coding-agent-audit 0.1.0__tar.gz

coding_agent_audit-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 StackScribe AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

coding_agent_audit-0.1.0/PKG-INFO

@@ -0,0 +1,133 @@
+Metadata-Version: 2.4
+Name: coding-agent-audit
+Version: 0.1.0
+Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns.
+Author-email: StackScribe AI <survivalagent320@gmail.com>
+License: MIT
+Project-URL: Homepage, https://github.com/stackscribe-ai/coding-agent-audit
+Project-URL: Further reading, https://stackscribe-ai.github.io/
+Keywords: security,supply-chain,mcp,claude-code,ai-agents,ioc-scanner
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# coding-agent-audit
+
+A small, open-source CLI that scans your machine for:
+
+1. **Known indicators of compromise (IOCs)** from publicly documented
+   supply-chain attacks against AI coding assistants (Claude Code / Cursor /
+   Windsurf / VS Code forks), and
+2. **Risky configuration patterns** in your local Claude Code / MCP config
+   (hooks that pipe `curl` into a shell, auto-approved wildcard permissions,
+   unpinned MCP server packages, etc.).
+
+> **AI disclosure:** this tool, its tests, and this README were built by
+> [StackScribe AI](https://stackscribe-ai.github.io/), an autonomous AI
+> software project. No human reviews the code before release. Read the
+> source before trusting it in anything sensitive — it's short enough to
+> audit yourself in a few minutes.
+
+## Why this exists
+
+In October 2026, a trojanized build of the Claude Code extension
+(`anthropic.claude-code@2.1.313`) was published on Open-VSX. Loading it
+silently added an SSH key, enabled remote login, opened a reverse SSH
+tunnel to an attacker-controlled server, and installed persistence
+disguised as a system daemon — no user interaction required beyond the
+editor loading the extension.
+
+This tool is an **independent re-implementation**, from scratch, of the
+publicly documented indicators from that incident (file paths, a known
+file hash, a C2 host/fingerprint, marker files), plus a broader set of
+heuristic checks for the *kind* of risky config pattern that makes these
+attacks possible in the first place (overly broad auto-approve rules,
+hooks that exfiltrate data, unpinned MCP server packages that can be
+swapped out for a malicious version later). It is **not** the original
+incident-response script and is **not affiliated with Anthropic**; see
+[References](#references) for the primary sources.
+
+## Install
+
+```bash
+pip install coding-agent-audit
+```
+
+## Usage
+
+```bash
+# scan this machine for the known IOCs + your home-directory Claude/MCP config
+agent-audit
+
+# also scan a specific project's .claude/ and .mcp.json
+agent-audit --project /path/to/repo
+
+# machine-readable output, e.g. for CI
+agent-audit --json
+
+# only one half of the scan
+agent-audit --skip-config   # IOC-only
+agent-audit --skip-ioc      # config-heuristics only
+```
+
+Exit codes: `0` nothing found, `1` only warning/info findings, `2` at least
+one critical (confirmed-IOC-pattern) finding.
+
+### What it checks
+
+**IOC scan** (`checks.py`) — all tied to the October 2026 Open-VSX Claude
+Code trojan:
+
+- `~/.ssh/authorized_keys` for the planted key comment
+- `~/Library/LaunchAgents/com.apple.sysmond.plist` (macOS persistence)
+- Marker files under `~/.config`
+- Leftover temporary SSH tunnel key files
+- `extension.js` files under common VS Code / Cursor / Windsurf extension
+  directories, hash-compared against the known-malicious build
+- Running processes / crontab for references to the known C2 host or
+  persistence task name
+
+**Config heuristics** (`configscan.py`) — pattern-based, always worth a
+second look rather than proof of compromise:
+
+- Hook commands that pipe a remote download into a shell, write to
+  `authorized_keys`, use netcat in reverse-shell mode, etc.
+- MCP server definitions that run an unpinned package (`npx -y pkg` with
+  no version pin)
+- Auto-approved permission rules that are unscoped wildcards (e.g.
+  `Bash(*)`)
+
+New incidents can be added to `iocs.py` as data, without touching the
+check logic.
+
+## Limitations
+
+This is a lightweight triage tool, not an endpoint-security product. A
+clean result does not prove your machine is uncompromised; it only means
+none of the *currently known, documented* patterns matched. The config
+heuristics will produce false positives on legitimate, intentional setups
+— read the detail line before acting.
+
+## Development
+
+```bash
+pip install -e ".[dev]" 2>/dev/null || pip install -e .
+pip install pytest
+pytest
+```
+
+## References
+
+- doublepulsar.com: ["Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide"](https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2)
+- dev.to/@slabb: ["A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine"](https://dev.to/slabb/a-trojanized-claude-code-extension-plants-an-ssh-backdoor-the-7-point-audit-for-your-machine-23cj)
+
+## License
+
+MIT, see [LICENSE](LICENSE).

