tops-bmad/security-tools/Shai-Hulud-2.0-Detector/action.yml

CLI tool to install BMAD workflow files into any project with integrated Shai-Hulud 2.0 security scanning

name: 'Shai-Hulud 2.0 Detector'
description: 'Detect Shai-Hulud 2.0 npm supply chain attack - 790+ packages, SHA256 hashing, runner & backdoor detection'
author: 'gensecaihq'
branding:
  icon: 'shield'
  color: 'red'

inputs:
  fail-on-critical:
    description: 'Fail the action if critical severity issues are found'
    required: false
    default: 'true'
  fail-on-high:
    description: 'Fail the action if high or critical severity issues are found'
    required: false
    default: 'false'
  fail-on-any:
    description: 'Fail the action if any compromised packages or security findings are detected'
    required: false
    default: 'false'
  scan-lockfiles:
    description: 'Scan lockfiles (package-lock.json, yarn.lock) for transitive dependencies'
    required: false
    default: 'true'
  scan-node-modules:
    description: 'Scan node_modules directory for installed packages'
    required: false
    default: 'false'
  output-format:
    description: 'Output format: text, json, or sarif'
    required: false
    default: 'text'
  working-directory:
    description: 'Directory to scan (defaults to repository root)'
    required: false
    default: '.'

outputs:
  affected-count:
    description: 'Number of compromised packages found'
  security-findings-count:
    description: 'Number of security findings (suspicious scripts, TruffleHog, malicious runners, etc.)'
  status:
    description: 'Scan status: clean or affected'
  scan-time:
    description: 'Time taken to complete the scan in milliseconds'
  results:
    description: 'JSON array of compromised packages'
  security-findings:
    description: 'JSON array of security findings (suspicious scripts, exfiltration, runners, etc.)'
  sarif-file:
    description: 'Path to SARIF report file (when output-format is sarif)'

runs:
  using: 'node20'
  main: 'dist/index.js'