coding-agent-audit 0.6.1__tar.gz → 0.8.0__tar.gz

{coding_agent_audit-0.6.1/src/coding_agent_audit.egg-info → coding_agent_audit-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.6.1
+Version: 0.8.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -112,6 +112,20 @@ Cursor Marketplace Claude Code trojan:
   VS Code and Claude Desktop), plus a presence check that flags Codex/VS
   Code (still unpatched at disclosure time) or Claude Desktop (patch status
   unconfirmed) if installed, with mitigation guidance
+- **Mini Shai-Hulud** (the npm worm that targets Claude Code / VS Code
+  specifically, added in v0.7.0): the `gh-token-monitor` persistence
+  service (systemd user service on Linux, LaunchAgent on macOS — both
+  carry a documented dead-man's switch that wipes your home directory if
+  the stolen GitHub token is revoked before the service is removed), and
+  the `.claude/router_runtime.js` / `.claude/setup.mjs` / `.vscode/setup.mjs`
+  dropper files it plants in a project (checked in the current directory
+  and any `--project` path)
+- **SANDWORM_MODE** (the npm worm that registers a rogue local MCP server
+  with Claude Code, Cursor, Windsurf and Continue, added in v0.8.0): the
+  hidden `~/.dev-utils/` directory it installs, and any MCP server entry
+  in your Claude Code / Claude Desktop / Cursor / Windsurf config that
+  points at that directory or uses one of its giveaway tool names
+  (`index_project`, `lint_check`, `scan_dependencies`)
 
 **Config heuristics** (`configscan.py`) — pattern-based, always worth a
 second look rather than proof of compromise:
@@ -195,6 +209,9 @@ heuristics) - it can't do this package's filesystem IOC scan remotely.
 Full request/response shape: `GET /openapi.json` on that URL, or the
 [source](https://github.com/stackscribe-ai/coding-agent-audit) of the x402
 worker. The free CLI above remains the full, unpaid alternative.
+Registered and domain-verified on [402index.io](https://402index.io); see
+[the writeup](https://stackscribe-ai.github.io/x402/cloudflare-workers/agent-payments/2026/11/03/x402-compliance-crawler-lessons.html)
+on the three compliance gaps discovery crawlers found that our own tests missed.
 
 ## GitHub Action (CI gate for your repo's own config)
 

{coding_agent_audit-0.6.1 → coding_agent_audit-0.8.0}/README.md

@@ -91,6 +91,20 @@ Cursor Marketplace Claude Code trojan:
   VS Code and Claude Desktop), plus a presence check that flags Codex/VS
   Code (still unpatched at disclosure time) or Claude Desktop (patch status
   unconfirmed) if installed, with mitigation guidance
+- **Mini Shai-Hulud** (the npm worm that targets Claude Code / VS Code
+  specifically, added in v0.7.0): the `gh-token-monitor` persistence
+  service (systemd user service on Linux, LaunchAgent on macOS — both
+  carry a documented dead-man's switch that wipes your home directory if
+  the stolen GitHub token is revoked before the service is removed), and
+  the `.claude/router_runtime.js` / `.claude/setup.mjs` / `.vscode/setup.mjs`
+  dropper files it plants in a project (checked in the current directory
+  and any `--project` path)
+- **SANDWORM_MODE** (the npm worm that registers a rogue local MCP server
+  with Claude Code, Cursor, Windsurf and Continue, added in v0.8.0): the
+  hidden `~/.dev-utils/` directory it installs, and any MCP server entry
+  in your Claude Code / Claude Desktop / Cursor / Windsurf config that
+  points at that directory or uses one of its giveaway tool names
+  (`index_project`, `lint_check`, `scan_dependencies`)
 
 **Config heuristics** (`configscan.py`) — pattern-based, always worth a
 second look rather than proof of compromise:
@@ -174,6 +188,9 @@ heuristics) - it can't do this package's filesystem IOC scan remotely.
 Full request/response shape: `GET /openapi.json` on that URL, or the
 [source](https://github.com/stackscribe-ai/coding-agent-audit) of the x402
 worker. The free CLI above remains the full, unpaid alternative.
+Registered and domain-verified on [402index.io](https://402index.io); see
+[the writeup](https://stackscribe-ai.github.io/x402/cloudflare-workers/agent-payments/2026/11/03/x402-compliance-crawler-lessons.html)
+on the three compliance gaps discovery crawlers found that our own tests missed.
 
