A simple bash only tool that will, for a specific CVE, recursively scan a directory for indicators of compromise (IoCs) and indicators of vulnerability.
Plus a cve-scanner skill, that can be used to collect data and create a YAML definition for a CVE.
The scanner itself does not use AI tools to run, so giving an AI agent access to your codebase should not be a concern.
./scan.sh <SCANNER> [options] [TARGET_DIR]| Argument | Description |
|---|---|
SCANNER |
A scanner directory (scanners/CVE-2025-54313-eslint-config-prettier), its name, or just the CVE identifier (CVE-2025-54313) |
TARGET_DIR |
Directory to scan recursively (default: .) |
Scanner directories are named CVE-ID plus a few words describing what they cover, so the CVE identifier on its own is
enough to select one:
./scan.sh CVE-2025-54313 # CVE identifier only
./scan.sh CVE-2025-54313-eslint-config-prettier # directory name
./scan.sh scanners/CVE-2025-54313-eslint-config-prettier ~/code # path, plus a target directory| Flag | Description |
|---|---|
--json |
Output results as JSON |
--output FILE |
Write results to a file |
Exit codes: 0 = clean, 1 = IoCs found, 2 = usage error.
Scanning is confined to TARGET_DIR, with one exception: where a CVE's malware installs persistence at a fixed host
location — a systemd unit or LaunchAgent in $HOME, say — the scanner also checks that location. Those paths are
listed in the CVE's own README.
| Advisory | Product | Type |
|---|---|---|
| CVE-2026-45321 | 170+ npm/PyPI packages (Mini Shai-Hulud worm, CVSS 9.6) | Malware IoCs |
| CVE-2026-33228 | flatted (prototype pollution in circular JSON parser, CVSS 9.8) | Vulnerability |
| MAL-2026-2307 | axios (supply chain RAT delivery, CVSS 9.3) | Malware IoCs |
| CVE-2026-33634 | Trivy, litellm, telnyx, KICS (TeamPCP supply chain attack, CVSS 9.4) | Malware IoCs |
| CVE-2025-59145 | color-name and related npm packages (supply chain attack, CVSS 8.8) | Malware IoCs |
| CVE-2025-55182 | React Server Components (React2Shell pre-auth RCE, CVSS 10.0) | Malware IoCs |
| CVE-2025-54313 | eslint-config-prettier / npm packages (supply chain, CVSS 7.5) | Malware IoCs |
Ensure you have asdf or equivalent such as mise installed.
Run...
make setupmake testThe main GitHub Actions test workflow runs on ubuntu-latest, macos-latest, and
windows-latest for both push and pull_request events. Each runner executes the
full Bats suite and a small end-to-end smoke test for scan.sh to verify consistent
behaviour across platforms.
You can run the smoke test locally with:
bash tests/smoke_scan.shUse Conventional Commits and the imperative mood.
Run /cve-scanner in Claude Code from this directory.
Each scanner lives in scanners/<CVE-ID>-<few-words>/ — the suffix says at a glance what the scanner covers — and
contains an indicators.yaml and README.md. scan.sh picks it up automatically.
Known indicators or compromise or vulnerability can change as more is learned about the CVE. You can update the definition by rerunning the cve-scanner skill for the CVE. Rerunning moves the previous version to the gitignored .scanner-backups/ directory so you can diff against it.
Use the most authoritative identifier available, in this order:
- CVE —
CVE-2025-54313. - OSV
MAL-record —MAL-2026-2307. Malicious package releases rarely get a CVE, and this is the namespace built for them. Look the package up on osv.dev. - GHSA —
GHSA-fw8c-xr5c-95f9, when OSV has no record. - A date-based placeholder —
CVE-2026-04-01-april-fool— only when nothing above exists.
Where an incident spans several advisories, name the scanner after the entry-point package's identifier and list
the rest under sources:. If a better identifier is assigned later, rename the directory and README entry and
rerun the cve-scanner skill.
Note that you may need to update the /cve-scanner skill to make it better if you find the generated indicators.yaml lacking in some way, but please keep it simple. Also, question everything the agentic coding assistant suggests, some things will just increase the likelihood of getting false positives.
See https://github.com/madetech/cve-scanner/issues for things you could pick up to contribute or to add new issues.
If you pick up an issue, assign yourself and keep the rest of us updated with progress in the comments and/or a draft pull request.