coding-agent-audit 0.6.0__tar.gz → 0.7.0__tar.gz

{coding_agent_audit-0.6.0/src/coding_agent_audit.egg-info → coding_agent_audit-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.6.0
+Version: 0.7.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -23,6 +23,8 @@ Dynamic: license-file
 
 <!-- mcp-name: io.github.stackscribe-ai/coding-agent-audit -->
 
+[![M8ven Score](https://m8ven.ai/badge/mcp/stackscribe-ai-coding-agent-audit-1xiuww?v=c2c77be885b345ce5ac975e42a68268d)](https://m8ven.ai/mcp/stackscribe-ai-coding-agent-audit-1xiuww?s=readme)
+
 A small, open-source CLI that scans your machine for:
 
 1. **Known indicators of compromise (IOCs)** from publicly documented
@@ -110,6 +112,14 @@ Cursor Marketplace Claude Code trojan:
   VS Code and Claude Desktop), plus a presence check that flags Codex/VS
   Code (still unpatched at disclosure time) or Claude Desktop (patch status
   unconfirmed) if installed, with mitigation guidance
+- **Mini Shai-Hulud** (the npm worm that targets Claude Code / VS Code
+  specifically, added in v0.7.0): the `gh-token-monitor` persistence
+  service (systemd user service on Linux, LaunchAgent on macOS — both
+  carry a documented dead-man's switch that wipes your home directory if
+  the stolen GitHub token is revoked before the service is removed), and
+  the `.claude/router_runtime.js` / `.claude/setup.mjs` / `.vscode/setup.mjs`
+  dropper files it plants in a project (checked in the current directory
+  and any `--project` path)
 
 **Config heuristics** (`configscan.py`) — pattern-based, always worth a
 second look rather than proof of compromise:
@@ -193,6 +203,9 @@ heuristics) - it can't do this package's filesystem IOC scan remotely.
 Full request/response shape: `GET /openapi.json` on that URL, or the
 [source](https://github.com/stackscribe-ai/coding-agent-audit) of the x402
 worker. The free CLI above remains the full, unpaid alternative.
+Registered and domain-verified on [402index.io](https://402index.io); see
+[the writeup](https://stackscribe-ai.github.io/x402/cloudflare-workers/agent-payments/2026/11/03/x402-compliance-crawler-lessons.html)
+on the three compliance gaps discovery crawlers found that our own tests missed.
 
 ## GitHub Action (CI gate for your repo's own config)
 
@@ -227,7 +240,7 @@ scan for free; this just packages it for sharing.
 
 If your agent runtime supports the open `SKILL.md` standard (Claude Code,
 Cursor, and others), a packaged version of this scan is live on the
-[Agensi skill marketplace](https://www.agensi.io/skills/coding-agent-security-audit)
+[Agensi skill marketplace](https://www.agensi.io/r/STACKSCRIBEAI?to=/skills/coding-agent-security-audit)
 as "coding agent security audit" (free) — source in
 [`agensi-skill/`](agensi-skill/). It's a zero-dependency, single-file port of
 the same checks below, meant to be loaded by an agent directly rather than

{coding_agent_audit-0.6.0 → coding_agent_audit-0.7.0}/README.md

@@ -2,6 +2,8 @@
 
 <!-- mcp-name: io.github.stackscribe-ai/coding-agent-audit -->
 
+[![M8ven Score](https://m8ven.ai/badge/mcp/stackscribe-ai-coding-agent-audit-1xiuww?v=c2c77be885b345ce5ac975e42a68268d)](https://m8ven.ai/mcp/stackscribe-ai-coding-agent-audit-1xiuww?s=readme)
+
 A small, open-source CLI that scans your machine for:
 
