Created
November 26, 2025 12:14
-
-
Save amitmahbubani/a1d45482ce3f6b9b3a82069272f6b3dc to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| echo "=== Checking for Shai-Hulud indicators ===" | |
| # Check for malicious files | |
| echo "\n[1] Checking for setup_bun.js..." | |
| find ~/ -name "setup_bun.js" 2>/dev/null | |
| echo "\n[2] Checking for bun_environment.js..." | |
| find ~/ -name "bun_environment.js" 2>/dev/null | |
| echo "\n[3] Checking for .truffler-cache..." | |
| ls -la ~/.truffler-cache/ 2>/dev/null | |
| echo "\n[4] Checking for .dev-env..." | |
| ls -la ~/.dev-env/ 2>/dev/null | |
| echo "\n[5] Checking running processes..." | |
| ps aux | grep -E "(trufflehog|setup_bun|bun_environment)" | grep -v grep | |
| echo "\n[6] Checking recent npm installs (Nov 21-24)..." | |
| find ~/**/node_modules -type d -newermt "2025-11-21" ! -newermt "2025-11-25" -maxdepth 1 2>/dev/null | |
| echo "\n[7] Checking for suspicious GitHub workflows..." | |
| find ~/ -path "**/.github/workflows/discussion.y*ml" 2>/dev/null | |
| find ~/ -path "**/.github/workflows/*hulud*.yml" 2>/dev/null | |
| echo "\n[8] Checking for truffleSecrets.json..." | |
| find ~/ -name "truffleSecrets.json" 2>/dev/null | |
| echo "\n=== Check complete ===" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment