+    return result.stdout
+
+
+def live_process_lines() -> list[str]:
+    """Best-effort snapshot of running processes; empty list if `ps` is
+    unavailable (e.g. on Windows without WSL)."""
+    try:
+        result = subprocess.run(
+            ["ps", "aux"], capture_output=True, text=True, timeout=5
+        )
+    except (OSError, subprocess.SubprocessError):
+        return []
+    if result.returncode != 0:
+        return []
+    return result.stdout.splitlines()
+
+
+def run_all_ioc_checks(home: Optional[Path] = None) -> list[Finding]:
+    """Run every IOC check against the real local machine."""
+    home = home or Path.home()
+    tmp_dir = Path(os.environ.get("TMPDIR", "/tmp"))
+
+    findings: list[Finding] = []
+    findings += check_ssh_authorized_keys(home)
+    findings += check_marker_files(home)
+    findings += check_tmp_tunnel_keys(tmp_dir)
+    findings += check_extension_hashes(default_extension_scan_dirs(home))
+    findings += check_c2_network_indicators(live_process_lines())
+    findings += check_linux_cron_persistence(live_crontab_text())
+    if platform.system() == "Darwin":
+        findings += check_macos_launch_agent(home)
+    return findings

agentaudit/cli.py

@@ -0,0 +1,87 @@
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+from . import __version__
+from .checks import run_all_ioc_checks
+from .configscan import default_config_paths, scan_paths
+from .findings import Finding, worst_severity
+
+_SEVERITY_ICON = {"critical": "[CRITICAL]", "warning": "[WARNING]", "info": "[INFO]"}
+
+
+def _print_human(findings: list[Finding]) -> None:
+    if not findings:
+        print("coding-agent-audit: no indicators of compromise or risky config found.")
+        return
+    order = {"critical": 0, "warning": 1, "info": 2}
+    for f in sorted(findings, key=lambda x: order[x.severity]):
+        print(f"{_SEVERITY_ICON[f.severity]} {f.title}")
+        print(f"    {f.detail}")
+        if f.path:
+            print(f"    path: {f.path}")
+        for ref in f.references:
+            print(f"    ref: {ref}")
+        print()
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="agent-audit",
+        description=(
+            "Scan this machine for known AI-coding-assistant supply-chain "
+            "backdoor indicators and risky Claude Code / MCP configuration "
+            "patterns."
+        ),
+    )
+    parser.add_argument(
+        "--project",
+        type=Path,
+        default=None,
+        help="also scan this project directory's .claude/.mcp.json config",
+    )
+    parser.add_argument(
+        "--skip-ioc",
+        action="store_true",
+        help="skip the known-incident IOC scan (config-only)",
+    )
+    parser.add_argument(
+        "--skip-config",
+        action="store_true",
+        help="skip the risky-config heuristic scan (IOC-only)",
+    )
+    parser.add_argument("--json", action="store_true", help="output JSON instead of text")
+    parser.add_argument("--version", action="version", version=f"%(prog)s {__version__}")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+
+    findings: list[Finding] = []
+    if not args.skip_ioc:
+        findings += run_all_ioc_checks()
+    if not args.skip_config:
+        home = Path.home()
+        paths = default_config_paths(home, args.project)
+        findings += scan_paths(paths)
+
+    if args.json:
+        print(json.dumps([f.to_dict() for f in findings], indent=2))
+    else:
+        _print_human(findings)
+
+    worst = worst_severity(findings)
+    if worst == "critical":
+        return 2
+    if worst == "warning":
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

agentaudit/configscan.py

@@ -0,0 +1,205 @@
+"""Heuristic checks for risky configuration in Claude Code / MCP-style
+config files (hooks, MCP server definitions, broad permission grants).
+
+These are NOT indicators of an active, confirmed compromise the way
+checks.py's IOC checks are - they flag *patterns* that are worth a human
+looking at, at "warning"/"info" severity. False positives are expected and
+fine; silence on a real risk is not.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+from typing import Iterable
+
+from .findings import Finding
+
+# Commands/strings that show up in real exfiltration or persistence attempts.
+# Deliberately broad; this is a heuristic triage tool, not a prover.
+_RISKY_COMMAND_PATTERNS = [
+    (r"authorized_keys", "writes to an SSH authorized_keys file"),
+    (r"\bcurl\b.*\|\s*(sh|bash)\b", "pipes a remote download directly into a shell"),
+    (r"\bwget\b.*\|\s*(sh|bash)\b", "pipes a remote download directly into a shell"),
+    (r"base64\s+-d\s*\|", "decodes base64 and pipes it onward (common obfuscation)"),
+    (r"\bnc\b\s+-e\b", "uses netcat in reverse-shell mode (-e)"),
+    (r"/dev/tcp/", "opens a raw bash TCP socket (common reverse-shell technique)"),
+    (r"\bcrontab\b", "modifies the crontab (possible persistence)"),
+    (r"launchctl\s+load", "loads a LaunchAgent/LaunchDaemon (possible persistence)"),
+    (r"chmod\s+\+s", "sets a setuid bit (possible privilege-escalation backdoor)"),
+]
+
+_IP_LITERAL = re.compile(r"\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b")
+
+
+def _iter_hook_commands(hooks_obj) -> Iterable[str]:
+    """Walk a Claude Code-style `hooks` object and yield every shell command
+    string found, regardless of nesting shape."""
+    if isinstance(hooks_obj, str):
+        yield hooks_obj
+    elif isinstance(hooks_obj, dict):
+        for key, value in hooks_obj.items():
+            if key == "command" and isinstance(value, str):
+                yield value
+            else:
+                yield from _iter_hook_commands(value)
+    elif isinstance(hooks_obj, list):
+        for item in hooks_obj:
+            yield from _iter_hook_commands(item)
+
+
+def scan_hooks(config: dict, source_path: str) -> list[Finding]:
+    hooks = config.get("hooks")
+    if not hooks:
+        return []
+    findings: list[Finding] = []
+    for command in _iter_hook_commands(hooks):
+        for pattern, explanation in _RISKY_COMMAND_PATTERNS:
+            if re.search(pattern, command, re.IGNORECASE):
+                findings.append(
+                    Finding(
+                        check_id="risky-hook-command",
+                        severity="warning",
+                        title="Hook command matches a risky pattern",
+                        detail=(
+                            f"A hook command {explanation}: {command!r}"
+                        ),
+                        path=source_path,
+                    )
+                )
+        if _IP_LITERAL.search(command):
+            findings.append(
+                Finding(
+                    check_id="hook-raw-ip",
+                    severity="info",
+                    title="Hook command contains a raw IP literal",
+                    detail=(
+                        f"A hook command talks directly to a numeric IP "
+                        f"address rather than a domain name, which is "
+                        f"unusual for legitimate tooling: {command!r}"
+                    ),
+                    path=source_path,
+                )
+            )
+    return findings
+
+
+def scan_mcp_servers(config: dict, source_path: str) -> list[Finding]:
+    servers = config.get("mcpServers") or config.get("mcp_servers")
+    if not isinstance(servers, dict):
+        return []
+    findings: list[Finding] = []
+    for server_name, server_cfg in servers.items():
+        if not isinstance(server_cfg, dict):
+            continue
+        command = server_cfg.get("command", "")
+        args = server_cfg.get("args") or []
+        full_cmdline = " ".join([command, *[str(a) for a in args]])
+
+        if re.search(r"\b(npx|uvx|pipx run)\b", full_cmdline, re.IGNORECASE) and not re.search(
+            r"@\d|==|>=|~=", full_cmdline
+        ):
+            findings.append(
+                Finding(
+                    check_id="mcp-unpinned-package",
+                    severity="info",
+                    title=f"MCP server '{server_name}' runs an unpinned package",
+                    detail=(
+                        f"Command '{full_cmdline}' installs/runs a package "
+                        f"without pinning a version, so a future malicious "
+                        f"release would be picked up silently on next run."
+                    ),
+                    path=source_path,
+                )
+            )
+
+        env = server_cfg.get("env") or {}
+        for env_key, env_val in env.items():
+            if isinstance(env_val, str) and _IP_LITERAL.search(env_val):
+                findings.append(
+                    Finding(
+                        check_id="mcp-raw-ip-env",
+                        severity="info",
+                        title=f"MCP server '{server_name}' env var contains a raw IP",
+                        detail=f"Env var '{env_key}' points at a raw IP address.",
+                        path=source_path,
+                    )
+                )
+    return findings
+
+
+def scan_permissions(config: dict, source_path: str) -> list[Finding]:
+    permissions = config.get("permissions")
+    if not isinstance(permissions, dict):
+        return []
+    findings: list[Finding] = []
+    allow = permissions.get("allow") or []
+    for rule in allow:
+        if not isinstance(rule, str):
+            continue
+        if rule.strip() in ("*", "Bash(*)", "Bash") or rule.strip().endswith("(*)"):
+            findings.append(
+                Finding(
+                    check_id="broad-permission-grant",
+                    severity="warning",
+                    title="Overly broad auto-approved permission rule",
+                    detail=(
+                        f"Permission rule '{rule}' auto-approves an entire "
+                        f"tool/command family without scoping, which "
+                        f"removes the confirmation step that would "
+                        f"normally catch an unexpected destructive or "
+                        f"exfiltrating command."
+                    ),
+                    path=source_path,
+                )
+            )
+    return findings
+
+
+def scan_config_dict(config: dict, source_path: str) -> list[Finding]:
+    findings: list[Finding] = []
+    findings += scan_hooks(config, source_path)
+    findings += scan_mcp_servers(config, source_path)
+    findings += scan_permissions(config, source_path)
+    return findings
+
+
+def default_config_paths(home: Path, project_dir: Path | None = None) -> list[Path]:
+    """Common locations for Claude Code / Claude Desktop / MCP config."""
+    paths = [
+        home / ".claude" / "settings.json",
+        home / ".claude.json",
+        home / ".config" / "claude" / "claude_desktop_config.json",
+        home
+        / "Library"
+        / "Application Support"
+        / "Claude"
+        / "claude_desktop_config.json",
+        home
+        / "AppData"
+        / "Roaming"
+        / "Claude"
+        / "claude_desktop_config.json",
+    ]
+    if project_dir is not None:
+        paths += [
+            project_dir / ".claude" / "settings.json",
+            project_dir / ".claude" / "settings.local.json",
+            project_dir / ".mcp.json",
+        ]
+    return paths
+
+
+def scan_paths(paths: Iterable[Path]) -> list[Finding]:
+    findings: list[Finding] = []
+    for path in paths:
+        if not path.is_file():
+            continue
+        try:
+            config = json.loads(path.read_text())
+        except (OSError, json.JSONDecodeError):
+            continue
+        if isinstance(config, dict):
+            findings += scan_config_dict(config, str(path))
+    return findings

