gensecaihq/Shai-Hulud 2.0 Detector
Detect Shai-Hulud 2.0 npm supply chain attack - 790+ packages, SHA256 hashing, runner & backdoor detection
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| fail-on-critical | Fail the action if critical severity issues are found | no | true |
| fail-on-high | Fail the action if high or critical severity issues are found | no | false |
| fail-on-any | Fail the action if any compromised packages or security findings are detected | no | false |
| scan-lockfiles | Scan lockfiles (package-lock.json, yarn.lock) for transitive dependencies | no | true |
| scan-node-modules | Scan node_modules directory for installed packages | no | false |
| output-format | Output format: text, json, or sarif | no | text |
| working-directory | Directory to scan (defaults to repository root) | no | . |
| allowlist-path | Path to allowlist JSON file for excluding false positives (default: .shai-hulud-allowlist.json) | no | .shai-hulud-allowlist.json |
| ignore-allowlist | Ignore allowlist file and report all findings (useful for security audits) | no | false |
| warn-on-allowlist | Show allowlisted items as warnings instead of hiding them completely | no | false |
Outputs
| name | description |
|---|---|
| affected-count | Number of compromised packages found |
| security-findings-count | Number of security findings (suspicious scripts, TruffleHog, malicious runners, etc.) |
| status | Scan status: clean or affected |
| scan-time | Time taken to complete the scan in milliseconds |
| results | JSON array of compromised packages |
| security-findings | JSON array of security findings (suspicious scripts, exfiltration, runners, etc.) |
| sarif-file | Path to SARIF report file (when output-format is sarif) |
| allowlisted-count | Number of findings excluded by allowlist |