 ## GitHub Action (CI gate for your repo's own config)
 

{coding_agent_audit-0.6.1 → coding_agent_audit-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "coding-agent-audit"
-version = "0.6.1"
+version = "0.8.0"
 description = "Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server."
 readme = "README.md"
 requires-python = ">=3.9"

{coding_agent_audit-0.6.1 → coding_agent_audit-0.8.0}/src/agentaudit/__init__.py

@@ -3,4 +3,4 @@ for AI coding assistants (Claude Code, Cursor, Windsurf, VS Code forks, MCP
 servers).
 """
 
-__version__ = "0.6.1"
+__version__ = "0.8.0"

{coding_agent_audit-0.6.1 → coding_agent_audit-0.8.0}/src/agentaudit/checks.py

@@ -7,6 +7,7 @@ module is unit-testable without touching a real home directory.
 from __future__ import annotations
 
 import hashlib
+import json
 import os
 import platform
 import re
@@ -14,11 +15,14 @@ import subprocess
 from pathlib import Path
 from typing import Iterable, Optional
 
+from .configscan import default_config_paths
 from .findings import Finding
 from .iocs import INCIDENTS
 
 _IOC = INCIDENTS["openvsx-claude-code-2026-10"]
 _EMBRACE = INCIDENTS["embrace-embedded-browser-2026-10"]
+_SHAI_HULUD = INCIDENTS["mini-shai-hulud-gh-token-monitor-2026"]
+_SANDWORM = INCIDENTS["sandworm-mode-npm-2026-11"]
 
 
 def check_ssh_authorized_keys(home: Path) -> list[Finding]:
@@ -400,7 +404,177 @@ def check_embrace_unpatched_tools(home: Path) -> list[Finding]:
     ]
 