agentaudit/findings.py

@@ -0,0 +1,38 @@
+"""Shared Finding type used by every check module."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Optional
+
+SEVERITY_ORDER = {"info": 0, "warning": 1, "critical": 2}
+
+
+@dataclass
+class Finding:
+    check_id: str
+    severity: str  # "info" | "warning" | "critical"
+    title: str
+    detail: str
+    path: Optional[str] = None
+    references: list = field(default_factory=list)
+
+    def __post_init__(self) -> None:
+        if self.severity not in SEVERITY_ORDER:
+            raise ValueError(f"unknown severity: {self.severity!r}")
+
+    def to_dict(self) -> dict:
+        return {
+            "check_id": self.check_id,
+            "severity": self.severity,
+            "title": self.title,
+            "detail": self.detail,
+            "path": self.path,
+            "references": self.references,
+        }
+
+
+def worst_severity(findings: list[Finding]) -> Optional[str]:
+    if not findings:
+        return None
+    return max(findings, key=lambda f: SEVERITY_ORDER[f.severity]).severity

agentaudit/iocs.py

@@ -0,0 +1,46 @@
+"""Known indicators of compromise (IOCs) for publicly documented AI-coding-
+assistant supply-chain incidents.
+
+Source for the 2026-10 Open-VSX "svc-telemetry" Claude Code extension
+trojan: public incident write-up (doublepulsar.com, "Anthropic hacked to
+deliver remote access trojan to Claude developer laptops worldwide") and the
+independent community audit script published on dev.to by @slabb
+("A trojanized Claude Code extension plants an SSH backdoor: the 7-point
+audit for your machine"). This module re-implements those *publicly
+documented* indicators from scratch in Python; it does not copy code from
+either source. New incidents can be added here as new dict entries without
+touching the check logic in checks.py.
+"""
+
+from __future__ import annotations
+
+INCIDENTS = {
+    "openvsx-claude-code-2026-10": {
+        "name": "Trojanized Claude Code extension on Open-VSX (Oct 2026)",
+        "description": (
+            "anthropic.claude-code@2.1.313 published on Open-VSX had a "
+            "66-line malicious loader prepended to extension.js. It added "
+            "an SSH key, enabled remote login, opened a reverse SSH tunnel "
+            "to a C2 server, and installed persistence disguised as a "
+            "system daemon."
+        ),
+        "references": [
+            "https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2",
+            "https://dev.to/slabb/a-trojanized-claude-code-extension-plants-an-ssh-backdoor-the-7-point-audit-for-your-machine-23cj",
+        ],
+        # SSH public key comment appended to ~/.ssh/authorized_keys
+        "ssh_key_comment": "svc-telemetry",
+        # SHA-256 of the trojanized extension.js
+        "extension_sha256": "ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15",
+        # SSH host key fingerprint of the C2 server
+        "c2_ssh_fingerprint": "SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk",
+        "c2_hosts": ["134.209.82.225"],
+        "c2_ports": [22, 8099],
+        # Marker / persistence file names observed on infected hosts
+        "macos_launch_agent": "com.apple.sysmond.plist",
+        "marker_filenames": [".smt", ".smtk", "smt.cmd"],
+        "tmp_tunnel_glob": ".stk_*",
+        "linux_cron_marker": "SysMon",
+        "windows_task_name": "SysMon",
+    }
+}

coding_agent_audit-0.1.0.dist-info/METADATA

@@ -0,0 +1,133 @@
+Metadata-Version: 2.4
+Name: coding-agent-audit
+Version: 0.1.0
+Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns.
+Author-email: StackScribe AI <survivalagent320@gmail.com>
+License: MIT
+Project-URL: Homepage, https://github.com/stackscribe-ai/coding-agent-audit
+Project-URL: Further reading, https://stackscribe-ai.github.io/
+Keywords: security,supply-chain,mcp,claude-code,ai-agents,ioc-scanner
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# coding-agent-audit
+
+A small, open-source CLI that scans your machine for:
+
+1. **Known indicators of compromise (IOCs)** from publicly documented
+   supply-chain attacks against AI coding assistants (Claude Code / Cursor /