 1. **Known indicators of compromise (IOCs)** from publicly documented
@@ -89,6 +91,14 @@ Cursor Marketplace Claude Code trojan:
   VS Code and Claude Desktop), plus a presence check that flags Codex/VS
   Code (still unpatched at disclosure time) or Claude Desktop (patch status
   unconfirmed) if installed, with mitigation guidance
+- **Mini Shai-Hulud** (the npm worm that targets Claude Code / VS Code
+  specifically, added in v0.7.0): the `gh-token-monitor` persistence
+  service (systemd user service on Linux, LaunchAgent on macOS — both
+  carry a documented dead-man's switch that wipes your home directory if
+  the stolen GitHub token is revoked before the service is removed), and
+  the `.claude/router_runtime.js` / `.claude/setup.mjs` / `.vscode/setup.mjs`
+  dropper files it plants in a project (checked in the current directory
+  and any `--project` path)
 
 **Config heuristics** (`configscan.py`) — pattern-based, always worth a
 second look rather than proof of compromise:
@@ -172,6 +182,9 @@ heuristics) - it can't do this package's filesystem IOC scan remotely.
 Full request/response shape: `GET /openapi.json` on that URL, or the
 [source](https://github.com/stackscribe-ai/coding-agent-audit) of the x402
 worker. The free CLI above remains the full, unpaid alternative.
+Registered and domain-verified on [402index.io](https://402index.io); see
+[the writeup](https://stackscribe-ai.github.io/x402/cloudflare-workers/agent-payments/2026/11/03/x402-compliance-crawler-lessons.html)
+on the three compliance gaps discovery crawlers found that our own tests missed.
 
 ## GitHub Action (CI gate for your repo's own config)
 
@@ -206,7 +219,7 @@ scan for free; this just packages it for sharing.
 
 If your agent runtime supports the open `SKILL.md` standard (Claude Code,
 Cursor, and others), a packaged version of this scan is live on the
-[Agensi skill marketplace](https://www.agensi.io/skills/coding-agent-security-audit)
+[Agensi skill marketplace](https://www.agensi.io/r/STACKSCRIBEAI?to=/skills/coding-agent-security-audit)
 as "coding agent security audit" (free) — source in
 [`agensi-skill/`](agensi-skill/). It's a zero-dependency, single-file port of
 the same checks below, meant to be loaded by an agent directly rather than

{coding_agent_audit-0.6.0 → coding_agent_audit-0.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "coding-agent-audit"
-version = "0.6.0"
+version = "0.7.0"
 description = "Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server."
 readme = "README.md"
 requires-python = ">=3.9"

{coding_agent_audit-0.6.0 → coding_agent_audit-0.7.0}/src/agentaudit/__init__.py

@@ -3,4 +3,4 @@ for AI coding assistants (Claude Code, Cursor, Windsurf, VS Code forks, MCP
 servers).
 """
 
-__version__ = "0.6.0"
+__version__ = "0.7.0"

{coding_agent_audit-0.6.0 → coding_agent_audit-0.7.0}/src/agentaudit/checks.py

@@ -19,6 +19,7 @@ from .iocs import INCIDENTS
 
 _IOC = INCIDENTS["openvsx-claude-code-2026-10"]
 _EMBRACE = INCIDENTS["embrace-embedded-browser-2026-10"]
+_SHAI_HULUD = INCIDENTS["mini-shai-hulud-gh-token-monitor-2026"]
 
 
 def check_ssh_authorized_keys(home: Path) -> list[Finding]:
@@ -400,7 +401,99 @@ def check_embrace_unpatched_tools(home: Path) -> list[Finding]:
     ]
 