 
-def run_all_ioc_checks(home: Optional[Path] = None) -> list[Finding]:
+def check_shai_hulud_systemd_service(home: Path) -> list[Finding]:
+    """Flag the gh-token-monitor systemd user service used for persistence
+    and credential theft on Linux."""
+    path = home / _SHAI_HULUD["linux_systemd_relpath"]
+    if path.exists():
+        return [
+            Finding(
+                check_id="shai-hulud-systemd-service",
+                severity="critical",
+                title="Known Mini Shai-Hulud persistence service found",
+                detail=(
+                    f"'{path}' exists, matching the gh-token-monitor "
+                    f"systemd user service installed by the "
+                    f"{_SHAI_HULUD['name']}. Stop and remove it "
+                    f"(`systemctl --user stop gh-token-monitor.service`), "
+                    f"then rotate every credential on this machine before "
+                    f"revoking any GitHub token - a documented dead-man's "
+                    f"switch wipes the home directory (`rm -rf ~`) if the "
+                    f"stolen token is revoked while the service is still "
+                    f"installed."
+                ),
+                path=str(path),
+                references=_SHAI_HULUD["references"],
+            )
+        ]
+    return []
+
+
+def check_shai_hulud_launch_agent(home: Path) -> list[Finding]:
+    """Flag the gh-token-monitor LaunchAgent used for persistence and
+    credential theft on macOS."""
+    path = home / "Library" / "LaunchAgents" / _SHAI_HULUD["macos_launch_agent"]
+    if path.exists():
+        return [
+            Finding(
+                check_id="shai-hulud-launch-agent",
+                severity="critical",
+                title="Known Mini Shai-Hulud persistence LaunchAgent found",
+                detail=(
+                    f"'{path}' exists, matching the gh-token-monitor "
+                    f"LaunchAgent installed by the {_SHAI_HULUD['name']}. "
+                    f"Unload and remove it, then rotate every credential "
+                    f"on this machine before revoking any GitHub token - a "
+                    f"documented dead-man's switch wipes the home "
+                    f"directory (`rm -rf ~`) if the stolen token is "
+                    f"revoked while the agent is still installed."
+                ),
+                path=str(path),
+                references=_SHAI_HULUD["references"],
+            )
+        ]
+    return []
+
+
+def check_shai_hulud_project_markers(project_dirs: Iterable[Optional[Path]]) -> list[Finding]:
+    """Flag known Mini Shai-Hulud dropper files inside one or more project
+    directories (e.g. the current working directory, or --project)."""
+    findings: list[Finding] = []
+    seen: set[Path] = set()
+    for project_dir in project_dirs:
+        if project_dir is None or not project_dir.is_dir():
+            continue
+        for relpath in _SHAI_HULUD["project_marker_files"]:
+            path = project_dir / relpath
+            resolved = path.resolve()
+            if resolved in seen or not path.is_file():
+                continue
+            seen.add(resolved)
+            findings.append(
+                Finding(
+                    check_id="shai-hulud-project-marker",
+                    severity="critical",
+                    title="Known Mini Shai-Hulud dropper file found in project",
+                    detail=(
+                        f"'{path}' exists, matching a dropper file planted "
+                        f"by the {_SHAI_HULUD['name']}, typically alongside "
+                        f"a SessionStart hook in .claude/settings.json (or "
+                        f"a folderOpen task in .vscode/tasks.json) that "
+                        f"re-executes it every time the project is opened. "
+                        f"Remove the file, check both of those config "
+                        f"files for a matching hook/task, and rotate every "
+                        f"credential this machine has used."
+                    ),
+                    path=str(path),
+                    references=_SHAI_HULUD["references"],
+                )
+            )
+    return findings
+
+
+def check_sandworm_mode_dev_utils(home: Path) -> list[Finding]:
+    """Flag the hidden ~/.dev-utils/ directory the SANDWORM_MODE npm worm
+    uses to host its rogue local MCP server."""
+    path = home / _SANDWORM["hidden_dir"]
+    if path.is_dir():
+        return [
+            Finding(
+                check_id="sandworm-mode-dev-utils-dir",
