Skip to content
#

supply-chain-attack

Star

Here are 43 public repositories matching this topic...

Language: All
Filter by language
All 43 Shell 11 Python 9 TypeScript 4 JavaScript 3 PowerShell 3 Rust 2 C# 1 HTML 1 Open Policy Agent 1
Sort: Most stars
Sort options
Most stars Fewest stars Most forks Fewest forks Recently updated Least recently updated
thumper

jestasecurity / thumper

Star 166

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

open-source npm security canary incident-response tripwire devsecops malware-detection honeytoken threat-detection credential-theft endpoint-security canarytokens supply-chain-security npm-security shai-hulud supply-chain-attack honeytokens
  • Updated Sep 9, 2026
  • Python

gensecaihq / Shai-Hulud-2.0-Detector

Star 150

GitHub Action that detects the Shai-Hulud 2.0 (Nov 2025) and ChainDrop (Aug 2026) npm supply-chain attacks. Scans dependencies, lockfiles and CI workflows against a daily-updated database of 1,200+ compromised packages, flags malicious install scripts, TruffleHog secret theft and SHA1HULUD runners. SARIF output for GitHub Code Scanning.

nodejs npm security ioc sarif devsecops code-scanning malware-detection threat-detection credential-theft github-actions github-action dependency-scanning open-source-security supply-chain-security npm-security shai-hulud supply-chain-attack chaindrop shai-hulud-2
  • Updated Sep 14, 2026
  • TypeScript

AviOfLagos / snare

Star 5

Supply-chain malware scanner for Git repos. Finds droppers committed into the repo itself — the kind npm audit can't see because there's no malicious dependency. Runs on git clone or when VS Code opens the folder. Kills the loader, scans every repo you can reach, purges it from history.

nodejs macos linux npm security incident-response malware vscode infosec devsecops malware-detection malware-scanner threat-detection supply-chain-security github-security clipboard-stealer npm-security shai-hulud supply-chain-attack etherhiding
  • Updated Sep 10, 2026
  • Shell

dream-horizon-org / sentinel

Star 4

Sentinel Package Manager blocks compromised packages BEFORE installation, preventing malicious code execution. Features: Pre-install blocking, command interception (npm/yarn/pnpm/bun), 795+ blacklist (Shai-Hulud), real-time checks (OSV/GitHub/Snyk), zero dependencies, auto-updates. Counters supply chain attacks.

npm security package-manager blacklist yarn pnpm security-tools bun vulnerability-scanner malware-detection zero-dependencies dependency-security supply-chain-security npm-security shai-hulud supply-chain-attack pre-install-validation package-validation npm-worm compromised-packages
  • Updated Dec 2, 2025
  • JavaScript

wuwatracker / remote-script-swap-demo

Star 3

Educational demo showing how a trusted remote PowerShell script can be silently swapped when served from a mutable source URL. The import tutorial at wuwatracker.com does NOT do this and uses hashed URLs instead to prevent this attack.

security exploit script malware poc vulnerability web-security genshin-impact zenless-zone-zero honkai-star-rail arknights-endfield wuthering-waves supply-chain-attack duet-night-abyss
  • Updated Mar 4, 2026
  • PowerShell

josedacosta / shai-hulud-detector

Sponsor
Star 2

🛡️ Advanced NPM supply chain attack detection tool - Specialized in detecting Shai-Hulud compromise indicators with beautiful CLI interface and automated security reporting

threat-hunting vulnerability-detection security-analysis malware-detection defensive-security npm-audit malicious-packages compromise-detection crypto-stealer npm-security shai-hulud shai-hulud-detector shai-hulud-attack supply-chain-attack self-replicating-worm github-actions-malware bundle-js-detection trufflehog-abuse cli-security-tool package-scanner
  • Updated Sep 19, 2025
  • TypeScript
polinrider-cleaner

meSingh / polinrider-cleaner

Star 2

Detect and clean up after the PolinRider supply-chain campaign — GitHub organizations, personal accounts, and macOS/Linux/Windows machines. Shell only, dry-run by default.

lazarus bash ioc powershell incident-response dfir threat-hunting security-tools devsecops malware-detection malware-removal supply-chain-security github-security git-recovery npm-security supply-chain-attack contagious-interview polinrider beavertail force-push-recovery
  • Updated Sep 14, 2026
  • Shell
tanstack-compromise-checker

fabriziosalmi / tanstack-compromise-checker

Sponsor
Star 2

Shell script to detect TanStack npm supply chain attack indicators (CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx)

docker security-audit incident-response bash-script security-scanner security-tools zero-day devsecops malware-detection github-actions compromise-detection supply-chain-security dependency-scanner ghsa tanstack ioc-detection npm-security shai-hulud supply-chain-attack cve-2026-45321
  • Updated Sep 7, 2026
  • Shell

Add this topic to your repo

To associate your repository with the supply-chain-attack topic, visit your repo's landing page and select "manage topics."

Learn more