 
-def run_all_ioc_checks(home: Optional[Path] = None) -> list[Finding]:
+def check_shai_hulud_systemd_service(home: Path) -> list[Finding]:
+    """Flag the gh-token-monitor systemd user service used for persistence
+    and credential theft on Linux."""
+    path = home / _SHAI_HULUD["linux_systemd_relpath"]
+    if path.exists():
+        return [
+            Finding(
+                check_id="shai-hulud-systemd-service",
+                severity="critical",
+                title="Known Mini Shai-Hulud persistence service found",
+                detail=(
+                    f"'{path}' exists, matching the gh-token-monitor "
+                    f"systemd user service installed by the "
+                    f"{_SHAI_HULUD['name']}. Stop and remove it "
+                    f"(`systemctl --user stop gh-token-monitor.service`), "
+                    f"then rotate every credential on this machine before "
+                    f"revoking any GitHub token - a documented dead-man's "
+                    f"switch wipes the home directory (`rm -rf ~`) if the "
+                    f"stolen token is revoked while the service is still "
+                    f"installed."
+                ),
+                path=str(path),
+                references=_SHAI_HULUD["references"],
+            )
+        ]
+    return []
+
+
+def check_shai_hulud_launch_agent(home: Path) -> list[Finding]:
+    """Flag the gh-token-monitor LaunchAgent used for persistence and
+    credential theft on macOS."""
+    path = home / "Library" / "LaunchAgents" / _SHAI_HULUD["macos_launch_agent"]
+    if path.exists():
+        return [
+            Finding(
+                check_id="shai-hulud-launch-agent",
+                severity="critical",
+                title="Known Mini Shai-Hulud persistence LaunchAgent found",
+                detail=(
+                    f"'{path}' exists, matching the gh-token-monitor "
+                    f"LaunchAgent installed by the {_SHAI_HULUD['name']}. "
+                    f"Unload and remove it, then rotate every credential "
+                    f"on this machine before revoking any GitHub token - a "
+                    f"documented dead-man's switch wipes the home "
+                    f"directory (`rm -rf ~`) if the stolen token is "
+                    f"revoked while the agent is still installed."
+                ),
+                path=str(path),
+                references=_SHAI_HULUD["references"],
+            )
+        ]
+    return []
+
+
+def check_shai_hulud_project_markers(project_dirs: Iterable[Optional[Path]]) -> list[Finding]:
+    """Flag known Mini Shai-Hulud dropper files inside one or more project
+    directories (e.g. the current working directory, or --project)."""
+    findings: list[Finding] = []
+    seen: set[Path] = set()
+    for project_dir in project_dirs:
+        if project_dir is None or not project_dir.is_dir():
+            continue
+        for relpath in _SHAI_HULUD["project_marker_files"]:
+            path = project_dir / relpath
+            resolved = path.resolve()
+            if resolved in seen or not path.is_file():
+                continue
+            seen.add(resolved)
+            findings.append(
+                Finding(
+                    check_id="shai-hulud-project-marker",
+                    severity="critical",
+                    title="Known Mini Shai-Hulud dropper file found in project",
+                    detail=(
+                        f"'{path}' exists, matching a dropper file planted "
+                        f"by the {_SHAI_HULUD['name']}, typically alongside "
+                        f"a SessionStart hook in .claude/settings.json (or "
+                        f"a folderOpen task in .vscode/tasks.json) that "
+                        f"re-executes it every time the project is opened. "
+                        f"Remove the file, check both of those config "
+                        f"files for a matching hook/task, and rotate every "
+                        f"credential this machine has used."
+                    ),
+                    path=str(path),
+                    references=_SHAI_HULUD["references"],
+                )
+            )
+    return findings
+
+
+def run_all_ioc_checks(
+    home: Optional[Path] = None, project_dirs: Iterable[Path] = ()
+) -> list[Finding]:
     """Run every IOC check against the real local machine."""
     home = home or Path.home()
     tmp_dir = Path(os.environ.get("TMPDIR", "/tmp"))
@@ -414,8 +507,12 @@ def run_all_ioc_checks(home: Optional[Path] = None) -> list[Finding]:
     findings += check_embrace_unpatched_tools(home)
     findings += check_c2_network_indicators(live_process_lines())
     findings += check_linux_cron_persistence(live_crontab_text())
+    findings += check_shai_hulud_project_markers([Path.cwd(), *project_dirs])
+    if platform.system() == "Linux":
+        findings += check_shai_hulud_systemd_service(home)
     if platform.system() == "Darwin":
         findings += check_macos_launch_agent(home)
+        findings += check_shai_hulud_launch_agent(home)
     if platform.system() == "Windows":
         appdata = Path(os.environ.get("APPDATA", home / "AppData" / "Roaming"))
         findings += check_windows_startup_folder(appdata)

