How to check whether your developer machine is compromised
- +Run npx am-i-hacked --system. It is a read-only audit that needs no root or sudo and makes no network calls. It checks login persistence (launchd on macOS, systemd user units and autostart on Linux) and the code signatures of what they launch, the crontab, shell startup files, AI coding tool config, and running processes. Pair it with npx am-i-being-recorded for screen-capture capability. Neither is antivirus: a clean result means no warning signs were found.
@@ -121,7 +121,7 @@ Shell startup files Remote scripts piped to a shell, decoded payloads, AI coding tool config User-level and managed settings for Claude Code, Codex, Cursor, Gemini CLI, OpenCode and Kilo Code: permission bypass, redirected API URLs, plain-text keys, MCP servers that run unpinned code, and hooks that run from writable places or observe your prompts Running processes Interpreters running capture scripts or scripts from staging areas such as Downloads, caches and Dark corners (next release) Folders where tooling installs code outside any project: virtualenvs, pip and uv caches, pyenv, pipx, the npx cache, the pnpm store, cargo, bun, deno, go and gem bin folders Dark corners Folders where tooling installs code outside any project: virtualenvs, pip and uv caches, pyenv, pipx, the npx cache, the pnpm store, cargo, bun, deno, go and gem bin folders
diff --git a/docs/guides/inspect-untrusted-repository/index.html b/docs/guides/inspect-untrusted-repository/index.html
index 67204ed..853c095 100644
--- a/docs/guides/inspect-untrusted-repository/index.html
+++ b/docs/guides/inspect-untrusted-repository/index.html
@@ -105,7 +105,7 @@
What the system scan checks
DYLD_INSERT_LIBRARIES or LD_PRELOAD, TLS checks disabled, a forced NODE_OPTIONS --require, sudo or ssh replaced by an alias, a redirected AI API base URL, a proxy or extra certificate authority/tmpHow to safely inspect an untrusted repository before you run it
- +Treat the repository as data until you have checked it. Do not open it in an editor, install its dependencies, or run its scripts or tests. Download it to a throwaway folder, scan it with npx am-i-hacked <dir>, read every flagged file as plain text, and list the files that must never run. A clean scan means no warning signs were found; it does not prove the code is safe.
diff --git a/docs/guides/macos-login-items/index.html b/docs/guides/macos-login-items/index.html
index 5d792c2..6a5fde4 100644
--- a/docs/guides/macos-login-items/index.html
+++ b/docs/guides/macos-login-items/index.html
@@ -105,7 +105,7 @@
Is this macOS login item or background item malware?
- +The name in System Settings is the code signer, not the plist. Find the launchd plist behind it, read the program it runs, and verify that program's code signature and Team ID against the vendor's own apps on your machine. A valid vendor signature on a vendor-labelled entry closes the case. Anything unsigned, ad-hoc signed, failing verification or signed by the wrong team stays open. npx am-i-hacked --system --verbose does these checks for every login item at once.
diff --git a/docs/guides/malicious-editor-config/index.html b/docs/guides/malicious-editor-config/index.html
index 50e06d5..3dbb7ea 100644
--- a/docs/guides/malicious-editor-config/index.html
+++ b/docs/guides/malicious-editor-config/index.html
@@ -105,7 +105,7 @@
How to detect malicious VS Code tasks that run when a folder opens
- +VS Code, and editors built on it such as Cursor, can run a task automatically when a folder opens if .vscode/tasks.json sets "runOn": "folderOpen". A malicious repository uses this to run a download-and-execute command the moment you look at it. Before opening an unfamiliar folder, scan it with npx am-i-hacked <dir>, which flags editor auto-run tasks and download-and-run commands in editor config, and keep Workspace Trust turned on.
diff --git a/docs/guides/supply-chain-attack-checks/index.html b/docs/guides/supply-chain-attack-checks/index.html
index de3cc56..ed62c7d 100644
--- a/docs/guides/supply-chain-attack-checks/index.html
+++ b/docs/guides/supply-chain-attack-checks/index.html
@@ -105,7 +105,7 @@
How to catch a supply-chain attack that npm audit misses
- +Advisory scanners such as npm audit, OSV-Scanner and Snyk compare your dependency versions with known, published vulnerabilities. They cannot see an attack committed into the repository itself, or one nobody has reported yet. Add an indicator-based check that reads the code: run npx am-i-hacked before the dev server and in CI, and pull with safe-pull so incoming commits are inspected before they reach your working tree. Run both kinds of check.
