{"uuid": "d9dc4501-ea66-4b88-9133-d597e1e1be4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-g7cv-rxg3-hmpx", "type": "seen", "source": "https://gist.github.com/nrajlekhak/84bda8dc75e9212c7699a79bb34fa4dc", "content": "#!/usr/bin/env bash\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# detect-mini-shai-hulud.sh\n#\n# Scans every project under the CWD for npm packages compromised in the\n# \"Mini Shai-Hulud\" supply-chain attack (npm ecosystem, 2026).\n#\n# Compromised package list source: StepSecurity blog\n#   https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem\n# @tanstack/* patched versions cross-verified against GitHub Security Advisory:\n#   https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx\n#\n# Usage:\n#   cd ~/projects\n#   bash detect-mini-shai-hulud.sh\n#\n# Scans: package-lock.json, yarn.lock, pnpm-lock.yaml  (skips node_modules)\n# Note:  bun.lockb is binary \u2014 for Bun projects:  bun pm ls | less\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nset -euo pipefail\n\n# \u2500\u2500\u2500 Compromised packages \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Format: \"|[,,...]|\"\n# Add new entries here as advisories drop.\nVULN_LIST=(\n  \"@uipath/docsai-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/packager-tool-apiworkflow|0.0.19|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/packager-tool-workflowcompiler-browser|0.0.34|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/packager-tool-functions|0.1.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/agent.sdk|0.0.18|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/filesystem|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/admin-tool|0.1.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/llmgw-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@tanstack/arktype-adapter|1.166.12,1.166.15|upgrade to 1.166.16\"\n  \"@tanstack/eslint-plugin-router|1.161.9,1.161.12|upgrade to 1.161.13\"\n  \"@tanstack/eslint-plugin-start|0.0.4,0.0.7|upgrade to 0.0.8\"\n  \"@tanstack/history|1.161.9,1.161.12|upgrade to 1.161.13\"\n  \"@tanstack/nitro-v2-vite-plugin|1.154.12,1.154.15|upgrade to 1.154.16\"\n  \"@tanstack/react-router|1.169.5,1.169.8|upgrade to 1.169.9\"\n  \"@tanstack/react-router-devtools|1.166.16,1.166.19|upgrade to 1.166.20\"\n  \"@tanstack/react-router-ssr-query|1.166.15,1.166.18|upgrade to 1.166.19\"\n  \"@tanstack/react-start|1.167.68,1.167.71|upgrade to 1.167.72\"\n  \"@tanstack/react-start-client|1.166.51,1.166.54|upgrade to 1.166.55\"\n  \"@tanstack/react-start-rsc|0.0.47,0.0.50|upgrade to 0.0.51\"\n  \"@tanstack/react-start-server|1.166.55,1.166.58|upgrade to 1.166.59\"\n  \"@tanstack/router-cli|1.166.46,1.166.49|upgrade to 1.166.50\"\n  \"@tanstack/router-core|1.169.5,1.169.8|upgrade to 1.169.9\"\n  \"@tanstack/router-devtools|1.166.16,1.166.19|upgrade to 1.166.20\"\n  \"@tanstack/router-devtools-core|1.167.6,1.167.9|upgrade to 1.167.10\"\n  \"@tanstack/router-generator|1.166.45,1.166.48|upgrade to 1.166.49\"\n  \"@tanstack/router-plugin|1.167.38,1.167.41|upgrade to 1.167.42\"\n  \"@tanstack/router-ssr-query-core|1.168.3,1.168.6|upgrade to 1.168.7\"\n  \"@tanstack/router-utils|1.161.11,1.161.14|upgrade to 1.161.15\"\n  \"@tanstack/router-vite-plugin|1.166.53,1.166.56|upgrade to 1.166.57\"\n  \"@tanstack/solid-router|1.169.5,1.169.8|upgrade to 1.169.9\"\n  \"@tanstack/solid-router-devtools|1.166.16,1.166.19|upgrade to 1.166.20\"\n  \"@tanstack/solid-router-ssr-query|1.166.15,1.166.18|upgrade to 1.166.19\"\n  \"@tanstack/solid-start|1.167.65,1.167.68|upgrade to 1.167.69\"\n  \"@tanstack/solid-start-client|1.166.50,1.166.53|upgrade to 1.166.54\"\n  \"@tanstack/solid-start-server|1.166.54,1.166.57|upgrade to 1.166.58\"\n  \"@tanstack/start-client-core|1.168.5,1.168.8|upgrade to 1.168.9\"\n  \"@tanstack/start-fn-stubs|1.161.9,1.161.12|upgrade to 1.161.13\"\n  \"@tanstack/start-plugin-core|1.169.23,1.169.26|upgrade to 1.169.27\"\n  \"@tanstack/start-server-core|1.167.33,1.167.36|upgrade to 1.167.37\"\n  \"@tanstack/start-static-server-functions|1.166.44,1.166.47|upgrade to 1.166.48\"\n  \"@tanstack/start-storage-context|1.166.38,1.166.41|upgrade to 1.166.42\"\n  \"@tanstack/valibot-adapter|1.166.12,1.166.15|upgrade to 1.166.16\"\n  \"@tanstack/virtual-file-routes|1.161.10,1.161.13|upgrade to 1.161.14\"\n  \"@tanstack/vue-router|1.169.5,1.169.8|upgrade to 1.169.9\"\n  \"@tanstack/vue-router-devtools|1.166.16,1.166.19|upgrade to 1.166.20\"\n  \"@tanstack/vue-router-ssr-query|1.166.15,1.166.18|upgrade to 1.166.19\"\n  \"@tanstack/vue-start|1.167.61,1.167.64|upgrade to 1.167.65\"\n  \"@tanstack/vue-start-client|1.166.46,1.166.49|upgrade to 1.166.50\"\n  \"@tanstack/vue-start-server|1.166.50,1.166.53|upgrade to 1.166.54\"\n  \"@tanstack/zod-adapter|1.166.12,1.166.15|upgrade to 1.166.16\"\n  \"@draftauth/client|0.2.1,0.2.2|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@draftauth/core|0.13.1,0.13.2|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@draftlab/auth|0.24.1,0.24.2|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@draftlab/auth-router|0.5.1,0.5.2|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@draftlab/db|0.16.1,0.16.2|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@taskflow-corp/cli|0.1.24,0.1.25,0.1.26,0.1.27,0.1.28,0.1.29|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@tolka/cli|1.0.2,1.0.3,1.0.4,1.0.6|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/access-policy-sdk|0.3.