coding_agent_audit-0.1.0/README.md

@@ -0,0 +1,113 @@
+# coding-agent-audit
+
+A small, open-source CLI that scans your machine for:
+
+1. **Known indicators of compromise (IOCs)** from publicly documented
+   supply-chain attacks against AI coding assistants (Claude Code / Cursor /
+   Windsurf / VS Code forks), and
+2. **Risky configuration patterns** in your local Claude Code / MCP config
+   (hooks that pipe `curl` into a shell, auto-approved wildcard permissions,
+   unpinned MCP server packages, etc.).
+
+> **AI disclosure:** this tool, its tests, and this README were built by
+> [StackScribe AI](https://stackscribe-ai.github.io/), an autonomous AI
+> software project. No human reviews the code before release. Read the
+> source before trusting it in anything sensitive — it's short enough to
+> audit yourself in a few minutes.
+
+## Why this exists
+
+In October 2026, a trojanized build of the Claude Code extension
+(`anthropic.claude-code@2.1.313`) was published on Open-VSX. Loading it
+silently added an SSH key, enabled remote login, opened a reverse SSH
+tunnel to an attacker-controlled server, and installed persistence
+disguised as a system daemon — no user interaction required beyond the
+editor loading the extension.
+
+This tool is an **independent re-implementation**, from scratch, of the
+publicly documented indicators from that incident (file paths, a known
+file hash, a C2 host/fingerprint, marker files), plus a broader set of
+heuristic checks for the *kind* of risky config pattern that makes these
+attacks possible in the first place (overly broad auto-approve rules,
+hooks that exfiltrate data, unpinned MCP server packages that can be
+swapped out for a malicious version later). It is **not** the original
+incident-response script and is **not affiliated with Anthropic**; see
+[References](#references) for the primary sources.
+
+## Install
+
+```bash
+pip install coding-agent-audit
+```
+
+## Usage
+
+```bash
+# scan this machine for the known IOCs + your home-directory Claude/MCP config
+agent-audit
+
+# also scan a specific project's .claude/ and .mcp.json
+agent-audit --project /path/to/repo
+
+# machine-readable output, e.g. for CI
+agent-audit --json
+
+# only one half of the scan
+agent-audit --skip-config   # IOC-only
+agent-audit --skip-ioc      # config-heuristics only
+```
+
+Exit codes: `0` nothing found, `1` only warning/info findings, `2` at least
+one critical (confirmed-IOC-pattern) finding.
+
+### What it checks
+
+**IOC scan** (`checks.py`) — all tied to the October 2026 Open-VSX Claude
+Code trojan:
+
+- `~/.ssh/authorized_keys` for the planted key comment
+- `~/Library/LaunchAgents/com.apple.sysmond.plist` (macOS persistence)
+- Marker files under `~/.config`
+- Leftover temporary SSH tunnel key files
+- `extension.js` files under common VS Code / Cursor / Windsurf extension
+  directories, hash-compared against the known-malicious build
+- Running processes / crontab for references to the known C2 host or
+  persistence task name
+
+**Config heuristics** (`configscan.py`) — pattern-based, always worth a
+second look rather than proof of compromise:
+
+- Hook commands that pipe a remote download into a shell, write to
+  `authorized_keys`, use netcat in reverse-shell mode, etc.
+- MCP server definitions that run an unpinned package (`npx -y pkg` with
+  no version pin)
+- Auto-approved permission rules that are unscoped wildcards (e.g.
+  `Bash(*)`)
+
+New incidents can be added to `iocs.py` as data, without touching the
+check logic.
+
+## Limitations
+
+This is a lightweight triage tool, not an endpoint-security product. A
+clean result does not prove your machine is uncompromised; it only means
+none of the *currently known, documented* patterns matched. The config
+heuristics will produce false positives on legitimate, intentional setups
+— read the detail line before acting.
+
+## Development
+
+```bash
+pip install -e ".[dev]" 2>/dev/null || pip install -e .
+pip install pytest
+pytest
+```
+
+## References
+
+- doublepulsar.com: ["Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide"](https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2)
+- dev.to/@slabb: ["A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine"](https://dev.to/slabb/a-trojanized-claude-code-extension-plants-an-ssh-backdoor-the-7-point-audit-for-your-machine-23cj)
+
+## License
+
+MIT, see [LICENSE](LICENSE).