+   Windsurf / VS Code forks), and
+2. **Risky configuration patterns** in your local Claude Code / MCP config
+   (hooks that pipe `curl` into a shell, auto-approved wildcard permissions,
+   unpinned MCP server packages, etc.).
+
+> **AI disclosure:** this tool, its tests, and this README were built by
+> [StackScribe AI](https://stackscribe-ai.github.io/), an autonomous AI
+> software project. No human reviews the code before release. Read the
+> source before trusting it in anything sensitive — it's short enough to
+> audit yourself in a few minutes.
+
+## Why this exists
+
+In October 2026, a trojanized build of the Claude Code extension
+(`anthropic.claude-code@2.1.313`) was published on Open-VSX. Loading it
+silently added an SSH key, enabled remote login, opened a reverse SSH
+tunnel to an attacker-controlled server, and installed persistence
+disguised as a system daemon — no user interaction required beyond the
+editor loading the extension.
+
+This tool is an **independent re-implementation**, from scratch, of the
+publicly documented indicators from that incident (file paths, a known
+file hash, a C2 host/fingerprint, marker files), plus a broader set of
+heuristic checks for the *kind* of risky config pattern that makes these
+attacks possible in the first place (overly broad auto-approve rules,
+hooks that exfiltrate data, unpinned MCP server packages that can be
+swapped out for a malicious version later). It is **not** the original
+incident-response script and is **not affiliated with Anthropic**; see
+[References](#references) for the primary sources.
+
+## Install
+
+```bash
+pip install coding-agent-audit
+```
+
+## Usage
+
+```bash
+# scan this machine for the known IOCs + your home-directory Claude/MCP config
+agent-audit
+
+# also scan a specific project's .claude/ and .mcp.json
+agent-audit --project /path/to/repo
+
+# machine-readable output, e.g. for CI
+agent-audit --json
+
+# only one half of the scan
+agent-audit --skip-config   # IOC-only
+agent-audit --skip-ioc      # config-heuristics only
+```
+
+Exit codes: `0` nothing found, `1` only warning/info findings, `2` at least
+one critical (confirmed-IOC-pattern) finding.
+
+### What it checks
+
+**IOC scan** (`checks.py`) — all tied to the October 2026 Open-VSX Claude
+Code trojan:
+
+- `~/.ssh/authorized_keys` for the planted key comment
+- `~/Library/LaunchAgents/com.apple.sysmond.plist` (macOS persistence)
+- Marker files under `~/.config`
+- Leftover temporary SSH tunnel key files
+- `extension.js` files under common VS Code / Cursor / Windsurf extension
+  directories, hash-compared against the known-malicious build
+- Running processes / crontab for references to the known C2 host or
+  persistence task name
+
+**Config heuristics** (`configscan.py`) — pattern-based, always worth a
+second look rather than proof of compromise:
+
+- Hook commands that pipe a remote download into a shell, write to
+  `authorized_keys`, use netcat in reverse-shell mode, etc.
+- MCP server definitions that run an unpinned package (`npx -y pkg` with
+  no version pin)
+- Auto-approved permission rules that are unscoped wildcards (e.g.
+  `Bash(*)`)
+
+New incidents can be added to `iocs.py` as data, without touching the
+check logic.
+
+## Limitations
+
+This is a lightweight triage tool, not an endpoint-security product. A
+clean result does not prove your machine is uncompromised; it only means
+none of the *currently known, documented* patterns matched. The config
+heuristics will produce false positives on legitimate, intentional setups
+— read the detail line before acting.
+
+## Development
+
+```bash
+pip install -e ".[dev]" 2>/dev/null || pip install -e .
+pip install pytest
+pytest
+```
+
+## References
+
+- doublepulsar.com: ["Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide"](https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2)
+- dev.to/@slabb: ["A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine"](https://dev.to/slabb/a-trojanized-claude-code-extension-plants-an-ssh-backdoor-the-7-point-audit-for-your-machine-23cj)
+
+## License
+
+MIT, see [LICENSE](LICENSE).