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/access-policy-tool|0.3.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/agent-sdk|1.0.2|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/agent-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/aops-policy-tool|0.3.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/ap-chat|1.5.7|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/api-workflow-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/apollo-core|5.9.2|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/apollo-react|4.24.5|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/apollo-wind|2.16.2|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/auth|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/case-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/cli|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/codedagent-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/codedagents-tool|0.1.12|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/codedapp-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/common|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/context-grounding-tool|0.1.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/data-fabric-tool|1.0.2|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/flow-tool|1.0.2|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/functions-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/gov-tool|0.3.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/identity-tool|0.1.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/insights-sdk|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/insights-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/integrationservice-sdk|1.0.2|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/integrationservice-tool|1.0.2|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/maestro-sdk|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/maestro-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/orchestrator-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/packager-tool-bpmn|0.0.9|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/packager-tool-case|0.0.9|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/packager-tool-connector|0.0.19|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/packager-tool-flow|0.0.19|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/packager-tool-webapp|1.0.6|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/packager-tool-workflowcompiler|0.0.16|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/platform-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/project-packager|1.1.16|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/resource-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/resourcecatalog-tool|0.1.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/resources-tool|0.1.11|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/robot|1.3.4|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/rpa-legacy-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/rpa-tool|0.9.5|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/solution-packager|0.0.35|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/solution-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/solutionpackager-sdk|1.0.11|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/solutionpackager-tool-core|0.0.34|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/tasks-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/telemetry|0.0.7|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/test-manager-tool|1.0.2|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/tool-workflowcompiler|0.0.12|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/traces-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/ui-widgets-multi-file-upload|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/uipath-python-bridge|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/vertical-solutions-tool|1.0.1|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/vss|0.1.6|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@uipath/widget.sdk|1.2.