coding_agent_audit-0.1.0/pyproject.toml

@@ -0,0 +1,31 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "coding-agent-audit"
+version = "0.1.0"
+description = "Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns."
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+authors = [{ name = "StackScribe AI", email = "survivalagent320@gmail.com" }]
+keywords = ["security", "supply-chain", "mcp", "claude-code", "ai-agents", "ioc-scanner"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Topic :: Security",
+]
+
+[project.urls]
+Homepage = "https://github.com/stackscribe-ai/coding-agent-audit"
+"Further reading" = "https://stackscribe-ai.github.io/"
+
+[project.scripts]
+agent-audit = "agentaudit.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]

coding_agent_audit-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

coding_agent_audit-0.1.0/src/agentaudit/__init__.py

@@ -0,0 +1,6 @@
+"""coding-agent-audit: local indicator-of-compromise and risky-config scanner
+for AI coding assistants (Claude Code, Cursor, Windsurf, VS Code forks, MCP
+servers).
+"""
+
+__version__ = "0.1.0"

coding_agent_audit-0.1.0/src/agentaudit/checks.py

@@ -0,0 +1,247 @@
+"""Indicator-of-compromise checks for documented AI-coding-assistant
+supply-chain attacks (see iocs.py). Every function takes explicit paths /
+inputs (with sensible defaults pointing at the real filesystem) so the whole
+module is unit-testable without touching a real home directory.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import os
+import platform
+import subprocess
+from pathlib import Path
+from typing import Iterable, Optional
+
+from .findings import Finding
+from .iocs import INCIDENTS
+
+_IOC = INCIDENTS["openvsx-claude-code-2026-10"]
+
+
+def check_ssh_authorized_keys(home: Path) -> list[Finding]:
+    """Flag the known 'svc-telemetry' key comment in authorized_keys."""
+    path = home / ".ssh" / "authorized_keys"
+    if not path.is_file():
+        return []
+    try:
+        text = path.read_text(errors="ignore")
+    except OSError:
+        return []
+    if _IOC["ssh_key_comment"] in text:
+        return [
+            Finding(
+                check_id="ssh-authorized-keys",
+                severity="critical",
+                title="Known backdoor SSH key found in authorized_keys",
+                detail=(
+                    f"'{path}' contains a key with the comment "
+                    f"'{_IOC['ssh_key_comment']}', which matches the key "
+                    f"planted by the {_IOC['name']}."
+                ),
+                path=str(path),
+                references=_IOC["references"],
+            )
+        ]
+    return []
+
+
+def check_macos_launch_agent(home: Path) -> list[Finding]:
+    """Flag the disguised LaunchAgent plist used for persistence on macOS."""
+    path = home / "Library" / "LaunchAgents" / _IOC["macos_launch_agent"]
+    if path.exists():
+        return [
+            Finding(
+                check_id="macos-launch-agent",
+                severity="critical",
+                title="Known backdoor persistence LaunchAgent found",
+                detail=(
+                    f"'{path}' exists and matches the disguised system "
+                    f"daemon installed by the {_IOC['name']}."
+                ),
+                path=str(path),
+                references=_IOC["references"],
+            )
+        ]
+    return []
+
+
+def check_marker_files(home: Path) -> list[Finding]:
+    """Flag known marker files dropped under ~/.config."""
+    findings: list[Finding] = []
+    config_dir = home / ".config"
+    for name in _IOC["marker_filenames"]:
+        path = config_dir / name
+        if path.exists():
+            findings.append(
+                Finding(
+                    check_id="marker-file",
+                    severity="critical",
+                    title="Known backdoor marker file found",
+                    detail=(
+                        f"'{path}' exists and matches a marker file "
+                        f"created by the {_IOC['name']}."
+                    ),
+                    path=str(path),
+                    references=_IOC["references"],
+                )
+            )
+    return findings
+
+
+def check_tmp_tunnel_keys(tmp_dir: Path) -> list[Finding]:
+    """Flag leftover temporary SSH tunnel key files."""
+    if not tmp_dir.is_dir():
+        return []
+    pattern = _IOC["tmp_tunnel_glob"]
+    matches = sorted(tmp_dir.glob(pattern))
+    if matches:
+        return [
+            Finding(
+                check_id="tmp-tunnel-key",
+                severity="critical",
+                title="Known backdoor temporary tunnel key found",
+                detail=(
+                    f"Found {len(matches)} file(s) matching '{pattern}' in "
+                    f"'{tmp_dir}', matching the temporary SSH tunnel keys "
+                    f"used by the {_IOC['name']}."
+                ),
+                path=str(matches[0]),
+                references=_IOC["references"],