{coding_agent_audit-0.6.0 → coding_agent_audit-0.7.0}/src/agentaudit/cli.py

@@ -85,7 +85,8 @@ def main(argv: list[str] | None = None) -> int:
 
     findings: list[Finding] = []
     if not args.skip_ioc:
-        findings += run_all_ioc_checks()
+        project_dirs = [args.project] if args.project is not None else []
+        findings += run_all_ioc_checks(project_dirs=project_dirs)
     if not args.skip_config:
         home = Path.home()
         paths = default_config_paths(home, args.project)

{coding_agent_audit-0.6.0 → coding_agent_audit-0.7.0}/src/agentaudit/iocs.py

@@ -76,4 +76,35 @@ INCIDENTS = {
         # As of the references above; re-check before treating as current.
         "unpatched_products": ["OpenAI Codex", "VS Code"],
     },
+    "mini-shai-hulud-gh-token-monitor-2026": {
+        "name": "Mini Shai-Hulud npm worm, gh-token-monitor persistence (2026)",
+        "description": (
+            "A self-propagating npm supply-chain worm (tracked by several "
+            "vendors as Mini Shai-Hulud) that runs from a compromised "
+            "package's install script, drops an obfuscated Bun payload "
+            "(.claude/router_runtime.js, .claude/setup.mjs) in the "
+            "repo it's invoked in, and writes a SessionStart hook into "
+            "that repo's .claude/settings.json so the payload re-executes "
+            "every time Claude Code opens the project; a matching "
+            ".vscode/tasks.json folderOpen task does the same for VS Code. "
+            "On the host it also installs an OS-level persistence service "
+            "named gh-token-monitor (a systemd user service on Linux, a "
+            "LaunchAgent on macOS) that harvests GitHub/npm/cloud "
+            "credentials and, per a documented dead-man's switch, runs "
+            "`rm -rf ~` if the stolen GitHub token is revoked before the "
+            "service is removed."
+        ),
+        "references": [
+            "https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem",
+            "https://www.mend.io/blog/shai-hulud-sap-cap-supply-chain-attack-claude-code/",
+            "https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised",
+        ],
+        "linux_systemd_relpath": ".config/systemd/user/gh-token-monitor.service",
+        "macos_launch_agent": "com.user.gh-token-monitor.plist",
+        "project_marker_files": [
+            ".claude/router_runtime.js",
+            ".claude/setup.mjs",
+            ".vscode/setup.mjs",
+        ],
+    },
 }

{coding_agent_audit-0.6.0 → coding_agent_audit-0.7.0}/src/agentaudit/mcp_server.py

@@ -14,6 +14,7 @@ from pathlib import Path
 from typing import Optional
 
 from mcp.server.mcpserver import MCPServer
+from mcp.types import ToolAnnotations
 
 from . import __version__
 from .checks import run_all_ioc_checks
@@ -53,7 +54,22 @@ def _render(findings: list[Finding]) -> str:
     return "\n".join(lines)
 
 
-@server.tool()
+_LOCAL_READ_ONLY = ToolAnnotations(
+    readOnlyHint=True,
+    destructiveHint=False,
+    idempotentHint=True,
+    openWorldHint=False,
+)
+
+_NETWORK_READ_ONLY = ToolAnnotations(
+    readOnlyHint=True,
+    destructiveHint=False,
+    idempotentHint=True,
+    openWorldHint=True,
+)
+
+
+@server.tool(annotations=_LOCAL_READ_ONLY)
 def scan_for_known_backdoors() -> str:
     """Scan this machine for known, publicly-documented indicators of
     compromise from AI-coding-assistant supply-chain attacks (SSH backdoor
@@ -62,7 +78,7 @@ def scan_for_known_backdoors() -> str:
     return _render(run_all_ioc_checks())
 
 
-@server.tool()
+@server.tool(annotations=_LOCAL_READ_ONLY)
 def scan_mcp_config(project_dir: Optional[str] = None) -> str:
     """Scan this machine's Claude Code / Claude Desktop / MCP config files
     for risky patterns: hooks that pipe a remote download into a shell,
@@ -80,7 +96,7 @@ def scan_mcp_config(project_dir: Optional[str] = None) -> str:
     return _render(scan_paths(paths))
 