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"safe-action|0.8.3,0.8.4|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@supersurkhet/cli|0.0.2,0.0.3,0.0.4,0.0.5,0.0.6,0.0.7|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@supersurkhet/sdk|0.0.2,0.0.3,0.0.4,0.0.5,0.0.6,0.0.7|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"cmux-agent-mcp|0.1.3,0.1.4,0.1.5,0.1.6,0.1.7,0.1.8|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"git-git-git|1.0.8,1.0.9,1.0.10,1.0.12|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"git-branch-selector|1.3.3,1.3.4,1.3.5,1.3.7|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"nextmove-mcp|0.1.3,0.1.4,0.1.5,0.1.7|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@beproduct/nestjs-auth|0.1.2,0.1.3,0.1.4,0.1.5,0.1.6,0.1.7,0.1.8,0.1.9,0.1.10,0.1.11,0.1.12,0.1.13,0.1.14,0.1.15,0.1.16,0.1.17,0.1.19|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@dirigible-ai/sdk|0.6.2,0.6.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@ml-toolkit-ts/preprocessing|1.0.2,1.0.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@ml-toolkit-ts/xgboost|1.0.3,1.0.4|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"agentwork-cli|0.1.4,0.1.5|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"ml-toolkit-ts|1.0.4,1.0.5|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/airport-data|0.7.4,0.7.5,0.7.7|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/airports|0.6.2,0.6.3,0.6.5|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/airspace|0.8.1,0.8.2,0.8.4|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/airspace-data|0.5.3,0.5.4,0.5.6|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/airway-data|0.5.4,0.5.5,0.5.7|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/airways|0.4.2,0.4.3,0.4.5|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/fix-data|0.6.4,0.6.5,0.6.7|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/fixes|0.3.2,0.3.3,0.3.5|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/flight-math|0.5.4,0.5.5,0.5.7|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/flightplan|0.5.2,0.5.3,0.5.5|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/geo|0.4.4,0.4.5,0.4.7|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/icao-registry|0.5.2,0.5.3,0.5.5|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/icao-registry-data|0.8.4,0.8.5,0.8.7|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/mcp|0.9.1,0.9.2,0.9.4|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/navaid-data|0.6.4,0.6.5,0.6.7|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/navaids|0.4.2,0.4.3,0.4.5|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/notams|0.3.6,0.3.7,0.3.9|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/procedure-data|0.7.3,0.7.4,0.7.6|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/procedures|0.5.2,0.5.3,0.5.5|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/types|0.8.1,0.8.2,0.8.4|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/units|0.4.3,0.4.4,0.4.6|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@squawk/weather|0.5.6,0.5.7,0.5.9|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"wot-api|0.8.1,0.8.2,0.8.4|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"cross-stitch|1.1.3,1.1.4,1.1.6|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"ts-dna|3.0.1,3.0.2,3.0.4|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@tallyui/components|1.0.1,1.0.2,1.0.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@tallyui/connector-medusa|1.0.1,1.0.2,1.0.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@tallyui/connector-shopify|1.0.1,1.0.2,1.0.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@tallyui/connector-vendure|1.0.1,1.0.2,1.0.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@tallyui/connector-woocommerce|1.0.1,1.0.2,1.0.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@tallyui/core|0.2.1,0.2.2,0.2.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@tallyui/database|1.0.1,1.0.2,1.0.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@tallyui/pos|0.1.1,0.1.2,0.1.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@tallyui/storage-sqlite|0.2.1,0.2.2,0.2.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@tallyui/theme|0.2.1,0.2.2,0.2.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@mesadev/rest|0.28.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@mesadev/saguaro|0.4.22|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@mesadev/sdk|0.28.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@mistralai/mistralai|2.2.3,2.2.4|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@mistralai/mistralai-azure|1.7.2,1.7.