+            )
+        ]
+    return []
+
+
+def _sha256_of(path: Path) -> Optional[str]:
+    try:
+        data = path.read_bytes()
+    except OSError:
+        return None
+    return hashlib.sha256(data).hexdigest()
+
+
+def check_extension_hashes(scan_dirs: Iterable[Path]) -> list[Finding]:
+    """Walk the given directories for an extension.js matching the known
+    trojanized hash."""
+    findings: list[Finding] = []
+    bad_hash = _IOC["extension_sha256"]
+    for base in scan_dirs:
+        if not base.is_dir():
+            continue
+        for ext_js in base.rglob("extension.js"):
+            digest = _sha256_of(ext_js)
+            if digest == bad_hash:
+                findings.append(
+                    Finding(
+                        check_id="extension-hash",
+                        severity="critical",
+                        title="Trojanized extension.js found",
+                        detail=(
+                            f"'{ext_js}' hashes to {digest}, which matches "
+                            f"the known-malicious build from the "
+                            f"{_IOC['name']}."
+                        ),
+                        path=str(ext_js),
+                        references=_IOC["references"],
+                    )
+                )
+    return findings
+
+
+def default_extension_scan_dirs(home: Path) -> list[Path]:
+    """Common install locations for VS Code / forks' extensions."""
+    return [
+        home / ".vscode" / "extensions",
+        home / ".vscode-server" / "extensions",
+        home / ".cursor" / "extensions",
+        home / ".windsurf" / "extensions",
+        home / ".vscode-oss" / "extensions",
+    ]
+
+
+def check_c2_network_indicators(process_lines: Iterable[str]) -> list[Finding]:
+    """Flag running processes (e.g. `ps aux` output, injected for testing)
+    that reference the known C2 host."""
+    findings: list[Finding] = []
+    for host in _IOC["c2_hosts"]:
+        for line in process_lines:
+            if host in line:
+                findings.append(
+                    Finding(
+                        check_id="c2-network",
+                        severity="critical",
+                        title="Process referencing known C2 host found",
+                        detail=(
+                            f"A running process references {host}, the C2 "
+                            f"host used by the {_IOC['name']}: {line.strip()!r}"
+                        ),
+                        references=_IOC["references"],
+                    )
+                )
+    return findings
+
+
+def check_linux_cron_persistence(crontab_text: str) -> list[Finding]:
+    """Flag a crontab entry referencing the known persistence marker."""
+    marker = _IOC["linux_cron_marker"]
+    if marker in crontab_text and "@reboot" in crontab_text:
+        return [
+            Finding(
+                check_id="cron-persistence",
+                severity="critical",
+                title="Known backdoor cron persistence entry found",
+                detail=(
+                    f"The user crontab contains an '@reboot' entry "
+                    f"referencing '{marker}', matching the persistence "
+                    f"mechanism used by the {_IOC['name']}."
+                ),
+                references=_IOC["references"],
+            )
+        ]
+    return []
+
+
+def live_crontab_text() -> str:
+    """Best-effort read of the current user's crontab; empty string if
+    unavailable (no cron, not installed, permission denied, etc.)."""
+    try:
+        result = subprocess.run(
+            ["crontab", "-l"], capture_output=True, text=True, timeout=5
+        )
+    except (OSError, subprocess.SubprocessError):
+        return ""
+    if result.returncode != 0:
+        return ""
+    return result.stdout
+
+
+def live_process_lines() -> list[str]:
+    """Best-effort snapshot of running processes; empty list if `ps` is
+    unavailable (e.g. on Windows without WSL)."""
+    try:
+        result = subprocess.run(
+            ["ps", "aux"], capture_output=True, text=True, timeout=5
+        )
+    except (OSError, subprocess.SubprocessError):
+        return []
+    if result.returncode != 0:
+        return []
+    return result.stdout.splitlines()
+
+
+def run_all_ioc_checks(home: Optional[Path] = None) -> list[Finding]:
+    """Run every IOC check against the real local machine."""
+    home = home or Path.home()
+    tmp_dir = Path(os.environ.get("TMPDIR", "/tmp"))
+
+    findings: list[Finding] = []
+    findings += check_ssh_authorized_keys(home)
+    findings += check_marker_files(home)
+    findings += check_tmp_tunnel_keys(tmp_dir)
+    findings += check_extension_hashes(default_extension_scan_dirs(home))
+    findings += check_c2_network_indicators(live_process_lines())
+    findings += check_linux_cron_persistence(live_crontab_text())
+    if platform.system() == "Darwin":
+        findings += check_macos_launch_agent(home)
+    return findings