+                severity="critical",
+                title="Known SANDWORM_MODE rogue MCP server directory found",
+                detail=(
+                    f"'{path}' exists, matching the hidden rogue MCP "
+                    f"server directory planted by the {_SANDWORM['name']}. "
+                    f"Remove the directory, check your Claude Code / "
+                    f"Cursor / Windsurf / Continue MCP config for a server "
+                    f"registration pointing at it (often named one of "
+                    f"{', '.join(_SANDWORM['rogue_tool_names'])}), and "
+                    f"rotate every SSH key, AWS credential and token on "
+                    f"this machine."
+                ),
+                path=str(path),
+                references=_SANDWORM["references"],
+            )
+        ]
+    return []
+
+
+def check_sandworm_mode_mcp_registration(config_paths: Iterable[Path]) -> list[Finding]:
+    """Flag any MCP server registration (Claude Code, Cursor, Windsurf,
+    Continue) that points at the SANDWORM_MODE rogue server directory or
+    uses one of its giveaway tool names."""
+    findings: list[Finding] = []
+    for path in config_paths:
+        if not path.is_file():
+            continue
+        try:
+            config = json.loads(path.read_text())
+        except (OSError, json.JSONDecodeError):
+            continue
+        if not isinstance(config, dict):
+            continue
+        servers = config.get("mcpServers") or config.get("mcp_servers")
+        if not isinstance(servers, dict):
+            continue
+        for server_name, server_cfg in servers.items():
+            if not isinstance(server_cfg, dict):
+                continue
+            command = str(server_cfg.get("command", ""))
+            args = " ".join(str(a) for a in (server_cfg.get("args") or []))
+            full_cmdline = f"{command} {args}"
+            hit_dir = _SANDWORM["hidden_dir"] in full_cmdline
+            hit_name = server_name in _SANDWORM["rogue_tool_names"]
+            if not (hit_dir or hit_name):
+                continue
+            reason = (
+                f"points at the rogue {_SANDWORM['hidden_dir']} directory"
+                if hit_dir
+                else "uses a known SANDWORM_MODE giveaway tool name"
+            )
+            findings.append(
+                Finding(
+                    check_id="sandworm-mode-mcp-registration",
+                    severity="critical",
+                    title="Known SANDWORM_MODE rogue MCP server registration found",
+                    detail=(
+                        f"MCP server '{server_name}' in '{path}' {reason}, "
+                        f"matching the {_SANDWORM['name']}. Remove this "
+                        f"server entry, delete ~/{_SANDWORM['hidden_dir']}/, "
+                        f"and rotate every SSH key, AWS credential and "
+                        f"token on this machine."
+                    ),
+                    path=str(path),
+                    references=_SANDWORM["references"],
+                )
+            )
+    return findings
+
+
+def run_all_ioc_checks(
+    home: Optional[Path] = None, project_dirs: Iterable[Path] = ()
+) -> list[Finding]:
     """Run every IOC check against the real local machine."""
     home = home or Path.home()
     tmp_dir = Path(os.environ.get("TMPDIR", "/tmp"))
@@ -414,8 +588,18 @@ def run_all_ioc_checks(home: Optional[Path] = None) -> list[Finding]:
     findings += check_embrace_unpatched_tools(home)
     findings += check_c2_network_indicators(live_process_lines())
     findings += check_linux_cron_persistence(live_crontab_text())
+    findings += check_shai_hulud_project_markers([Path.cwd(), *project_dirs])
+    findings += check_sandworm_mode_dev_utils(home)
+    config_paths: dict[str, Path] = {str(p): p for p in default_config_paths(home)}
+    for project_dir in [Path.cwd(), *project_dirs]:
+        for p in default_config_paths(home, project_dir):
+            config_paths[str(p)] = p
+    findings += check_sandworm_mode_mcp_registration(config_paths.values())
+    if platform.system() == "Linux":
+        findings += check_shai_hulud_systemd_service(home)
     if platform.system() == "Darwin":
         findings += check_macos_launch_agent(home)
+        findings += check_shai_hulud_launch_agent(home)
     if platform.system() == "Windows":
         appdata = Path(os.environ.get("APPDATA", home / "AppData" / "Roaming"))
         findings += check_windows_startup_folder(appdata)