@@ -142,7 +142,7 @@ `; `--system`/`--full-system-scan`; `--max-findings N` (folder scan, default 1000); `-v`/`--verbose`; `-h`/`--help`.
diff --git a/docs/security/index.html b/docs/security/index.html
index b362981..c40087a 100644
--- a/docs/security/index.html
+++ b/docs/security/index.html
@@ -156,7 +156,7 @@ Maintainer: Isaac Bell (@IsaacBell).
License: MIT. Third-party notices are in NOTICE.md.
Platforms: macOS and Linux.
- Current releases: am-i-hacked 2.0.1, am-i-being-recorded 1.0.0, secure-semgrep 1.0.1.
+ Current releases: am-i-hacked 2.1.0, am-i-being-recorded 1.0.0, secure-semgrep 1.0.1.
Plans: ROADMAP.md.
diff --git a/docs/tools/am-i-hacked/index.html b/docs/tools/am-i-hacked/index.html
index 077c845..d12af6e 100644
--- a/docs/tools/am-i-hacked/index.html
+++ b/docs/tools/am-i-hacked/index.html
@@ -67,7 +67,7 @@
"applicationCategory": "SecurityApplication",
"applicationSubCategory": "Command-line tool",
"operatingSystem": "macOS, Linux",
- "softwareVersion": "2.0.1",
+ "softwareVersion": "2.1.0",
"softwareRequirements": "bash 4.2+, ripgrep and jq for the folder scan; bash 3.2+ and jq for the system scan",
"license": "https://opensource.org/license/mit",
"isAccessibleForFree": true,
@@ -151,7 +151,7 @@
Other signals it checks
- Official Yarn release files committed to the repository, verified by SHA256.
.envfiles in the git index.
- - Python virtualenvs whose files no longer match their package
RECORDhashes, files no package owns, and.pthhooks that run code. This check ships in the next am-i-hacked release, after 2.0.1.
+ - Python virtualenvs whose files no longer match their package
RECORDhashes, files no package owns, and.pthhooks that run code. This check was added in am-i-hacked 2.1.0.
Limits
diff --git a/docs/llms.txt b/docs/llms.txt index fd22ac7..3867737 100644 --- a/docs/llms.txt +++ b/docs/llms.txt @@ -4,7 +4,7 @@ secure-devtools is a collection of local security tools for macOS and Linux. They check a project folder, and the machine, for supply-chain and dev-environment attack indicators. They need no signup, account or API key, have no npm runtime dependencies, and exit non-zero on findings so they drop into dev scripts or CI. -**Current releases:** `am-i-hacked` 2.0.1, `am-i-being-recorded` 1.0.0, `secure-semgrep` 1.0.1. In the next `am-i-hacked` release: a dark-corner system scan, a Python virtualenv integrity check, and `--max-findings`. +**Current releases:** `am-i-hacked` 2.1.0, `am-i-being-recorded` 1.0.0, `secure-semgrep` 1.0.1. **Website:** https://isaacbell.github.io/secure-devtools/ **Repository:** https://github.com/IsaacBell/secure-devtools **Maintainer:** Isaac Bell — https://isaacbell.io — https://github.com/IsaacBell @@ -54,8 +54,6 @@ Install all with `npx skills add IsaacBell/secure-devtools -g`, or one with `--s ## am-i-hacked in detail -The dark-corner system scan, the Python virtualenv integrity check and `--max-findings` below are unreleased: they ship in the next `am-i-hacked` release and are not in 2.0.1. - - **Folder scan.** Reads JS/TS, Python, Rust, Ruby, C, C++, and C# sources. Skips `node_modules` and `.git`; also reads dot-directories and tracked files that `.gitignore` matches. Detects dynamic code execution (`eval`, `new Function`), child processes, direct network module access, runtime global writes; encoded or obfuscated payloads and unusually long lines; suspicious `package.json` scripts; editor config that runs code on folder open; download-and-run commands in editor config; executable payloads disguised as assets; clipboard/keystroke/screen capture paired with an exfiltration endpoint; `.env` files in the git index; official Yarn releases verified by SHA256; Python virtualenv integrity (package RECORD hashes, unowned files, code-running `.pth` hooks). In bundled code, only high-signal patterns are reported. - **System scan (`--system`, alias `--full-system-scan`).** Read-only, no root or sudo. Adds login persistence (launchd on macOS; systemd user units and XDG autostart on Linux) and macOS code signatures, crontab, shell startup files, user-level and managed AI-tool config, running processes, and the "dark corners" where tooling installs code outside any project. `am-i-hacked host [dir]` checks only a folder's AI-tool config. - **Flags:** `Project facts
am-i-hacked
- +am-i-hacked is a command-line scanner that checks the code you are about to run, and the machine you run it on, for signs of a supply-chain or dev-environment attack. npx am-i-hacked scans the current folder; --system also audits the machine. It is read-only, makes no network calls, needs no account, and exits 1 on findings. It is not antivirus: a clean result means no warning signs were found.
