Detect npm packages compromised in the Shai-Hulud 2.0 supply chain attack (Nov 2025). Scans for 790+ malicious packages, suspicious scripts, TruffleHog activity, SHA1HULUD runners, and secrets exfiltration. GitHub Action with SARIF support.

Shai-Hulud Checker

Simple package.json containing all packages affected by the sh1-hulud worm attack.

Scanning Public Repos used in the Sha1-Hulud Compromise

🔍 Automated GitHub scanner to detect Sha1-Hulud project repositories across organization members. Fetches org members, scans for specific repos, and sends Slack notifications when found.

🛡️ Detect Shai Hulud npm-worm compromises in GitHub users and organizations with this easy-to-use CLI tool, protecting your code from malicious attacks.