{coding_agent_audit-0.6.1 → coding_agent_audit-0.8.0}/src/agentaudit/cli.py

@@ -85,7 +85,8 @@ def main(argv: list[str] | None = None) -> int:
 
     findings: list[Finding] = []
     if not args.skip_ioc:
-        findings += run_all_ioc_checks()
+        project_dirs = [args.project] if args.project is not None else []
+        findings += run_all_ioc_checks(project_dirs=project_dirs)
     if not args.skip_config:
         home = Path.home()
         paths = default_config_paths(home, args.project)

{coding_agent_audit-0.6.1 → coding_agent_audit-0.8.0}/src/agentaudit/configscan.py

@@ -245,12 +245,15 @@ def default_config_paths(home: Path, project_dir: Path | None = None) -> list[Pa
         / "Roaming"
         / "Claude"
         / "claude_desktop_config.json",
+        home / ".cursor" / "mcp.json",
+        home / ".codeium" / "windsurf" / "mcp_config.json",
     ]
     if project_dir is not None:
         paths += [
             project_dir / ".claude" / "settings.json",
             project_dir / ".claude" / "settings.local.json",
             project_dir / ".mcp.json",
+            project_dir / ".cursor" / "mcp.json",
         ]
     return paths
 

{coding_agent_audit-0.6.1 → coding_agent_audit-0.8.0}/src/agentaudit/iocs.py

@@ -76,4 +76,60 @@ INCIDENTS = {
         # As of the references above; re-check before treating as current.
         "unpatched_products": ["OpenAI Codex", "VS Code"],
     },
+    "mini-shai-hulud-gh-token-monitor-2026": {
+        "name": "Mini Shai-Hulud npm worm, gh-token-monitor persistence (2026)",
+        "description": (
+            "A self-propagating npm supply-chain worm (tracked by several "
+            "vendors as Mini Shai-Hulud) that runs from a compromised "
+            "package's install script, drops an obfuscated Bun payload "
+            "(.claude/router_runtime.js, .claude/setup.mjs) in the "
+            "repo it's invoked in, and writes a SessionStart hook into "
+            "that repo's .claude/settings.json so the payload re-executes "
+            "every time Claude Code opens the project; a matching "
+            ".vscode/tasks.json folderOpen task does the same for VS Code. "
+            "On the host it also installs an OS-level persistence service "
+            "named gh-token-monitor (a systemd user service on Linux, a "
+            "LaunchAgent on macOS) that harvests GitHub/npm/cloud "
+            "credentials and, per a documented dead-man's switch, runs "
+            "`rm -rf ~` if the stolen GitHub token is revoked before the "
+            "service is removed."
+        ),
+        "references": [
+            "https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem",
+            "https://www.mend.io/blog/shai-hulud-sap-cap-supply-chain-attack-claude-code/",
+            "https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised",
+        ],
+        "linux_systemd_relpath": ".config/systemd/user/gh-token-monitor.service",
+        "macos_launch_agent": "com.user.gh-token-monitor.plist",
+        "project_marker_files": [
+            ".claude/router_runtime.js",
+            ".claude/setup.mjs",
+            ".vscode/setup.mjs",
+        ],
+    },
+    "sandworm-mode-npm-2026-11": {
+        "name": "SANDWORM_MODE npm supply-chain worm, rogue MCP server (Nov 2026)",
+        "description": (
+            "A self-propagating npm supply-chain worm (SANDWORM_MODE), "
+            "distributed via 19 typosquatted packages published under the "
+            "'official334' and 'javaorg' npm aliases (e.g. suport-color, a "
+            "typosquat of supports-color). Its install script drops a "
+            "hidden directory, ~/.dev-utils/, containing a rogue local MCP "
+            "server and registers it with Claude Code, Cursor, Windsurf "
+            "and Continue under three innocuous-sounding tool names "
+            "(index_project, lint_check, scan_dependencies) so the AI "
+            "assistant itself ends up invoking it; the server then reads "
+            "SSH keys, AWS credentials and password-manager secrets, "
+            "installs Git-hooks persistence, and propagates by publishing "
+            "further typosquatted packages."
+        ),
+        "references": [
+            "https://socket.dev/blog/sandworm-mode-npm-worm-ai-toolchain-poisoning",
+            "https://www.endorlabs.com/learn/sandworm-mode-dissecting-a-multi-stage-npm-supply-chain-attack",
+            "https://www.securityweek.com/new-sandworm_mode-supply-chain-attack-hits-npm/",
+        ],
+        "hidden_dir": ".dev-utils",
+        "rogue_tool_names": ["index_project", "lint_check", "scan_dependencies"],
+        "typosquat_aliases": ["official334", "javaorg"],
+    },
 }

{coding_agent_audit-0.6.1 → coding_agent_audit-0.8.0/src/coding_agent_audit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.6.1
+Version: 0.8.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -112,6 +112,20 @@ Cursor Marketplace Claude Code trojan:
   VS Code and Claude Desktop), plus a presence check that flags Codex/VS
   Code (still unpatched at disclosure time) or Claude Desktop (patch status
   unconfirmed) if installed, with mitigation guidance
+- **Mini Shai-Hulud** (the npm worm that targets Claude Code / VS Code
+  specifically, added in v0.7.0): the `gh-token-monitor` persistence
+  service (systemd user service on Linux, LaunchAgent on macOS — both
+  carry a documented dead-man's switch that wipes your home directory if
+  the stolen GitHub token is revoked before the service is removed), and
+  the `.claude/router_runtime.js` / `.claude/setup.mjs` / `.vscode/setup.mjs`
+  dropper files it plants in a project (checked in the current directory
+  and any `--project` path)
+- **SANDWORM_MODE** (the npm worm that registers a rogue local MCP server
+  with Claude Code, Cursor, Windsurf and Continue, added in v0.8.0): the
+  hidden `~/.dev-utils/` directory it installs, and any MCP server entry
+  in your Claude Code / Claude Desktop / Cursor / Windsurf config that
+  points at that directory or uses one of its giveaway tool names
+  (`index_project`, `lint_check`, `scan_dependencies`)
 
