jpmckearin/Shai-Hulud Scanner

Scan lockfiles for compromised packages using shai-hulud-scanner

Trust Signals

name	description	required	default
list-path	Path to custom exploited packages list file. If not specified, uses the built-in list of known compromised packages. Example: 'security/custom-packages.txt'	no	""
root-dir	Root directory to scan for lockfiles. Scans recursively for package-lock.json, yarn.lock, pnpm-lock.yaml, and bun.lock files. Example: './src' or '.'	no	.
managers	Package managers to scan (comma-separated). Valid options: yarn, npm, pnpm, bun. Example: 'yarn,npm' to scan only Yarn and npm lockfiles.	no	yarn,npm,pnpm,bun
include	Glob patterns to include (comma-separated). Only scan paths matching these patterns. Example: 'src/,apps/' to scan only src and apps directories.	no	—
exclude	Glob patterns to exclude (comma-separated). Skip paths matching these patterns. Example: '/test/,/dist/' to skip test and dist directories.	no	—
fail-on-match	Whether to fail the workflow when compromised packages are found. Set to 'false' to only warn without failing the build.	no	true
only-affected	Show only compromised packages in output, hiding safe packages. Useful for focusing on actionable items only.	no	false
summary	Show only summary output without detailed package information. Useful for getting a quick overview of scan results.	no	false
quiet	Suppress non-essential output including clean package listings. Only shows compromised packages and warnings.	no	false
no-color	Disable colored output. Useful when output will be processed by tools that don't handle ANSI color codes.	no	false

name	description
has-matches	Whether any compromised packages were found
match-count	Number of compromised packages found
warning-count	Number of packages with vulnerable versions available
json-output	JSON output of scan results