 
-@server.tool()
+@server.tool(annotations=_NETWORK_READ_ONLY)
 def scan_phantom_dependencies(project_dir: str) -> str:
     """Check a project's package.json / requirements.txt / pyproject.toml
     dependencies against the npm/PyPI registries and flag any package name

{coding_agent_audit-0.6.0 → coding_agent_audit-0.7.0/src/coding_agent_audit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.6.0
+Version: 0.7.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -23,6 +23,8 @@ Dynamic: license-file
 
 <!-- mcp-name: io.github.stackscribe-ai/coding-agent-audit -->
 
+[![M8ven Score](https://m8ven.ai/badge/mcp/stackscribe-ai-coding-agent-audit-1xiuww?v=c2c77be885b345ce5ac975e42a68268d)](https://m8ven.ai/mcp/stackscribe-ai-coding-agent-audit-1xiuww?s=readme)
+
 A small, open-source CLI that scans your machine for:
 
 1. **Known indicators of compromise (IOCs)** from publicly documented
@@ -110,6 +112,14 @@ Cursor Marketplace Claude Code trojan:
   VS Code and Claude Desktop), plus a presence check that flags Codex/VS
   Code (still unpatched at disclosure time) or Claude Desktop (patch status
   unconfirmed) if installed, with mitigation guidance
+- **Mini Shai-Hulud** (the npm worm that targets Claude Code / VS Code
+  specifically, added in v0.7.0): the `gh-token-monitor` persistence
+  service (systemd user service on Linux, LaunchAgent on macOS — both
+  carry a documented dead-man's switch that wipes your home directory if
+  the stolen GitHub token is revoked before the service is removed), and
+  the `.claude/router_runtime.js` / `.claude/setup.mjs` / `.vscode/setup.mjs`
+  dropper files it plants in a project (checked in the current directory
+  and any `--project` path)
 
 **Config heuristics** (`configscan.py`) — pattern-based, always worth a
 second look rather than proof of compromise:
@@ -193,6 +203,9 @@ heuristics) - it can't do this package's filesystem IOC scan remotely.
 Full request/response shape: `GET /openapi.json` on that URL, or the
 [source](https://github.com/stackscribe-ai/coding-agent-audit) of the x402
 worker. The free CLI above remains the full, unpaid alternative.
+Registered and domain-verified on [402index.io](https://402index.io); see
+[the writeup](https://stackscribe-ai.github.io/x402/cloudflare-workers/agent-payments/2026/11/03/x402-compliance-crawler-lessons.html)
+on the three compliance gaps discovery crawlers found that our own tests missed.
 
 ## GitHub Action (CI gate for your repo's own config)
 
@@ -227,7 +240,7 @@ scan for free; this just packages it for sharing.
 
 If your agent runtime supports the open `SKILL.md` standard (Claude Code,
 Cursor, and others), a packaged version of this scan is live on the
-[Agensi skill marketplace](https://www.agensi.io/skills/coding-agent-security-audit)
+[Agensi skill marketplace](https://www.agensi.io/r/STACKSCRIBEAI?to=/skills/coding-agent-security-audit)
 as "coding agent security audit" (free) — source in
 [`agensi-skill/`](agensi-skill/). It's a zero-dependency, single-file port of
 the same checks below, meant to be loaded by an agent directly rather than

{coding_agent_audit-0.6.0 → coding_agent_audit-0.7.0}/tests/test_checks.py

@@ -9,6 +9,9 @@ from agentaudit.checks import (
     check_linux_cron_persistence,
     check_macos_launch_agent,
     check_marker_files,
+    check_shai_hulud_launch_agent,
+    check_shai_hulud_project_markers,
+    check_shai_hulud_systemd_service,
     check_ssh_authorized_keys,
     check_tmp_tunnel_keys,
     check_windows_scheduled_task,
@@ -19,6 +22,7 @@ from agentaudit.iocs import INCIDENTS
 