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n  \"@mistralai/mistralai-gcp|1.7.2,1.7.3|remove/replace \u2014 no known clean patched version; rotate any creds touched at install\"\n)\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n# Serialize VULN_LIST to JSON for the per-lockfile Python parser\nVULN_RAW=$(printf '%s\\n' \"${VULN_LIST[@]}\")\nexport VULN_RAW\nVULN_JSON=$(python3 -c '\nimport json, os\nout = {}\nfor line in os.environ[\"VULN_RAW\"].strip().split(\"\\n\"):\n    pkg, bad_csv, fix = line.split(\"|\", 2)\n    out[pkg] = {\"bad\": bad_csv.split(\",\"), \"fix\": fix}\nprint(json.dumps(out))\n')\nexport VULN_JSON\n\nNUM_PKGS=${#VULN_LIST[@]}\n\nLOCKFILES=()\nwhile IFS= read -r line; do\n  LOCKFILES+=(\"$line\")\ndone < <(find . \\( -name package-lock.json -o -name yarn.lock -o -name pnpm-lock.yaml \\) -not -path '*/node_modules/*' 2>/dev/null | sort)\n\nif [[ ${#LOCKFILES[@]} -eq 0 ]]; then\n  echo \"No lock files found under $(pwd)\"\n  exit 0\nfi\n\necho \"Scanning ${#LOCKFILES[@]} lock file(s) for $NUM_PKGS compromised packages (Mini Shai-Hulud campaign)...\"\necho\n\nTOTAL_HITS=0\nAFFECTED_PROJECTS=()\n\nfor lock in \"${LOCKFILES[@]}\"; do\n  project=$(dirname \"$lock\" | sed 's|^\\./||')\n  base=$(basename \"$lock\")\n\n  hits=$(LOCK_PATH=\"$lock\" LOCK_TYPE=\"$base\" python3 - <<'PY'\nimport json, os, re, sys\n\nvuln = json.loads(os.environ['VULN_JSON'])\npath = os.environ['LOCK_PATH']\nkind = os.environ['LOCK_TYPE']\nfound = []  # list of (pkg, version, fix)\n\ndef check(pkg, ver):\n    if pkg in vuln and ver in vuln[pkg]['bad']:\n        found.append((pkg, ver, vuln[pkg]['fix']))\n\n# Pre-built alternation of all watched package names for fast scanning\npkg_re_alt = '|'.join(re.escape(p) for p in vuln.keys())\n\ntry:\n    with open(path, 'r', encoding='utf-8', errors='replace') as f:\n        content = f.read()\nexcept Exception as e:\n    print(f\"ERROR_READING:{e}\", file=sys.stderr)\n    sys.exit(0)\n\nif kind == 'package-lock.json':\n    try:\n        d = json.loads(content)\n    except json.JSONDecodeError:\n        sys.exit(0)\n    # npm v7+ \"packages\" map\n    pkg_suffix_re = re.compile(r'node_modules/(' + pkg_re_alt + r')$')\n    for key, meta in (d.get('packages') or {}).items():\n        m = pkg_suffix_re.search(key)\n        if m:\n            check(m.group(1), meta.get('version', ''))\n    # legacy \"dependencies\" tree (npm v6)\n    def walk(deps):\n        for name, meta in (deps or {}).items():\n            if name in vuln:\n                check(name, meta.get('version', ''))\n            walk(meta.get('dependencies'))\n    walk(d.get('dependencies'))\n\nelif kind == 'yarn.lock':\n    # Yarn v1 / Berry blocks\n    blocks = re.split(r'\\n(?=[^\\s])', content)\n    header_pkg_re = re.compile(r'\"?(' + pkg_re_alt + r')@')\n    ver_line_re   = re.compile(r'^\\s+version\\s+\"([^\"]+)\"', re.M)\n    for block in blocks:\n        first = block.split('\\n', 1)[0]\n        pkgs_in_header = header_pkg_re.findall(first)\n        if not pkgs_in_header:\n            continue\n        ver_match = ver_line_re.search(block)\n        if not ver_match:\n            continue\n        version = ver_match.group(1)\n        for pkg in set(pkgs_in_header):\n            check(pkg, version)\n\nelif kind == 'pnpm-lock.yaml':\n    # pnpm: every package@version reference is captured\n    occ_re = re.compile(r'(' + pkg_re_alt + r')@([0-9][0-9a-zA-Z.+-]*)')\n    for m in occ_re.finditer(content):\n        check(m.group(1), m.group(2))\n\nseen = set()\nfor pkg, ver, fix in found:\n    key = (pkg, ver)\n    if key in seen: continue\n    seen.add(key)\n    print(f\"{pkg}|{ver}|{fix}\")\nPY\n)\n\n  if [[ -n \"$hits\" ]]; then\n    AFFECTED_PROJECTS+=(\"$project\")\n    echo \"\u274c $project  ($base)\"\n    while IFS='|' read -r pkg ver fix; do\n      echo \"      $pkg@$ver   \u2192  $fix\"\n      TOTAL_HITS=$((TOTAL_HITS + 1))\n    done <<< \"$hits\"\n    echo\n  fi\ndone\n\necho \"\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\"\nif [[ $TOTAL_HITS -eq 0 ]]; then\n  echo \"\u2705 No compromised packages found in ${#LOCKFILES[@]} lock file(s).\"\nelse\n  uniq_projects=$(printf '%s\\n' \"${AFFECTED_PROJECTS[@]}\" | sort -u | wc -l | tr -d ' ')\n  echo \"\u274c Found $TOTAL_HITS compromised dependency entries across $uniq_projects project(s).\"\n  echo\n  echo \"Remediation:\"\n  echo \"  1. Upgrade/remove each affected package per the message above.\"\n  echo \"  2. Delete node_modules and the lock file, then reinstall.\"\n  echo \"  3. Rotate any secrets accessible to your dev/build/CI environment\"\n  echo \"     (the worm exfiltrates env vars, .env files, cloud/GitHub/npm tokens, SSH keys).\"\n  echo \"  4. Audit CI logs for outbound calls to attacker-controlled GitHub repos.\"\nfi\n", "creation_timestamp": "2026-05-12T04:52:42.000000Z"}