@@ -187,7 +187,7 @@ Official Yarn releases, verified by SHA256.
The folder's AI-tool config:
- Python virtualenv integrity: files that no longer match their package
+ Python virtualenv integrity: files that no longer match their package
Shell startup files: piped remote scripts, injected libraries, hijacked
User-level and managed AI-tool config for Claude Code, Codex, Cursor, Gemini CLI, OpenCode and Kilo Code: permission bypass, plain-text keys, MCP servers that run unpinned code, and hooks.
Running processes that run capture scripts or scripts from staging areas.
- "Dark corners" where tooling installs code outside any project, such as virtualenvs, package-manager caches and language bin folders. Next release.
+ "Dark corners" where tooling installs code outside any project, such as virtualenvs, package-manager caches and language bin folders.
Directory to scan (default: the current directory) Check only a folder's AI-tool config Also audit the whole machine Maximum findings printed (default 1000; the true total is always shown). Next release. Maximum findings printed (default 1000; the true total is always shown). System scan: also list informational items and every persistence entry with its signer Show usage "
run = "bash scripts/release.sh dry-run"
-[tasks.export-public]
-description = "Stage the public repository as one fresh commit. Usage: mise run export-public "
-run = "bash scripts/export-public.sh"
-
[tasks.doctor]
description = "Diagnose the dev environment (mise doctor)"
run = "mise doctor"
diff --git a/scripts/export-public.sh b/scripts/export-public.sh
deleted file mode 100755
index 2a37080..0000000
--- a/scripts/export-public.sh
+++ /dev/null
@@ -1,173 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# scripts/export-public.sh
-#
-# Stage the public secure-devtools repository with exactly one commit, so none of
-# the private history is published. Only the paths in scripts/public-paths.txt are
-# copied; add a tool or skill there once it has passed review. A line starting with
-# `!` removes that path from the copy (for example, live malware samples).
-#
-# scripts/export-public.sh "$(mktemp -d)"
-#
-# Refuses a non-empty destination, never copies node_modules, VCS folders, local
-# settings, logs or env files, runs the personal-data pattern check over the copy
-# and fails on any hit, then `git init -b main` and one commit,
-# "Initial public release". It never adds a remote and never pushes.
-#
-# Patterns come from scripts/silver-gate-patterns.json in the enclosing workspace
-# (found by walking up from this repo). Override with PII_PATTERNS_JSON=.
-# The check fails closed: a missing file, a missing tool or a pattern that does not
-# compile is a failure, not a pass.
-#
-# Needs: git, jq, rsync, rg (ripgrep built with PCRE2; the patterns use look-ahead).
-
-die() {
- echo "export-public: $*" >&2
- exit 1
-}
-
-[[ $# -eq 1 && -n "$1" ]] || {
- echo "usage: export-public.sh " >&2
- exit 2
-}
-
-SRC="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-MANIFEST="$SRC/scripts/public-paths.txt"
-DEST_ARG="$1"
-
-for tool in git jq rg rsync; do
- command -v "$tool" >/dev/null 2>&1 || die "$tool is required but was not found on PATH"
-done
-[[ -f "$MANIFEST" ]] || die "missing $MANIFEST"
-
-# --- destination: must be empty (or absent), and outside the source folder -----------
-
-if [[ -e "$DEST_ARG" && ! -d "$DEST_ARG" ]]; then
- die "'$DEST_ARG' exists and is not a directory"
-fi
-if [[ -d "$DEST_ARG" && -n "$(ls -A "$DEST_ARG")" ]]; then
- die "'$DEST_ARG' is not empty; refusing to export into it"
-fi
-mkdir -p "$DEST_ARG"
-DEST="$(cd "$DEST_ARG" && pwd)"
-case "$DEST/" in
-"$SRC"/*) die "destination must be outside $SRC" ;;
-esac
-
-# --- personal-data patterns -----------------------------------------------------------
-
-find_patterns_json() {
- local dir="$SRC"
- if [[ -n "${PII_PATTERNS_JSON:-}" ]]; then
- printf '%s' "$PII_PATTERNS_JSON"
- return 0
- fi
- while [[ "$dir" != "/" ]]; do
- if [[ -f "$dir/scripts/silver-gate-patterns.json" ]]; then
- printf '%s' "$dir/scripts/silver-gate-patterns.json"
- return 0
- fi
- dir="$(dirname "$dir")"
- done
- return 1
-}
-
-PATTERNS_JSON="$(find_patterns_json)" || die "no scripts/silver-gate-patterns.json above $SRC; set PII_PATTERNS_JSON"
-[[ -f "$PATTERNS_JSON" ]] || die "pattern file '$PATTERNS_JSON' does not exist"
-
-WORK="$(mktemp -d)"
-cleanup() {
- local status=$?