 _IOC = INCIDENTS["openvsx-claude-code-2026-10"]
 _EMBRACE = INCIDENTS["embrace-embedded-browser-2026-10"]
+_SHAI_HULUD = INCIDENTS["mini-shai-hulud-gh-token-monitor-2026"]
 
 
 def test_ssh_authorized_keys_clean(tmp_path: Path):
@@ -245,3 +249,81 @@ def test_embrace_unpatched_tools_claude_desktop_only_is_info(tmp_path: Path):
     assert len(findings) == 1
     assert findings[0].severity == "info"
     assert "Claude Desktop" in findings[0].detail
+
+
+def test_shai_hulud_systemd_service_absent(tmp_path: Path):
+    assert check_shai_hulud_systemd_service(tmp_path) == []
+
+
+def test_shai_hulud_systemd_service_present(tmp_path: Path):
+    relpath = _SHAI_HULUD["linux_systemd_relpath"]
+    target = tmp_path / relpath
+    target.parent.mkdir(parents=True)
+    target.write_text("[Unit]\nDescription=gh-token-monitor\n")
+    findings = check_shai_hulud_systemd_service(tmp_path)
+    assert len(findings) == 1
+    assert findings[0].severity == "critical"
+    assert findings[0].check_id == "shai-hulud-systemd-service"
+
+
+def test_shai_hulud_launch_agent_absent(tmp_path: Path):
+    assert check_shai_hulud_launch_agent(tmp_path) == []
+
+
+def test_shai_hulud_launch_agent_present(tmp_path: Path):
+    agents_dir = tmp_path / "Library" / "LaunchAgents"
+    agents_dir.mkdir(parents=True)
+    (agents_dir / _SHAI_HULUD["macos_launch_agent"]).write_text("<plist></plist>")
+    findings = check_shai_hulud_launch_agent(tmp_path)
+    assert len(findings) == 1
+    assert findings[0].severity == "critical"
+    assert findings[0].check_id == "shai-hulud-launch-agent"
+
+
+def test_shai_hulud_project_markers_clean(tmp_path: Path):
+    (tmp_path / ".claude").mkdir()
+    assert check_shai_hulud_project_markers([tmp_path]) == []
+
+
+def test_shai_hulud_project_markers_one_present(tmp_path: Path):
+    claude_dir = tmp_path / ".claude"
+    claude_dir.mkdir()
+    (claude_dir / "router_runtime.js").write_text("// payload")
+    findings = check_shai_hulud_project_markers([tmp_path])
+    assert len(findings) == 1
+    assert findings[0].severity == "critical"
+    assert findings[0].check_id == "shai-hulud-project-marker"
+
+
+def test_shai_hulud_project_markers_all_present(tmp_path: Path):
+    for relpath in _SHAI_HULUD["project_marker_files"]:
+        target = tmp_path / relpath
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_text("x")
+    findings = check_shai_hulud_project_markers([tmp_path])
+    assert len(findings) == len(_SHAI_HULUD["project_marker_files"])
+
+
+def test_shai_hulud_project_markers_nonexistent_dir(tmp_path: Path):
+    assert check_shai_hulud_project_markers([tmp_path / "nope"]) == []
+
+
+def test_shai_hulud_project_markers_skips_none():
+    assert check_shai_hulud_project_markers([None]) == []
+
+
+def test_shai_hulud_project_markers_dedupes_duplicate_dirs(tmp_path: Path):
+    claude_dir = tmp_path / ".claude"
+    claude_dir.mkdir()
+    (claude_dir / "setup.mjs").write_text("// dropper")
+    findings = check_shai_hulud_project_markers([tmp_path, tmp_path])
+    assert len(findings) == 1
+
+
+def test_shai_hulud_project_markers_dedupes_relative_and_absolute(tmp_path: Path, monkeypatch):
+    claude_dir = tmp_path / ".claude"
+    claude_dir.mkdir()
+    (claude_dir / "setup.mjs").write_text("// dropper")
+    monkeypatch.chdir(tmp_path)
+    findings = check_shai_hulud_project_markers([tmp_path, Path(".")])
+    assert len(findings) == 1