 **Config heuristics** (`configscan.py`) — pattern-based, always worth a
 second look rather than proof of compromise:
@@ -195,6 +209,9 @@ heuristics) - it can't do this package's filesystem IOC scan remotely.
 Full request/response shape: `GET /openapi.json` on that URL, or the
 [source](https://github.com/stackscribe-ai/coding-agent-audit) of the x402
 worker. The free CLI above remains the full, unpaid alternative.
+Registered and domain-verified on [402index.io](https://402index.io); see
+[the writeup](https://stackscribe-ai.github.io/x402/cloudflare-workers/agent-payments/2026/11/03/x402-compliance-crawler-lessons.html)
+on the three compliance gaps discovery crawlers found that our own tests missed.
 
 ## GitHub Action (CI gate for your repo's own config)
 

{coding_agent_audit-0.6.1 → coding_agent_audit-0.8.0}/tests/test_checks.py

@@ -1,6 +1,8 @@
 import hashlib
 from pathlib import Path
 
+import json
+
 from agentaudit.checks import (
     check_c2_network_indicators,
     check_embrace_copilot_version,
@@ -9,6 +11,11 @@ from agentaudit.checks import (
     check_linux_cron_persistence,
     check_macos_launch_agent,
     check_marker_files,
+    check_sandworm_mode_dev_utils,
+    check_sandworm_mode_mcp_registration,
+    check_shai_hulud_launch_agent,
+    check_shai_hulud_project_markers,
+    check_shai_hulud_systemd_service,
     check_ssh_authorized_keys,
     check_tmp_tunnel_keys,
     check_windows_scheduled_task,
@@ -19,6 +26,8 @@ from agentaudit.iocs import INCIDENTS
 
 _IOC = INCIDENTS["openvsx-claude-code-2026-10"]
 _EMBRACE = INCIDENTS["embrace-embedded-browser-2026-10"]
+_SHAI_HULUD = INCIDENTS["mini-shai-hulud-gh-token-monitor-2026"]
+_SANDWORM = INCIDENTS["sandworm-mode-npm-2026-11"]
 