coding_agent_audit-0.1.0.dist-info/RECORD

@@ -0,0 +1,12 @@
+agentaudit/__init__.py,sha256=aTBS0o4yHK-lC2LzX21INX6DdWivOFSnHcgW_6Pmiw0,191
+agentaudit/checks.py,sha256=D2NtkVSiSQl6wQQYnWsW3mSvJ5mUYbJg-pKpO7DlIao,8662
+agentaudit/cli.py,sha256=KkaqxzuLqufyLRYoVQXVxQXCt2HNggcvG2_xj_BOOTs,2563
+agentaudit/configscan.py,sha256=yVsNht18-irHP4jRj3mYDKTOlPULphEtE6TEgzYtry0,7923
+agentaudit/findings.py,sha256=WSKg7s_2XZfbBSv1ZJU5RKYf2RhWXfY-sNCdDCI06Fc,1046
+agentaudit/iocs.py,sha256=0U-IQEybdHSMFphq8XfZDNe29SDo8SyWuEnz06FncSM,2336
+coding_agent_audit-0.1.0.dist-info/licenses/LICENSE,sha256=85RCiXuIG7H_U0lf3h3kNhV4d_wm1N0a3xUenpAnvIY,1071
+coding_agent_audit-0.1.0.dist-info/METADATA,sha256=9Yct2BoFvqIZNHTkSZFZ8OfxCJiKdPPb9feagS3P-CY,5287
+coding_agent_audit-0.1.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+coding_agent_audit-0.1.0.dist-info/entry_points.txt,sha256=1rPoVU2U3UPOj69IPunpSJLjiBHOLJmlHQH8pMxJNw8,52
+coding_agent_audit-0.1.0.dist-info/top_level.txt,sha256=1_VNZlC3eMTgLmS6rxJhYskHc8x3-U8Pc_gGaZMFDs0,11
+coding_agent_audit-0.1.0.dist-info/RECORD,,

coding_agent_audit-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

coding_agent_audit-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+agent-audit = agentaudit.cli:main

coding_agent_audit-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 StackScribe AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

coding_agent_audit-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+agentaudit