Repository navigation
ci: add supply-chain malware scan - #1
Merged
Merged
Conversation
mallison031
force-pushed
the
ci/malware-scan
branch
from
October 20, 2026 10:36
68041bc to
ebe91fe
Compare
Scan every tracked file for supply-chain malware indicators (invisible-Unicode payloads, decode-and-eval loaders, install-hook droppers, credential harvesting, exfiltration endpoints, VS Code auto-run tasks, pull_request_target checkouts, committed native binaries) and check lockfiles with OSV-Scanner, failing on known-malicious (MAL-) packages. Runs on pull_request, pushes to main, weekly, and on demand, with a read-only token. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mallison031
force-pushed
the
ci/malware-scan
branch
from
October 20, 2026 10:39
ebe91fe to
d1bb2a9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
.github/workflows/malware-scan.ymland.github/scripts/malware_scan.py.invisible/bidi Unicode (GlassWorm, Trojan Source),
eval/Functionover decoded data,_0xobfuscator output, install hooks that download or decode, credential-store paths,hard-coded Discord/Telegram/webhook.site exfil endpoints, blockchain C2 lookups,
.vscode/tasks.jsonauto-run tasks,pull_request_targetworkflows that check out PR code,build.rsnetwork/shell use, and committed native executables. Softer signals(
child_process, plaineval, pipe-to-shell, long encoded blobs) are annotations only, and on PRsonly for files the PR touches.
MAL-(known-malicious package)advisories, warns on other vulnerabilities.
Triggers:
pull_request(neverpull_request_target), pushes tomain, weekly, and manual, withcontents: readonly. Actions are pinned by SHA.A reviewed false positive can be silenced with
malware-scan: allow <reason>on the line, or a pathglob in
.github/malware-scan-allow.txt.Current
mainscans clean (0 HIGH findings).🤖 Generated with Claude Code