 
 def test_ssh_authorized_keys_clean(tmp_path: Path):
@@ -245,3 +254,131 @@ def test_embrace_unpatched_tools_claude_desktop_only_is_info(tmp_path: Path):
     assert len(findings) == 1
     assert findings[0].severity == "info"
     assert "Claude Desktop" in findings[0].detail
+
+
+def test_shai_hulud_systemd_service_absent(tmp_path: Path):
+    assert check_shai_hulud_systemd_service(tmp_path) == []
+
+
+def test_shai_hulud_systemd_service_present(tmp_path: Path):
+    relpath = _SHAI_HULUD["linux_systemd_relpath"]
+    target = tmp_path / relpath
+    target.parent.mkdir(parents=True)
+    target.write_text("[Unit]\nDescription=gh-token-monitor\n")
+    findings = check_shai_hulud_systemd_service(tmp_path)
+    assert len(findings) == 1
+    assert findings[0].severity == "critical"
+    assert findings[0].check_id == "shai-hulud-systemd-service"
+
+
+def test_shai_hulud_launch_agent_absent(tmp_path: Path):
+    assert check_shai_hulud_launch_agent(tmp_path) == []
+
+
+def test_shai_hulud_launch_agent_present(tmp_path: Path):
+    agents_dir = tmp_path / "Library" / "LaunchAgents"
+    agents_dir.mkdir(parents=True)
+    (agents_dir / _SHAI_HULUD["macos_launch_agent"]).write_text("<plist></plist>")
+    findings = check_shai_hulud_launch_agent(tmp_path)
+    assert len(findings) == 1
+    assert findings[0].severity == "critical"
+    assert findings[0].check_id == "shai-hulud-launch-agent"
+
+
+def test_shai_hulud_project_markers_clean(tmp_path: Path):
+    (tmp_path / ".claude").mkdir()
+    assert check_shai_hulud_project_markers([tmp_path]) == []
+
+
+def test_shai_hulud_project_markers_one_present(tmp_path: Path):
+    claude_dir = tmp_path / ".claude"
+    claude_dir.mkdir()
+    (claude_dir / "router_runtime.js").write_text("// payload")
+    findings = check_shai_hulud_project_markers([tmp_path])
+    assert len(findings) == 1
+    assert findings[0].severity == "critical"
+    assert findings[0].check_id == "shai-hulud-project-marker"
+
+
+def test_shai_hulud_project_markers_all_present(tmp_path: Path):
+    for relpath in _SHAI_HULUD["project_marker_files"]:
+        target = tmp_path / relpath
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_text("x")
+    findings = check_shai_hulud_project_markers([tmp_path])
+    assert len(findings) == len(_SHAI_HULUD["project_marker_files"])
+
+
+def test_shai_hulud_project_markers_nonexistent_dir(tmp_path: Path):
+    assert check_shai_hulud_project_markers([tmp_path / "nope"]) == []
+
+
+def test_shai_hulud_project_markers_skips_none():
+    assert check_shai_hulud_project_markers([None]) == []
+
+
+def test_shai_hulud_project_markers_dedupes_duplicate_dirs(tmp_path: Path):
+    claude_dir = tmp_path / ".claude"
+    claude_dir.mkdir()
+    (claude_dir / "setup.mjs").write_text("// dropper")
+    findings = check_shai_hulud_project_markers([tmp_path, tmp_path])
+    assert len(findings) == 1
+
+
+def test_shai_hulud_project_markers_dedupes_relative_and_absolute(tmp_path: Path, monkeypatch):
+    claude_dir = tmp_path / ".claude"
+    claude_dir.mkdir()
+    (claude_dir / "setup.mjs").write_text("// dropper")
+    monkeypatch.chdir(tmp_path)
+    findings = check_shai_hulud_project_markers([tmp_path, Path(".")])
+    assert len(findings) == 1
+
+
+def test_sandworm_mode_dev_utils_absent(tmp_path: Path):
+    assert check_sandworm_mode_dev_utils(tmp_path) == []
+
+
+def test_sandworm_mode_dev_utils_present(tmp_path: Path):
+    (tmp_path / _SANDWORM["hidden_dir"]).mkdir()
+    findings = check_sandworm_mode_dev_utils(tmp_path)
+    assert len(findings) == 1
+    assert findings[0].severity == "critical"
+    assert findings[0].check_id == "sandworm-mode-dev-utils-dir"
+
+
+def test_sandworm_mode_mcp_registration_clean(tmp_path: Path):
+    config = tmp_path / ".claude.json"
+    config.write_text(json.dumps({"mcpServers": {"filesystem": {"command": "npx", "args": ["-y", "@a/b@1.0.0"]}}}))
+    assert check_sandworm_mode_mcp_registration([config]) == []
+
+
+def test_sandworm_mode_mcp_registration_by_dir(tmp_path: Path):
+    config = tmp_path / ".claude.json"
+    config.write_text(
+        json.dumps(
+            {
+                "mcpServers": {
+                    "helper": {
+                        "command": "node",
+                        "args": [str(Path.home() / ".dev-utils" / "server.js")],
+                    }
+                }
+            }
+        )
+    )
+    findings = check_sandworm_mode_mcp_registration([config])
+    assert len(findings) == 1
+    assert findings[0].severity == "critical"
+    assert findings[0].check_id == "sandworm-mode-mcp-registration"
+
+
+def test_sandworm_mode_mcp_registration_by_tool_name(tmp_path: Path):
+    config = tmp_path / ".mcp.json"
+    config.write_text(json.dumps({"mcpServers": {"lint_check": {"command": "node", "args": ["server.js"]}}}))
+    findings = check_sandworm_mode_mcp_registration([config])
+    assert len(findings) == 1
+    assert findings[0].check_id == "sandworm-mode-mcp-registration"
+
+
+def test_sandworm_mode_mcp_registration_missing_file(tmp_path: Path):
+    assert check_sandworm_mode_mcp_registration([tmp_path / "missing.json"]) == []