- rm -rf "$WORK"
- # A copy that failed a check must not be left behind to be published by hand.
- if ((status != 0)) && [[ -d "$DEST" ]]; then
- find "$DEST" -mindepth 1 -delete 2>/dev/null || true
- fi
-}
-trap cleanup EXIT
-
-# Block-severity personal and secret patterns, email and personal-profile URLs,
-# plus the name, internal-framing and family-reference groups. Warn-level shapes
-# that fire on ordinary code (IP addresses, dates, ZIP codes) are left out.
-jq -r '
- (.pii[] | select(.severity == "block" or .name == "Email Address" or .name == "Personal URL")),
- .internal_framing[],
- .family_references[]
- | .pattern
-' "$PATTERNS_JSON" >"$WORK/patterns.txt" || die "could not read patterns from $PATTERNS_JSON"
-[[ -s "$WORK/patterns.txt" ]] || die "no patterns were read from $PATTERNS_JSON"
-
-# --- copy the manifest -------------------------------------------------------------------
-
-excluded=()
-while IFS= read -r path || [[ -n "$path" ]]; do
- [[ -z "$path" || "$path" == \#* ]] && continue
- if [[ "$path" == !* ]]; then
- excluded+=("${path#!}")
- continue
- fi
- [[ "$path" != /* && "$path" != *..* ]] || die "unsafe manifest path: $path"
- [[ -e "$SRC/$path" ]] || die "manifest lists $path, which does not exist"
- mkdir -p "$DEST/$(dirname "$path")"
- rsync -a \
- --exclude node_modules --exclude .git --exclude .jj --exclude .DS_Store \
- --exclude '.env*' --exclude settings.local.json --exclude '*.log' --exclude reports \
- "$SRC/$path" "$DEST/$(dirname "$path")/"
-done <"$MANIFEST"
-
-for path in ${excluded[@]+"${excluded[@]}"}; do
- [[ "$path" != /* && "$path" != *..* && -n "$path" ]] || die "unsafe exclusion: $path"
- rm -rf "${DEST:?}/$path"
- [[ ! -e "$DEST/$path" ]] || die "could not remove excluded path $path"
-done
-
-forbidden="$(find "$DEST" \( -name node_modules -o -name .git -o -name .jj -o -name reports -o -name '.env*' -o -name 'settings.local.json' -o -name '*.log' \) -print)"
-[[ -z "$forbidden" ]] || die "refusing to publish local files:
-$forbidden"
-
-# --- personal-data check on the copy ----------------------------------------------------
-
-# Matched text that is allowed to ship: each package author's own contact address
-# (published on purpose) and placeholder addresses on reserved domains used by the
-# tests. Every other hit fails the export.
-AUTHOR_EMAILS="$(find "$DEST" -name package.json -not -path '*/node_modules/*' -exec jq -r '(.author // "") | if type == "string" then (capture("<(?[^>]+)>").e // empty) else (.email // empty) end' {} \; | sort -u)"
-PLACEHOLDER_EMAIL='^[^@]+@(example\.(com|org|net)|[A-Za-z0-9.-]+\.(test|invalid|example))$'
-
-rc=0
-rg --pcre2 -o -n --no-heading --hidden --color never \
- -f "$WORK/patterns.txt" -- "$DEST" >"$WORK/hits.txt" 2>"$WORK/rg.err" || rc=$?
-if ((rc == 2)); then
- cat "$WORK/rg.err" >&2
- die "the pattern check could not run (is rg built with PCRE2? does a pattern compile?); nothing was exported"
-fi
-
-# rg -o prints path:line:matched-text; judge the matched text only.