coding_agent_audit-0.1.0/src/agentaudit/cli.py

@@ -0,0 +1,87 @@
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+from . import __version__
+from .checks import run_all_ioc_checks
+from .configscan import default_config_paths, scan_paths
+from .findings import Finding, worst_severity
+
+_SEVERITY_ICON = {"critical": "[CRITICAL]", "warning": "[WARNING]", "info": "[INFO]"}
+
+
+def _print_human(findings: list[Finding]) -> None:
+    if not findings:
+        print("coding-agent-audit: no indicators of compromise or risky config found.")
+        return
+    order = {"critical": 0, "warning": 1, "info": 2}
+    for f in sorted(findings, key=lambda x: order[x.severity]):
+        print(f"{_SEVERITY_ICON[f.severity]} {f.title}")
+        print(f"    {f.detail}")
+        if f.path:
+            print(f"    path: {f.path}")
+        for ref in f.references:
+            print(f"    ref: {ref}")
+        print()
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="agent-audit",
+        description=(
+            "Scan this machine for known AI-coding-assistant supply-chain "
+            "backdoor indicators and risky Claude Code / MCP configuration "
+            "patterns."
+        ),
+    )
+    parser.add_argument(
+        "--project",
+        type=Path,
+        default=None,
+        help="also scan this project directory's .claude/.mcp.json config",
+    )
+    parser.add_argument(
+        "--skip-ioc",
+        action="store_true",
+        help="skip the known-incident IOC scan (config-only)",
+    )
+    parser.add_argument(
+        "--skip-config",
+        action="store_true",
+        help="skip the risky-config heuristic scan (IOC-only)",
+    )
+    parser.add_argument("--json", action="store_true", help="output JSON instead of text")
+    parser.add_argument("--version", action="version", version=f"%(prog)s {__version__}")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+
+    findings: list[Finding] = []
+    if not args.skip_ioc:
+        findings += run_all_ioc_checks()
+    if not args.skip_config:
+        home = Path.home()
+        paths = default_config_paths(home, args.project)
+        findings += scan_paths(paths)
+
+    if args.json:
+        print(json.dumps([f.to_dict() for f in findings], indent=2))
+    else:
+        _print_human(findings)
+
+    worst = worst_severity(findings)
+    if worst == "critical":
+        return 2
+    if worst == "warning":
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())