-hits="$(AUTHORS="$AUTHOR_EMAILS" OK="$PLACEHOLDER_EMAIL" awk '
- BEGIN { n = split(ENVIRON["AUTHORS"], a, "\n"); for (i = 1; i <= n; i++) if (a[i] != "") allowed[a[i]] = 1 }
- {
- text = $0
- sub(/^[^:]*:[0-9]+:/, "", text)
- if (text in allowed) next
- if (text ~ ENVIRON["OK"]) next
- print
- }
-' "$WORK/hits.txt")"
-if [[ -n "$hits" ]]; then
- printf '%s\n' "$hits" | sed "s#$DEST/##" >&2
- die "personal-data pattern hits in the copy (listed above); nothing was exported"
-fi
-
-# --- one commit ----------------------------------------------------------------------------
-
-git -C "$DEST" init -q -b main
-git -C "$DEST" add -A
-# Hooks off: a global hooks path from another project must not run here.
-git -C "$DEST" -c core.hooksPath=/dev/null commit -q -m "Initial public release"
-
-[[ "$(git -C "$DEST" rev-list --count HEAD)" == "1" ]] || die "expected exactly one commit"
-[[ "$(git -C "$DEST" log -1 --format=%B | sed '/^$/d')" == "Initial public release" ]] || die "commit message is not exactly the subject"
-[[ -z "$(git -C "$DEST" remote)" ]] || die "unexpected git remote"
-
-echo "export-public: staged $(git -C "$DEST" ls-files | wc -l | tr -d ' ') files as one commit in $DEST"
-echo "export-public: no remote added, nothing pushed"
diff --git a/skills/secure-skill-pull/SKILL.md b/skills/secure-skill-pull/SKILL.md
index d4c6ef8..0db0f0b 100644
--- a/skills/secure-skill-pull/SKILL.md
+++ b/skills/secure-skill-pull/SKILL.md
@@ -54,7 +54,7 @@ echo "== files =="; (cd "$work/src" && find . -type f ! -path './.git/*' | sort)
echo "== executable files =="; find "$work/src" -type f -perm -u+x
echo "== scanner =="; npx am-i-hacked "$work/src"
echo "== risky lines =="
-grep -rInE '(curl|wget)[^|]*\|[[:space:]]*(sh|bash)|base64[[:space:]]+(-d|--decode)|eval[[:space:](]|(npx|pnpx|pnpm dlx)[[:space:]]|pip3? install|npm (i|install)[[:space:]]|chmod \+x|\.ssh|\.env|ignore (all |any )?(previous|prior) instructions|disregard (the |all )?(above|previous)' "$work/src" --exclude-dir=.git
+grep -rInE '(curl|wget)[^|]*\|[[:space:]]*(sh|bash)|base64[[:space:]]+(-d|--decode)|eval[[:space:](]|(^|[^[:alnum:]_-])(npx|pnpx|bunx|(pnpm|yarn)[[:space:]]+dlx|npm[[:space:]]+(exec|x)|bun[[:space:]]+x)[[:space:]]|pip3? install|npm (i|install)[[:space:]]|chmod \+x|\.ssh|\.env|ignore (all |any )?(previous|prior) instructions|disregard (the |all )?(above|previous)' "$work/src" --exclude-dir=.git
echo "== invisible characters =="
find "$work/src" -type f ! -path '*/.git/*' -print0 | xargs -0 perl -CSD -ne 'print "$ARGV:$.: invisible character\n" if /[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{2064}\x{E0000}-\x{E007F}]/'
echo "== main file =="; find "$work/src" -name SKILL.md | while read -r f; do shasum -a 256 "$f"; done
What the folder scan detects
.env files in the git index..claude/settings*.json and .mcp.json.RECORD hashes, files no package owns, and .pth or startup hooks that run code. Next release.RECORD hashes, files no package owns, and .pth or startup hooks that run code.Languages read: JS/TS, Python, Rust, Ruby, C, C++ and C#. Dot-directories and tracked files that .gitignore matches are read; node_modules and .git are skipped. In bundled output (webpack, esbuild, ncc) only high-signal patterns are reported.
What the system scan detects
sudo or ssh, background launchers, redirected AI API base URLs, proxies and extra certificate authorities.Example output
@@ -224,7 +224,7 @@Flags
<dir>host [dir]--system, --full-system-scan--max-findings N--max-findings N-v, --verbose-h, --help